It’s March, and I’ve already installed the January 2008 Critical Patch Update in all of my environments.  This gives me at least 6 weeks of contentment before the April CPU is released.  Normally, I would not have all of the environments patched before the next CPU was released, but timing is everything and an opportunity presented itself.  If you haven’t applied it yet, the January 2008 CPU requires you to install a new opatch version first.   In addition to the normal @catcpu after the binaries have been patched,  you also need to rebuild your views.  If you are running in RAC and looking forward to a rolling upgrade, you will be disappointed.  The catcpu doesn’t require a “startup upgrade”, but the view rebuild does.  Just keep telling the finance manager that RAC will pay for itself the day one of the servers fails

Do you patch your clients?  Whenever a new patch set is released, I apply it to the clients as well as the database servers.  The same is true of Critical Patch Updates. The last CPU to include client patches was the April 2007 CPU.  If you have already applied it, your clients are fully patched.  If not, you should plan to patch the clients while the database is down for the January 2008 CPU.

Clients can be particularly vulnerable because they are often installed by system administrators, developers or end users who probably don’t know that they need to apply patches.