Medium WID-SEC-2023-0141 8 CVEs

Oracle Database Server: Mehrere Schwachstellen

Published Jan 17, 2023 · Updated Jan 17, 2023 · de-DE

Vendor: Oracle Product: Database Server Product: Database Server 19c Product: Database Server 21c Platform: Linux Platform: Windows

Summary

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Oracle Database Server ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.

Product

Die Oracle Datenbank ist ein weit verbreitetes relationales Datenbanksystem.

Vulnerabilities 8

High 7.5

CVE-2018-25032 Public exploit EPSS 52%

Nokogiri affected by zlib's Out-of-bounds Write vulnerability

zlib before 1.2.12 allows memory corruption when deflating (i.e., when compressing) if the input has many distant matches.

mariadb-10.3 mariadb-10.6 mariadb openjpeg2 Debian Ubuntu Azure Linux Alpine Wolfi RubyGems

Mar 25, 2022
High 7.5

CVE-2021-3737 EPSS 13%

A flaw was found in python. An improperly handled HTTP response in the HTTP client code of python may allow a remote at…

python3.4 python3.5 python3.6 python3.8 Debian Ubuntu

Mar 4, 2022
High 7.5

CVE-2022-42003

Uncontrolled Resource Consumption in Jackson-databind

In FasterXML jackson-databind before versions 2.13.4.1 and 2.12.17.1, resource exhaustion can occur because of a lack of a check in primitive value deserializers to avoid deep wrapper array nesting, when the UNWRAP_SINGLE_VALUE_ARRAYS feature is enabled.

management-api-for-apache-cassandra-5.0 jackson-databind com.fasterxml.jackson.core:jackson-databind jackson-databind Debian Ubuntu Wolfi Maven

Oct 2, 2022
High 7.5

CVE-2023-21893

Component takeover in Oracle Data Provider for .NET

Vulnerability in the Oracle Data Provider for .NET component of Oracle Database Server. Supported versions that are affected are 19c and 21c. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TCPS to compromise Oracle …

Oracle Data Provider for .NET Oracle.ManagedDataAccess.Core Oracle.ManagedDataAccess NuGet

Jan 17, 2023
Medium 6.3

CVE-2023-21829

Vulnerability in the Oracle Database RDBMS Security component of Oracle Database Server. Supported versions that are af…

Oracle Database - Enterprise Edition

Jan 17, 2023
Medium 6.2

CVE-2020-10735

A flaw was found in python. In algorithms with quadratic time complexity using non-binary bases, when using int("text")…

python3.4 python3.5 python2.7 python3.6 Debian Ubuntu Wolfi

Sep 9, 2022
Medium 4.3

CVE-2022-39429

Vulnerability in the Java VM component of Oracle Database Server. Supported versions that are affected are 19c and 21c.…

Oracle Database - Enterprise Edition

Jan 17, 2023
Medium 4.3

CVE-2023-21827

Vulnerability in the Oracle Database Data Redaction component of Oracle Database Server. Supported versions that are af…

Oracle Database - Enterprise Edition

Jan 17, 2023

Revision history

2023-01-17 #1
Initiale Fassung

References

Oracle Critical Patch Update Advisory - January 2023 - Appendix Oracle Database Server vom 2023-01-17
https://www.oracle.com/security-alerts/cpujan2023.html#AppendixDB