Headline
CVE-2013-2378: Oracle Critical Patch Update - April 2013
Unspecified vulnerability in Oracle MySQL 5.1.67 and earlier, 5.5.29 and earlier, and 5.6.10 and earlier allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors related to Information Schema.
Click to view our Accessibility Policy
Skip to content
Security Alerts
Oracle Critical Patch Update Advisory - April 2013****Description
A Critical Patch Update (CPU) is a collection of patches for multiple security vulnerabilities. Critical Patch Update patches are usually cumulative, but each advisory describes only the security fixes added since the previous Critical Patch Update advisory. Thus, prior Critical Patch Update advisories should be reviewed for information regarding earlier published security fixes. Please refer to:
Critical Patch Updates and Security Alerts for information about Oracle Security Advisories.
Due to the threat posed by a successful attack, Oracle strongly recommends that customers apply CPU fixes as soon as possible. This Critical Patch Update contains 128 new security fixes across the product families listed below.
This Critical Patch Update advisory is also available in an XML format that conforms to the Common Vulnerability Reporting Format (CVRF) version 1.1. More information about Oracle’s use of CVRF is available at: http://www.oracle.com/security-alerts/cpufaq.html#CVRF.
Affected Products and Components
Security vulnerabilities addressed by this Critical Patch Update affect the products listed in the categories below. The product area of the patches for the listed versions is shown in the Patch Availability column corresponding to the specified Products and Versions column. Please click on the link in the Patch Availability column below or in the Patch Availability Table to access the documentation for those patches.
The list of affected product releases and versions that are in Premier Support or Extended Support, under the Oracle Lifetime Support Policy is as follows:
Affected Products and Versions
Patch Availability
Oracle Database 11_g_ Release 2, versions 11.2.0.2, 11.2.0.3
Database
Oracle Database 11_g_ Release 1, version 11.1.0.7
Database
Oracle Database 10_g_ Release 2, versions 10.2.0.4, 10.2.0.5
Database
Oracle Application Express, versions prior to 4.2.1
Database
Oracle Containers for J2EE, version 10.1.3.5
Fusion Middleware
Oracle COREid Access, version 10.1.4.3
Fusion Middleware
Oracle GoldenGate Veridata, version 3.0.0.11
Fusion Middleware
Oracle HTTP Server, versions 10.1.3.5.0, 11.1.1.5.0, 11.1.1.6.0
Fusion Middleware
Oracle JRockit, versions R27.7.4 and earlier, R28.2.6 and earlier
Fusion Middleware
Oracle Outside In Technology, versions 8.3.7, 8.4.0
Fusion Middleware
Oracle WebCenter Capture, version 10.1.3.5.1
Fusion Middleware
Oracle WebCenter Content, versions 10.1.3.5.1, 11.1.1.6.0
Fusion Middleware
Oracle WebCenter Interaction, versions 6.5.1, 10.3.3.0
Fusion Middleware
Oracle WebCenter Sites, versions 7.6.2, 11.1.1.6.0, 11.1.1.6.1
Fusion Middleware
Oracle WebLogic Server, versions 10.0.2, 10.3.5, 10.3.6, 12.1.1
Fusion Middleware
Oracle Web Services Manager, version 11.1.1.6
Fusion Middleware
Oracle E-Business Suite Release 12_i_, versions 12.0.6, 12.1.1, 12.1.2, 12.1.3
E-Business Suite
Oracle E-Business Suite Release 11_i_, version 11.5.10.2
E-Business Suite
Oracle Agile EDM, versions 6.1.1.0, 6.1.2.0, 6.1.2.2
Supply Chain
Oracle Transportation Management, versions 5.5.05, 6.2
Supply Chain
Oracle PeopleSoft HRMS, version 9.1
PeopleSoft
Oracle PeopleSoft PeopleTools, versions 8.51, 8.52, 8.53
PeopleSoft
Oracle Siebel CRM, versions 8.1.1, 8.2.2
Siebel
Oracle Clinical Remote Data Capture Option, versions 4.6.0, 4.6.6
Health Sciences
Oracle Retail Central Office, versions 13.1, 13.2, 13.3, 13.4
Retail
Oracle Retail Integration Bus, versions 13.0, 13.1, 13.2
Retail
Oracle FLEXCUBE Direct Banking, versions 2.8.0 - 12.0.1
Oracle FLEXCUBE
Primavera P6 Enterprise Project Portfolio Management, versions 7.0, 8.1, 8.2
Primavera
Oracle and Sun Systems Product Suite
Oracle and Sun Systems Product Suite
Oracle Sun Middleware Products
Fusion Middleware
Oracle MySQL Server, versions 5.1, 5.5, 5.6
Oracle MySQL Product Suite
Oracle Automatic Service Request, versions prior to 4.3.2
Oracle Support Tools
Patch Availability Table and Risk Matrices****Products with Cumulative Patches
The Oracle Database, Oracle Fusion Middleware, Oracle Enterprise Manager Grid Control, Oracle E-Business Suite Applications, JD Edwards EnterpriseOne, JD Edwards OneWorld Tools, PeopleSoft Enterprise Portal Applications, PeopleSoft Enterprise PeopleTools, Siebel Enterprise, Industry Applications, FLEXCUBE, Primavera and Oracle VM patches in the Critical Patch Updates are cumulative. In other words, patches for any of these products included in a Critical Patch Update will include all fixes for that product from the previous Critical Patch Updates. For more information about cumulative and non-cumulative patches, check the patch availability documents in the table below for the respective product groups.
