We run McAfee Database Access manager and the product keeps complaining about patches not been applied, especially java.
We have grid infrastructure with July 2019 patch applied.
Below the reply from McAfee:
Based on available data then client is missing OJVM patch:
JavaVM is enable (based on dba_registry-view) Opatch lsinventory does not list OJVM patch.
OJVM patch is important, because CVE-2016-3609 is JavaVM vulnerability.
CVE-2016-3609 is addressed July 2016 release, but we would recommend the latest OJVM patch (2019 oct).