Oracle Critical Patch Update Advisory - April 2014
Description
A Critical Patch Update (CPU) is a collection of patches for multiple security vulnerabilities. Critical Patch Update
patches are usually cumulative, but each advisory describes only the security fixes added since the previous Critical
Patch Update advisory. Thus, prior Critical Patch Update advisories should be reviewed for information regarding
earlier published security fixes. Please refer to:
Critical Patch Updates and Security Alerts for information about Oracle Security Advisories.
Due to the threat posed by a successful attack, Oracle strongly recommends that customers apply CPU fixes
as soon as possible. This Critical Patch Update contains 104 new security fixes across the product families listed
below.
Please note that a blog entry summarizing the content of this Critical Patch Update and other Oracle Software
Security Assurance activities is located at https://blogs.oracle.com/security.
This Critical Patch Update advisory is also available in an XML format that conforms to the Common Vulnerability
Reporting Format (CVRF) version 1.1. More information about Oracle's use of CVRF is available
at:http://www.oracle.com/technetwork/topics/security/cpufaq-098434.html#CVRF.
Affected Products and Components
Security vulnerabilities addressed by this Critical Patch Update affect the products listed in the categories below. The
product area of the patches for the listed versions is shown in the Patch Availability column corresponding to the
specified Products and Versions column. Please click on the link in the Patch Availability column below or in
the Patch Availability Table to access the documentation for those patches.
The list of affected product releases and versions that are in Premier Support or Extended Support, under the Oracle
Lifetime Support Policy is as follows:
Affected Products and Versions
Patch Availability
Oracle Database 11g Release 1, version 11.1.0.7
Database
Oracle Database 11g Release 2, versions 11.2.0.3, 11.2.0.4
Database
Oracle Database 12c Release 1, version 12.1.0.1
Database
Oracle Fusion Middleware 11g Release 1, versions 11.1.1.7, 11.1.1.8
Fusion Middleware
Oracle Fusion Middleware 12c Release 1, versions 12.1.1.0, 12.1.2.0
Fusion Middleware
Oracle Fusion Applications, versions 11.1.2 through 11.1.8
Fusion Applications
Oracle Access Manager, versions 10.1.4.3, 11.1.1.3.0, 11.1.1.5.0, 11.1.1.7.0,
11.1.2.0.0, 11.1.2.1.0, 11.1.2.2.0
Fusion Middleware
Oracle Containers for J2EE, version 10.1.3.5
Fusion Middleware
Oracle Data Integrator, version 11.1.1.3.0
Fusion Middleware
Oracle Endeca Server, version 2.2.2
Fusion Middleware
Oracle Event Processing, version 11.1.1.7.0
Fusion Middleware
Oracle Identity Analytics, version 11.1.1.5, Sun Role Manager, version 5.0
Fusion Middleware
Oracle OpenSSO, version 8.0 Update 2 Patch 5
Fusion Middleware
Oracle OpenSSO Policy Agent, version 3.0-03
Fusion Middleware
Oracle WebCenter Portal, versions 11.1.1.7, 11.1.1.8
Fusion Middleware
Oracle WebLogic Server, versions 10.0.2.0, 10.3.6.0, 12.1.1.0, 12.1.2.0
Fusion Middleware
Oracle Hyperion Common Admin, versions 11.1.2.2, 11.1.2.3
Fusion Middleware
Oracle E-Business Suite Release 11i, 12i
E-Business Suite
Affected Products and Versions
Patch Availability
Oracle Agile PLM Framework, versions 9.3.1.1, 9.3.3.0
Oracle Supply Chain
Oracle Agile Product Lifecycle Management for Process, versions 6.0.0.7, 6.1.1.3 Oracle Supply Chain
Oracle Transportation Management, versions 6.3, 6.3.4
Oracle Supply Chain
Oracle PeopleSoft Enterprise CS Campus Self Service, version 9.0
PeopleSoft
Oracle PeopleSoft Enterprise HRMS Talent Acquisition Manager, versions 8.52,
8.53
PeopleSoft
Oracle PeopleSoft Enterprise PT Tools, versions 8.52, 8.53
PeopleSoft
Oracle Siebel UI Framework, versions 8.1.1, 8.2.2
Siebel
Oracle iLearning, versions 6.0, 6.1
iLearning
Oracle JavaFX, version 2.2.51
Oracle Java SE
Oracle Java SE, versions 5.0u61, 6u71, 7u51, 8
Oracle Java SE
Oracle Java SE Embedded, version 7u51
Oracle Java SE
Oracle JRockit, versions R27.8.1, R28.3.1
Oracle Java SE
Oracle Solaris, versions 9, 10, 11.1
Oracle and Sun Systems
Products Suite
Oracle Secure Global Desktop, versions 4.63, 4.71, 5.0, 5.1
Oracle Linux and Virtualization
Oracle VM VirtualBox, versions prior to 3.2.22, 4.0.24, 4.1.32, 4.2.24, 4.3.10
Oracle Linux and Virtualization
Oracle MySQL Server, versions 5.5, 5.6
Oracle MySQL Product Suite
Patch Availability Table and Risk Matrices
Products with Cumulative Patches
The Oracle Database, Oracle Fusion Middleware, Oracle Enterprise Manager Grid Control, Oracle E-Business Suite
Applications, JD Edwards EnterpriseOne, JD Edwards OneWorld Tools, PeopleSoft Enterprise Portal Applications,
PeopleSoft Enterprise PeopleTools, Siebel Enterprise, Industry Applications, Primavera and Oracle VM patches in
the Critical Patch Updates are cumulative. In other words, patches for any of these products included in a Critical
Patch Update will include all fixes for that product from the previous Critical Patch Updates. For more information
about cumulative and non-cumulative patches, check the patch availability documents in the table below for the
respective product groups.
