Useful Oracle Sun patch download options, including metadata & READMEs

(Updated May 14, 2013)

Here are some Oracle Sun patch download options which my colleague Don O'Malley and I believe you may find useful:

You can download an Oracle Sun patch README simply by using an URI of the following form:

Just replace the PatchID in the URI above with the PatchID you are interested in.

If you are logged on to MOS, and have a valid support contract associated with your account, you can download patches using an URI of the following form for an individual patch:

XML metadata for a patch is available using a URI of the form:

This XML metadata contains useful information like:

  • The MD5 and SHA-1 checksums, see <digest type=...>.  Getting MD5 and SHA-1 checksums directly from MOS or this XML metadata file is the most accurate way to get checksum information. 
  • The latest PatchID in this lineage which obsoletes (supersedes) this patch revision , see <patch_replacements> - in this example 127127-11
  • What bug fixes (CRs) are delivered in the Patch - note if <fixes_bugs truncated="yes">, then the list of CRs fixed in truncated, so see the patch README for the full list of CRs
  • What access entitlement is needed to download this patch - in this example "OS" (Operating System) which means you need a support contract which covers Solaris in order to download it.  Other common access entitlements are "FMW" (Firmware) and "SW" ([other] Software), which means you need a support contract which covers Hardware or other Software respectively.  If multiple access entitlements are shown, then a support contract which covers any of them is sufficient to download the patch.
  • The Oracle BugDB Bug number reference to this patch which can be used as an alternative way to access it (see example below) - in this example 9615556
  • The Oracle BugDB Bug number reference to the README of this patch which can be used as an alternative way to access it (see example below) - in this example 12450076

Note, there are two nearly identical <patch> entries in the XML Metadata file in this example, one for 32-bit and one for 64-bit.  This is common and occurs for the vast majority of Oracle Sun patches.  Java patches are the main exception to this multiple <patch> entries rule for Oracle Sun patches, as they produce a separate 64-bit patch which will have a separate metadata file.  Where multiple <patch> entries exist in a metadata file, they always refer to one and the same patch, so either metadata entry can be parsed.  So while the "aru" <request id> references in the URIs differ for each in addition to <platform>, it's the identical patch which is downloaded in each case.

It's also possible to access a nice landing page using the Oracle BugDB Bug number reference to a patch (taken from the XML Metadata file above) to construct a URI of the form:

The "View Digest" button on the landing page shows the MD4 and SHA-1 Checksums for the patch.  The landing page also facilitates viewing of the README and download of the patch.

The "HTML version" of the patch README can be accessed two ways: (using the PatchID) or (using the Oracle BugDB Bug number reference to the README taken from the XML Metadata file above)

Both of the above URIs resolve to the same patch README.  The "HTML version" of the README contains a download link for the patch at the top of the page.  It also provides links to two key resources for Oracle Sun patching information:

It's also possible to directly access the MOS Flash-based download page using a URI of the form:,(page=PatchDetailPage&id=gnrgyece(patchId=120068-02&patchType=Patch&patchName=120068-02))

Since patchsets are named a little differently, here's a table showing the relevant URIs for key patchsets:
Patchset Name
Landing Page
XML Metadata
Checksums (subset of XML Metadata)
Recommended OS Patchset for Solaris 10 SPARC
Landing Page README Download XML Metadata

Click "View Digest" on Landing Page or extract from XML Metadata

Recommended OS Patchset for Solaris 10 x86
Landing Page README Download XML Metadata

Click "View Digest" on Landing Page or extract from XML Metadata

Critical Patch Update (CPU) Patchset for Solaris 10 SPARC, Apr 2013
Landing Page README Download XML Metadata Checksums
Critical Patch Update (CPU) Patchset for Solaris 10 x86, Apr 2013
Landing Page README Download XML Metadata Checksums
Solaris 10 1/13 (Update 11) SPARC Patchset
Landing Page README

See Landing Page

XML Metadata Checksums
Solaris 10 1/13 (Update 10) x86 Patchset
Landing Page README See Landing Page XML Metadata Checksums
Here are some other useful links:
Sun Alerts - Knowledge article with summary of, and links to, all published Sun Alerts alerting customers to known Security (through the link to the "Critical Patch Update (CPU) and Security Alerts" page), Availability and Data Corruption issues
patchdiag.xref - metadata file listing latest available revision of all Oracle Sun 6-2 digit patches
withdrawn_patch_report - list of all Oracle Sun patches withdrawn from release in the last 12 months
weekly_patch_report - list of all Oracle Sun patches released in the last week

