Critical Patch Update for E Business Suite - July 2014 is released

From

https://blogs.oracle.com/stevenChan/entry/critical_patch_update_for_july4

1. Make a list of all the Oracle E-Business Suite homes on your system, together with their associated Oracle products and full versions.
2. Identify the CPU patches needed for each Oracle product. Depending on your configuration, you may need to apply multiple Oracle Database and Oracle Fusion Middleware patches.
3. Set the environment to point to the relevant Oracle home or product before applying a patch.
4. Shut down all processes running from an Oracle home before patching the products there.
5. Apply patches to one Oracle product at a time, then move on to the next Oracle product.
6. Patch the database tier before the application (middle) tier. This is to ensure the database post-installation scripts have been run before application tier services are restarted.
7. Patch your system in the following order:
   1. Any separate or remote Oracle Fusion Middleware or Oracle HTTP Server Database home, including a separate Metadata Repository home.
   2. Oracle E-Business Suite Database home.
   3. Oracle Identity Management and infrastructure homes.
   4. Oracle Fusion Middleware application tier home.
   5. Oracle E-Business Suite applications.
8. Ensure that each product is patched completely before continuing to the next.

Table 1: Oracle E-Business Suite CPU patches

Oracle E-Business Suite Release	Minimum Required Code Level to Apply CPU Patch	CPU Patch
Release 12.2	12.2.2 Release Update Patch.	Patch 18122014 Notes: Run AutoConfig after applying the CPU patch.
Release 12.1	12.1.1 Release Update Patch. CPU patches typically require a smaller number of prerequisite patches than are listed in Appendix A of My Oracle Support Knowledge Document 1195034.1, Oracle E-Business Suite Error Correction Support Policy (V.4). The CPU patch continues to have the Oracle Applications Technology patch(es) listed as minimum requirements: currently, R12.ATG_PF.B.delta.3. For an exact list of prerequisites for this CPU patch, refer to the patch readme.	Patch 18122013 Notes: If you have implemented "Landed Cost Management (INL)" and If you are at 12.1.2 level, apply Patch 16397046:R12.INL.B after applying the CPU patch. If you are at 12.1.3 level, apply Patch 14108961:R12.INL.B after applying the CPU patch. Run AutoConfig after applying the CPU patch.
Release 12.0	12.0.6 Release Update Patch.	Patch 18122011 Notes: If any security patch was applied in this CPU to 10.1.2.x or 10.1.3.x Oracle home of your Oracle E-Business Suite instance, run AD Admin task to regenerate product JAR files after applying the CPU patch. If changes to protocol.ora are overwritten when AutoConfig is run on a Release 12.0.6 system with the R12.TXK.A.delta.7 (9386653), apply Patch 18137820:R12.TXK.A after applying the CPU patch. Run AutoConfig after applying the CPU patch.
Release 11i	Minimum Baseline for Extended Support on Oracle E-Business Suite 11.5.10 with the Oracle Applications Technology patch 11i.ATG_PF.H.delta.7 (ATG RUP7), along with the latest ATG consolidated patches on top of Release 11i.	Patch 18122010 Notes: If you have implemented "E-Business Intelligence (BIS)" and if you are at 11i.BIS_PF.G (5404886) level, apply Patch 10107418. If you are at 11i TXK RUP U (9535311) level, apply Patch 16264433 after applying the CPU patch. If changes to protocol.ora are overwritten when AutoConfig is run on a Release 11iRUP7 with TXK RUP U, apply Patch 17028253 after applying the CPU patch. Run AutoConfig after applying the CPU patch.
Release 11i	Minimum Baseline for Extended Support on Oracle E-Business Suite 11.5.10 with the Oracle Applications Technology patch 11i.ATG_PF.H.delta.6 (ATG RUP6), along with the latest ATG consolidated patches on top of Release 11i.	Patch 18122009 Notes: If you have implemented "Lease Management (OKL)" and If you are at 11i.OKL.H level, apply Patch 6672497 after applying the CPU patch. If you have implemented "E-Business Intelligence (BIS)" and if you are at 11i.BIS_PF.G (5404886) level, apply Patch 10107418. If you are at 11i TXK RUP S (6372396) level, apply Patch 16322742 after applying the CPU patch. If changes to protocol.ora are overwritten when AutoConfig is run on a Release 11iRUP6 with TXK RUP S, apply Patch 18115895 after applying the CPU patch. Run AutoConfig after applying the CPU patch.