Patch Availability Table
For each administered Oracle product, consult the documentation for patch availability information and installation instructions referenced from the following table. For an overview of the Oracle product documentation related to this Critical Patch Update, please refer to the Oracle Critical Patch Update April 2013 Documentation Map, My Oracle Support Note 1519884.1.
Product Group
Risk Matrix
Patch Availability and Installation Information
Oracle Database
Oracle Database Risk Matrix
Patch Set Update and Critical Patch Update April 2013 Availability Document, My Oracle Support Note 1525152.1
Oracle Fusion Middleware
Oracle Fusion Middleware Risk Matrix
Patch Set Update and Critical Patch Update April 2013 Availability Document, My Oracle Support Note 1525152.1
Oracle Applications - E-Business Suite
Oracle Applications, E-Business Suite Risk Matrix
Oracle E-Business Suite Releases 11_i_ and 12 Critical Patch Update Knowledge Document (April 2013), My Oracle Support Note 1530756.1
Oracle Applications - Oracle Supply Chain, PeopleSoft Enterprise, and Siebel Products Suite
Oracle Supply Chain Products Risk Matrix
Oracle PeopleSoft Enterprise Risk Matrix
Oracle Siebel Products Risk Matrix
Critical Patch Update Knowledge Document for Oracle Supply Chain, PeopleSoft Enterprise and Siebel Products suite, My Oracle Support Note 1543115.1
Oracle Health Sciences
Oracle Industry Applications Risk Matrix
Critical Patch Update April 2013 Patch Delivery Document for Oracle Health Sciences, My Oracle Support Note 1542717.1
Oracle Retail Industry Suite
Oracle Industry Applications Risk Matrix
Critical Patch Update April 2013 Patch Delivery Document for Oracle Retail Products, My Oracle Support Note 1542021.1
Oracle FLEXCUBE Products Suite
Oracle Financial Services Software Risk Matrix
Contact Oracle Customer Support for patches
Oracle Primavera Products Suite
Oracle Primavera Products Suite Risk Matrix
Critical Patch Update April 2013 Patch Delivery Document for Oracle Primavera Products Suite My Oracle Support Note 1539367.1
Oracle and Sun Systems Products Suite
Oracle and Sun Systems Products Suite Risk Matrix
Critical Patch Update April 2013 Patch Availability Document for Oracle and Sun Systems Products SuiteMy Oracle Support Note 1526078.1
Oracle Sun Middleware Products
Oracle Sun Middleware Products Risk Matrix
Patch Set Update and Critical Patch Update April 2013 Availability Document, My Oracle Support Note 1525152.1
Oracle MySQL Server
Oracle MySQL Risk Matrix
Critical Patch Update April 2013 Patch Availability Document for Oracle MySQL Products My Oracle Support Note 1536938.1
Oracle Support Tools
Oracle Support Tools Risk Matrix
Critical Patch Update April 2013 Patch Availability Document for Oracle Support Tools My Oracle Support Note 1541430.1
Risk Matrix Content
Risk matrices list only security vulnerabilities that are newly fixed by the patches associated with this advisory. Risk matrices for previous security fixes can be found in previous Critical Patch Update advisories.
Several vulnerabilities addressed in this Critical Patch Update affect multiple products. Each vulnerability is identified by a CVE# which is a unique identifier for a vulnerability. A vulnerability that affects multiple products will appear with the same CVE# in all risk matrices. Italics indicate vulnerabilities in code included from other product areas.
Security vulnerabilities are scored using CVSS version 2.0 (see Oracle CVSS Scoring for an explanation of how Oracle applies CVSS 2.0). Oracle conducts an analysis of each security vulnerability addressed by a Critical Patch Update (CPU). Oracle does not disclose information about the security analysis, but the resulting Risk Matrix and associated documentation provide information about the type of vulnerability, the conditions required to exploit it, and the potential impact of a successful exploit. Oracle provides this information, in part, so that customers may conduct their own risk analysis based on the particulars of their product usage. For more information, see Oracle vulnerability disclosure policies.
