Oracle Security Patch Update – 22 January 2025

By /
  • 17/2025
  • Critical

Oracle released its critical patch updates for January 2025, containing (318) new security patches for multiple affected products in Oracle code and third-party components.

The addressed vulnerabilities could allow the attacker to perform various attacks such as obtaining sensitive information, gaining elevated privileges, conducting denial of service attacks, performing data manipulation (update, insert, or delete access), executing arbitrary codes, and gaining access to the affected systems.

Sample of the addressed vulnerabilities:

1. Oracle Agile PLM Framework Takeover Vulnerability (CVE-2025-21556):

  • CVSS: 9.9
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: Low
  • User Interaction: None
  • Consequences: Gain Access

2. Oracle WebLogic Server Takeover Vulnerability (CVE-2025-21535):

  • CVSS: 9.8
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Consequences: Gain Access

Sample of the affected products:

  • Oracle Database Server.
  • Oracle Application Express.
  • Oracle Communications.
  • MySQL Connectors.
  • MySQL Enterprise Backup.
  • Oracle MySQL.

The complete list of the affected products: Oracle Advisory – January 2025

Vulnerabilities
Mitigations

The enterprise should deploy this patch as soon as the testing phase is completed.

Oracle Advisory – January 2025

References