Do I need to update Oracle Client?
It looks like the database server updates include client updates.

See this CPU:

http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html#AppendixDB

Includes a fix to SQL*Plus which is part of the client.

Bobby