The protocol in the risk matrix implies that all of its secure variants (if applicable) are affected as well. For example, if HTTP is listed as an affected protocol, it implies that HTTPS (if applicable) is also affected.
Workarounds
Due to the threat posed by a successful attack, Oracle strongly recommends that customers apply CPU fixes as soon as possible. Until you apply the CPU fixes, it may be possible to reduce the risk of successful attack by blocking network protocols required by an attack. For attacks that require certain privileges or access to certain packages, removing the privileges or the ability to access the packages from users that do not need the privileges may help reduce the risk of successful attack. Both approaches may break application functionality, so Oracle strongly recommends that customers test changes on non-production systems. Neither approach should be considered a long-term solution as neither corrects the underlying problem.
Skipped Critical Patch Updates
Oracle strongly recommends that customers apply security fixes as soon as possible. For customers that have skipped one or more Critical Patch Updates and are concerned about products that do not have security fixes announced in this CPU, please review previous Critical Patch Update advisories to determine appropriate actions.
Product Dependencies
Oracle products may have dependencies on other Oracle products. Hence security vulnerability fixes announced in this Critical Patch Update may affect one or more dependent Oracle products. For details regarding these dependencies and to apply patches to dependent products, please refer to Patch Set Update and Critical Patch Update April 2013 Availability Document, My Oracle Support Note 1525152.1.
Critical Patch Update Supported Products and Versions
Critical Patch Update patches are provided only for product versions that are covered under the Premier Support or Extended Support phases of the Lifetime Support Policy. We recommend that customers plan product upgrades to ensure that Critical Patch Update patches are available for the versions they are currently running.
Product releases that are not under Premier Support or Extended Support are not tested for the presence of vulnerabilities addressed by this Critical Patch Update. However, it is likely that earlier versions of affected releases are also affected by these vulnerabilities. As a result, customers are recommended to upgrade to supported versions.
Supported Database, Fusion Middleware, Oracle Enterprise Manager Base Platform (formerly “Oracle Enterprise Manager Grid Control”) and Collaboration Suite products are patched in accordance with the Software Error Correction Support Policy explained in My Oracle Support Note 209768.1. Please review the Technical Support Policies for further guidelines regarding support policies and phases of support.
Products in Extended Support
Critical Patch Update patches are available to customers who have purchased Extended Support under the Lifetime Support Policy. Customers must have a valid Extended Support service contract to download Critical Patch Update patches for products in the Extended Support Phase.
Credit Statement
The following people or organizations reported security vulnerabilities addressed by this Critical Patch Update to Oracle: Aaron Portnoy of Exodus Intelligence; Alex Mor of Ernst & Young; Andrea Micalizzi aka rgod, working with HP’s Zero Day Initiative; Andrew Davies formerly of NCC Group; Andy Davis of NCC Group; Behrang Fouladi of SensePost Information Security; Borked of the Google Security Team; Fernando Muñoz via Secunia SVCRP; Fernando Muñoz; Francis Provencher via HP’s Zero Day Initiative; Jakub Wartak via iDefense Labs; K. Gudinavicius of SEC Consult; Mike Gerdts formerly of GE; Oliver Gruskovnjak of Portcullis Inc; Oren Hafif of Ernst & Young; Pavel Toporkov of Positive Technologies; Rajat Swarup of AT&T Consulting; Recx; River Tarnell of Wikimedia Deutschland; Rohan Stelling of BAE Systems Detica; Tan, Kean Siong of KPMG Management Consulting, Singapore; Travis Emmert; and Travis Emmert via iDefense.
Security-In-Depth Contributors
Oracle provides recognition to people that have contributed to our Security-In-Depth program (see FAQ). People are recognized for Security-In-Depth contributions if they provide information, observations or suggestions pertaining to security vulnerability issues that result in significant modification of Oracle code or documentation in future releases, but are not of such a critical nature that they are distributed in Critical Patch Updates.
In this Critical Patch Update Advisory, Oracle recognizes Manuel García Cárdenas of Internet Security Auditors; and Mohamed Nazim of Help AG for contributions to Oracle’s Security-In-Depth program.
On-Line Presence Security Contributors
Oracle provides recognition to people that have contributed to our On-Line Presence Security program (see FAQ). People are recognized for contributions relating to Oracle’s on-line presence if they provide information, observations or suggestions pertaining to security-related issues that result in significant modification to Oracle’s on-line external-facing systems.
For this Quarter, Oracle recognizes Abdelmorite Eljoaydi (Jigsaw); Ali Hasan Ghauri; Keith W. Blackwell; Rishal Dwivedi & Manjot Singh; Vaibhav Khatke of Syntel Inc; and Wan Ikram for contributions to Oracle’s On-Line Presence Security program.
