Patch Set Update and Critical Patch Update October 2011 Availability Document

1.1 How To Use This Document

The following steps explain how to use this document.

Step 1   Assess your Environments

Determine the Oracle product suites and products and their release numbers for each of your environments.

Step 2   Read Important Announcements

Review Section 2, "What's New in October 2011," as it lists documentation and packaging changes along with important announcements such as upcoming final patches.

Step 3   Determine Patches to be Applied

For each environment, determine which patches need to be applied by using the tables in Section 3, "Patch Availability for Oracle Products."

There is one availability table for each product suite release, such as Oracle Database 11.1.0.7, Oracle Fusion Middleware 10.1.2.3, and Enterprise Manager Base Platform 10.2.0.5. These tables list all the patches to apply, in order, to the various Oracle homes that are associated with the product suite. Apply only the applicable patches for each installed release. For example, the Oracle Fusion Middleware 10.1.2.3 table lists an Oracle Portal Repository patch for Oracle Portal 10.1.4.2 Repository, and a different patch for Oracle Portal 10.1.2.3 Repository. Apply the corresponding patch based on which release of Oracle Portal is installed.

The product suite release tables may reference Section 3.1.3, "Oracle Database." You need to determine the Oracle Database release that is installed, and find the patches to apply in the table for that specific Oracle Database release. All Oracle Database versions that are under error correction are listed in Section 3.1.3. If your installed Oracle Database version does not have an associated table, then refer to Table 66, "Final Patch History" and contact Oracle Support for further assistance.

There is one availability table for products that are released independently, such as Oracle Secure Backup. Products may require a minimum release and/or list of patches. This is dependent on the patching and release mechanisms for the product. If a minimum release is indicated, the environment must be at that release to address the announced security vulnerabilities.

The tables list the CPU and PSU patches only for product versions that are under error correction. For more information, see My Oracle Support Note 209768.1, Database, FMW, EM Grid Control, and OCS Software Error Correction Support Policy.

Patches that include security vulnerabilities announced in the current quarter's CPU Advisory, will list the vulnerability CVE numbers in the Advisory Number column. If you are interested in the risk matrix for the vulnerabilities fixed in the patch, then see the CPU Advisory for the release at http://www.oracle.com/technetwork/topics/security/alerts-086861.html. For patches that are listed from previous CPU releases, the column will indicate 'Released MMM YYYY'. You can easily find which patches are new in a CPU release by searching for the string 'CVE' in the tables.

Step 4   Apply the Patches

Download the patches, review the READMEs, and apply the patches according to the instructions.

1.2 Terminology in the Tables

The following terminology is used in this patch availability document and in the subsequent tables.

• Bundle The Critical Patch Update and Patch Set Update fixes are included in cumulative Microsoft Windows Bundles.

• Patch Number The patch is available on the platform for the release version.

• Not Applicable (NA) The patch is not planned for this platform and release version combination. This may be due to several reasons including:

  1. The release version is not available on this platform.

  2. The release version does not fall under Critical Patch Update release policies. Refer to My Oracle Support Note 209768.1, Database, FMW, EM Grid Control, and OCS Software Error Correction Support Policy.

• On-Request (OR) The patch may be made available through the On-Request program.

1.3 On-Request Patches

Oracle does not release proactive patches for platform-version combinations that have fewer than 10 downloads in the prior Critical Patch Update (CPU) or Patch Set Update (PSU) period. Oracle will deliver patches for these historically inactive platform-version combinations when requested.

The following guidelines describe how you may request an on-request (OR) Critical Patch Update or Patch Set Update.

A request may be made:

• At any time. however a specific CPU/PSU cannot be requested. Either the current CPU/PSU or the next CPU/PSU patch will be provided depending on when the request is received and processed. Your Service Request (SR) will provide you the planned availability date for the patch.

• As long as the version is in either Premier Support or Extended Support. Once the final patch for the version has been released, an OR can be requested for up to 2 weeks after the release date. For example, Oracle Database 10.1.0.5 is under Extended Support through the release of CPUJan2012 on January 17, 2012, so you can file a request for 10.1.0.5 through January 31, 2012.

