Oracle releases patches for more than 100 flaws

Oracle Corp. Tuesday released patches addressing more than 100 separate vulnerabilities in its database and application server software, as well as in its collaboration and e-business suites.

The patches, which are part of Oracle's scheduled quarterly updates, included fixes for flaws in its PeopleSoft and J.D. Edwards portfolios..

A large number of the flaws affecting Oracle's databases were listed as having a "wide" impact on database availability, integrity and confidentiality.

For instance, one of the them is a vulnerability in Oracle databases that enables any user with basic access privileges to assume the role of a database administrator. The flaw, first reported to Oracle in October by database security firm Imperva Inc., also allows would-be attackers to prevent illegal activity from being recorded by the database server's built-in auditing mechanism, said Shlomo Kramer, Imperva's CEO.

This is the second batch of patches to be released by Oracle since the company moved to a quarterly schedule last fall. Oracle's next patch update is slated for April 12.

Under its Critical Patch Update program, Oracle has said that it will release highly integrated patches that combine fixes for multiple high-priority vulnerabilities. The patches are cumulative, meaning users who miss applying patches one quarter can apply a cumulative update the following quarter that addresses both the previous problems and any new ones that might have cropped up.