Software

What's big and red and needs 270 security patches?

Oracle software, that's what

By Simon Sharwood

9 SHARE

Oracle has revealed its quarterly Critical Patch Update Advisory for January 2017, which offers users a buffet of 270 fixes to apply.

Big Red says that “due to the threat posed by a successful attack, Oracle strongly recommends that customers apply CPU fixes as soon as possible.”

Where to start? Perhaps with the sole problem that rates a ten on the the Common Vulnerability Scoring Standard (CVSS) that Oracle uses to assess the scariness of bugs.

That bug impacts Oracle's Primavera project management product, which is susceptible to CVE-2017-3324, a remote code execution and/or denial of service bug present in Internet Explorer 9 and 11.

The Register counts three severity 9.8 bugs in Oracle Enterprise Manager Grid Control; a pair in the Fusion Middleware; and one each in Supply Chain Suite, PeopleSoft, Big Data Graph, JD Edwards and Oracle Communications Applications. Several refer to the same bug – CVE-2016-6303 – that NIST says is an “Integer overflow in the MDC2_Update function in crypto/mdc2/mdc2dgst.c in OpenSSL before 1.1.0 allows remote attackers to cause a denial of service (out-of-bounds write and application crash) or possibly have unspecified other impact via unknown vectors.”

Java has 16 bugs, rated from 9.6 to 3.1. That's half the 32 issues deserving of repair in Oracle's E-Business Suite and Fusion Middleware. Not far behind, with 27 patches apiece, you'll find MySQL's and Big Red's Flexcube banking code.

Plenty of the bugs aren't Oracle's fault: like most sensible software houses Big Red uses open source code and flaws in those projects account for quite a few of the 270 recommended patches. ®

Sign up to our NewsletterGet IT in your inbox daily

9 Comments

More from The Register

Oracle gets busy with Lazy FPU fix, adds more CPU Spectre-protectors

Oracle Linux and VM get their innoculations

Oracle Database 18: Now in downloadable Linux flavour

Oh, and Windows, but cool kids don't use that

Firefighters choke on Oracle's alleged smoke-and-mirrors cloud

Pension fund cries fraud over database giant's boasts about its off-prem biz performance

Oracle puts release of new freebie mini-database on ice to work out kinks

Issues 'too severe' to launch this summer

Oracle cuts ribbon on distributed ledger service

Big Red brags bank backing for blockchain biz

Umm, Oracle – about that patch? It might not be very sticky ...

Security researcher says WebLogic fix can be bypassed, posts proof-of-concept

CIOs planning to snub Oracle for other cloudy vendors – analyst

Drop for Big Red shares as biz prepares to announce Q4 financial results

Salesforce takes leaf out of Oracle's book to forge little co-CEO bromance

Room for another ego at the top, Benioff?

Oracle tells court: Boss man Mark Hurd didn't have docs relevant to HPE spat over Solaris

If he did, HPE has to prove he deliberately deleted them

Oracle launches its very own 'net threat map

Pew! Pew! The whole world is connected, and the Internet is super-dangerous