Re: Oracle January 2025 Critical Patch Update

[Solar Designer <solar () openwall com>]

On Thu, Jan 23, 2025 at 09:24:14AM -0800, Alan Coopersmith wrote:
> The open source packages delivered in Oracle Linux & Oracle Solaris are
> listed separately, but these are downstreams, so I've always thought they'd
> be off topic here, since we normally only cover upstream issues, and don't
> publish every distro's notices that they've applied the latest fixes to
> rsync, openssl, glibc, or whatever upstream was fixed this week.
>
> For those who want to see such downstream notices, you can find them at:
>
> Oracle Linux:
>    https://linux.oracle.com/security/
>    https://oss.oracle.com/mailman/listinfo/el-errata
>    https://www.oracle.com/security-alerts/#OLBulletin
>
> Oracle Solaris:
>    https://www.oracle.com/security-alerts/#SolarisThirdPartyBulletin

You're correct, these would generally be off-topic here.

So in this thread I am not talking about Oracle's OS distros, but about
Oracle's upstream Open Source projects.  Looking at the Critical Patch
Update, I don't know which projects fit such criteria.  Like I wrote, I
think it's MySQL and VirtualBox, but probably not only these two.
Perhaps also Java?  I'm not familiar with most of Oracle's products and
their licensing.

Also, in some cases we make exceptions for projects closely related to
or enabling Open Source ones e.g. as in the recent AMD microcode thread.

Alexander