“Oracle strongly recommends that customers remain on actively-supported versions and apply Critical Patch Update security patches without delay,” the company stated in its advisory. Oracle Database Server versions 19.3-19.26, 21.3-21.17, and 23.4-23.7 received patches for multiple security issues, highlighting the importance of updating database systems. Oracle released its April 2025 Critical Patch Update (CPU), addressing 378 new security vulnerabilities across its extensive product portfolio. For organizations unable to immediately apply patches, Oracle suggests potentially reducing risk by “blocking network protocols required by an attack” or “removing privileges or the ability to access the packages from users that do not need the privileges”. The patches cover flaws reported by numerous security researchers and organizations, including Google, Amazon AWS Security, Alibaba, Tsinghua University, and various independent security experts. The quarterly security update, announced on Wednesday, contains patches for numerous high-risk flaws, many of which could potentially allow remote exploitation without authentication. Java SE one of Oracle’s most widely distributed technologies, received patches for versions 8u441, 11.0.26, 17.0.14, 21.0.6, and 24, addressing vulnerabilities potentially impacting millions of systems worldwide. The April 2025 CPU impacts many Oracle products and services, including Oracle Database Server, Java SE, MySQL, Fusion Middleware, E-Business Suite, Communications products, and numerous others. Security professionals recommend that organizations implement a risk-based approach to applying these patches. Oracle emphasized that patches are only provided for product versions under the Premier Support or Extended Support phases of the Lifetime Support Policy. Oracle has explicitly warned about the consequences of delayed patching, noting past incidents where attackers successfully compromised systems because “targeted customers had failed to apply available Oracle patches”.
This Cyber News was published on cybersecuritynews.com. Publication date: Wed, 16 Apr 2025 09:15:18 +0000