 

Note: If you are running Oracle E-Business Suite Release 12.2, you should apply all Oracle Fusion Middleware patches to the Oracle homes of the patch edition file system during the apply phase of an online patching cycle, then use fs_clone to propagate the changes to the other file system after cutover.
 
For more information about online patching, refer to Oracle E-Business Suite Maintenance Guide or My Oracle Support Knowledge Document 1583902.1, Oracle E-Business Suite Release 12.2: Online Patching FAQ.

Table 2: Current CPU Technology Patches used with Oracle E-Business Suite

Oracle Product	Latest Security Patch (see Footnote 1)	Notes (see Footnote 2)
Oracle Database 12.1.0.1	PSU 12.1.0.1.4 (Patch 18522516)	Knowledge Document 1666884.1, Patch Set Update and Critical Patch Update July 2014 Availability Document.
Oracle Database 11.2.0.4	Jul 2014 CPU (Patch 18681862) PSU 11.2.0.4.3 (Patch 18522509)	Knowledge Document 1666884.1, Patch Set Update and Critical Patch Update July 2014 Availability Document.
Oracle Database 11.2.0.3	Jul 2014 CPU (Patch 18681866) PSU 11.2.0.3.11 (Patch 18522512)	Knowledge Document 1666884.1, Patch Set Update and Critical Patch Update July 2014 Availability Document. If you encounter the following conflict when applying the CPU patch, apply the specified merge patch and then apply the CPU patch again. 18173593 with 13259364, 13036331, 12849688, 12764337, 11071989 - apply merge Patch 19060544. 18740215 with 16040940 - apply merge Patch 19060727.
Oracle Database 11.1.0.7	Jul 2014 CPU (Patch 18681875)	Knowledge Document 1666884.1, Patch Set Update and Critical Patch Update July 2014 Availability Document. If you encounter the following conflicts when applying the CPU patch, apply the specified merge patch and then apply the CPU patch again. 8855577 with 8940108 - Apply Merge Patch 9304416 16610144 with 9554727 or 18242495 with both 7111245 and 9554727 - Apply Merge Patch 18107392 18242495 with 7111245 - Apply Merge Patch 18381445 18242495 with 18107392 - Apply Merge Patch 18455614
Oracle Fusion Middleware 1.0.2.2	Jul 2014 CPU (Patch 18973432)	This patch is only supplied for use with Oracle E-Business Suite.
Oracle Java	Java SE JDK and JRE 7 Update 65 Java SE JDK and JRE 6 Update 81	Knowledge Document 1900468.1, Critical Patch Update July 2014 Patch Availability Document for Oracle Java SE. Note: JRE update 7u51 was the first version that required signing of Oracle E-Business Suite JAR files. If you skipped that version and are applying this latest version for the first time, you will be required to sign the Oracle E-Business Suite JAR files. Refer to My Oracle Support Knowledge Document 1591073.1, Enhanced Signing of Oracle E-Business Suite JAR Files. You should also review the following documents for information about Java versions to use and the appropriate procedures to follow. JDK for Oracle E-Business Suite Servers My Oracle Support Knowledge Document 1530033.1 - Using The Latest JDK 7.0 Update with Oracle E-Business Suite Release 12.2. My Oracle Support Knowledge Document 418664.1 - Overview of Using Java with Oracle E-Business Suite Release 12. My Oracle Support Knowledge Document 1467892.1, Using JDK 7.0 Latest Update with Oracle E-Business Suite Release 12.0 and 12.1. My Oracle Support Knowledge Document 455492.1, Using Latest Java 6.0 Update With Oracle E-Business Suite Release 12. My Oracle Support Knowledge Document 401561.1, Using J2SE Version 6 with Oracle E-Business Suite 11i. JRE for Oracle E-Business Suite Clients My Oracle Support Knowledge Document 393931.1, Deploying JRE (Native Plug-in) for Windows Clients in Oracle E-Business Suite Release 12. My Oracle Support Knowledge Document 290807.1, Deploying JRE (Native Plug-in) for Windows Clients in Oracle E-Business Suite 11i.
Oracle E-Business Suite AccessGate	Jul 2014 CPU (Patch 18131618)	The mentioned CPU patch supersedes all previous Oracle E-Business Suite AccessGate releases (1.0.0 through to 1.2.2).

