Skip to content
OpenAdvisories
High WID-SEC-2024-3219 3 CVEs

Oracle Supply Chain: Mehrere Schwachstellen

Published Oct 15, 2024 · Updated Oct 15, 2024 · de-DE

Vendor: Oracle Product: Supply Chain

Summary

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Oracle Supply Chain ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.

Product

Die Oracle Supply Chain ist eine Sammlung von Applikationen für verschiedene Zwecke.

Vulnerabilities 3

  • High 8.1
    CVE-2024-23807

    Apache Xerces C++: Use-after-free on external DTD scan

    The Apache Xerces C++ XML parser on versions 3.0.0 before 3.2.5 contains a use-after-free error triggered during the scanning of external DTDs. Users are recommended to upgrade to version 3.2.5 which fixes the issue, or mitigate the issue by disabling DTD pro…

    Apache Software Foundation Apache Xerces C++ xerces-c xerces-c Ubuntu Azure Linux
  • High 7.5
    CVE-2024-22201

    Jetty connection leaking on idle timeout when TCP congested

    Jetty is a Java based web server and servlet engine. An HTTP/2 SSL connection that is established and TCP congested will be leaked when it times out. An attacker can cause many connections to end up in this state, and the server may run out of file descriptor…

    jetty jetty.project jetty9 jetty Debian Ubuntu Maven
  • High 7.5
    CVE-2024-24549 Public exploit EPSS 23%

    Apache Tomcat: HTTP/2 header handling DoS

    Denial of Service due to improper input validation vulnerability for HTTP/2 requests in Apache Tomcat. When processing an HTTP/2 request, if the request exceeded any of the configured limits for headers, the associated HTTP/2 stream was not reset until after …

    Apache Software Foundation Apache Tomcat tomcat9 tomcat8 Debian Ubuntu Maven

Revision history

  1. #1

    Initiale Fassung

References