Skip to content
OpenAdvisories
Medium WID-SEC-2024-0113 7 CVEs

Oracle Utilities Applications: Mehrere Schwachstellen

Published Jan 16, 2024 · Updated Mar 19, 2024 · Revision 2 · de-DE

Vendor: Fedora Vendor: Oracle Product: Linux Product: Utilities Applications Platform: Linux Platform: Windows

Summary

Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Oracle Utilities Applications ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.

Product

Oracle Utilities Applications ist eine Produktfamilie mit branchenspezifischen Lösungen für Ver- und Entsorger.

Vulnerabilities 7

  • Medium 6.5
    CVE-2021-29425 Public exploit EPSS 11%

    Possible limited path traversal vulnerabily in Apache Commons IO

    In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like "//../foo", or "\\..\foo", the result would be the same value, thus possibly providing access to files in the parent directory, but not furth…

    Apache Software Foundation Apache Commons IO druid commons-io Debian Ubuntu Wolfi Maven
  • Medium 6.5
    CVE-2023-34462

    netty-handler SniHandler 16MB allocation

    Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. The `SniHandler` can allocate up to 16MB of heap for each channel during the TLS handshake. When the handler…

    netty netty netty netty Debian Ubuntu Wolfi Maven
  • Medium 5.5
    CVE-2022-40896

    Pygments vulnerable to ReDoS

    A ReDoS issue was discovered in pygments/lexers/smithy.py in pygments through 2.15.0 via SmithyLexer.

    pygments pygments pygments python-pygments Debian Ubuntu Azure Linux PyPI
  • Medium 5.5
    CVE-2023-2976

    Use of temporary directory for file creation in `FileBackedOutputStream` in Guava

    Use of Java's default temporary directory for file creation in `FileBackedOutputStream` in Google Guava versions 1.0 to 31.1 on Unix systems and Android Ice Cream Sandwich allows other users and apps on the machine with access to the default Java temporary di…

    Google Guava celeborn-0.6 trino-plugin-clickhouse Debian Ubuntu Azure Linux Wolfi Maven
  • Medium 5.5
    CVE-2023-42503

    Apache Commons Compress: Denial of service via CPU consumption for malformed TAR file

    Improper Input Validation, Uncontrolled Resource Consumption vulnerability in Apache Commons Compress in TAR parsing.This issue affects Apache Commons Compress: from 1.22 before 1.24.0. Users are recommended to upgrade to version 1.24.0, which fixes the issue…

    Apache Software Foundation Apache Commons Compress trino trino-plugin-opensearch Debian Ubuntu Wolfi Maven
  • Medium 5.3
    CVE-2020-7760

    Regular Expression Denial of Service (ReDoS)

    This affects the package codemirror before 5.58.2; the package org.apache.marmotta.webjars:codemirror before 5.58.2. The vulnerable regular expression is located in https://github.com/codemirror/CodeMirror/blob/cdb228ac736369c685865b122b736cd0d397836c/mode/ja…

    codemirror-js codemirror-js codemirror Debian Ubuntu npm
  • Medium 5.3
    CVE-2023-33201

    Bouncy Castle For Java LDAP injection vulnerability

    Bouncy Castle For Java before 1.74 is affected by an LDAP injection vulnerability. The vulnerability only affects applications that use an LDAP CertStore from Bouncy Castle to validate X.509 certificates. During the certificate validation process, Bouncy Cast…

    druid tez bouncycastle bouncycastle Debian Ubuntu Wolfi Maven

Revision history

  1. #2

    Neue Updates von Fedora aufgenommen

  2. #1

    Initiale Fassung

References