Footnote 1: For some patches, the patch number is different on Windows. Refer to the relevant Patch Set Update and Critical Patch Update document for the Windows patch numbers.
Footnote 2: We aim to document all known information till the time of current CPU release in the Notes column. Note that latest Oracle Database PSU patches have not yet been fully tested with Oracle E-Business Suite. You may want to take a backup of your environment before applying them, or apply them first in a test environment. If you encounter patch conflicts or other issues with a latest Oracle Database PSU, open a service request with Oracle Support.
Table 3: Technology Security Patches of earlier CPUs

Oracle Product	Latest Security Patch (see Footnote 1)	Notes
Oracle Database 11.2.0.2	Oct 2013 CPU (Patch 17082375)	Knowledge Document 1571391.1, Patch Set Update and Critical Patch Update October 2013 Availability Document. If you encounter the following conflict when applying the CPU patch, apply the specified merge patch and then apply the CPU patch again. 17347260 with 17198178 or 17087391 - apply merge Patch 17529556.
Oracle Database 11.2.0.1	Jul 2011 CPU (Patch 12419278)	Knowledge Document 1315202.1, Oracle E-Business Suite Releases 11i and 12 Critical Patch Update Knowledge Document (July 2011).
Oracle Database 10.2.0.5	July 2013 CPU (Patch 16742123)	Knowledge Document 1548709.1, Patch Set Update and Critical Patch Update July 2013 Availability Document.
Oracle Database 10.2.0.4	Apr 2012 CPU (Patch 12879926)	Knowledge Document 1406263.1, Oracle E-Business Suite Releases 11i and 12 Critical Patch Update Knowledge Document (April 2012).
Oracle Database 10.2.0.3	Jan 2013 CPU (Patch 14841486)	All platforms other than IBM z/OS, HP Tru-64, and Windows 64-bit Itanium: Knowledge Document 738923.1, Oracle E-Business Suite Critical Patch Update Note January 2009. IBM z/OS: Knowledge Document 1499376.1, Oracle E-Business Suite Releases 11i and 12 Critical Patch Update Knowledge Document (January 2013). HP Tru-64 and Windows 64-bit Itanium: Knowledge Document 787703.1, Oracle E-Business Suite Critical Patch Update Knowledge Document April 2009.
Oracle Database 10.1.0.5	Apr 2014 CPU (Patch 18128233)	This is a patch designed specifically for use with Oracle E-Business Suite. Apply the patch to your Oracle Fusion Middleware 10.1.3 Home. If you are on the Linux x86-64 platform, download the 32-bit version of the patch. For any other UNIX platform, download the 64-bit version. Before applying the patch on any UNIX platform, run the command: $ export OPATCH_PLATFORM_ID=46
Oracle Database Lite 10g Release 3 (10.3.x) (for Oracle Mobile Field Service)	Jan 2013 CPU (Patch 15984417)	Knowledge Document 1499376.1, Oracle E-Business Suite Releases 11i and 12 Critical Patch Update Knowledge Document (January 2013).
Oracle WebLogic Server 10.3.6.0	PSU 10.3.6.0.7 (Patch 17572726)	Knowledge Document 1594621.1, Patch Set Update and Critical Patch Update January 2014 Availability Document. If you encounter conflicts with 13729611 (YIJF), 13583235 (WCD1), 14597598 (VFS8), 13572948 (LL4G), or 16083651 (D33T), uninstall the conflicting patch(es) and then install the current WLS PSU (which will include them). If you encounter a conflict with 14049348 (3ZY8), uninstall the conflicting patch, install the 10.3.6.0.7 version of overlay patch 13729611 (BLTG) on top of WLS 10.3.6.0.7. If you encounter conflicts with any other patches, refer to My Oracle Support Knowledge Document 1306505.1, Announcing Oracle WebLogic Server PSUs (Patch Set Updates).
Oracle Fusion Middleware 11.1.1.6 - Web Tier Home	Jan 2014 CPU (Merge Patch 18084864)	Merge patch includes the Jan 2014 CPU Patch 17664562, as listed in Knowledge Document 1594621.1, Patch Set Update and Critical Patch Update January 2014 Availability Document.
Oracle Fusion Middleware 11.1.1.6 - Oracle Common	Oct 2013 CPU (Patch 16920856)	Knowledge Document 1571391.1, Patch Set Update and Critical Patch Update October 2013 Availability Document. If you are using Oracle E-Business Suite Release 12.2 Integrated SOA Gateway (see Knowledge Document 1311068.1), you should also apply Patch 16920856 to the Oracle Fusion Middleware SOA tier.
Oracle Fusion Middleware 10.1.3.5	April 2014 CPU	Oracle E-Business Suite customers are not affected by the vulnerability fixed in April 2014 CPU. If you plan to apply April 2014 CPU, you must do so before you apply the 10.1.0.5 CPU patch. Oracle E-Business Suite customers are required to apply Oct 2013 Oracle Fusion Middleware 10.1.3.5 CPU (Patch 16802901), if not already applied.
Oracle Fusion Middleware 10.1.3.4	Jan 2010 CPU (Patch 9173038)	Knowledge Document 985520.1, Oracle E-Business Suite Releases 11i and 12 Critical Patch Update Knowledge Document (January 2010).
Oracle Fusion Middleware 10.1.3.3	Jul 2009 CPU (Patch 8537037)	Knowledge Document 836258.1, Oracle E-Business Suite Releases 11i and 12 Critical Patch Update Knowledge Document (July 2009).
Oracle Fusion Middleware 10.1.2.3	Oct 2011 CPU (Patch 12837860)	Knowledge Document 1354842.1, Oracle E-Business Suite Releases 11i and 12 Critical Patch Update Knowledge Document (October 2011).
Oracle Fusion Middleware 10.1.2.2	Jan 2009 CPU (Patch 7608318)	Knowledge Document 738923.1, Oracle E-Business Suite Critical Patch Update Note January 2009.
Oracle9i Application Server 1.0.2.2.2	Oct 2012 CPU (Patch 14510576)	This is a patch designed specifically for use with Oracle E-Business Suite.
Oracle Developer Suite 6i Patchset 19 (Release 6.0.8.28)	N/A	For the latest updates, refer to Knowledge Document 125767.1, Upgrading Developer 6i with Oracle Applications 11i. Also refer to Knowledge Document 1082747.1, Steps to fix the defective version of share.zip shipped in Developer 6i Patchset 19 in E-Business Suite 11i for any applicable actions.

