Summary
Oracle heeft kwetsbaarheden verholpen in diverse producten, waaronder Oracle MySQL Server, MySQL Cluster, MySQL Enterprise Backup, MySQL Connectors (waaronder Connector/ODBC) en MySQL Router.
Details
Interpretaties
De kwetsbaarheden in Oracle MySQL betreffen diverse componenten, waaronder MySQL Server, MySQL Cluster, MySQL Enterprise Backup, MySQL Connectors en MySQL Router. De potentiële impact omvat ongeautoriseerde toegang tot of wijziging van gegevens en verstoring van de beschikbaarheid van systemen (denial-of-service). De Oracle Critical Patch Update van oktober 2026 bevat 98 nieuwe beveiligingspatches, waarvan 29 kwetsbaarheden op afstand kunnen worden misbruikt zonder authenticatie. De hoogste CVSS-score bedraagt 9,8. De ernst en impact verschillen per kwetsbaarheid en zijn afhankelijk van de getroffen component en configuratie.
Oplossingen
OpenSSL, curl en Oracle hebben updates uitgebracht om de kwetsbaarheden in hun respectievelijke producten te verhelpen. Zie bijgevoegde referenties voor meer informatie.
Vulnerabilities 18
-
High 8.8
Stack buffer overflow in CMS (Auth)EnvelopedData parsing
Issue summary: Parsing CMS AuthEnvelopedData or EnvelopedData message with maliciously crafted AEAD parameters can trigger a stack buffer overflow. Impact summary: A stack buffer overflow may lead to a crash, causing Denial of Service, or potentially remote c…
-
High 8.8
Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Group Replication GCS). Su…
-
High 8.3
Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: JSON). Supported versions …
-
High 8.1
Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J). The supported version that is a…
-
High 8.1
Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Client programs). Supported versio…
-
High 8.1
Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Client programs). Supported versio…
-
High 8.1
Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Client programs). Supported versio…
-
High 7.5
Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Client programs). Supported versio…
-
High 7.5
Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication). Supported ve…
-
High 7.5
Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Client: mysqldump). Supported vers…
-
High 7.5
Vulnerability in the MySQL Router product of Oracle MySQL (component: Router: General). The supported version that is a…
-
High 7.5
Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/Python). The supported version that…
-
High 7.4
Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication). Supported ve…
-
High 7.4
Vulnerability in the MySQL Router product of Oracle MySQL (component: Router: General). The supported version that is a…
-
High 7.4
SSH improper host validation
When a libcurl-based application performs transfers via `SCP://` or `SFTP://` and utilizes the `CURLOPT_SSH_KEYFUNCTION` callback, it may silently accept an untrusted server. This vulnerability occurs when a server presents a host key type that does not match…
-
High 7.2
Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer). Supported vers…
-
High 7.1
Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Group Replication Plugin).…
-
High 7.0
Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are a…
Revision history
-
#1.0.0
Initiele versie
References
-
Reference
https://www.oracle.com/security-alerts/cpuoct2026.html