Oracle emits 603 patches, names one it wants you to worry about soon

Oracle has delivered its regular quarterly collection of patches: 603 in total, 318 for its own products, and another 285 for Linux code it ships. Big Red’s VP of security assurance Eric Maurice singled out one patch as worthy of particular attention: The fix addresses CVE-2025-21556, a CVSS 9.9-out-of-10-rated vulnerability in Oracle’s Agile Product Lifecycle Management (PLM) Framework which allows a low-privileged attacker with network access to compromise that tool, and through it other Oracle products. Maurice urged action because in November 2024 Oracle published an out-of-band security alert for the Agile PLM Framework. He wrote that the patch delivered on Wednesday “includes patches for this alert as well as additional patches.” Another catch-up concerns CVE-2024-45492, a flaw in the XML parsing library LibExpat that Oracle uses in several products. The flaw was tackled in August 2024 and rated 6.2 in severity, but in December was upgraded to 9.8. NIST’s page for the flaw states: “It is awaiting reanalysis which may result in further changes to the information provided.” It's probably not a major concern, as it only poses a threat on 32-bit systems under certain conditions. But it’s rated as having a low attack complexity, and the version 2.6.3 that fixed it was published in September 2024. Libraries like this can often find their way into software and be all-but forgotten. At Oracle, it’s used in products for telcos, financial services orgs, and middleware. Other fixe...