I've applied the latest Oracle 12c Database Proactive Bundle Patch (DBBP).

My security team runs scans and April 2015 CPU (amongst other CPUs) continues to show up as vulnerabilities.

I need to prove that DBBP is a cumulative patch and all those old vulnerabilities are fixed.

sys.registry$history doesn't help

select ACTION,NAMESPACE,COMMENTS from registry$history;
------------------------- ------------ ------------------------
UPGRADE                   SERVER Upgraded from

opatch lsinventory -bugs_fixed or opatch lsinventory -details isn't giving me what I want.

How can I find out what vulnerabilities are in April 2015 CPU and prove that DBBP has mitigated them???

  • Actually there are times that you can not, I have applied latest patches available and have given them (security team) the logs that show that the patch was installed and was successful. Might be something with DPBP or the security suit being ran. BTW I am lucky enough to only deal with 1 oracle system now and that is the only one being flagged. If your software vendor is using Symantec for the patches, that can be an issue as well, but as it sounds, it is not.
    – jstexasdba
    Jul 25, 2017 at 23:42

1 Answer 1


The key word you're looking for is "cumulative".

Note 1962125.1 (Oracle Database - Overview of Database Patch Delivery Methods), includes this text about Bundle Patches:

Bundle Patch (BP)
- a cumulative collection of fixes to address bugs in a given feature, product, or configuration
     For example: Windows Database Bundle Patch, Database Patch for Exadata, Database Proactive Bundle Patch
- a superset of PSU

So that's all you should need to provide! BPs include all patches previously included in earlier BPs/PSUs.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.