Some patch updates are larger than others, a lot larger. Such is the case with Oracle’s July Critical Patch Update, which tackles a whopping 276 vulnerabilities across multiple Oracle software products.
Oracle has had a quarterly patch cycle for its software portfolio since 2004, and as new companies have been acquired, including Sun Microsystems in 2010, the list of software has expanded. Yet during the 12 years of Oracle software updates, there have never been as many vulnerabilities patched as there are now in the July 2016 update.
In April 2006, Oracle’s CPU patched a meager 36 vulnerabilities, while the most recent patch update in April 2016 fixed 136 flaws.
So far in 2016, the patched vulnerability count has gone up significantly, with 248 in January and 276 in July, Sarwate said.
Not all of the vulnerabilities that Oracle patched are equally severe, and the most serious are typically those identified as being remotely exploitable without authentication. For the July update, 159 vulnerabilities can be exploited remotely by a potential attacker, without the use of a username or password.
Regarding specific software applications that are being patched, Oracle’s Fusion middleware tops the list with the most issues, at 40 vulnerabilities, 35 of which are remotely exploitable without authentication.
Software from Oracle’s Sun Systems portfolio is being patched for 34 different vulnerabilities, 21 of which are remotely exploitable without authentication.
Oracle has invested in improving Java over the last few years; back in 2014, Cisco identified Java as the primary cause of 91 percent of all attacks. In 2015, improvements Oracle made to Java significantly reduced the risks. In December 2015, Oracle settled with the U.S. Federal Trade Commission over charges related to Java software updates and security.
The MySQL database server, in contrast to Java, has only three issues that are remotely exploitable without authentication, out of a total of 22 security vulnerabilities. Oracle’s namesake database is also being patched, but only five of the nine vulnerabilities that are patched can be remotely exploited by an attacker without authentication.
“Most components affected in today’s update were the usual suspect, so no surprise there,” Sarwate said. “In my opinion, the massive size of the update itself was a surprise, and going forward, I think 200-plus vulnerability fixes is going to be the norm.”]
Originally published on eWeek
Fourth quarter results beat Wall Street expectations, as overall sales rise 6 percent, but EU…
Hate speech non-profit that defeated Elon Musk's lawsuit, warns X's Community Notes is failing to…
Good luck. Russia demands Google pay a fine worth more than the world's total GDP,…
Google Cloud signs up Spotify, Paramount Global as early customers of its first ARM-based cloud…
Facebook parent Meta warns of 'significant acceleration' in expenditures on AI infrastructure as revenue, profits…
Microsoft says Azure cloud revenues up 33 percent for September quarter as capital expenditures surge…