Critical Patch Update Schedule
Critical Patch Updates are released on the Tuesday closest to the 17th day of January, April, July and October. The next four dates are:
- 16 July 2013
- 15 October 2013
- 14 January 2014
- 15 April 2014
References
- Oracle Critical Patch Updates and Security Alerts main page [ Oracle Technology Network ]
- Critical Patch Update - April 2013 Documentation Map [ My Oracle Support Note 1519884.1 ]
- Oracle Critical Patch Updates and Security Alerts - Frequently Asked Questions [ CPU FAQ ]
- Risk Matrix definitions [ Risk Matrix Definitions ]
- Use of Common Vulnerability Scoring System (CVSS) by Oracle [ Oracle CVSS Scoring ]
- English text version of the risk matrices [ Oracle Technology Network ]
- CVRF XML version of the risk matrices [ Oracle Technology Network ]
- List of public vulnerabilities fixed in Critical Patch Updates and Security Alerts [ Oracle Technology Network ]
- Software Error Correction Support Policy [ My Oracle Support Note 209768.1 ]
Modification History
2013-April-16
Rev 1. Initial Release
Appendix - Oracle Database Server****Oracle Database Server Executive Summary
This Critical Patch Update contains 4 new security fixes for the Oracle Database Server. All of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without the need for a username and password. None of these fixes are applicable to client-only installations, i.e., installations that do not have the Oracle Database Server installed. The English text form of this Risk Matrix can be found here.
Oracle Database Server Risk Matrix
CVE#
Component
Protocol
Package and/or Privilege Required
Remote Exploit without Auth.?
CVSS VERSION 2.0 RISK (see Risk Matrix Definitions)
Supported Versions Affected
Notes
Base Score
Access Vector
Access Complexity
Authentication
Confidentiality
Integrity
Availability
CVE-2013-1534
Workload Manager
HTTP
None
Yes
10.0
Network
Low
None
Complete
Complete
Complete
11.2.0.2, 11.2.0.3
See Note 1
CVE-2013-1519
Application Express
HTTP
None
Yes
5.0
Network
Low
None
None
Partial
None
All releases prior to 4.2.1
See Note 2
CVE-2013-1554
Network Layer
Oracle Net
None
Yes
5.0
Network
Low
None
None
None
Partial+
10.2.0.4, 10.2.0.5, 11.1.0.7, 11.2.0.2, 11.2.0.3
CVE-2013-1538
Network Layer
Oracle Net
None
Yes
5.0
Network
Low
None
None
None
Partial+
11.2.0.2, 11.2.0.3
Notes:
- This is only applicable in RAC configurations. Workload Manager is not separately downloadable. The CVSS Base Score is 10.0 only for Windows. For Linux, Unix and other platforms, the CVSS Base Score is 7.5, and the impacts for Confidentiality, Integrity and Availability are Partial+.
- The Supported Versions Affected are all releases prior to 4.2.1, with the exception of APEX 4.2 that is installed with 12.1 release of Database.
Appendix - Oracle Fusion Middleware****Oracle Fusion Middleware Executive Summary
This Critical Patch Update contains 29 new security fixes for Oracle Fusion Middleware. 22 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without the need for a username and password. The English text form of this Risk Matrix can be found here.
Oracle Fusion Middleware products include Oracle Database components that are affected by the vulnerabilities listed in the Oracle Database section. The exposure of Oracle Fusion Middleware products is dependent on the Oracle Database version being used. Oracle Database security fixes are not listed in the Oracle Fusion Middleware risk matrix. However, since vulnerabilities affecting Oracle Database versions may affect Oracle Fusion Middleware products, Oracle recommends that customers apply the April 2013 Critical Patch Update to the Oracle Database components of Oracle Fusion Middleware products. For information on what patches need to be applied to your environments, refer to Critical Patch Update April 2013 Patch Availability Document for Oracle Products, My Oracle Support Note 1525152.1.
Oracle Fusion Middleware Risk Matrix
CVE#
Component
Protocol
Subcomponent
Remote Exploit without Auth.?
