'Stupid' Holes Reported in Oracle 11g
449710
A security expert has found programming errors in Oracle 11g that left security vulnerabilities.
568061
Oracle Corp. urged customers to apply software patches it released in August because of the availability of malicious code that can exploit unpatched vulnerabilities in its software.
767079
After struggling with it for a good while, Maggie Nelson finally figured out the answer to her problems with Oracle, PDO and CLOBs - they're just not supported.   LOB support was added to PDO_OCI in PHP 5.1. This is really cool, however, it appears that the LOB support really means BLOB support. After much investigation and self-doubt (e.g. "what if we're using streams incorrectly?"), we found out that PDO_OCI does not currently support CLOBs (BLOBs only!).   The bug's already been documented and remains open, but Maggie encourages all of the Oracle developers out there with the fact that Chris Jones (of Oracle) knows about the issue and plans to correct it in the next release of the extension.
207332
The Motley Fool - It appears that Larry Ellison took to the stage last week with more drama in mind than he had the right to perform. Oracle (Nasdaq: ORCL - News) really did produce a strong quarter, but the CEO may have been speaking with feet of clay when he came out strongly in regard to rival enterprise-software developer SAP (NYSE: S News). An SAP representative took the time to give me his company's side of the story, to which I've added my own Foolish touch.
248240
46 fixes coming at ya Oracle plans to release 46 security patches next week as part of its quarterly update cycle.â¦
48844
According to this new post on DynamicWebPges.de and a message from Derick Rethans on the php.internals mailing list, there's an issue with PHP 4.4.5 where sessions are causing segfaults when register_globals is set to "On".   As per Derick:   Because of this I'd like to release a 4.4.6 soon with this fixes. As  there is also an upgrade to pcre 7.0 we'd need at least one RC, which I  plan to release on Thursday.   Users of the PHP 4.4.x series should keep watch for this new update to correct the issue quickly.
559035
Michael Kimsal has posted a formal prediction that a patch, created by someone in the community, will emerge making it simple to bridge the gap between PHP4 and PHP5 applications.   Given the high number of shared hosts still running PHP4, the backwards compatibility issues going from 4->5 (yes, there are some!) and the new PHP4 "end of life" date (8/8/8), someone will likely find a way to make these run together, and possibly even charge money for it.   He suggests that many hosts out there would happily pay a sum to get this kind of functionally for their customers. It would provide a solution to customers who just don't understand the force towards PHP5 and would make them (and their PHP4 applications) happier.
378087
Vista Review: Bugs and Confusion &gt;&gt; Advertisement &lt;&lt;  ALERT: "How A Hacker Launches A Blind SQL Injection Attack Step-by-Step"!" - White Paper  Blind SQL Injection can deliver total control of your server to a hacker giving them the ability to read, write and manipulate all data stored in your backend systems! Download this *FREE* white paper from SPI Dynamics for a complete guide to protection! https://download.spidynamics.com/1/ad/bsq.asp?Campaign_ID=701600000004c29
234083
.NET patch trips up systems Early reports are suggesting problems after users apply one of the six patches issued by Microsoft on Tuesday.â¦
486380
InfoWorld - Oracle plans to fix dozens of flaws in its software products next Tuesday, including critical bugs in the company's database, e-business suite, and application server.
223142
(InfoWorld) - Microsoft has blamed an unspecified server problem for a 19-hour stretch during which paying users of Windows XP and Vista were accused by the company's WGA (Windows Genuine Advantage) validation system of running pirated software. Any Vista system fingered during the episode was stripped of some features, including the operating system's Aero graphical interface. As of Saturday at 3 p.m. EDT, Microsoft said the problem had been fixed. "We are aware it is a server-side issue," said Phil Liu, a Microsoft program manager in the WGA group. "[But] the cause is unknown at this current time." "Customers who received an incorrect validation response can fix their system by revalidating on our site," said Alex Kochis, senior product manager of WGA, in a blog posting. The site Kochis referred to is the Genuine Microsoft Software home page, which includes links to validation tests for Windows and Microsoft Office. "After successfully revalidating, any affected system should be rebooted to ensure the genuine-only features are restored," Kochis continued. The validation server snafu began sometime prior to 8 p.m. EDT on Friday, when users started posting messages on Microsoft's support forums, including Vista Validation Issues, saying that their PCs had been tagged as running nongenuine Windows. Overnight, the number of users adding their accounts to the tale spiked significantly, as did the frustration index. "What in hell is going on, Microsoft?" asked a user named Hedgemeister. "SUPPORT? Where are you? Validation issues with Vista. Hello? All of us need help," wrote Gnrlbzik. "This is an absolute disgrace. Treating legitimate customers like criminals is a great way to make people want to buy your software in the future! [I'm] absolutely disgusted," added Costanza. Although copies of both Windows XP and Vista were being tagged as counterfeit during the 19 hours, users of the latter were especially incensed. The WGA antipiracy scheme for that operating system disables several features when it thinks