Oracle Supply Chain: Mehrere Schwachstellen

Summary

Product

Vulnerabilities 3

• Critical 9.8
  CVE-2024-56337

  Apache Tomcat: RCE due to TOCTOU issue in JSP compilation - CVE-2024-50379 mitigation was incomplete

  Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.1, from 10.1.0-M1 through 10.1.33, from 9.0.0.M1 through 9.0.97. The following versions were EOL at the time the CV…

  Apache Software Foundation Apache Tomcat thingsboard-tb-node thingsboard-tb-mqtt-transport Debian Ubuntu Wolfi Maven
  Dec 20, 2024
• High 8.2
  CVE-2023-37536

  HCL BigFix Platform is vulnerable to an integer overflow in xerces-c++ 3.2.3

  An integer overflow in xerces-c++ 3.2.3 in BigFix Platform allows remote attackers to cause out-of-bound access via HTTP request.

  HCL Software BigFix Platform xerces-c xerces-c Debian Ubuntu
  Oct 11, 2023
• Medium 4.3
  CVE-2024-47554

  Apache Commons IO: Possible denial of service attack on untrusted input to XmlStreamReader

  Uncontrolled Resource Consumption vulnerability in Apache Commons IO. The org.apache.commons.io.input.XmlStreamReader class may excessively consume CPU resources when processing maliciously crafted input. This issue affects Apache Commons IO: from 2.0 before …

  Apache Software Foundation Apache Commons IO druid kserve-storage-controller Debian Ubuntu Azure Linux Wolfi Maven
  Oct 3, 2024

Revision history

1. 2025-04-15 #1

   Initiale Fassung

References

• Oracle Critical Patch Update Advisory - April 2025 - Appendix Oracle Supply Chain vom 2025-04-15
  https://www.oracle.com/security-alerts/cpuapr2025.html#AppendixSCP