CVSS VERSION 2.0 RISK (see Risk Matrix Definitions)
Supported Versions Affected
Notes
Base Score
Access Vector
Access Complexity
Authentication
Confidentiality
Integrity
Availability
CVE-2013-2380
Oracle JRockit
Multiple
-
Yes
10.0
Network
Low
None
Complete
Complete
Complete
R27.7.4 and earlier, R28.2.6 and earlier
See Note 1
CVE-2009-1955
Oracle HTTP Server
HTTP
Web Listener
Yes
7.8
Network
Low
None
None
None
Complete
-
See Note 2
CVE-2009-1890
Oracle HTTP Server
HTTP
Web Listener
Yes
7.1
Network
Medium
None
None
None
Complete
-
See Note 2
CVE-2009-1956
Oracle HTTP Server
HTTP
Web Listener
Yes
6.4
Network
Low
None
Partial
None
Partial
-
See Note 2
CVE-2013-1553
Oracle Web Services Manager
HTTP
Web Services Security
Yes
6.4
Network
Low
None
Partial
Partial
None
11.1.1.6.0
CVE-2013-1565
Oracle GoldenGate Veridata
HTTP
None
Yes
5.0
Network
Low
None
None
None
Partial+
3.0.0.11
CVE-2012-0841
Oracle HTTP Server
HTTP
ModSecurity
Yes
5.0
Network
Low
None
None
None
Partial
11.1.1.6.0
CVE-2007-1862
Oracle HTTP Server
HTTP
Web Listener
Yes
5.0
Network
Low
None
Partial
None
None
-
See Note 2
CVE-2009-1191
Oracle HTTP Server
HTTP
Web Listener
Yes
5.0
Network
Low
None
Partial
None
None
-
See Note 2
CVE-2009-2699
Oracle HTTP Server
HTTP
Web Listener
Yes
5.0
Network
Low
None
None
None
Partial
-
See Note 2
CVE-2013-1545
Oracle HTTP Server
HTTP
Web Listener
Yes
5.0
Network
Low
None
None
None
Partial+
10.1.3.5, 11.1.1.5.0, 11.1.1.6.0
CVE-2010-0408
Oracle HTTP Server
HTTP
Web Listener
Yes
5.0
Network
Low
None
None
None
Partial
-
See Note 2
CVE-2010-2791
Oracle HTTP Server
HTTP
Web Listener
Yes
5.0
Network
Low
None
Partial
None
None
-
See Note 2
CVE-2010-2068
Oracle HTTP Server
HTTP
Web Listener
Yes
5.0
Network
Low
None
Partial
None
None
-
See Note 2
CVE-2013-1497
Oracle COREid Access
HTTP
WebGate - WebServer plugin
Yes
4.3
Network
Medium
None
None
Partial
None
10.1.4.3.0
CVE-2013-1542
Oracle Containers for J2EE
HTTP
Servlet Runtime
Yes
4.3
Network
Medium
None
None
Partial
None
10.1.3.5
CVE-2009-0023
Oracle HTTP Server
HTTP
Web Listener
Yes
4.3
Network
Medium
None
None
None
Partial
-
See Note 2
CVE-2012-2751
Oracle HTTP Server
HTTP
Web Listener
Yes
4.3
Network
Medium
None
None
Partial
None
11.1.1.6.0
CVE-2013-1522
Oracle WebCenter Content
HTTP
Content Server
Yes
4.3
Network
Medium
None
None
Partial
None
10.1.3.5.1, 11.1.1.6.0
CVE-2013-1529
Oracle WebCenter Interaction
HTTP
Image Service
Yes
4.3
Network
Medium
None
None
Partial
None
6.5.1, 10.3.3.0
CVE-2013-1504
Oracle WebLogic Server
HTTP
WebLogic Console
Yes
4.3
Network
Medium
None
None
Partial
None
10.0.2, 10.3.5, 10.3.6, 12.1.1
CVE-2013-2390
Oracle WebLogic Server
HTTP
WebLogic Console
Yes
4.3
Network
Medium
None
None
Partial
None
10.0.2, 10.3.5, 10.3.6, 12.1.1
CVE-2013-1514
Oracle Containers for J2EE
Java RMI
RMI Support
No
4.0
Network
Low
Single
None
Partial
None
10.1.3.5
CVE-2013-1516
Oracle WebCenter Capture
HTTP
Import Server
No
4.0
Network
Low
Single
None
None
Partial
10.1.3.5.1
CVE-2013-1559
Oracle WebCenter Content
HTTP
Content Server
No
4.0
Network
Low
Single
None
None
Partial+
10.1.3.5.1, 11.1.1.6.0
CVE-2013-1509
Oracle WebCenter Sites
HTTP
WebCenter Sites
No
4.0
Network
Low
Single
None
Partial+
None
7.6.2, 11.1.1.6.0, 11.1.1.6.1
CVE-2013-1503
Oracle WebCenter Content
HTTP
Content Server
No
3.5
Network
Medium
Single
None
Partial
None
10.1.3.5.1, 11.1.1.6.0
CVE-2012-4303
Oracle WebCenter Content
HTTP
Content Server
No
3.5
Network
Medium
Single
Partial
None
None
11.1.1.6.0
CVE-2013-2393
Oracle Outside In Technology
None
Outside In Filters
No
1.5
Local
Medium
Single
None
None
Partial+
8.3.7, 8.4.0
See Note 3
Notes:
- Oracle released a Java SE Critical Patch Update on April 16, 2013 to address multiple vulnerabilities affecting the Java Runtime Environment. Oracle CVE-2013-2380 refers to the advisories that are applicable to JRockit from the Java SE Critical Patch Update. The CVSS score of this vulnerability CVE# reflects the highest among those fixed in JRockit. The complete list of all vulnerabilities addressed in JRockit under CVE-2013-2380 is as follows: CVE-2013-1537 and CVE-2013-2415.
