Summary
Oracle heeft kwetsbaarheden verholpen in diverse Database producten als de Database Server, Essbase, Autonomous Health Framework en de Application Testing Suite
Details
Interpretaties
Oracle Database Server (versies 19.3 tot 23.26.3) bevat kritieke kwetsbaarheden in de RDBMS en Portable Clusterware componenten, waaronder mogelijkheden voor ongeauthenticeerde aanvallers met fysieke of netwerktoegang om controle te verkrijgen over clusterware, volledige controle over de RDBMS te verkrijgen, of ongeautoriseerde lees- en schrijfbewerkingen uit te voeren. Sommige kwetsbaarheden vereisen fysieke toegang tot communicatie segmenten, andere kunnen via netwerktoegang worden misbruikt.
Oracle Essbase kent kwetsbaarheden die een aanvaller met netwerktoegang via HTTP in staat stellen volledige systeemcompromittatie te bereiken.
Oracle Autonomous Health Framework bevat meerdere kwetsbaarheden in de Trace File Analyzer en Cluster Health Analyzer componenten, die ongeautoriseerde toegang, datamanipulatie en denial of service mogelijk maken, afhankelijk van privileges en netwerktoegang.
Oracle Application Testing Suite versie 13.3.0.1 bevat diverse kwetsbaarheden die ongeauthenticeerde of laaggeprivilegieerde aanvallers met netwerktoegang via HTTP(S) in staat stellen kritieke data te creëren, wijzigen of verwijderen, privileges te escaleren en volledige systeemcompromis te bereiken.
Deze kwetsbaarheden kunnen leiden tot datalekken, datamanipulatie, denial of service en volledige systeemcompromittatie.
Oplossingen
Oracle heeeft updates uitgebracht om de genoemde kwetsbaarheden te verhelpen. Zie bijgevoegde referenties voor meer informatie.
Vulnerabilities 24
-
Critical 9.8
Apache HTTP Server: mod_ldap per-dir use-after-free
Use After Free vulnerability in Apache HTTP Server with mod_ldap in per-directory configuration This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67. Users are recommended to upgrade to version 2.4.68, which fixes the issue.
-
Critical 9.8
Vulnerability in Oracle Essbase (component: Infrastructure). The supported version that is affected is 21.8.1.0.0. Easi…
-
Critical 9.6
Vulnerability in the Portable Clusterware component of Oracle Database Server. Supported versions that are affected are…
-
Critical 9.6
Vulnerability in the Portable Clusterware component of Oracle Database Server. Supported versions that are affected are…
-
Critical 9.1
Vulnerability in Oracle Application Testing Suite. The supported version that is affected is 13.3.0.1. Easily exploitab…
-
Critical 9.1
Vulnerability in the Portable Clusterware component of Oracle Database Server. Supported versions that are affected are…
-
High 8.8CVE-2026-45447 Public exploit
Heap Use-After-Free in the PKCS7_verify() Function
Issue summary: A specially crafted PKCS#7 or S/MIME signed message could trigger a use-after-free during PKCS#7 signature verification. Impact summary: A use-after-free may result in process crashes, heap corruption, or potentially remote code execution. When…
-
High 8.8
Vulnerability in Oracle Essbase (component: Calculator). The supported version that is affected is 21.8.1.0.0. Easily e…
-
High 8.8
Vulnerability in Oracle Autonomous Health Framework (component: Trace File Analyzer). Supported versions that are affec…
-
High 8.8
Vulnerability in Oracle Application Testing Suite. The supported version that is affected is 13.3.0.1. Easily exploitab…
-
High 8.5
Vulnerability in Oracle Autonomous Health Framework (component: Trace File Analyzer). Supported versions that are affec…
-
High 8.5
Vulnerability in the RDBMS component of Oracle Database Server. Supported versions that are affected are 23.4.0-23.26.3…
-
High 8.4
Vulnerability in Oracle Autonomous Health Framework (component: Trace File Analyzer). Supported versions that are affec…
-
High 8.1
Vulnerability in Oracle Application Testing Suite. The supported version that is affected is 13.3.0.1. Difficult to exp…
-
High 7.8
Vulnerability in Oracle Application Testing Suite. The supported version that is affected is 13.3.0.1. Easily exploitab…
-
High 7.7
Vulnerability in Oracle Autonomous Health Framework (component: Cluster Health Analyzer). Supported versions that are a…
-
High 7.6
Vulnerability in Oracle Application Testing Suite. The supported version that is affected is 13.3.0.1. Easily exploitab…
-
High 7.5
NULL Pointer Dereference in QUIC Server Initial Packet Handling
Issue summary: Receiving a QUIC initial packet with an invalid token may trigger a NULL pointer dereference in the OpenSSL QUIC server with address validation disabled. Impact summary: NULL pointer dereference typically causes abnormal termination of the affe…
-
High 7.5
Vulnerability in Oracle Application Testing Suite. The supported version that is affected is 13.3.0.1. Difficult to exp…
-
High 7.5
In Eclipse Parsson published Maven Central artifacts before version 1.1.8, the JSON parser did not enforce a default ma…
-
High 7.4
Vulnerability in Oracle Autonomous Health Framework (component: Trace File Analyzer). Supported versions that are affec…
-
High 7.1
Vulnerability in Oracle Application Testing Suite. The supported version that is affected is 13.3.0.1. Easily exploitab…
-
Medium 6.5
jackson-databind: @JsonView ypassed for @JsonUnwrapped container properties on deserialization
jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.18.0 until 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1, UnwrappedPropertyHandler.processUnwrapped() replays buffered JSON for a @JsonUnwrap…
-
Medium 5.3
Vulnerability in the RDBMS component of Oracle Database Server. Supported versions that are affected are 19.3-19.32, 21…
Revision history
-
#1.0.0
Initiele versie
References
-
Reference
https://www.oracle.com/security-alerts/cspuaug2026.html