Complete failure of Oracle security response (2005) (seclists.org)

And yet Oracle insists that users wanting to protect themselves against bugs in Oracle products are misguided because "well we wrote the software so it's our job to fix things".