- Fixed in all supported releases and patchsets.
- Outside In Technology is a suite of software development kits (SDKs). It does not have any particular associated protocol. If the hosting software passes data received over the network to Outside In Technology code, the CVSS Base Score would increase to 6.8.
Appendix - Oracle Applications****Oracle E-Business Suite Executive Summary
This Critical Patch Update contains 6 new security fixes for the Oracle E-Business Suite. All of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without the need for a username and password. The English text form of this Risk Matrix can be found here.
Oracle E-Business Suite products include Oracle Database and Oracle Fusion Middleware components that are affected by the vulnerabilities listed in the Oracle Database and Oracle Fusion Middleware sections. The exposure of Oracle E-Business Suite products is dependent on the Oracle Database and Oracle Fusion Middleware versions being used. Oracle Database and Oracle Fusion Middleware security fixes are not listed in the Oracle E-Business Suite risk matrix. However, since vulnerabilities affecting Oracle Database and Oracle Fusion Middleware versions may affect Oracle E-Business Suite products, Oracle recommends that customers apply the April 2013 Critical Patch Update to the Oracle Database and Oracle Fusion Middleware components of Oracle E-Business Suite. For information on what patches need to be applied to your environments, refer to Oracle E-Business Suite Releases 11i and 12 Critical Patch Update Knowledge Document (April 2013), My Oracle Support Note 1530756.1.
Oracle E-Business Suite Risk Matrix
CVE#
Component
Protocol
Subcomponent
Remote Exploit without Auth.?
CVSS VERSION 2.0 RISK (see Risk Matrix Definitions)
Supported Versions Affected
Notes
Base Score
Access Vector
Access Complexity
Authentication
Confidentiality
Integrity
Availability
CVE-2013-2388
Oracle Applications Technology Stack
HTTP
Mid Tier File Management
Yes
5.0
Network
Low
None
None
None
Partial
11.5.10.2, 12.0.6, 12.1.3
CVE-2013-1524
Oracle Application Object Library
HTTP
Attachments
Yes
4.3
Network
Medium
None
None
Partial
None
12.0.6, 12.1.3
CVE-2013-2396
Oracle Applications Manager
HTTP
HTML OAM client
Yes
4.3
Network
Medium
None
None
Partial
None
12.0.6, 12.1.3
CVE-2013-1528
Oracle HRMS
HTTP
Payroll
Yes
4.3
Network
Medium
None
None
Partial
None
11.5.10.2, 12.0.6, 12.1.1, 12.1.2, 12.1.3
CVE-2013-1501
Oracle iStore
HTTP
Login
Yes
4.3
Network
Medium
None
None
Partial
None
11.5.10.2
CVE-2013-1517
Oracle Application Object Library
HTTP
Diagnostics
Yes
2.6
Network
High
None
Partial
None
None
11.5.10.2, 12.0.6, 12.1.3
Oracle Supply Chain Products Suite Executive Summary
This Critical Patch Update contains 3 new security fixes for the Oracle Supply Chain Products Suite. 1 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without the need for a username and password. The English text form of this Risk Matrix can be found here.
Oracle Supply Chain Products Suite Risk Matrix
CVE#
Component
Protocol
Subcomponent
Remote Exploit without Auth.?
CVSS VERSION 2.0 RISK (see Risk Matrix Definitions)
Supported Versions Affected
Notes
Base Score
Access Vector
Access Complexity
Authentication
Confidentiality
Integrity
Availability
CVE-2013-0410
Agile EDM
HTTP
Base Component - Common Objects
Yes
4.3
Network
Medium
None
Partial+
None
None
6.1.1.0, 6.1.2.0, 6.1.2.2
CVE-2013-2441
Agile EDM
HTTP
Java Client
No
4.0
Network
Low
Single
None
Partial
None
6.1.1.0, 6.1.2.0, 6.1.2.2
CVE-2013-1536
Oracle Transportation Management
HTTP
Security
No
4.0
Network
Low
Single
Partial+
None
None
5.5.05, 6.2
Oracle PeopleSoft Products Executive Summary
This Critical Patch Update contains 11 new security fixes for Oracle PeopleSoft Products. 6 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without the need for a username and password. The English text form of this Risk Matrix can be found here.
Oracle PeopleSoft Products Risk Matrix
CVE#
Component
Protocol
Subcomponent
Remote Exploit without Auth.?
