Threat Center Security News Oracle Critical Patch Update Advisory - July 2008
Oracle Critical Patch Update Advisory - July 2008 Print E-mail
Written by Rebecca Mints   
Thursday, 17 July 2008 08:49

Quoted from http://www.oracle.com.

A Critical Patch Update is a collection of patches for multiple security vulnerabilities. It also includes non-security fixes that are required (because of interdependencies) by those security patches. Critical Patch Updates are cumulative, except as noted below, but each advisory describes only the security fixes added since the previous Critical Patch Update. Thus, prior Critical Patch Update Advisories should be reviewed for information regarding earlier accumulated security fixes. Please refer to

 

Due to the threat posed by a successful attack, Oracle strongly recommends that customers apply fixes as soon as possible. This Critical Patch Update contains 45 new security fixes across all products.

 

Category I

Product releases and versions that are in Premier Support or Extended Support, under the Oracle Lifetime Support policy:

  • Oracle Database 11g, version 11.1.0.6   [ Database ]
  • Oracle Database 10g Release 2, versions 10.2.0.2, 10.2.0.3, 10.2.0.4   [ Database ]
  • Oracle Database 10g, version 10.1.0.5   [ Database ]
  • Oracle Database 9i Release 2, versions 9.2.0.8, 9.2.0.8DV   [ Database ]
  • Oracle TimesTen In-Memory Database version 7.0.3.0.0   [ Database ]
  • Oracle Application Server 10g Release 3 (10.1.3), versions 10.1.3.1.0, 10.1.3.3.0   [ Application Server ]
  • Oracle Application Server 10g Release 2 (10.1.2), versions 10.1.2.2.0, 10.1.2.3.0   [ Application Server ]
  • Oracle Application Server 10g (9.0.4), version 9.0.4.3   [ Application Server ]
  • Oracle Hyperion BI Plus version 9.2.0.3, 9.2.1.0,and 9.3.1.0   [ Application Server ]
  • Oracle Hyperion Performance Suite version 8.3.2.4, and 8.5.0.3   [ Application Server ]
  • Oracle E-Business Suite Release 12, version 12.0.4   [ E-Business Suite ]
  • Oracle E-Business Suite Release 11i, version 11.5.10.2   [ E-Business Suite ]
  • Oracle Enterprise Manager Database Control 11i version 11.1.0.6   [ Enterprise Manager ]
  • Oracle Enterprise Manager Database Control 10g Release 2, versions 10.2.0.2, 10.2.0.3, 10.2.0.4   [ Enterprise Manager ]
  • Oracle Enterprise Manager Database Control 10g Release 1, version 10.1.0.5   [ Enterprise Manager ]
  • Oracle Enterprise Manager Grid Control 10g Release 1, versions 10.1.0.5, 10.1.0.6   [ Enterprise Manager ]
  • Oracle PeopleSoft Enterprise PeopleTools versions 8.48.17, 8.49.11   [ PeopleSoft/JDE ]
  • Oracle PeopleSoft Enterprise CRM version 8.9, 9.0   [ PeopleSoft/JDE ]
  • Oracle WebLogic Server (formerly BEA WebLogic Server) 10.0 released through MP1   [ BEA ]
  • Oracle WebLogic Server (formerly BEA WebLogic Server) 9.0, 9.1, 9.2 released through MP3   [ BEA ]
  • Oracle WebLogic Server (formerly BEA WebLogic Server) 8.1 released through SP6   [ BEA ]
  • Oracle WebLogic Server (formerly BEA WebLogic Server) 7.0 released through SP7   [ BEA ]
  • Oracle WebLogic Server (formerly BEA WebLogic Server) 6.1 released through SP7   [ BEA ]
    •

    Category II

    Products and components that are bundled with the products listed in Category I. No products in this category are affected by the fixes included in this Critical Patch Update. Category III

    Products that are de-supported as a standalone installation but are supported when installed with the products listed in Category I:

  • Oracle Database 9i, version 9.0.1.5 FIPS+   [ Application Server ]
  • Oracle Application Server 9i Release 1, version 1.0.2.2   [ E-Business Suite ]
    •

    Patches for Category III products are only available when these products are installed as part of Category I products, and are tested solely on supported configurations and environments. Please refer to the documentation for each product for specific details concerning the support and availability of patches.
     

    WTW Threat Level