• For a platform-version combination if the product or patch set is released on a platform after a CPU/PSU release date. Oracle will provide the next CPU/PSU for that platform-version combination, however you may request the current CPU/PSU by following the on-request process. For example, if a 10.2.0.5 database patch set is released for a platform on August 1, 2011, Oracle will provide the 10.2.0.5 CPUJul2011 for that platform. You may request a 10.2.0.5 CPUJul2011 on the platform, and Oracle will review the request and determine whether to provide CPUJul2011 or CPUOct2011.

A patch that is marked as on-request (OR) may already have been requested by another customer and be available on My Oracle Support. Before you file a Service Request (SR), check on My Oracle Support to see if the patch is already available for your platform.

1.4 Oracle Database Critical Patch Updates and Patch Set Updates

The Database Patch Set Updates and Critical Patch Updates that are released each quarter contain the same security fixes. However, they use different patching mechanisms, and Patch Set Updates include both security and recommended bug fixes. Consider the following guidelines when you are deciding to apply Patch Set Updates instead of Critical Patch Updates.

• Critical Patch Updates are applied only on the base release version, for example 10.2.0.4.0.

• Patch Set Updates can be applied on the base release version or on any earlier Patch Set Update. For example, 11.1.0.7.2 can be applied on 11.1.0.7.1 and 11.1.0.7.0.

• Once a Patch Set Update has been applied, the recommended way to get future security content is to apply subsequent Patch Set Updates. Reverting from an applied Patch Set Update back to the Critical Patch Update, while technically possible, requires significant time and effort, and is not advised.

• Applying a Critical Patch Update on an installation with a Patch Set Update installed is not supported.

For more information on Patch Set Updates, see Note 854428.1, Patch Set Updates for Oracle Products.

2.1 Final Patch Information (Error Correction Policies)

The Final patch is the last CPU/PSU release for which the product release is under error correction. Final patches for the October 2011 release, the January 2012 release, and newly scheduled final patches are listed in the following sections.

Final patches scheduled for October 2011:

• Oracle Identity Management 10.1.4.3, except for Oracle Single Sign-on and Delegated Administration Services working with Oracle Internet Directory 11gR1 for user authentication of Portal 11gR1, Forms 11gR1, Reports 11gR1 and Discoverer 11gR1 Middleware 11g PFRD installation.

• Oracle Identity Management 10.1.4.0.1

• Oracle Fusion Middleware 10.1.2.3

Final patches scheduled for January 2012:

• Oracle Database 10.1.0.5

• Oracle Enterprise Manager Base Platform 10.1.0.6

• Secure Enterprise Search 10.1.8.4

Newly Scheduled final patches:

• Oracle Database 11.2.0.2 — July 2012

For additional final patch history information, see Table 66. For information on the error correction support policy for patches, refer to My Oracle Support Note 209768.1, Database, FMW, EM Grid Control, and OCS Software Error Correction Support Policy.

2.2 New Minimum Product Requirements for CPUOct2011

The following is new for CPUOct2011:

• The new minimum version for Oracle Application Express is 4.1.0.00.32

• The new minimum version for Oracle Database Appliance is 2.1.0.1.0

2.3 New OPatch Requirements

There is no new minimum OPatch requirement for October 2011.

2.4 README Patch Apply Changes for Database and Fusion Middleware Patches

The following describe the README changes in October 2011:

• For Oracle Fusion Middleware 10.1.2.3 patches (12434134, 12434141, 12434144) the README files from July 2011 CPU omitted the manual redeploy step needed for BC4j.jar. This has been corrected in the README files for October 2011 FMW 10.1.2.3 patches (12837860, 12837864, 12837867).

2.5 Changes to the Patch Availability Document

The following changes to this document are for October 2011:

• The BEA information has been incorporated into this document. There is no longer a separate BEA Patch Availability Document.

