Overview
On January 14, 2020, Oracle officially announced critical patch update (CPU) security announcement and third-party security announcement, and fixed 334 vulnerabilities. See the appendix table for the affected conditions and available patches of each product.
For complete information, please refer to the official notice:
https://www.oracle.com/security-alerts/cpujan2020.html
Vulnerability Summary
| Product | Number of vulnerabilities | Unauthorized remote use | Highest CVSS score |
| Oracle Database server | 12 | 3 | 7.7 |
| Oracle Communications Applications | 25 | 23 | 9.8 |
| Oracle Construction and Engineering Suite | 12 | 8 | 9.8 |
| Oracle E-Business Suite | 23 | 21 | 9.9 |
| Oracle Enterprise Manager | 50 | 10 | 9.8 |
| Oracle Financial Services Applications | 24 | 6 | 7.5 |
| Oracle Food and Beverage Applications | 1 | 0 | 4.9 |
| Oracle Fusion Middleware | 38 | 30 | 9.8 |
| Oracle GraalVM | 5 | 3 | 9.8 |
| Oracle Health Sciences Applications | 3 | 3 | 9.8 |
| Oracle Hospitality Applications | 5 | 2 | 7.5 |
| Oracle Hyperion | 2 | 1 | 9.8 |
| Oracle iLearning | 1 | 1 | 4.7 |
| Oracle Java SE | 12 | 12 | 8.1 |
| Oracle JD Edwards | 9 | 9 | 9.8 |
| Oracle MySQL | 19 | 6 | 7.5 |
| Oracle PeopleSoft | 15 | 12 | 9.8 |
| Oracle Retail Applications | 22 | 14 | 9.8 |
| Oracle Siebel CRM | 5 | 5 | 9.8 |
| Oracle Systems | 17 | 8 | 9.8 |
| Oracle Supply Chain | 8 | 8 | 9.6 |
| Oracle Utilities Applications | 4 | 4 | 9.8 |
| Oracle Virtualization | 22 | 3 | 8.2 |
Affected products and versions
Please refer to the appendix at the end of the article for the affected products and versions.
Critical patch update (CPU)
Critical patch update (CPU) is a collection of patches for multiple security vulnerabilities. Critical patch updates are usually cumulative, but each time only security fixes that have been added since the last critical patch update consultation are described. Therefore, important update recommendations for previously released security patches should be reviewed for information on security fixes for earlier releases.
Solution
Given the threat of a successful attack, Oracle strongly recommends that customers download and install critical patch updates as soon as possible.
Appendix
Affected products (including versions) and related patches are shown in the table below:
Statement
This advisory is only used to describe a potential risk. NSFOCUS does not provide any commitment or promise on this advisory. NSFOCUS and the author will not bear any liability for any direct and/or indirect consequences and losses caused by transmitting and/or using this advisory. NSFOCUS reserves all the rights to modify and interpret this advisory. Please include this statement paragraph when reproducing or transferring this advisory. Do not modify this advisory, add/delete any information to/from it, or use this advisory for commercial purposes without permission from NSFOCUS.
About NSFOCUS
NSFOCUS, Inc., a global network and cyber security leader, protects enterprises and carriers from advanced cyber attacks. The company’s Intelligent Hybrid Security strategy utilizes both cloud and on-premises security platforms, built on a foundation of real-time global threat intelligence, to provide multi-layered, unified and dynamic protection against advanced cyber attacks.
NSFOCUS works with Fortune Global 500 companies, including four of the world’s five largest financial institutions, organizations in insurance, retail, healthcare, critical infrastructure industries as well as government agencies. NSFOCUS has technology and channel partners in more than 60 countries, is a member of both the Microsoft Active Protections Program (MAPP), and the Cloud Security Alliance (CSA).
A wholly owned subsidiary of NSFOCUS Information Technology Co. Ltd., the company has operations in the Americas, Europe, the Middle East and Asia Pacific.
