Oracle releases 136 security patches for wide range of products

The company has adopted the new CVSS 3.0 vulnerability rating system, resulting in a larger number of flaws rated as high and critical

Oracle has released another monster quarterly security update containing 136 fixes for flaws in a wide range of products including Oracle Database Server, E-Business Suite, Fusion Middleware, Oracle Sun Products, Java and MySQL.

The biggest change is Oracle's adoption of the Common Vulnerability Scoring System (CVSS) version 3.0, which more accurately reflects the impact of flaws than CVSS 2.0. This Oracle Critical Patch Update (CPU) has both CVSS 3.0 and CVSS 2.0 scores for vulnerabilities, providing a chance to compare how the new rating system might affect Oracle patch prioritization inside organizations.

One immediately noticeable change is that there are five vulnerabilities rated with the maximum score of 10.0 based on the CVSS 2.0 scale, but none when using the CVSS 3.0 rating. At first glance, this would suggest that based on CVSS 3.0, flaws are rated as less critical, but that's not true.

While there are no flaws with a 10.0 score, the number of flaws in this CPU that are considered critical based on their CVSS 3.0 score is 17, compared to 9 based on CVSS 2.0. Similarly, 25 flaws are rated as high severity using CVSS 3.0, compared to only 12 using CVSS 2.0.

The number of low severity flaws also decreased from 28, based on CVSS 2.0, to only 10 based on CVSS 3.0. This shows that overall, CVSS 3.0 increases the severity rating of vulnerabilities compared to CVSS 2.0.

"First of all, I’m glad to see such changes in the scoring system, as there were many discussions about the quality of CVSS v.2.0," said Alexander Polyakov, CTO at vulnerability intelligence firm ERPScan, via email. "For example, vendors could rate issues discovered in their products as less critical (intentionally or unintentionally) because of some flaws in this scoring system. Now the recently updated system is more accurate and many drawbacks affecting the previous version were resolved."

Oracle products that have vulnerabilities rated as high (CVSS 3 score from 7.0 to 8.9) and critical (score 9.0 to 10.0) are: Oracle Database Server, Oracle Fusion Middleware, Oracle Enterprise Manager Grid Control, Oracle E-Business Suite, Oracle Supply Chain Products Suite, Oracle PeopleSoft Products, Oracle Financial Services Software, Oracle Java SE, Oracle Sun Systems Products, Oracle Virtualization, Oracle MySQL and Oracle Berkeley DB.

Join the newsletter!

Or

Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.

Tags Oraclesoftwarepatches

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Lucian Constantin

IDG News Service
Show Comments

Father’s Day Gift Guide

Brand Post

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Luke Hill

MSI GT75 TITAN

I need power and lots of it. As a Front End Web developer anything less just won’t cut it which is why the MSI GT75 is an outstanding laptop for me. It’s a sleek and futuristic looking, high quality, beast that has a touch of sci-fi flare about it.

Emily Tyson

MSI GE63 Raider

If you’re looking to invest in your next work horse laptop for work or home use, you can’t go wrong with the MSI GE63.

Laura Johnston

MSI GS65 Stealth Thin

If you can afford the price tag, it is well worth the money. It out performs any other laptop I have tried for gaming, and the transportable design and incredible display also make it ideal for work.

Andrew Teoh

Brother MFC-L9570CDW Multifunction Printer

Touch screen visibility and operation was great and easy to navigate. Each menu and sub-menu was in an understandable order and category

Louise Coady

Brother MFC-L9570CDW Multifunction Printer

The printer was convenient, produced clear and vibrant images and was very easy to use

Edwina Hargreaves

WD My Cloud Home

I would recommend this device for families and small businesses who want one safe place to store all their important digital content and a way to easily share it with friends, family, business partners, or customers.

Featured Content

Product Launch Showcase

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?