Today Oracle has published the Pre-Release Announcement for the first CPU Patch in 2014. This Critical Patch Update contains 147 new security vulnerability fixes for several Oracle products. From the Oracle database point of view it is a small update. There are only five security fix for the Oracle Database Server and no for client-only installations.
Although the CVSS rating of these vulnerabilites are 5.0, it looks that there is no hurry to install this security fix on most of the database environments. If this is true, we’ll see next Tuesday when Oracle is officially releasing CPU / PSU January 2014. Next week I’ll have a closer look.
More details about the patch will follow soon on the Oracle Security Pages.