Oracle is preparing to release 45 security patches on Tuesday 15 July as part of its quarterly update cycle.

The updates cover unspecified security bugs across multiple Oracle products including its Oracle Database, Application Server, E-Business Suite and PeopleSoft business applications. Some of the updates address vulnerabilities in multiple products.

Eleven of the planned security updates include patches for versions of Oracle's database. Fortunately none of the flaws lend themselves to remote exploitation without requiring login credentials.

The same can't be said for the nine new security fixes for Oracle Application Server. All nine are capable of being exploited by hackers without login credentials, Oracle warns. Three of the seven updates for Oracle WebLogic Server carry the same risk.

Oracle rates the most severe of this quarter's patch batch (involving the flaws in Application Servers and WebLogic Server) at 6.8 out of 10 - pretty critical - according to the Common Vulnerability Scoring System (CVSS), a cross-industry initiative designed to standardise vulnerability ratings. More details can be found in Oracle's pre-release announcement here. ®

Related stories

• Oracle discharges monster bug fix (16 October 2008)
• Hello, this is Oracle - we're not in right now (29 August 2008)
• Oracle breaks patch cycle with emergency fix (7 August 2008)
• Oracle warns over unpatched vuln (29 July 2008)
• Oracle patches 'sitting duck' database vulns (16 April 2008)
• Cisco hops onto patching treadmill (6 March 2008)
• Databases still open to basic attack (15 November 2007)
• Oracle readies mega-update patching 51 security holes (13 October 2007)
• Oracle drops litter of summer patches (18 July 2007)