You can be proactively notified daily of Sun Alert issues (and other knowledge articles) by configuring the "Hot Topics" option in My Oracle Support:

   1. Go to url
   2. Sign in
   3. Select the tab "More..." --> Settings
   4. Select "Hot Topics E-Mail" on the left
   5. Update the Hot Topics Settings
         1. Toggle the E-Mail to 'On'
         2. Ensure set "Send Every 1 Days"
         3. Select desired format (text or HTML)
         4. Set the item limit to some number larger than 5 (suggest 25)
         5. Set Service Request to "None"
         6. leave "Product Bugs Marked as Favorites" deselected
   6. Add the needed Sun Alert Filter(s) ** Note: To receive all Sun Alerts, use the following filter **
   7. Select  "Add..." (new window will pop up)
         1. Add the Product "Solaris SPARC Operating System"
         2. Add the Platform "GENERIC (All Platforms)"
         3. Check the "Knowledge Articles" box
         4. Check the "Alerts" box
         5. Select "OK" (selection window closes)
   8. Select "Save"
         1. You should be able to see your Hot Topics filter you just set up.
   9. Log out of MOS

Finally, for details on how to script access to resources such as the URIs listed above, check out:

MOS - Using 'wget' to Automate Sun Patch Downloads

I'd like to thank my colleague, Don O'Malley, for researching much of the above. 

I hope you find this helpful.

Best Wishes,



Thanks for passing on this information - it's a great help in avoiding the heavy MyOracle Flash interface when you just want to lookup a few patch READMEs :-)

Posted by sean on September 14, 2011 at 02:50 PM IST #

This is all to the good, thank you Gerry and Don.

I used to get most of this information from one tool -- PatchFinder. Is there any chance that this great SunSolve app could be brought back to life?

-cheers, CSB

Posted by Craig S. Bell on September 15, 2011 at 02:06 AM IST #

Thanks Sean, Craig,

I'm glad you find this helpful.

Craig, regarding PatchFinder, I've been unable to persuade the ARU/MOS folks to host PatchFinder. It's too specific to Oracle Sun patches. They prefer more generic solutions which is understandable.

My team and I have filed a number of RFEs (Requests For Enhancement) with the ARU/MOS teams to provide some similar functionality to PatchFinder in future releases. The ARU/MOS teams have been open to such enhancements. Some of this was done in the MOS 5.2 and 5.3 releases. More will follow in future releases.

Best Wishes,


Posted by Gerry Haskins on September 15, 2011 at 04:45 AM IST #

Is there a API also to gather XML data about the bugs too ?

Posted by Thomas on September 16, 2011 at 10:53 AM IST #

Thanks Gerry Haskins and Don O'Malley...Great job! We see that come from the "old school" Sun ;-)...Thanks (Don) for posting the news here [1]


Best regards

Posted by Michele Vecchiato on September 17, 2011 at 10:02 AM IST #

Thanks Michele, Thomas,

Michele, I'm glad that you find it useful.

BTW: I've updated the link to the READMEs and Checksums for the Recommended Patchsets as the version I originally used wasn't persistent across updates to the Patchsets.

Thomas, good question! I don't know the answer but I'll check. But I do know that currently most Oracle Sun products are still utiliziing the old Sun Bugster defect tracking system which isn't integrated into MOS. So you won't be able to access them apart from what's in the READMEs.

Over the course of the next year, we'll be transitioning to using the Oracle BugDB defect tracking system. However, I don't know if that will provide any more visibility into bugs. Oracle is understandably very cautious indeed about sharing bug information, so as not to provide any opportunity for exploits.

Best Wishes,


Posted by Gerry Haskins on September 21, 2011 at 01:01 PM IST #

I am missing the access to the patch reports, e.g. 10_patch_report. Until June 2011, these were available under etc. but since then we get 404 errors. These reports appear still in CHECKSUMS and I wonder where they have been moved to.

Thanks for your help and best regards, Andreas.

