There's an interesting discussion on Bugrtaq about the time it takes Oracle to fix bugs. One of security researchers has list of bugs not fixed for more than 700 days...
It's not a new problem, there were articles about the same subject in July and September. The time they release security fixes is comming, it'll be interesting to see what they decide to release.