Skip to content
OpenAdvisories
Medium WID-SEC-2026-0157 7 CVEs

Oracle Database Server: Mehrere Schwachstellen

Published Jan 20, 2026 · Updated Jan 20, 2026 · de-DE

Vendor: Oracle Product: Database Server Platform: Linux Platform: Windows

Summary

Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Oracle Database Server ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.

Product

Die Oracle Datenbank ist ein weit verbreitetes relationales Datenbanksystem.

Vulnerabilities 7

  • Critical 9.4
    CVE-2025-12383

    Race Condition allows Bypass of Trust Restrictions

    In Eclipse Jersey versions 2.45, 3.0.16, 3.1.9 a race condition can cause ignoring of critical SSL configurations - such as mutual authentication, custom key/trust stores, and other security settings. This issue may result in SSLHandshakeException under norma…

    Eclipse Foundation Jersey celeborn-0.6 neo4j-2025.10 Wolfi Maven
  • High 7.5
    CVE-2025-8194

    Tarfile infinite loop during parsing with negative member offset

    There is a defect in the CPython “tarfile” module affecting the “TarFile” extraction and entry enumeration APIs. The tar implementation would process tar archives with negative offsets without error, resulting in an infinite loop and deadlock during the parsi…

    Python Software Foundation CPython python3.4 python3.5 Debian Ubuntu Azure Linux Wolfi
  • High 7.0
    CVE-2026-21939

    Vulnerability in the SQLcl component of Oracle Database Server. Supported versions that are affected are 23.4.0-23.26.0…

    Oracle Oracle Database Server
  • Medium 6.6
    CVE-2025-54874 Public exploit

    OpenJPEG allows OOB heap memory write in opj_jp2_read_header

    OpenJPEG is an open-source JPEG 2000 codec. In OpenJPEG from 2.5.1 through 2.5.3, a call to opj_jp2_read_header may lead to OOB heap memory write when the data stream p_stream is too short and p_image is not initialized.

    uclouvain openjpeg qt6-qtwebengine insighttoolkit4 Debian Ubuntu Azure Linux Alpine Wolfi
  • Medium 6.5
    CVE-2025-67735

    Netty has a CRLF Injection vulnerability in io.netty.handler.codec.http.HttpRequestEncoder

    Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.129.Final and 4.2.8.Final, the `io.netty.handler.codec.http.HttpRequestEncoder` has a CRLF injection with the request URI when constructing a request. This leads to…

    netty netty druid thingsboard-tb-node Debian Ubuntu Wolfi Maven
  • Medium 4.5
    CVE-2026-21975

    Vulnerability in the Java VM component of Oracle Database Server. Supported versions that are affected are 19.3-19.29 a…

    Oracle Oracle Database Server
  • Low 3.7
    CVE-2025-61755

    Vulnerability in the Oracle GraalVM for JDK product of Oracle Java SE (component: Compiler). Supported versions that ar…

    Oracle Oracle GraalVM for JDK

Revision history

  1. #1

    Initiale Fassung

References