Oracle released its third quarterly edition of Critical Patch Update, which contains patches for 386 security vulnerabilities. Some of the vulnerabilities addressed in this update impact more than one product. These patches address vulnerabilities in various product families, including third-party components in Oracle products.
In the third quarterly Oracle Critical Patch Update, Oracle Communications received the highest number of patches, 95, constituting about 24% of the total patches released. Oracle Financial Services Applications and Oracle Fusion Middleware followed, with 60 and 41 security patches, respectively.
319 of the 386, i.e., about 83% of security patches, are for non-Oracle CVEs, which are security fixes for issues in third-party products such as open-source components included and exploitable in the context of their Oracle product distributions.
This month’s batch of security patches contains 15 updates for Oracle Database products. Product-wise distribution is as follows:
- 8 new security updates for Oracle Database Server with a maximum reported CVSS Base Score of 7.5.
-
- 1 of these updates applies to client-only deployments of the Oracle Database.
-
- 1 new security update for Oracle Application Express with a maximum reported CVSS Base Score of 4.7.
- 2 new security updates for Oracle Essbase with a maximum reported CVSS Base Score of 6.7.
- 1 new security update for Oracle GoldenGate with a maximum reported CVSS Base Score of 5.9.
- 1 new security update for Oracle NoSQL Database with a maximum reported CVSS Base Score of 5.9.
- 1 new security update for Oracle REST Data Services with a maximum reported CVSS Base Score of 5.3.
- 1 new security update for Oracle TimesTen In-Memory Database with a maximum reported CVSS Base Score of 4.3.
In these security updates, Oracle has covered product families, including Oracle Database Server, Oracle Application Express, Oracle Essbase, Oracle GoldenGate, Oracle NoSQL Database, Oracle REST Data Services, Oracle TimesTen In-Memory Database, Oracle Commerce, Oracle Communications Applications, Oracle Communications, Oracle Construction and Engineering, Oracle E-Business Suite, Oracle Enterprise Manager, Oracle Financial Services Applications, Oracle Fusion Middleware, Oracle Analytics, Oracle HealthCare Applications, Oracle Hyperion, Oracle Insurance Applications, Oracle Java SE, Oracle JD Edwards, Oracle MySQL, Oracle PeopleSoft, Oracle Retail Applications, Oracle Siebel CRM, Oracle Supply Chain, Oracle Systems, Oracle Utilities Applications, Oracle Virtualization.
Notable Oracle Vulnerabilities Patched
Oracle Communications
This Critical Patch Update for Oracle Communications contains 95 security patches. Out of these, 84 vulnerabilities can be exploited over a network without user credentials.
CVE-2024-23897, CVE-2023-37920, and CVE-2022-48174 in different Oracle Communications products have critical severity ratings and CVSS scores of 9.8. A remote attacker may exploit these vulnerabilities in a low-complexity network attack.
Oracle Financial Services Applications
This Critical Patch Update for Oracle Financial Services Applications contains 60 new security patches. 44 of these vulnerabilities can be remotely exploitable without authentication.
CVE-2023-47248 and CVE-2022-36944 in different Oracle Financial Services Applications products have critical severity ratings and CVSS scores of 9.8. A remote attacker may exploit these vulnerabilities in a low-complexity network attack.
Oracle Fusion Middleware
This Critical Patch Update for Oracle Fusion Middleware contains 41 new security patches. 32 of these vulnerabilities can be remotely exploitable without authentication.
CVE-2023-45853, CVE-2022-45378, CVE-2023-34034, and CVE-2024-21181 in different Oracle Communications products have critical severity ratings and CVSS scores of 9.8. A remote attacker may exploit these vulnerabilities in a low-complexity network attack.
Oracle MySQL
This Critical Patch Update for Oracle MySQL contains 37 security patches. 11 of these vulnerabilities may be remotely exploitable without authentication.
CVE-2023-37920 in the MySQL Cluster has a critical severity rating and CVSS score of 9.8. A remote attacker may exploit these vulnerabilities in a low-complexity network attack.
Oracle Communications Applications
This Critical Patch Update for Oracle Communications Applications contains 20 security patches. 14 of these vulnerabilities may be exploited over a network without requiring user credentials.
CVE-2022-34381 in the Oracle Communications Billing and Revenue Management has a critical severity rating and CVSS score of 9.8. A remote attacker may exploit these vulnerabilities in a low-complexity network attack.
Oracle Analytics
This Critical Patch Update for Oracle Analytics contains 17 security patches. 12 of these vulnerabilities may be exploited over a network without requiring user credentials.
CVE-2022-0239 and CVE-2022-21797 in the Oracle Business Intelligence Enterprise Edition have critical severity ratings and CVSS scores of 9.8. A remote attacker may exploit these vulnerabilities in a low-complexity network attack.
Oracle Siebel CRM
This Critical Patch Update for Oracle Analytics contains 12 security patches. 11 of these vulnerabilities may be exploited over a network without requiring user credentials.
CVE-2022-37434 in the Siebel CRM Deployment has a critical severity rating and CVSS score of 9.8. A remote attacker may exploit these vulnerabilities in a low-complexity network attack.
Discover and Prioritize Vulnerabilities in Vulnerability Management, Detection & Response (VMDR)
Qualys VMDR automatically detects new Patch Tuesday vulnerabilities using continuous Knowledgebase (KB) updates.
You can see all your impacted hosts by these vulnerabilities using the following QQL query:
vulnerabilities.vulnerability: ( qid:`152029` OR qid:`20438` OR qid:`380193` OR qid:`380192` OR qid:`380191` OR qid:`20437` OR qid:`380190` OR qid:`296114` OR qid:`87557` OR qid:`380188` OR qid:`20436` OR qid:`20435` OR qid:`20434`)
Rapid Response with Patch Management (PM)
VMDR rapidly remediates Windows hosts by deploying the most relevant and applicable per-technology version patches. You can simply select respective QIDs in the Patch Catalog and filter on the “Missing” patches to identify and deploy the applicable, available patches with one click.
The following QQL will return the missing patches for this Patch Tuesday:
( qid:`152029` OR qid:`20438` OR qid:`380193` OR qid:`380192` OR qid:`380191` OR qid:`20437` OR qid:`380190` OR qid:`296114` OR qid:`87557` OR qid:`380188` OR qid:`20436` OR qid:`20435` OR qid:`20434`)
Visit the Oracle Critical Patch Update July 2024 (CPUJUL2024) page to describe each vulnerability and the systems it affects.
Customers can scan their network with QIDs 152029, 20438, 380193, 380192, 380191, 20437, 380190, 296114, 87557, 380188, 20436, 20435, and 20434 to detect vulnerable assets.
Please continue to follow Qualys Threat Protection for more coverage of the latest vulnerabilities.
References:
https://www.oracle.com/security-alerts/cpujul2024.html
