Oracle to fix 73 security bugs next week

Oracle plans to release a large number of security patches for its various software products next week, including six bug-fixes for its flagship database software.

All told, there will be 73 security vulnerabilities fixed across Oracle’s various product lines. Oracle releases patches for all of its software – except the Java virtual machine — quarterly, in a set of patches it calls the Critical Patch Update (CPU).

Next week’s CPU is due on Tuesday. There are nine fixes set for Oracle Fusion middleware, 14 for the PeopleSoft Suite and eight for the JD Edwards Suite.

Two of the database flaws are considered critical, meaning they “may be exploited over a network without the need for a username and password,” Oracle said in a statement posted to its website Thursday.

The updates are set to come one week after Microsoft issued one of the largest collections of security patches it has ever issued. They also come on the tail of Apple Mac OS X, Safari and iOS updates, released Thursday.

Oracle will patch many of its Sun products, including Solaris and some of the Java server software. However, the widely used Java SE and Java for Business client software are not scheduled to be updated in next week’s release.

Oracle seems to be trying to put client-side Java on its quarterly Critical Patch Update schedule, but it’s not quite there yet. While the company’s Oct. 18 CPU will include the Java platform, the next scheduled Java fix is set for June 7. That’s out of synch with the next CPU for the rest of Oracle’s products, which is due July 19.

Robert McMillan covers computer security and general technology breaking news for The IDG News Service. Follow Robert on Twitter at @bobmcmillan. Robert’s e-mail address is robert_mcmillan@idg.com