Footnote 1: For some patches, the patch number is different on Windows. Refer to the relevant Patch Set Update and Critical Patch Update document for the Windows patch numbers.

Security Information On Using Oracle Access Manager With Oracle E-Business Suite

To configure a whitelist in Oracle Access Manager, follow the "Configure Oracle Access Manager Whitelist" section in whichever of the following documents are relevant to your environment:

Oracle Access Manager 11gR2 PS1 (11.1.2.x)

• My Oracle Support Knowledge Document 1484024.1, Integrating Oracle E-Business Suite Release 12 with Oracle Access Manager 11gR2 (11.1.2) using Oracle E-Business Suite AccessGate
• My Oracle Support Knowledge Document 1536941.1, Integrating Oracle E-Business Suite Release 11i with Oracle Access Manager 11gR2 (11.1.2) using Oracle E-Business Suite AccessGate
• My Oracle Support Knowledge Document 1485033.1, Migrating Oracle Single Sign-On 10gR3 (10.1.4.3) to Oracle Access Manager 11gR2 (11.1.2) with Oracle E-Business Suite
  

Oracle Access Manager 11gR1 PS2 (11.1.1.7.0)

• My Oracle Support Knowledge Document 1543803.1, Integrating Oracle E-Business Suite Release 12 with Oracle Access Manager 11gR1 PS2 (11.1.1.7.0) using Oracle E-Business Suite AccessGate
• My Oracle Support Knowledge Document 1304550.1, Migrating Oracle Single Sign-On 10gR3 (10.1.4.3) to Oracle Access Manager 11gR1 Patchset 2 (11.1.1.7.0) with Oracle E-Business Suite

Oracle Access Manager 11gR1 PS1 (11.1.1.5.0)

• My Oracle Support Knowledge Document 1309013.1, Integrating Oracle E-Business Suite Release 12 with Oracle Access Manager 11gR1 (11.1.1.5) using Oracle E-Business Suite AccessGate