diff --git a/django/db/backends/oracle/creation.py b/django/db/backends/oracle/creation.py
index 18653c39aa..aa5279fdce 100644
--- a/django/db/backends/oracle/creation.py
+++ b/django/db/backends/oracle/creation.py
@@ -209,7 +209,7 @@ class DatabaseCreation(BaseDatabaseCreation):
             print("_create_test_user(): username = %s" % parameters['user'])
         statements = [
             """CREATE USER %(user)s
-               IDENTIFIED BY %(password)s
+               IDENTIFIED BY "%(password)s"
                DEFAULT TABLESPACE %(tblspace)s
                TEMPORARY TABLESPACE %(tblspace_temp)s
                QUOTA UNLIMITED ON %(tblspace)s
@@ -226,7 +226,7 @@ class DatabaseCreation(BaseDatabaseCreation):
         success = self._execute_allow_fail_statements(cursor, statements, parameters, verbosity, acceptable_ora_err)
         # If the password was randomly generated, change the user accordingly.
         if not success and self._test_settings_get('PASSWORD') is None:
-            set_password = "ALTER USER %(user)s IDENTIFIED BY %(password)s"
+            set_password = 'ALTER USER %(user)s IDENTIFIED BY "%(password)s"'
             self._execute_statements(cursor, [set_password], parameters, verbosity)
         # Most test-suites can be run without the create-view privilege. But some need it.
         extra = "GRANT CREATE VIEW TO %(user)s"
diff --git a/docs/ref/databases.txt b/docs/ref/databases.txt
index e7dcff04b9..65368ee27e 100644
--- a/docs/ref/databases.txt
+++ b/docs/ref/databases.txt
@@ -758,6 +758,7 @@ To run a project's test suite, the user usually needs these *additional*
 privileges:
 
 * CREATE USER
+* ALTER USER
 * DROP USER
 * CREATE TABLESPACE
 * DROP TABLESPACE
diff --git a/docs/releases/1.10.4.txt b/docs/releases/1.10.4.txt
new file mode 100644
index 0000000000..c9c6181beb
--- /dev/null
+++ b/docs/releases/1.10.4.txt
@@ -0,0 +1,14 @@
+===========================
+Django 1.10.4 release notes
+===========================
+
+*Under development*
+
+Django 1.10.4 fixes several bugs in 1.10.3.
+
+Bugfixes
+========
+
+* Quoted the Oracle test user's password in queries to fix the "ORA-00922:
+  missing or invalid option" error when the password starts with a number or
+  special character (:ticket:`27420`).
diff --git a/docs/releases/1.8.17.txt b/docs/releases/1.8.17.txt
new file mode 100644
index 0000000000..2464d155da
--- /dev/null
+++ b/docs/releases/1.8.17.txt
@@ -0,0 +1,14 @@
+===========================
+Django 1.8.17 release notes
+===========================
+
+*Under development*
+
+Django 1.8.17 fixes a regression in 1.8.16.
+
+Bugfixes
+========
+
+* Quoted the Oracle test user's password in queries to fix the "ORA-00922:
+  missing or invalid option" error when the password starts with a number or
+  special character (:ticket:`27420`).
diff --git a/docs/releases/1.9.12.txt b/docs/releases/1.9.12.txt
new file mode 100644
index 0000000000..d8a8af8d9d
--- /dev/null
+++ b/docs/releases/1.9.12.txt
@@ -0,0 +1,14 @@
+===========================
+Django 1.9.12 release notes
+===========================
+
+*Under development*
+
+Django 1.9.12 fixes a regression in 1.9.11.
+
+Bugfixes
+========
+
+* Quoted the Oracle test user's password in queries to fix the "ORA-00922:
+  missing or invalid option" error when the password starts with a number or
+  special character (:ticket:`27420`).
diff --git a/docs/releases/index.txt b/docs/releases/index.txt
index 8c02aa39b2..a3ed4e6e3e 100644
--- a/docs/releases/index.txt
+++ b/docs/releases/index.txt
@@ -33,6 +33,7 @@ versions of the documentation contain the release notes for any later releases.
 .. toctree::
    :maxdepth: 1
 
+   1.10.4
    1.10.3
    1.10.2
    1.10.1
@@ -43,6 +44,7 @@ versions of the documentation contain the release notes for any later releases.
 .. toctree::
    :maxdepth: 1
 
+   1.9.12
    1.9.11
    1.9.10
    1.9.9
@@ -61,6 +63,7 @@ versions of the documentation contain the release notes for any later releases.
 .. toctree::
    :maxdepth: 1
 
+   1.8.17
    1.8.16
    1.8.15
    1.8.14