Oracle PeopleSoft: Mehrere Schwachstellen

Summary

Product

Vulnerabilities 7

• High 8.8
  CVE-2024-9143 EPSS 12%

  Low-level invalid GF(2^m) parameters lead to OOB memory access

  Issue summary: Use of the low-level GF(2^m) elliptic curve APIs with untrusted explicit values for the field polynomial can lead to out-of-bounds memory reads or writes. Impact summary: Out of bound memory writes can lead to an application crash or even a pos…

  OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  Oct 16, 2024
• High 8.1
  CVE-2025-50062

  Vulnerability in the PeopleSoft Enterprise HCM Global Payroll Core product of Oracle PeopleSoft (component: Global Payr…

  Oracle PeopleSoft Enterprise HCM Global Payroll Core
  Jul 15, 2025
• High 7.5
  CVE-2025-24970

  SslHandler doesn't correctly validate packets which can lead to native crash when using native SSLEngine

  Netty, an asynchronous, event-driven network application framework, has a vulnerability starting in version 4.1.91.Final and prior to version 4.1.118.Final. When a special crafted packet is received via SslHandler it doesn't correctly handle validation of suc…

  netty netty druid thingsboard-tb-node Ubuntu Wolfi Maven
  Feb 10, 2025
• Medium 6.5
  CVE-2023-44483

  Apache Santuario: Private Key disclosure in debug-log output

  All versions of Apache Santuario - XML Security for Java prior to 2.2.6, 2.3.4, and 3.0.3, when using the JSR 105 API, are vulnerable to an issue where a private key may be disclosed in log files when generating an XML Signature and logging with debug level i…

  Apache Software Foundation Apache Santuario sonarqube-10 org.apache.santuario:xmlsec Debian Ubuntu Wolfi Maven
  Oct 20, 2023
• Medium 6.1
  CVE-2025-30748

  Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: PIA Core Technology). S…

  Oracle PeopleSoft Enterprise PeopleTools
  Jul 15, 2025
• Medium 5.6
  CVE-2025-23084

  A vulnerability has been identified in Node.js, specifically affecting the handling of drive names in the Windows envir…

  Node.js node nodejs nodejs-16 Alpine Wolfi
  Jan 28, 2025
• Medium 4.3
  CVE-2025-30747

  Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: PIA Core Technology). S…

  Oracle PeopleSoft Enterprise PeopleTools
  Jul 15, 2025

Revision history

1. 2025-07-15 #1

   Initiale Fassung

References

• Oracle Critical Patch Update Advisory - July 2025 - Appendix Oracle PeopleSoft vom 2025-07-15
  https://www.oracle.com/security-alerts/cpujul2025.html#AppendixPS