Skip to content
OpenAdvisories
Medium WID-SEC-2024-3201 6 CVEs

Oracle Database Server: Mehrere Schwachstellen

Published Oct 15, 2024 · Updated Nov 6, 2024 · Revision 2 · de-DE

Vendor: Oracle Product: Database Server Product: Linux Platform: Windows

Summary

Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Oracle Database Server ausnutzen, um die Integrität und Verfügbarkeit zu gefährden.

Product

Die Oracle Datenbank ist ein weit verbreitetes relationales Datenbanksystem.

Vulnerabilities 6

  • High 7.5
    CVE-2024-6119 EPSS 67%

    Possible denial of service in X.509 name checks

    Issue summary: Applications performing certificate name checks (e.g., TLS clients checking server certificates) may attempt to read an invalid memory address resulting in abnormal termination of the application process. Impact summary: Abnormal termination of…

    OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  • Medium 6.3
    CVE-2024-7264 EPSS 20%

    ASN.1 date parser overread

    libcurl's ASN1 parser code has the `GTime2str()` function, used for parsing an ASN.1 Generalized Time field. If given an syntactically incorrect field, the parser might end up using -1 for the length of the *time fraction*, leading to a `strlen()` getting per…

    curl curl curl curl Debian Ubuntu Azure Linux Alpine Wolfi
  • Medium 5.3
    CVE-2024-29025

    Netty HttpPostRequestDecoder can OOM

    Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. The `HttpPostRequestDecoder` can be tricked to accumulate data. While the decoder can store items on the dis…

    netty netty druid netty Debian Ubuntu Wolfi Maven
  • Medium 4.3
    CVE-2024-21233

    Vulnerability in the Oracle Database Core component of Oracle Database Server. Supported versions that are affected are…

    Oracle Oracle Database Server
  • Low 3.5
    CVE-2024-21242

    Vulnerability in the XML Database component of Oracle Database Server. Supported versions that are affected are 19.3-19…

    Oracle Oracle Database Server
  • Low 3.1
    CVE-2024-21251

    Vulnerability in the Java VM component of Oracle Database Server. Supported versions that are affected are 19.3-19.24, …

    Oracle Oracle Database Server

Revision history

  1. #2

    Neue Updates von Oracle Linux aufgenommen

  2. #1

    Initiale Fassung

References