July saw two high-severity bugs in Firefox, while Oracle patched over 500 vulnerabilities.
See full article...
See full article...
Bug-squashing summer: A month’s worth of 0-day fixes among tech giants
- Thread starter JournalBot
- Start date
Not to nitpick on just Oracle, but geez! 57 of the 77 in Oracle Communications were RCEs??? Someone's SDLC process is severely failing.
Upvote
29
(29
/
0)
Well you can't maintain a bug hunt and create an utterly baroque licensing system to squeeze every dime out of your customers.
One must prioritize.
Upvote
44
(44
/
0)
FWIW, Thunderbird patched to 102.13.1 on July 26. Firefox had a patch around that time too, but then released 116.0 today (August 1). Presumably, in a month or so, Thunderbird will update to that base too.
The Cumulative Update Previews for August for Win10 & 11 were released on July 26, too. Shadow Patch Tuesday.
The Cumulative Update Previews for August for Win10 & 11 were released on July 26, too. Shadow Patch Tuesday.
Upvote
6
(7
/
-1)
Hot summer streets and my OS is burning
I sit around
Trying to smile but the exploits susceptable to drive-bys
Strange files are savin' (what did they save?)
Things I can't now decrypt
Exploited too many apps with the bad guys installing their scripts...
It's a cruel, (cruel) cruel summer
Leavin' me here on my own
Patching too, (patching too!) many apps
Data's gone
Android's the first none, my phone is too old
So I'm on my own
It's one rev behind so the telco's told me to go
It's a cruel, (cruel) cruel summer
Downloading all of the patches
It's a cruel, (it's a cruel) cruel summer
Installing in several batches
Gonna feel only it was...
Windows was hit while I looked for a film
That I used to watch
Another exploit when I tried to order some scotch...
It's a cruel, (cruel) cruel summer...
With apologies to Bananarama...
I sit around
Trying to smile but the exploits susceptable to drive-bys
Strange files are savin' (what did they save?)
Things I can't now decrypt
Exploited too many apps with the bad guys installing their scripts...
It's a cruel, (cruel) cruel summer
Leavin' me here on my own
Patching too, (patching too!) many apps
Data's gone
Android's the first none, my phone is too old
So I'm on my own
It's one rev behind so the telco's told me to go
It's a cruel, (cruel) cruel summer
Downloading all of the patches
It's a cruel, (it's a cruel) cruel summer
Installing in several batches
Gonna feel only it was...
Windows was hit while I looked for a film
That I used to watch
Another exploit when I tried to order some scotch...
It's a cruel, (cruel) cruel summer...
With apologies to Bananarama...
Upvote
8
(9
/
-1)
Only 500+ for Oracle? Maybe time to hire more engineers and coders instead of lawyers.
Upvote
16
(16
/
0)
internet2000
Smack-Fu Master, in training
This seems to be just normal course of business patching? Why the alarmist headline?
Upvote
15
(15
/
0)
Upvote
40
(40
/
0)
(Dis)honorable mention to BeyondTrust, which squeaked just under the wire to not publicly announce a perfect CVSS 10 bug in its remote support products on August 1, since who would need those to be trustworthy or secure?
Upvote
16
(16
/
0)
I'm guessing about a billion android devices will never get patched for these vulnerabilities.
That's probably OK though. /s
Please Law makers, just write some legislation that demands 5 years of prompt (monthly for CVSS 9.0 or above. Quarterly for the rest) updates, with the 5 years starting from when the device is no longer sold. Yes things will be more expensive, but everyone and every business benefits.
That's probably OK though. /s
Please Law makers, just write some legislation that demands 5 years of prompt (monthly for CVSS 9.0 or above. Quarterly for the rest) updates, with the 5 years starting from when the device is no longer sold. Yes things will be more expensive, but everyone and every business benefits.
Upvote
8
(11
/
-3)
Upvote
5
(5
/
0)
Oracle products aren't really a monolithic product - they're a bundle of Oracle code and open source (like most products these days really); so some of it will be Apache, some of it will be Java, some of it will be their own stuff...things like that. But you can't separate them - they'll only certify their bundle of Apache as supported, so when they patch, you get their Apache's patches.
Upvote
0
(0
/
0)
It's possible many of them were one common library used across multiple functions.
Upvote
1
(1
/
0)