TXK patches in a CPU are cumulative

Yesterday, while discussing about a patch scoping analysis with Sandhya, I realized that the TXK patch provided in any given CPU is cumulative. For example, the TXK patch published in April 2008 CPU contains all TXK patches published in previous CPUs. If you go through the readme of ATG_PF.H RUP6 which is Metalink Note 444524.1. It says:

Oracle Applications Technology 11i.ATG_PF.H.delta.6 (RUP6) contains Oracle Applications Technology (ATG) security fixes for core ATG products from the January 2005 Critical Patch Update (CPUJan2005) through the July 2007 Critical Patch Update (CPUJul2007). The following core ATG products are included in 11i.ATG_PF.H.delta.6: FND, OAM, OWF, FWK, JTT, JTA, TXK, XDO, ECX, EC, AK, ALR, UMX, BNE, and FRM.

However, the following CPU patches for ATG core products are not included in 11i.ATG_PF.H.delta.6 and must be applied on top of 11i.ATG_PF.H.delta.6 in order to obtain the complete set of ATG security fixes, if you are applying 11i.ATG_PF.H.delta.6 as part of a CPU implementation. Additionally, you must apply the CPU patches for products other than the core ATG products, if you have not already done so. Please refer to the CPU documentation for information on CPU patches for products not listed above.

• Customers using AutoConfig must apply patch 5658489 (TXK).

• Customers who are not using AutoConfig must apply patch 5082356 (TXK) and refer to the readme file for patch 5658489 (TXK) for more details.

Note: Customers who apply the TXK patches 5658489 or 5082356 must have installed a minimum of Oracle Developer Suite 6i patchset 17 plus the CPU patches for Oracle Developer Suite 6i patchset 17

You can verify about the cumulative nature of the TXK patches by this process:

Download the TXK patch 6831988 (present in April 2008 CPU) and unzip it.
cd to the patch directory
vi u5648489.drv

Here's three of previous TXK patches released in older CPUs:

5046719 TXK patch present in April 2006 CPU
4759690 TXK patch present in Jan 2006 CPU
5658489 TXK patch present in Jan 2007 CPU

If you search for these patch numbers inside the driver, you'll find them present. There is no TXK patch in July 2008 CPU. However you can verify this in future CPUs easily by searching for older TXK patch numbers inside the TXK patch driver file.

What critical patch updates to apply after Apps upgrade ?

If you are planning to upgrade your E-Business Suite version to 11.5.10.2 or 12.0.2, it is a good idea to apply all quarterly security patches. 11.5.10.2 comes pre-loaded with April 2005 Critical Patch Update. Since on 11i, E-biz security patches are not cumulative, to be current you need to apply all E-Business security patches from July 2005 CPU to July 2007 CPU. A great gotcha here is that after upgrading your 11i E-Business Suite to 11.5.10, you have to reapply any security patches which you applied for previous versions. As per Integrigy, a lot of patches are release specific. It is very murky to determine exactly which CPU patches are required during a major upgrade. You should review all modules patches to determine if different patches were available for 11.5.9 and 11.5.10, if so these patches typically have to be reapplied if released prior to 11.5.10.2. What happens is that the CPU patch updates a file (say version 115.2) to something like for 11.5.9 = 115.3.115090.1 and for 11.5.10 = 115.4.115100.2. The 11.5.10.2 patch then will update to 115.4, but not 115.4.115100.2. So you applied the patch for 11.5.9, but 11.5.10 will replace the file with a vulnerable version. This only happens for a subset of files and not all files work this way. Where it is usually happens is in functional modules where there are dependencies. So to be on the safer side, it is best to reapply all quarterly CPUs starting from Jul 2005 - July 2007 for 11i.


Here's a ready reference of the metalink notes for these quarterly CPUs:

432882.1 July 2007 CPU for E-biz
311040.1 July 2005 CPU for E-biz
333963.1 Oct 2005 CPU for E-biz
343389.1 Jan 2006 CPU for E-biz
360468.1 April 2006 CPU for E-biz
372931.1 July 2006 CPU for E-biz
391564.1 Oct 2006 CPU for E-biz
402670.1 Jan 2007 CPU for E-biz
420072.1 Apr 2007 CPU for E-biz
432882.1 July 2007 CPU for E-biz
455294.1 October 2007 CPU for E-biz
467742.1 Jan 2008 CPU for E-biz
557157.1 Apr 2008 CPU for E-biz


Fortunately, in Release 12, the E-biz patches are cumulative. If you apply R12 RUP2, it includes all security patches including July 2007 CPU. The version becomes 12.0.2 after applying R12 RUP2.