the copy is bogus, among them the Aero graphical user interface and ReadyBoost. Early in the outage, several Microsoft customers posted what they said was the text of e-mail they had received from Microsoft support that suggested users sit tight for several days. "I'm sorry to inform you that the Windows Genuine server might be down for few days," the e-mail, attributed to Microsoft Technical Support, said. "I have escalated the issue to our Genuine team, kindly try to validate again on Tuesday 28 Aug 2007." If the message was intended to mollify users, it didn't work. "TUESDAY!?! Yeah, f that," said Nooaah. It wasn't until Saturday around 1 p.m. EDT that a non-anonymous Microsoft manager offered up information. "I guarantee that we're working on this issue right now," said Liu in a post to the forum. "My goal is to identify a FIX for this issue -- afterwards get you all what you are looking for, an explanation and cause. I promise I will have an explanation and resolution as soon as humanly possible." Users' testy relationship with WGA Although Microsoft did not identify the number of affected systems Saturday, based on the user comments and Liu's promises, it appeared to be systemwide. If so, it would be the biggest problem so far in the developer's contentious WGA program. Designed to spot pirated copies of its Windows and Office software, WGA has been mandatory since mid-2005 before nonsecurity updates or files can be downloaded from Microsoft's site. WGA has faced criticism almost since its inception, but until Friday, the most vocal complaints dated back to June 2006, when users discovered that the Windows XP version of WGA was "phoning home" to Microsoft every time the PC was booted. Those critics returned when Microsoft upped the ante with Vista by replacing the WGA messages that only nagged XP users suspected of running counterfeits with a new policy that used an RFM (reduced functionality mode) to cripple machines. In RFM, only Internet Explorer works, and then for just an hour at a time. Because RFM only allows a grace period of three days to those who previously activated Windows but are subsequently deemed pirates, any problems must be fixed quickly to prevent customers' PCs from going dark. Microsoft managed to beat the deadline. That, however, didn't mean much to some, who said this was it for their relationship with the vendor. One claimed that he was heading out the door to buy a Mac, while others swore they would switch to Linux. Others called on Microsoft to ditch WGA. "Once again the legitimate person gets screwed while the people who pirate software probably aren't even affected," said Mark in the support forum. "This whole validation process should be dropped. This is just another nail in the Microsoft coffin." Saturday's outage was not the first time the validation service has gone dark and then identified all PCs connecting with the servers as running pirated copies. In October 2006, Microsoft's Kochis acknowledged a similar blackout. "Earlier this week, a server on the back end of the WGA service experienced a bug that resulted in a temporary outage. As a result, some systems were incorrectly flagged as being non-genuine, and we want to confirm for those who contacted us about this that it was indeed an error," he wrote.
59423
Christopher Jones has posted to his Oracle blog today about the release of a new beta for the PECL Oracle (OCI8) drivers for PHP.   I've created a PECL OCI8 1.3.1 Beta bundle of the code with Connection Pooling support that I mentioned in http://blogs.oracle.com/opal/2008/01/31.  You can get it from http://pecl.php.net/package/oci8.  The README contains the details.   Of course, it's still in beta, so any testing and feedback is more than welcome. This bundle also includes several other "non-DRCP related bug fixes" including an issue that caused constant pinging for persistent connections.
48646
In this new post to the PHP Security blog, Stefan Esser points out that an issue that was previously marked as corrected - a problem with the chunk_split function - hasn't completely been corrected.   This [bugfix] fixes the chunk_split() overflow (found by SEC-CONSULT) that was according to the PHP 5.2.3 release notes already fixed. The original fix was however not only broken but complete nonsense. If you can read C you will see that the integer overflow was not fixed in PHP 5.2.3 but simply moved into a separate line and an additional bogus if clause was added.   Stefan includes a simple four line code example to illustrate his point.
424439
10.3.7 fixes bugs, fills security holes
106469
SQuirreL SQL Client is a graphical SQL client written in Java that will allow you to view the structure of a JDBC compliant database, browse the data in tables, issue SQL commands etc.   We released version 2.6.1 which addresses the following two problems:  A critical packaging flaw that prevents launch on some platforms:     http://sourceforge.net/tracker/index.php?func=detail&aid=1818446&group_id=28383&atid=393414    A bug causing tables in the object tree to appear unsorted alphabetically:    https://sourceforge.net/tracker/index.php?func=detail&aid=1805954&group_id=28383&atid=393414    The 2.6.1 release files are available for download here:  http://sourceforge.net/project/showfiles.php?group_id=28383&package_id=29193
498125
Hoodies hit Microsoft, big lads do Larry Oracle users could be headed for a Microsoft-scale hack or a major database breach as master criminals begin to target valuable business systems.â¦
427676
Database giant investigates DenyHosts reports Compromised computers at Oracle UK are listed among the 10 worst offenders on the net for launching attacks on servers which run SSH (secure shell) server software.â¦