# MA-419.102014: MyCERT Advisory - Oracle Critical Patch Update for October 2014

**Date:** 16 Oct 2014  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-419.102014  
**Advisory ID:** MA-419.102014

---

**1.0     Introduction**
Oracle has released its Critical Patch Update (CPU) for October 2014 to address 154 vulnerabilities across multiple products. Users and administrators are encourages reviewing the Oracle October 2014 CPU and applying the necessary updates as soon as possible. A CPU is a collection of patches for multiple security vulnerabilities.
**2.0    Impact**
This CPU provides fixes for 154 new security vulnerabilities across a wide range of product families.  The October 2014 CPU provided:
- 31 for the Oracle Database
- 18 for Oracle Fusion Middleware
- 25 for Oracle Java SE
- 15 for Oracle and Sun Systems Products Suite
- 5 for Oracle Virtualization
- 24 for Oracle MySQL
Due to possible successful attacks of remotely exploitable without authentication, Administrators are strongly recommended to apply the new security fixes as soon as possible.
**3.0    Affected Products**
Below is the details list of critical patch update for Oracle product:
- Oracle Database
- Oracle Fusion Middleware
- Oracle Enterprise Manager Grid Control
- Oracle E-Business Suite
- Oracle Supply Chain Product Suite
- Oracle PeopleSoft Enterprise
- Oracle JDEdwards EnterpriseOne
- Oracle Communications Industry Suite
- Oracle Retail Industry Suite
- Oracle Health Sciences Industry Suite
- Oracle Primavera
- Oracle Java SE
- Oracle and Sun Systems Product Suite
- Oracle Linux and Virtualization
- Oracle MySQL.
**4.0    Workaround**
Due to the criticality of applying the new security fixes, Administrators are advised to apply the fixes as soon as possible to correct the problems. However, until the fixes are applied, Administrators may consider the below workarounds to reduce possible successful attacks:
- Restrict network protocols required by an attack
- For attacks that require certain privileges or access to certain packages, remove the privileges or the ability to access the packages from unprivileged users
The above workarounds may break application functionality, so Administrators are strongly recommended to test changes on non-production systems first.
Please take note that the above workarounds are only temporary solution measures. Security fixes must be applied to correct the underlying problem permanently.
**5.0    Recommendation**
Oracle has released a security update for these issues. Users are highly encouraged to download the most recent release to address these vulnerabilities. Update can be obtained from:
- Oracle Critical Patch Update October 2014 Documentation Map, [My Oracle Support Note 1907791.1](https://support.oracle.com/rs?type=doc&id=1907791.1).
- [Patch Availability Table](http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html#PIN) to access the documentation for those patches.
- Developers can download the latest release from [http://www.oracle.com](http://www.oracle.com/).
- Users running Java SE with a browser can download the latest release from <http://java.com/en/download/installed.jsp>. Users on the Windows and Mac OS X platforms can also use automatic updates to get the latest release.
- Supported Database, Fusion Middleware, Oracle Enterprise Manager Base Platform (formerly "Oracle Enterprise Manager Grid Control") and Collaboration Suite products are patched in accordance with the Software Error Correction Support Policy explained in [My Oracle Support Note 209768.1](https://support.oracle.com/rs?type=doc&id=209768.1).
For further enquiries, please contact MyCERT through the following channels:
E-mail : [[email protected]](/cdn-cgi/l/email-protection) or [[email protected]](/cdn-cgi/l/email-protection)
Phone : 1-300-88-2999 (monitored during business hours)
Fax : +603 89453442
Handphone : +60 19 2665850 (24x7 call incident reporting)
SMS : CYBER999 REPORT EMAIL COMPLAINT to 15888
Business Hours : Mon - Fri 09:00 AM - 18:00 PM MYT
Web : [https://www.mycert.org.my](https://www.mycert.org.my/)
Twitter : <http://www.twitter.com/mycert>
**6.0     References**
- Oracle Critical Patch Update Advisory - October 2014
<http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html>
- Oracle Releases October 2014 Security Advisory
<https://www.us-cert.gov/ncas/current-activity/2014/10/14/Oracle-Releases-October-2014-Security-Advisory>
- October 2014 Critical Patch Update Released
<https://blogs.oracle.com/security/entry/october_2014_critical_patch_update>
- Critical Patch Updates, Security Alerts and Third Party Bulletin
<http://www.oracle.com/technetwork/topics/security/alerts-086861.html>