oss-security - Oracle January 2025 Critical Patch Update

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20250123024222.GA16803@openwall.com>
Date: Thu, 23 Jan 2025 03:42:22 +0100
From: Solar Designer <solar@...nwall.com>
To: oss-security@...ts.openwall.com
Subject: Oracle January 2025 Critical Patch Update

Hi,

Once in a while, Oracle publishes what they call Critical Patch Update
documents, which list many vulnerabilities addressed across many Oracle
products, some of them Open Source and some not.  This is great, but it
would be even better if Oracle also communicated to oss-security about
those vulnerabilities in its Open Source products, perhaps one message
per product (e.g., MySQL separately from VirtualBox).  I hope someone
from Oracle reads this and will get the wheels moving.  Anyone?

Meanwhile, the latest Critical Patch Update is:

https://blogs.oracle.com/security/post/january-2025-cpu-released
https://www.oracle.com/security-alerts/cpujan2025.html

For MySQL, it says:

https://www.oracle.com/security-alerts/cpujan2025.html#AppendixMSQL

"Oracle MySQL Risk Matrix

This Critical Patch Update contains 39 new security patches, plus
additional third party patches noted below, for Oracle MySQL.  4 of
these vulnerabilities may be remotely exploitable without
authentication, i.e., may be exploited over a network without requiring
user credentials.  The English text form of this Risk Matrix can be
found here."

and links to:

https://www.oracle.com/security-alerts/cpujan2025verbose.html#MSQL

and lists additional information on some CVEs not included in the matrix
itself (duplicate or not vulnerable).  With so many CVEs, all of this is
rather long, but I imagine someone from Oracle - or someone external -
could copy-paste the "English text form of this Risk Matrix" and the
extra notes on a few CVEs to a separate message focusing on MySQL.

Similarly, there's info on a couple of VirtualBox CVEs here, which would
ideally be a separate message with copy-pasted detail:

https://www.oracle.com/security-alerts/cpujan2025.html#AppendixOVIR
https://www.oracle.com/security-alerts/cpujan2025verbose.html#OVIR

Perhaps there's more Open Source software listed in there, which needs
similar treatment.  Not only this time, but each time, please.

Alexander

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.