I find the last bit of this article the most interesting. If Oracle finds this many flaws per quarter, & actually delays the releases so that they can get all of the updates out in four packages per year, is it really all that much to ask for customers to keep their systems updated? Downtime, sure, but think of the alternative...

"A survey of 305 DBAs, consultants and others by database security company Sentrigo found that just 31 people, or roughly 10 percent of those surveyed, had deployed the most recent set of CPUs (critical patch updates) from Oracle. About two-thirds said they had never applied a critical update from Oracle."