Oracle pushed out 59 security patches July 13, including 13 for its database portfolio.
Six of the 13 database vulnerabilities are for the Oracle Database server. Four of these can be exploited remotely over a network without authentication, Oracle advised. Both of the vulnerabilities in the TimesTen In-Memory Database can be exploited remotely without authentication as well, as can three of the five bugs patched in Oracle Secure Backup.
“As is typical for the most recent Oracle CPUs, the most severe are in the network layer — these are very dangerous because they are exploitable remotely and without authentication; if someone were to get through they would have arbitrary code execution capabilities and could literally do anything on the target machine,” explained Roy Fox, head of security research at Sentrigo.
Twenty-one of the 59 fixes affected the Solaris product suite, which the company acquired when it bought Sun Microsystems. Seven of these can be exploited remotely without authentication. Among the Oracle Solaris Suite products affected by the vulnerabilities are Solaris Studio and Sun GlassFish Enterprise Server.
Seventeen security fixes for Oracle Applications, while seven are coming for Oracle Fusion Middleware. There is also a fix for Oracle Enterprise Manager Grid Control.