Oracle has released its Critical Patch Update for October 2009 to address 38 vulnerabilities across several database and server products. The update contains the following security fixes:
Oracle users and administrators should immediately review the October Critical Patch Update and apply any necessary updates.
Alexander Kornbrust of Red Database Security has more details including a claim that there are more than 20 unfixed issues still pending.