http://news.com.com/Oracle+plugs+51+security+flaws/2100-1002_3-6150671.html 

By Joris Evers
Staff Writer, CNET News.com
January 16, 2007

Oracle on Tuesday released fixes for 51 vulnerabilities that affect its 
software products.

The update is part of the Redwood City, Calif., company's quarterly 
patch cycle. Oracle preannounced its patch release Thursday, when, for 
the first time, it published an advance notification so customers could 
plan ahead to apply the fixes.

Oracle's actual Tuesday "Critical Patch Update" has one fix less than 
the company originally announced. Instead of the planned 27 fixes for 
its database products, 26 vulnerabilities are addressed in the company's 
flagship software.

"An issue was detected with one of the database fixes for a number of 
database versions," Eric Maurice, manager for security at Oracle, wrote 
on a corporate blog. "Per our policywe removed the fix from the January 
CPU. We are working to resolve this issue to release the fix on all 
supported database versions with the next CPU in April."

In addition to the database fixes, Oracle's update repairs 12 flaws in 
Application Server, 7 in E-Business Suite, 6 in Enterprise Manager and 3 
in PeopleSoft. Many bugs are serious and could allow a system running 
the vulnerable Oracle software to be compromised remotely by an 
anonymous attacker, Oracle said.

"As usual, we highly recommend that customers apply all patches 
promptly," Maurice wrote.

Oracle's next patch release is due on April 17.


_____________________________
Subscribe to InfoSec News
http://www.infosecnews.org/mailman/listinfo/isn