Countries, and supranational governments like the EU, have jurisdiction over companies that do business in their jurisdictions.
Oracle is technically not a U.S. corporation; it's a closely related group of California and Delaware corporations. Very few companies incorporate under U.S. federal law (I believe some banking corporations are required to, but don't quote me on that). Almost all companies are incorporated under state law.
However, if Oracle does business in Texas, it still has to obey Texas law. And if it does business in the EU, it still has to obey EU law.
Some laws make distinctions in some corporate matters between domestic corporations (incorporated under that state's laws) and foreign corporations (incorporated under another state's laws). But if you do business in a state, including an EU member state, you still need to obey that state's general laws, including antitrust law.
Short version: if you visit another country, you can't go around shooting people, then say, "your laws don't apply to me, I'm an American." Neither can a company, no matter where it's incorporated.
As for stopping the merger...any country where the merging companies do business can stop the merged company from doing business there if the merger violates local law. If this is a major, commercially important region like the EU, then failure to get EU approval will stop the merger. If it's a minor territory, the company will sometimes enter into an agreement to divest itself of local assets or entities. For example, if merging Oracle and Sun would create an antitrust problem in the minicomputer repair market in Laos, the merged entities would sell off either Oracle's or Sun's Laotian minicomputer repair division.