Oracle's emergency patch fixes flaws being used in active attacks, but opens the door to a previously undisclosed vulnerability.