• Starting with the October 2011 Critical Patch Update, security vulnerability fixes for Oracle JRockit will be announced with the Oracle Java SE Critical Patch Updates, at http://www.oracle.com/technetwork/topics/security/javacpuoct2011-443431.html.

  For the Java SE Critical Patch Update schedule, see http://www.oracle.com/technetwork/topics/security/alerts-086861.html, Critical Patch Updates and Security Alerts.

• The Enterprise Manager product names have been changed to reflect their new names as documented in Note 1361443.1, Name Changes for Enterprise Manager And Related Management Products.

2.6 Post Release CPU and PSU Patches

The following are the planned release dates for the CPU and PSU patches that have been delayed. This section will be updated as the patches are made available.

• Oracle Database 11.2.0.2 Microsoft Windows Bundle 12 including PSU content

  Available: October 21st, 2011

• Oracle Database 10.1.0.5 Microsoft Windows Bundle 43

  Available: October 19th, 2011

• Oracle Fusion Middleware 10.1.2.3 Microsoft Windows patch

  Available: October 19th, 2011

3.1 Oracle Database

This section contains the following:

• Section 3.1.1, "Oracle Application Express"

• Section 3.1.2, "Oracle Audit Vault"

• Section 3.1.3, "Oracle Database"

• Section 3.1.4, "Oracle Database Appliance"

• Section 3.1.5, "Oracle Database Patch Set Update (PSU)"

• Section 3.1.6, "Oracle Fusion Middleware Utilities for Oracle Databases"

• Section 3.1.7, "Oracle Secure Backup"

• Section 3.1.8, "Oracle Secure Enterprise Search"

• Section 3.1.9, "Oracle TimesTen"

• Section 3.1.10, "Oracle Workflow Server"

3.2 Oracle Fusion Middleware

This section contains the following:

• Section 3.2.1, "Oracle Beehive 2.0.1.x"

• Section 3.2.2, "Oracle Business Intelligence Enterprise Edition"

• Section 3.2.3, "Oracle Business Intelligence Publisher"

• Section 3.2.4, "Oracle Business Process Management"

• Section 3.2.5, "Oracle Complex Event Processing and WebLogic Event Server"

• Section 3.2.6, "Oracle Data Service Integrator and AquaLogic Data Services Platform"

• Section 3.2.7, "Oracle Document Capture"

• Section 3.2.8, "Oracle Exalogic Patch Set Update (PSU)"

• Section 3.2.9, "Oracle Fusion Middleware"

• Section 3.2.10, "Oracle GoldenGate Veridata"

• Section 3.2.11, "Oracle Hyperion BI+"

• Section 3.2.12, "Oracle Identity Manager"

• Section 3.2.13, "Oracle JRockit"

• Section 3.2.14, "Oracle Outside In Technology"

• Section 3.2.15, "Oracle WebLogic Integration"

• Section 3.2.16, "Oracle WebLogic Portal"

• Section 3.2.17, "Oracle WebLogic Server and WebLogic Express"

• Section 3.2.18, "Oracle WebLogic Server Patch Set Update (PSU)"

• Section 3.2.19, "Oracle WebLogic Server Plug-ins"

3.3 Oracle Enterprise Manager

This section contains the following:

• Section 3.3.1, "Patch Availability Information for Oracle Enterprise Manager Base Platform"

• Section 3.3.2, "Patch Availability for Oracle Enterprise Manager Base Platform 12.1.0.1,"

• Section 3.3.3, "Patch Availability for Oracle Enterprise Manager Base Platform 11.1.0.1"

• Section 3.3.4, "Patch Availability for Oracle Enterprise Manager Base Platform 10.2.0.5"

• Section 3.3.5, "Patch Availability for Oracle Enterprise Manager Base Platform 10.1.0.6"

• Section 3.3.6, "Patch Availability for Oracle Real User Experience Insight,"

3.4 Oracle Collaboration

This section contains the following:

• Section 3.4.1, "Patch Availability Information for Oracle Collaboration Suite"

3.5 Tools

This section contains the following:

• Section 3.5.1, "Oracle Opatch"