Patch Availability Table
For each administered Oracle product, consult the documentation for patch availability information and installation
instructions referenced from the following table. For an overview of the Oracle product documentation related to this
Critical Patch Update, please refer to the Oracle Critical Patch Update April 2014 Documentation Map, My Oracle
Support Note 1637289.1.
Product Group
Oracle Database
Risk Matrix
Oracle Database Risk Matrix
Patch Availability and Installation
Information
Patch Set Update and Critical Patch Update
April 2014 Availability Document, My Oracle
Support Note 1618213.1
Product Group
Patch Availability and Installation
Information
Risk Matrix
Oracle Fusion Middleware
Oracle Fusion Middleware Risk
Matrix
Patch Set Update and Critical Patch Update
April 2014 Availability Document, My Oracle
Support Note 1618213.1
Oracle Fusion Applications
Oracle Database Risk
Matrix andOracle Fusion
Middleware Risk Matrix
Vulnerabilities affecting Oracle
Database and Oracle Fusion Middleware may
affect Oracle Fusion Applications, so Oracle
customers should refer to Oracle Fusion
Applications Critical Patch Update Knowledge
Document (April 2014) My Oracle Support Note
1644949.1 for information on patches to be
applied to Fusion Application environments.
Oracle Hyperion
Oracle Hyperion Risk Matrix
Patch Set Update and Critical Patch Update
April 2014 Availability Document, My Oracle
Support Note 1618213.1
Oracle Applications - E-Business Oracle Database Risk
Suite
Matrix andOracle Fusion
Middleware Risk Matrix
Vulnerabilities affecting Oracle
Database and Oracle Fusion Middleware may
affect Oracle E-Business Suite products, so
Oracle customers should refer to Oracle EBusiness Suite Releases 11i and 12i Critical
Patch Update Knowledge Document (April
2014), My Oracle Support Note 1614525.1 for
information on patches to be applied to EBS
environments.
Oracle Applications - PeopleSoft
Enterprise, Siebel CRM, Oracle
Supply Chain, and iLearning
Product Suite
Oracle PeopleSoft Enterprise
Risk Matrix
Oracle Siebel CRM Risk Matrix
Oracle Supply Chain Risk Matrix
Oracle iLearning Products Risk
Matrix
Critical Patch Update Knowledge Document for
PeopleSoft Enterprise, Siebel Core, Oracle
Supply Chain and Oracle iLearning
Products, My Oracle Support Note 1638652.1
Oracle Java SE
Oracle SE Risk Matrix
Critical Patch Update April 2014 Patch
Availability Document for Java SE, My Oracle
Support Note 1636775.1
Users running Java SE with a browser can
download the latest release
from http://java.com.Users on the Windows and
Mac OS X platforms can also use automatic
updates to get the latest release.
The latest JavaFX release is included with the
latest update of JDK and JRE 7 and 8.
Oracle and Sun Systems
Products Suite
Oracle and Sun Systems
Products Suite Risk Matrix
Critical Patch Update April 2014 Patch Delivery
Document for Oracle and Sun Systems Product
Suite,My Oracle Support Note 1637067.1
Oracle Linux and Virtualization
Products
Oracle Linux and Virtualization
Products Risk Matrix
Patch Set Update and Critical Patch Update
April 2014 Availability Document, My Oracle
Support Note 1635985.1
Oracle MySQL
Oracle MySQL Risk Matrix
Critical Patch Update April 2014 Patch
Availability Document for Oracle MySQL
Products, My Oracle Support Note 1635913.1