Posted by guest on October 14, 2011 at 12:10 PM IST #

Hi Andreas,

The MOS 5.3 release in early July 2011 saw the completion of the transition of the back-end infrastructure for Oracle Sun patches from the old Sun infrastructure to the Oracle ARU/MOS infrastructure.

Therefore, some old Sun links disappeared. This was deliberate. Please use the MOS search features instead. Please see my previous blog postings for tips and details.

Best Wishes,


Posted by Gerry Haskins on October 18, 2011 at 02:28 PM IST #


Please also see the Patchdiag.xref file, whose URI I provide in the body of the above blog post - namely

This lists the latest revision of every single patch we produce. A quick grep will give you the S10 patches.

Best Wishes,


Posted by Gerry Haskins on October 20, 2011 at 02:08 PM IST #

I have a question regarding the patchset README’s. In previous blog posts, I’ve seen the URL’s have the format of:

or even:

However, with the latest Bundle/Patchset (Solaris 10 8/11 SPARC Patchset), the README location looks like:

It doesn’t seem to follow the same format as the “old” style. Is there a README location for this patchset that is similar to the old style? I’ve been trying different URLs for this Bundle README, without any luck.

I also noticed that patchsets that are even newer than the patchset in question, seem to still have README’s in the old style, i.e.

So it just seemed odd that the 8/11 Patchset is the only one without the old style URL.

The reason I ask is because we have scripts that automatically download README’s, and it would be very helpful if we could continue use the format from the past (or at least have a format that is similar throughout all the patchset README’s).

Any information you have on this, would be very helpful. Thanks so much!


Posted by Brennan on May 07, 2012 at 06:26 PM IST #

Is there a more efficient method to determine significant updates between patch revs. other than reviewing each bug id and change listed in the Readme?

Thank you,

Posted by Phil S. on June 19, 2012 at 04:45 PM IST #

Thanks for sharing this Gerry and Don, very handy and very good to know! I only recently found this site, I'll be sure to check it out MUCH more often. Great, great help!

Posted by guest on October 11, 2012 at 08:55 PM IST #

Please let me know from where I can see/download older cluster patch bundles.

Posted by guest on November 20, 2012 at 02:17 AM GMT #


The quarterly Critical Patch Updates for Solaris 10 are archived and available from MOS.

These are effectively archived copies of the Recommended Patchset.

For the Recommended Patchset itself, we only make the latest and greatest available as we do want customers to patch forward to get the latest critical fixes.

To get either the CPUs or latest Recommended Patchset, go to, click the "Patches & Updates" tab, select "Product or Family (Advanced)", for Product enter "Solaris Operating System", select the release(s) and platform(s) you are interested in - for example, Oracle Solaris on SPARC (64-bit) - and select Type = Patchset.

Best Wishes,


Posted by guest on April 15, 2013 at 11:28 AM IST #

Any where I can find the CVE ids for the patchIDs whose flag is security set to s in the
A xml or a file similar to patchdiag.xref would be great.

Posted by guest on November 19, 2014 at 08:41 AM GMT #


Apologies for my delay in responding.

Please see the CPU (Critical Patch Update) documentation on MOS, for example Doc 1935468.1. Drill down to the products you are interested in. For example Doc 1956176.1.

Also the CPU Risk Matrix, for example

Best Wishes,


Posted by Gerry on March 25, 2015 at 05:38 PM GMT #

Post a Comment:
  • HTML Syntax: NOT allowed

This blog is to inform customers about patching best practice, feature enhancements, and key issues. The views expressed on this blog are my own and do not necessarily reflect the views of Oracle. The Documents contained within this site may include statements about Oracle's product development plans. Many factors can materially affect these plans and the nature and timing of future product releases. Accordingly, this Information is provided to you solely for information only, is not a commitment to deliver any material code, or functionality, and SHOULD NOT BE RELIED UPON IN MAKING PURCHASING DECISIONS. The development, release, and timing of any features or functionality described remains at the sole discretion of Oracle. THIS INFORMATION MAY NOT BE INCORPORATED INTO ANY CONTRACTUAL AGREEMENT WITH ORACLE OR ITS SUBSIDIARIES OR AFFILIATES. ORACLE SPECIFICALLY DISCLAIMS ANY LIABILITY WITH RESPECT TO THIS INFORMATION. ~~~~~~~~~~~~ Gerry Haskins, Director, Software Lifecycle Engineer


« November 2015