Oracle patches 88 holes in quarterly security update

Oracle Corp. released a bundle of critical security patches for its software on Tuesday, fixing 88 vulnerabilities in products including its database and application servers and in some PeopleSoft and JD Edwards applications. A work-around exists for just one of the vulnerabilties, according to Oracle. It recommends applying the patches as soon as possible.

The patches are part of Oracle’s quarterly security update program, and affect versions of its database software from 8i onwards. Customers covered by Oracle’s Extended Maintenance Support or Extended Support plans can download the patches.

The company supplied fixes for 33 vulnerabilities in its database server software, many of them easy to exploit and with wide impact on the confidentiality, integrity or availability of information stored in databases: as bad as it gets in Oracle’s security rating system.

Oracle patched 14 flaws in its application server software (four of them fixed by the database server patches, 10 requiring further patches), 13 flaws in its Collaboration Suite, 22 in its E-Business Suite and one in its Enterprise Manager software.

Six of the patches are for PeopleSoft or JD Edwards EnterpriseOne software. There is a work-around for one of these vulnerabilities, which can be fixed by turning off PSOL Manager until the patch is applied.

One of the security vulnerabilities, known as CAN-2005-0873, was already public, Oracle said. According to the Common Vulnerabilities and Exposures list, this allows remote attackers to inject arbitrary web scripts or HTML into Oracle Reports Server 10g ( via multiple cross-site scripting attacks. Oracle provides few details of the vulnerabilties fixed by the other patches.

More information on Oracle’s latest critical patch update can be found at this Web site.

Oracle plans to release its next update on Jan. 17.

Would you recommend this article?


Thanks for taking the time to let us know what you think of this article!
We'd love to hear your opinion about this or any other story you read in our publication.

Jim Love, Chief Content Officer, IT World Canada

Featured Download

Featured Articles

Empowering the hybrid workforce: how technology can build a better employee experience

Across the country, employees from organizations of all sizes expect flexibility...

What’s behind the best customer experience: How to make it real for your business

The best customer experience – the kind that builds businesses and...

Overcoming the obstacles to optimized operations

Network-driven optimization is a top priority for many Canadian business leaders...

Thriving amid Canada’s tech talent shortage

With today’s tight labour market, rising customer demands, fast-evolving cyber threats...

Staying protected and compliant in an evolving IT landscape

Canadian businesses have changed remarkably and quickly over the last few...

Related Tech News

Tech Jobs

Our experienced team of journalists and bloggers bring you engaging in-depth interviews, videos and content targeted to IT professionals and line-of-business executives.

Tech Companies Hiring Right Now