As announced last week in my post Oracle CPU / PSU Pre-Release Announcement April 2014, Oracle has now released the Critical Patch Updates for April 2014. Overall this CPU contains 104 new security fixes across several Oracle products like Database Server, MySQL Server, Sun Product Suite, WebLogic Server etc. For Oracle Database it contains only 2 security fixes, whereas one of the fixes has a very high CVSS rating. But this only affects installations on Windows. On these platform it is recommended to install the patch bundle as soon as possible. Nevertheless it is certainly advisable to install the patches on Unix/Linux-based systems

As somehow expectable, Oracle did not add any information about the OpenSSL issue to it’s current Critical Patch Advisory. I assume this is because the vulnerability was announced a few days ago. As discussed in my post Oracle and OpenSSL ‘Heartbleed’ vulnerability, Oracle is tracking information about this issue in MOS Note 1645479.1 OpenSSL Security Bug-Heartbleed.

CPU Release Dates

The next four Critical Patch Updates will be released at the following dates:

• 15 July 2014
• 14 October 2014
• 20 January 2015
• 14 April 2015

References

As usual there are a bunch of links and MOS Notes around the critical patch update available:

• Oracle Critical Patch Update Advisory – April 2014
• Patch Set Update and Critical Patch Update April 2014 Availability Document [1618213.1]
• Oracle Critical Patch Update April 2014 Documentation Map [1637289.1]
• Critical Patch Update April 2014 Database Known Issues [1615881.1]
• Critical Patch April 2014 Database Patch Security Vulnerability Molecule Mapping [1615882.1]
• Critical Patch Update April 2014 Oracle Fusion Middleware Known Issues [1618208.1]
• Oracle Critical Patch Updates and Security Alerts on OTN