Software

What's big and red and needs 270 security patches?

Oracle software, that's what

By Simon Sharwood

9 SHARE

Oracle has revealed its quarterly Critical Patch Update Advisory for January 2017, which offers users a buffet of 270 fixes to apply.

Big Red says that “due to the threat posed by a successful attack, Oracle strongly recommends that customers apply CPU fixes as soon as possible.”

Where to start? Perhaps with the sole problem that rates a ten on the the Common Vulnerability Scoring Standard (CVSS) that Oracle uses to assess the scariness of bugs.

That bug impacts Oracle's Primavera project management product, which is susceptible to CVE-2017-3324, a remote code execution and/or denial of service bug present in Internet Explorer 9 and 11.

The Register counts three severity 9.8 bugs in Oracle Enterprise Manager Grid Control; a pair in the Fusion Middleware; and one each in Supply Chain Suite, PeopleSoft, Big Data Graph, JD Edwards and Oracle Communications Applications. Several refer to the same bug – CVE-2016-6303 – that NIST says is an “Integer overflow in the MDC2_Update function in crypto/mdc2/mdc2dgst.c in OpenSSL before 1.1.0 allows remote attackers to cause a denial of service (out-of-bounds write and application crash) or possibly have unspecified other impact via unknown vectors.”

Java has 16 bugs, rated from 9.6 to 3.1. That's half the 32 issues deserving of repair in Oracle's E-Business Suite and Fusion Middleware. Not far behind, with 27 patches apiece, you'll find MySQL's and Big Red's Flexcube banking code.

Plenty of the bugs aren't Oracle's fault: like most sensible software houses Big Red uses open source code and flaws in those projects account for quite a few of the 270 recommended patches. ®

Sign up to our NewsletterGet IT in your inbox daily

9 Comments

More from The Register

U wot M8? Oracle chip designers quietly work on new SPARC CPU

Would be the first M-line server processor since 2015's M7

Oracle staff report big layoffs across Solaris, SPARC teams

Storage products in peril, too, but Big Red declines to comment

I can DB clearly now the clouds are gone: Oracle 12c on-premises for Linux, SPARC

Bet both of those cloud customers are angry now

Oracle cloud supremo Thomas Kurian extends temp leave to the heat death of the universe

Friday afternoon – a great time to bury bad news, like the exit of your product president

SPARC will fly: Your cheat sheet for cocktail banter at Oracle's upcoming shindig

OpenWorld Or a little historical insight for those not going

Oracle gets busy with Lazy FPU fix, adds more CPU Spectre-protectors

Oracle Linux and VM get their innoculations

Oracle softly increments SPARC M7 to M8, then whispers: We'll still love you, Solaris, to 2034

And possibly beyond

Oracle and Fujitsu SPARC up M12 big iron

Updated Flatten that server application load with Oracle and Fujitsu's new big iron

Oracle pledges annual Solaris updates for you to install each summer

And a plan to have users of Sun hardware upgrade if they want Solaris 11.4 and proper patches

Oracle Database 18: Now in downloadable Linux flavour

Oh, and Windows, but cool kids don't use that