Oracle Supply Chain: Mehrere Schwachstellen

Summary

Product

Vulnerabilities 8

• High 7.5
  CVE-2022-24839

  Uncontrolled Resource Consumption in org.cyberneko.html (nokogiri fork)

  org.cyberneko.html is an html parser written in Java. The fork of `org.cyberneko.html` used by Nokogiri (Rubygem) raises a `java.lang.OutOfMemoryError` exception when parsing ill-formed HTML markup. Users are advised to upgrade to `>= 1.9.22.noko2`. Note: The…

  sparklemotion nekohtml org.nokogiri:nekohtml nekohtml Debian Ubuntu Maven
  Apr 11, 2022
• High 7.5
  CVE-2022-34169 Public exploit EPSS 82%

  Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets

  The Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets. This can be used to corrupt Java class files generated by the internal XSLTC compiler and execute arbitrary Java bytecode. Users are re…

  Apache Software Foundation Apache Xalan-J openjdk-8 openjdk-lts Debian Ubuntu Alpine Maven
  Jul 19, 2022
• High 7.5
  CVE-2022-42252

  Apache Tomcat request smuggling via malformed content-length

  If Apache Tomcat 8.5.0 to 8.5.82, 9.0.0-M1 to 9.0.67, 10.0.0-M1 to 10.0.26 or 10.1.0-M1 to 10.1.0 was configured to ignore invalid HTTP headers via setting rejectIllegalHeader to false (the default for 8.5.x only), Tomcat did not reject a request containing a…

  Apache Software Foundation Apache Tomcat tomcat8 tomcat9 Debian Ubuntu Maven
  Nov 1, 2022
• High 7.5
  CVE-2023-21850

  Vulnerability in the Oracle Demantra Demand Management product of Oracle Supply Chain (component: E-Business Collection…

  Oracle Demantra Demand Management
  Jan 17, 2023
• Medium 6.6
  CVE-2021-44832 Public exploit EPSS 98%

  Apache Log4j2 vulnerable to RCE via JDBC Appender when attacker controls configuration

  Apache Log4j2 versions 2.0-beta7 through 2.17.0 (excluding security fix releases 2.3.2 and 2.12.4) are vulnerable to a remote code execution (RCE) attack when a configuration uses a JDBC Appender with a JNDI LDAP data source URI when an attacker has control o…

  Apache Software Foundation Apache Log4j2 apache-log4j2 org.apache.logging.log4j:log4j-core Debian Ubuntu Maven
  Dec 28, 2021
• Medium 5.5
  CVE-2019-12415

  Improper Restriction of XML External Entity Reference in Apache POI

  In Apache POI up to 4.1.0, when using the tool XSSFExportToXml to convert user-provided Microsoft Excel documents, a specially crafted document can allow an attacker to read files from the local filesystem or from internal network resources via XML External E…

  libapache-poi-java org.apache.poi:poi libapache-poi-java Debian Ubuntu Maven
  Oct 23, 2019
• Medium 5.3
  CVE-2019-7317

  png_image_free in png.c in libpng 1.6.x before 1.6.37 has a use-after-free because png_image_free_function is called un…

  thunderbird firefox thunderbird firefox-esr Debian Ubuntu Azure Linux Alpine Wolfi
  Feb 4, 2019
• Unscored —
  CVE-2020-27844

  A flaw was found in openjpeg's src/lib/openjp2/t2.c in versions prior to 2.4.0. This flaw allows an attacker to provide…

  qt5-qtwebengine chromium insighttoolkit4 openjpeg2 Ubuntu Azure Linux Alpine
  Jan 5, 2021

Revision history

1. 2023-01-17 #1

   Initiale Fassung

References

• Oracle Critical Patch Update Advisory - January 2023 - Appendix Oracle Supply Chain vom 2023-01-17
  https://www.oracle.com/security-alerts/cpujan2023.html#AppendixSCP