CVSS VERSION 2.0 RISK (see Risk Matrix Definitions)
Supported Versions Affected
Notes
Base Score
Access Vector
Access Complexity
Authentication
Confidentiality
Integrity
Availability
CVE-2013-2409
PeopleSoft Enterprise PeopleTools
HTTP
PIA Core Technology
Yes
5.0
Network
Low
None
Partial
None
None
8.51, 8.52, 8.53
CVE-2013-1513
PeopleSoft Enterprise PeopleTools
HTTP
PIA Core Technology
Yes
4.3
Network
Medium
None
None
Partial
None
8.51, 8.52, 8.53
CVE-2013-2408
PeopleSoft Enterprise PeopleTools
HTTP
PIA Core Technology
Yes
4.3
Network
Medium
None
None
Partial
None
8.51, 8.52, 8.53
See Note 1
CVE-2013-2404
PeopleSoft Enterprise PeopleTools
HTTP
Portal
Yes
4.3
Network
Medium
None
None
Partial
None
8.51, 8.52, 8.53
CVE-2013-1550
PeopleSoft Enterprise PeopleTools
HTTP
WorkCenter
Yes
4.3
Network
Medium
None
None
Partial
None
8.52, 8.53
CVE-2013-2402
PeopleSoft Enterprise PeopleTools
HTTP
WorkCenter
Yes
4.3
Network
Medium
None
None
Partial
None
8.51, 8.52, 8.53
CVE-2013-2410
PeopleSoft Enterprise HRMS
HTTP
Absence Management
No
4.0
Network
Low
Single
Partial
None
None
9.1.0
CVE-2013-1527
PeopleSoft Enterprise PeopleTools
HTTP
Report Distribution
No
4.0
Network
Low
Single
Partial
None
None
8.51, 8.52, 8.53
CVE-2013-2374
PeopleSoft Enterprise PeopleTools
HTTP
Rich Text Editor
No
4.0
Network
Low
Single
None
Partial
None
8.51, 8.52, 8.53
CVE-2013-2406
PeopleSoft Enterprise PeopleTools
HTTP
PIA Core Technology
No
3.5
Network
Medium
Single
None
Partial
None
8.51, 8.52, 8.53
CVE-2013-2401
PeopleSoft Enterprise PeopleTools
HTTP
Portal
No
3.5
Network
Medium
Single
None
Partial
None
8.51, 8.52, 8.53
Notes:
- This only affects IE 6.
Oracle Siebel CRM Executive Summary
This Critical Patch Update contains 8 new security fixes for Oracle Siebel CRM. 1 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without the need for a username and password. The English text form of this Risk Matrix can be found here.
Oracle Siebel CRM Risk Matrix
CVE#
Component
Protocol
Subcomponent
Remote Exploit without Auth.?
CVSS VERSION 2.0 RISK (see Risk Matrix Definitions)
Supported Versions Affected
Notes
Base Score
Access Vector
Access Complexity
Authentication
Confidentiality
Integrity
Availability
CVE-2013-1551
Siebel Enterprise Application Integration
HTTP
Integration Business Services
No
6.0
Network
Medium
Single
Partial
Partial
Partial
8.1.1, 8.2.2
CVE-2013-2398
Siebel UI Framework
HTTP
Open UI Client
No
6.0
Network
Medium
Single
Partial
Partial
Partial
8.1.1, 8.2.2
CVE-2013-1510
Siebel UI Framework
HTTP
Portal Framework
Yes
5.0
Network
Low
None
Partial
None
None
8.1.1, 8.2.2
CVE-2013-2413
Siebel Enterprise Application Integration
HTTP
Web Services
No
4.9
Network
Medium
Single
Partial
Partial
None
8.1.1, 8.2.2
CVE-2013-2399
Siebel Call Center
HTTP
Email - COMM Server Components
No
4.0
Network
Low
Single
Partial
None
None
8.1.1, 8.2.2
CVE-2013-0416
Siebel Enterprise Application Integration
HTTP
Web Services
No
4.0
Network
Low
Single
Partial
None
None
8.1.1, 8.2.2
CVE-2013-1543
Siebel UI Framework
HTTP
Open UI Client
No
4.0
Network
Low
Single
Partial
None
None
8.1.1, 8.2.2
CVE-2013-2403
Siebel Enterprise Application Integration
HTTP
Web Services
No
3.5
Network
Medium
Single
Partial
None
None
8.1.1, 8.2.2
Appendix - Oracle Industry Applications****Oracle Industry Applications Executive Summary
This Critical Patch Update contains 3 new security fixes for Oracle Industry Applications. None of these vulnerabilities may be remotely exploitable without authentication, i.e., none may be exploited over a network without the need for a username and password. The English text form of this Risk Matrix can be found here.
