High WID-SEC-2023-2680 6 CVEs

Oracle Communications Applications: Mehrere Schwachstellen

Published Oct 17, 2023 · Updated Oct 17, 2023 · de-DE

Vendor: Oracle Product: Communications Applications Product: Communications Applications <= 12.0.0.8 Product: Communications Applications <= 5.5.17 Product: Communications Applications <= 6.0.2 Product: Communications Applications <= 6.0.3 Product: Communications Applications 12.0.6.0 Product: Communications Applications 6.3.1.0.0 Product: Communications Applications 7.4.0 Product: Communications Applications 7.4.1 Product: Communications Applications 7.5.0 Platform: Linux Platform: Windows

Summary

Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Oracle Communications Applications ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.

Product

Communications Applications umfasst eine Sammlung von Werkzeugen zur Verwaltung von Messaging-, Kommunikationsdiensten und -ressourcen.

Vulnerabilities 6

Critical 9.8

CVE-2022-42920

Apache Commons BCEL prior to 6.6.0 allows producing arbitrary bytecode via out-of-bounds writing

Apache Commons BCEL has a number of APIs that would normally only allow changing specific class characteristics. However, due to an out-of-bounds writing issue, these APIs can be used to produce arbitrary bytecode. This could be abused in applications that pa…

Apache Software Foundation Apache Commons BCEL bcel bcel Debian Ubuntu Azure Linux Maven

Nov 7, 2022
High 7.5

CVE-2023-34981

Apache Tomcat: AJP response header mix-up

A regression in the fix for bug 66512 in Apache Tomcat 11.0.0-M5, 10.1.8, 9.0.74 and 8.5.88 meant that, if a response did not include any HTTP headers no AJP SEND_HEADERS messare woudl be sent for the response which in turn meant that at least one AJP proxy (…

Apache Software Foundation Apache Tomcat tomcat10 org.apache.tomcat.embed:tomcat-embed-core Debian Maven

Jun 21, 2023
Medium 6.5

CVE-2021-37533

Apache Commons Net's FTP client trusts the host from PASV response by default

Prior to Apache Commons Net 3.9.0, Net's FTP client trusts the host from PASV response by default. A malicious server can redirect the Commons Net code to use a different host, but the user has to connect to the malicious server in the first place. This may l…

Apache Software Foundation Apache Commons Net druid libcommons-net-java Debian Ubuntu Wolfi Maven

Dec 3, 2022
Medium 6.5

CVE-2023-34462

netty-handler SniHandler 16MB allocation

Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. The `SniHandler` can allocate up to 16MB of heap for each channel during the TLS handshake. When the handler…

netty netty netty netty Debian Ubuntu Wolfi Maven

Jun 22, 2023
Medium 4.3

CVE-2023-22088

Vulnerability in the Oracle Communications Order and Service Management product of Oracle Communications Applications (…

Oracle Communications Order and Service Management

Oct 17, 2023
Low 2.6

CVE-2023-3247

Missing error check and insufficient random bytes in HTTP Digest authentication for SOAP

In PHP versions 8.0.* before 8.0.29, 8.1.* before 8.1.20, 8.2.* before 8.2.7 when using SOAP HTTP Digest Authentication, random value generator was not checked for failure, and was using narrower range of values than it should have. In case of random generato…

PHP Group PHP php5 php7.0 Debian Ubuntu Azure Linux Alpine

Jul 22, 2023

Revision history

2023-10-17 #1
Initiale Fassung

References

Oracle Critical Patch Update Advisory - October 2023 - Appendix Oracle Communications Applications vom 2023-10-17
https://www.oracle.com/security-alerts/cpuoct2023.html#AppendixCAGBU