Oracle Critical Patch Updates Database Patchset Support
"As a general rule, Critical Patch Updates (CPUs) are created for the last two patch sets of Server Technologies releases during the period when a release is in Premier Support (under the Lifetime Support Policy) or Error Correction Support (ECS). However, in the case where the latest patch set of a release has been available for more than 1 year, CPUs will be provided only for the most recent patch set for that release. Once a release enters its Extended Support (under the Lifetime Support Policy) or Extended Maintenance Support (EMS) period, CPUs are created only for the last patch set of that release."
Based on Oracle's policy, all organizations as a matter of policy should apply a database patchset at least annually in order to apply CPU patches on a timely basis. Oracle maintains strict adherence to this policy with few exceptions. With the release of 10.2.0.4 in February/March 2008 for Linux and other platforms, CPU support for 10.2.0.3 should be ending March 2009 -- this means no April 2009 CPU for 10.2.0.3. This support timeline can be problematic for some databases as the application may not allow or certify the newest patchset for a number of months, thus cutting this year to a few months in some cases.
(This may be difficult for many organizations to fathom since many have not yet applied April 2007 nor upgraded from 10.2.0.2.)