Oracle to release critical security fixes for hundreds of products (including Java) on Tuesday

On Tuesday 14 January, Oracle will be releasing its quarterly batch of security updates – and it’s gonna be a doozy.

Oracle’s critical patch update will address multiple security issues, including “144 new security vulnerability fixes across hundreds of Oracle products”.

Oracle says that it is strongly recommending that customers apply the patches “as soon as possible” because of “the threat posed by a successful attack.”

As always, the risk is that one of these vulnerabilities might be exploited by a hacker to run malware onto your computer.

Many of the vulnerabilities are said to be “remotely exploitable without authentication” – which means that for an attack to be successful against your computer you wouldn’t have to enter your username and password.

The Oracle product which will grab the most headlines because of its need to be patched is probably Java SE, used on a wide number of both business and consumer computers and long regarded as something of a “Swiss cheese” for its numerous security holes.

Oracle says that Tuesday’s release will contain 36 fixes for Java, 34 of which can be exploited by an attacker without the need for authentication.

Once again, it might be sensible for you to consider whether you really need Java enabled in your web browser. (Note: Java is entirely diffferent from JavaScript).

More details can be found in Oracle’s pre-announcement about the security updates, but here is a list of affected products:

And don’t forget – as if you weren’t busy enough with security patches – Oracle times its quarterly security fixes to coincide with the regular monthly security updates from Microsoft and Adobe.

Found this article interesting? Follow Graham Cluley on Twitter, Mastodon, or Threads to read more of the exclusive content we post.

Graham Cluley •   @gcluley

Graham Cluley is an award-winning keynote speaker who has given presentations around the world about cybersecurity, hackers, and online privacy. A veteran of the computer security industry since the early 1990s, he wrote the first ever version of Dr Solomon's Anti-Virus Toolkit for Windows, makes regular media appearances, and is the co-host of the popular "Smashing Security" podcast. Follow him on Twitter, Mastodon, Threads, Bluesky, or drop him an email.