Oracle released its third quarterly edition of Critical Patch Update, which contains patches for 386 security vulnerabilities. Some of the vulnerabilities addressed in this update impact more than one product. These patches address vulnerabilities in various product families, including third-party components in Oracle products.
In the third quarterly Oracle Critical Patch Update, Oracle Communications received the highest number of patches, 95, constituting about 24% of the total patches released.Oracle Financial Services Applications and Oracle Fusion Middlewarefollowed, with 60 and 41security patches, respectively.
319 of the 386, i.e., about 83% of security patches, are for non-Oracle CVEs, which are security fixes for issues in third-party products such as open-source components included and exploitable in the context of their Oracle product distributions.
This month’s batch of security patches contains 15 updates for Oracle Database products. Product-wise distribution is as follows:
- 8 new security updates for Oracle Database Server with a maximum reported CVSS Base Score of 7.5.
- 1 of these updates applies to client-only deployments of the Oracle Database.
- 1 new security update for Oracle Application Express with a maximum reported CVSS Base Score of 4.7.
- 2 new security updates for Oracle Essbase with a maximum reported CVSS Base Score of 6.7.
- 1 new security update for Oracle GoldenGate with a maximum reported CVSS Base Score of 5.9.
- 1 new security update for Oracle NoSQL Database with a maximum reported CVSS Base Score of 5.9.
- 1 new security update for Oracle REST Data Services with a maximum reported CVSS Base Score of 5.3.
- 1 new security update for Oracle TimesTen In-Memory Database with a maximum reported CVSS Base Score of 4.3.
In these security updates, Oracle has covered product families, including Oracle Database Server, Oracle Application Express, Oracle Essbase, Oracle GoldenGate, Oracle NoSQL Database, Oracle REST Data Services, Oracle TimesTen In-Memory Database, Oracle Commerce, Oracle Communications Applications, Oracle Communications, Oracle Construction and Engineering, Oracle E-Business Suite, Oracle Enterprise Manager, Oracle Financial Services Applications, Oracle Fusion Middleware, Oracle Analytics, Oracle HealthCare Applications, Oracle Hyperion, Oracle Insurance Applications, Oracle Java SE, Oracle JD Edwards, Oracle MySQL, Oracle PeopleSoft, Oracle Retail Applications, Oracle Siebel CRM, Oracle Supply Chain, Oracle Systems, Oracle Utilities Applications, Oracle Virtualization.
Qualys QID Coverage
Qualys has released 12 QIDs mentioned in the table below:
| QIDs | Title |
| 20438 | Oracle MySQL JULY 2024 Critical Patch Update (CPUJUL2024)(CVE-2024-21185) |
| 380193 | Oracle Managed Virtualization (VM) VirtualBox Denial of Service (DoS) Vulnerability (CPUJUL2024) (CVE-2024-21161) |
| 380192 | Oracle Managed Virtualization (VM) VirtualBox Multiple Vulnerabilities (CPUJUL2024) (CVE-2024-21141, CVE-2024-21164) |
| 380191 | Oracle Coherence April 2024 Critical Patch Update (CPUJUL2024) |
| 20437 | Oracle MySQL JULY 2024 Critical Patch Update (CPUJUL2024) |
| 380190 | Oracle Hypertext Transfer Protocol (HTTP) Server Multiple Vulnerabilities (CPUJUL2024) |
| 296114 | Oracle Solaris 11.4 Support Repository Update (SRU) 71.170.2 Missing (CPUJUL2024) |
| 87557 | Oracle WebLogic Server Multiple Vulnerabilities (CPUJUL2024) |
| 380188 | Oracle Java Standard Edition (SE) Critical Patch Update – July 2024 (CPUJUL2024) |
| 20436 | Oracle Database 21c Critical Patch Update – July 2024 |
| 20435 | Oracle Database 19c Critical OJVM Patch Update – July 2024 |
| 20420 | Oracle Database 19c Critical Patch Update – July 2024 |
| 152029 | Oracle WebLogic Server Multiple Vulnerabilities (CPUJUL2024) |
Note: The table will be updated with the additional QIDs once released.
Notable Oracle Vulnerabilities Patched
Oracle Communications
This Critical Patch Update for Oracle Communications contains 95 security patches. Out of these, 84vulnerabilities can be exploited over a network without user credentials.
CVE-2024-23897, CVE-2023-37920, and CVE-2022-48174 in different Oracle Communications products have critical severity ratings and CVSS scores of 9.8. A remote attacker may exploit these vulnerabilities in a low-complexity network attack.
Oracle Financial Services Applications
This Critical Patch Update for Oracle Financial Services Applications contains 60 new security patches. 44of these vulnerabilities can be remotely exploitable without authentication.
CVE-2023-47248 and CVE-2022-36944in different Oracle Financial Services Applications products have critical severity ratings and CVSS scores of 9.8. A remote attacker may exploit these vulnerabilities in a low-complexity network attack.
Oracle Fusion Middleware
This Critical Patch Update for Oracle Fusion Middleware contains 41 new security patches. 32 of these vulnerabilities can be remotely exploitable without authentication.
CVE-2023-45853, CVE-2022-45378, CVE-2023-34034, andCVE-2024-21181in different Oracle Communications products have critical severity ratings and CVSS scores of 9.8. A remote attacker may exploit these vulnerabilities in a low-complexity network attack.
Oracle MySQL
This Critical Patch Update for Oracle MySQL contains 37 security patches. 11 of these vulnerabilities may be remotely exploitable without authentication.
CVE-2023-37920 in the MySQL Cluster has a critical severity rating and CVSS score of 9.8. A remote attacker may exploit these vulnerabilities in a low-complexity network attack.
Oracle Communications Applications
This Critical Patch Update for Oracle Communications Applications contains 20 security patches. 14 of these vulnerabilities may be exploited over a network without requiring user credentials.
CVE-2022-34381in theOracle Communications Billing and Revenue Managementhas a critical severity rating and CVSS score of 9.8. A remote attacker may exploit these vulnerabilities in a low-complexity network attack.
Oracle Analytics
This Critical Patch Update forOracle Analyticscontains 17 security patches. 12 of these vulnerabilities may be exploited over a network without requiring user credentials.
CVE-2022-0239 and CVE-2022-21797in theOracle Business Intelligence Enterprise Editionhave critical severity ratings and CVSS scores of 9.8. A remote attacker may exploit these vulnerabilities in a low-complexity network attack.
Oracle Siebel CRM
This Critical Patch Update forOracle Analyticscontains 12 security patches. 11 of these vulnerabilities may be exploited over a network without requiring user credentials.
CVE-2022-37434in theSiebel CRM Deploymenthas a critical severity rating and CVSS score of 9.8. A remote attacker may exploit these vulnerabilities in a low-complexity network attack.
