Oracle Utilities Applications: Mehrere Schwachstellen

Summary

Product

Vulnerabilities 6

• High 8.7
  CVE-2024-7254

  Stack overflow in Protocol Buffers Java Lite

  Any project that parses untrusted Protocol Buffers data containing an arbitrary number of nested groups / series of SGROUP tags can corrupted by exceeding the stack limit i.e. StackOverflow. Parsing nested groups as unknown fields with DiscardUnknownFieldsPar…

  Google protobuf-java google-protobuf [JRuby Gem] protobuf-kotlin Debian Ubuntu Wolfi Maven RubyGems
  Sep 19, 2024
• High 7.5
  CVE-2024-57699

  Netplex Json-smart Uncontrolled Recursion vulnerability

  A security issue was found in Netplex Json-smart 2.5.0 through 2.5.1. When loading a specially crafted JSON input, containing a large number of ’{’, a stack exhaustion can be trigger, which could allow an attacker to cause a Denial of Service (DoS). This issu…

  trino trino-plugin-opensearch trino-plugin-lakehouse trino-plugin-pinot Debian Ubuntu Wolfi Maven
  Feb 5, 2025
• High 7.5
  CVE-2025-24970

  SslHandler doesn't correctly validate packets which can lead to native crash when using native SSLEngine

  Netty, an asynchronous, event-driven network application framework, has a vulnerability starting in version 4.1.91.Final and prior to version 4.1.118.Final. When a special crafted packet is received via SslHandler it doesn't correctly handle validation of suc…

  netty netty druid thingsboard-tb-node Ubuntu Wolfi Maven
  Feb 10, 2025
• High 7.5
  CVE-2025-48988 Public exploit EPSS 31%

  Apache Tomcat: FileUpload large number of parts with headers DoS

  Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0-M1 through 10.1.41, from 9.0.0.M1 through 9.0.105. The following versions were EOL at the time th…

  Apache Software Foundation Apache Tomcat thingsboard-tb-node thingsboard-tb-mqtt-transport Debian Ubuntu Wolfi Maven
  Jun 16, 2025
• Medium 4.5
  CVE-2025-26791

  DOMPurify allows Cross-site Scripting (XSS)

  DOMPurify before 3.2.4 has an incorrect template literal regular expression, sometimes leading to mutation cross-site scripting (mXSS).

  cure53 DOMPurify grafana-image-renderer dompurify Debian Ubuntu Wolfi npm
  Feb 14, 2025
• Medium 4.3
  CVE-2024-47554

  Apache Commons IO: Possible denial of service attack on untrusted input to XmlStreamReader

  Uncontrolled Resource Consumption vulnerability in Apache Commons IO. The org.apache.commons.io.input.XmlStreamReader class may excessively consume CPU resources when processing maliciously crafted input. This issue affects Apache Commons IO: from 2.0 before …

  Apache Software Foundation Apache Commons IO druid kserve-storage-controller Debian Ubuntu Azure Linux Wolfi Maven
  Oct 3, 2024

Revision history

1. 2025-07-15 #1

   Initiale Fassung

References

• Oracle Critical Patch Update Advisory - July 2025 - Appendix Oracle Utilities Applications vom 2025-07-15
  https://www.oracle.com/security-alerts/cpujul2025.html#AppendixUTIL