Medium WID-SEC-2023-2673 10 CVEs

Oracle Database Server: Mehrere Schwachstellen

Published Oct 17, 2023 · Updated Nov 12, 2023 · Revision 2 · de-DE

Vendor: IBM Vendor: Oracle Product: Database Server Product: Database Server <= 19.20 Product: Database Server <= 21.11 Product: QRadar SIEM < 7.5.0 UP7 IF02 Platform: Linux Platform: Windows

Summary

Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Oracle Database Server ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.

Product

Die Oracle Datenbank ist ein weit verbreitetes relationales Datenbanksystem.

Vulnerabilities 10

High 7.5

CVE-2023-38039 Public exploit EPSS 56%

When curl retrieves an HTTP response, it stores the incoming headers so that they can be accessed later via the libcurl…

curl curl mysql curl Debian Ubuntu Azure Linux Alpine

Sep 15, 2023
High 7.1

CVE-2022-44729

Apache XML Graphics Batik: Information disclosure vulnerability

Server-Side Request Forgery (SSRF) vulnerability in Apache Software Foundation Apache XML Graphics Batik.This issue affects Apache XML Graphics Batik: 1.16. On version 1.16, a malicious SVG could trigger loading external resources by default, causing resource…

Apache Software Foundation Apache XML Graphics Batik batik batik Debian Ubuntu Maven

Aug 22, 2023
Medium 6.8

CVE-2022-23491

Removal of TrustCor root certificate

Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Certifi 2022.12.07 removes root certificates from "TrustCor" from the root store. These are in the process o…

certifi python-certifi certifi python-certifi Debian Ubuntu PyPI

Dec 7, 2022
Medium 5.9

CVE-2023-22071

Vulnerability in the PL/SQL component of Oracle Database Server. Supported versions that are affected are 19.3-19.20 an…

Oracle PL/SQL

Oct 17, 2023
Medium 4.9

CVE-2023-22077 Public exploit

Vulnerability in the Oracle Database Recovery Manager component of Oracle Database Server. Supported versions that are …

Oracle Database - Enterprise Edition

Oct 17, 2023
Medium 4.3

CVE-2023-22073

Vulnerability in the Oracle Notification Server component of Oracle Database Server. Supported versions that are affect…

Oracle Database - Enterprise Edition

Oct 17, 2023
Medium 4.3

CVE-2023-22096

Vulnerability in the Java VM component of Oracle Database Server. Supported versions that are affected are 19.3-19.20 a…

Oracle Database - Enterprise Edition

Oct 17, 2023
Low 2.4

CVE-2023-22074 Public exploit

Vulnerability in the Oracle Database Sharding component of Oracle Database Server. Supported versions that are affected…

Oracle Database - Enterprise Edition

Oct 17, 2023
Low 2.4

CVE-2023-22075

Vulnerability in the Oracle Database Sharding component of Oracle Database Server. Supported versions that are affected…

Oracle Database - Enterprise Edition

Oct 17, 2023
Unscored —

CVE-2023-35116

jackson-databind through 2.15.2 allows attackers to cause a denial of service or other unspecified impact via a crafted…

Jun 14, 2023

Revision history

2023-11-12 #2
Neue Updates von IBM aufgenommen
2023-10-17 #1
Initiale Fassung

References

IBM Security Bulletin 7070736 vom 2023-11-10
https://www.ibm.com/support/pages/node/7070736
Oracle Critical Patch Update Advisory - October 2023 - Appendix Oracle Database Server vom 2023-10-17
https://www.oracle.com/security-alerts/cpuoct2023.html#AppendixDB