Oracle Patches 98 Flaws

Thursday, April 16, 2015 @ 04:04 PM gHale

Oracle released patches for 98 security issues across a wide range of products, including 14 in Java.

This offering will be the last free patch for Java 7, and company officials said users should upgrade to version 8.

Patch Tuesday Closes Zero Days
Chrome 42 Releases; 45 Flaws Fixed
Patch Tuesday Features FREAK Focus
Alter One Bit, Bypass Security

Three of the Java vulnerabilities patched Tuesday have the maximum severity score of 10 in the Common Vulnerability Scoring System (CVSS), which means they can suffer exploitation over the network without authentication and can lead to a full compromise of the system’s confidentiality and integrity.

Twelve of the flaws affect the Java client, meaning they can potentially end up exploited from the Web through the Java browser plug-in. One of them also affects Java server deployments and the remaining two affect the client and server deployments of the Java Secure Socket Extension (JSSE).

In order to address these vulnerabilities, Oracle released Java 8 update 45 (Java 8u45), Java 7u79, Java 6u95 and Java 5u85. The Java 6 and 5 updates are only available to customers with long-term Java support contracts.

With this latest release, Java 7 reached end of life for public updates, so future security patches for this version of Java will also be available only to customers with special support contracts. Users who have automatic updates enabled in Java 7 have been getting prompts \to upgrade to Java 8 since January.

As a part of its April 2015 Critical Patch Update, Oracle fixed security flaws in the Oracle Database, Oracle Fusion Middleware, Oracle Hyperion, Oracle Enterprise Manager, Oracle E-Business Suite, Oracle Supply Chain Suite, Oracle PeopleSoft Enterprise, Oracle JDEdwards EnterpriseOne, Oracle Siebel CRM, Oracle Industry Applications, Oracle Java SE, Oracle Sun Systems Products Suite, Oracle MySQL and Oracle Support Tools.

Leave a Reply

You must be logged in to post a comment.