Oracle Industry Applications Risk Matrix
CVE#
Component
Protocol
Subcomponent
Remote Exploit without Auth.?
CVSS VERSION 2.0 RISK (see Risk Matrix Definitions)
Supported Versions Affected
Notes
Base Score
Access Vector
Access Complexity
Authentication
Confidentiality
Integrity
Availability
CVE-2013-1520
Oracle Clinical Remote Data Capture Option
HTTP
HTML Surround
No
5.5
Network
Low
Single
Partial+
Partial+
None
4.6.0, 4.6.6
CVE-2013-2397
Oracle Retail Central Office
HTTP
Customer Operations (Add, Search)
No
5.5
Network
Low
Single
Partial+
Partial+
None
13.1, 13.2, 13.3, 13.4
CVE-2013-1525
Oracle Retail Integration Bus
HTTP
Retail Integration Bus Manager
No
4.0
Network
Low
Single
Partial
None
None
13.0, 13.1, 13.2
Appendix - Oracle Financial Services Software****Oracle Financial Services Software Executive Summary
This Critical Patch Update contains 18 new security fixes for Oracle Financial Services Software. 1 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without the need for a username and password. The English text form of this Risk Matrix can be found here.
Oracle Financial Services Software Risk Matrix
CVE#
Component
Protocol
Subcomponent
Remote Exploit without Auth.?
CVSS VERSION 2.0 RISK (see Risk Matrix Definitions)
Supported Versions Affected
Notes
Base Score
Access Vector
Access Complexity
Authentication
Confidentiality
Integrity
Availability
CVE-2013-1533
Oracle FLEXCUBE Direct Banking
HTTP
BASE
No
5.5
Network
Low
Single
Partial+
Partial+
None
2.8.0 - 3.1.0, 5.1.0, 5.2.0, 5.3.1 - 5.3.3, 6.0.1 - 12.0.0
CVE-2013-1535
Oracle FLEXCUBE Direct Banking
HTTP
BASE
Yes
5.0
Network
Low
None
Partial
None
None
2.8.0 - 4.1.0, 5.1.0, 5.2.0, 5.3.4, 6.0.1
CVE-2013-2386
Oracle FLEXCUBE Direct Banking
HTTP
BASE
No
4.9
Network
Medium
Single
None
Partial
Partial
2.8.0 - 4.1.0
CVE-2013-1505
Oracle FLEXCUBE Direct Banking
HTTP
BASE
No
4.9
Network
Medium
Single
Partial
Partial
None
2.8.0 - 3.1.0
CVE-2013-2385
Oracle FLEXCUBE Direct Banking
HTTP
BASE
No
4.0
Network
Low
Single
Partial
None
None
2.8.0 - 4.1.0
CVE-2013-1568
Oracle FLEXCUBE Direct Banking
HTTP
CB
No
4.0
Network
Low
Single
None
None
Partial
2.8.0 - 5.3.3, 6.0.1, 6.2.0
CVE-2013-1562
Oracle FLEXCUBE Direct Banking
HTTP
HELP
No
4.0
Network
Low
Single
None
Partial
None
2.8.0 - 4.1.0
CVE-2013-2387
Oracle FLEXCUBE Direct Banking
HTTP
BASE
No
3.6
Network
High
Single
Partial
Partial
None
2.8.0 - 4.1.0
CVE-2013-1541
Oracle FLEXCUBE Direct Banking
HTTP
BASE
No
3.5
Network
Medium
Single
Partial
None
None
2.8.0 - 3.1.0, 5.0.2 - 5.0.5, 5.3.0 - 5.3.4
CVE-2013-1549
Oracle FLEXCUBE Direct Banking
HTTP
BASE
No
3.5
Network
Medium
Single
None
Partial
None
2.8.0 - 5.3.3, 6.0.1, 12.0.0
CVE-2013-1547
Oracle FLEXCUBE Direct Banking
HTTP
BASE
No
3.5
Network
Medium
Single
None
Partial
None
2.8.0 - 12.0.1
CVE-2013-1539
Oracle FLEXCUBE Direct Banking
HTTP
CTF
No
3.5
Network
Medium
Single
Partial
None
None
2.8.0 - 3.1.0, 5.0.2 - 5.0.5, 5.3.0 - 5.3.4
CVE-2013-2377
Oracle FLEXCUBE Direct Banking
HTTP
My Services
No
3.5
Network
Medium
Single
Partial
None
None
2.8.0 - 4.1.0
CVE-2013-1556
Oracle FLEXCUBE Direct Banking
HTTP
OTH
No
3.5
Network
Medium
Single
None
Partial
None
2.8.0 - 12.0.1
CVE-2013-2379
Oracle FLEXCUBE Direct Banking
HTTP
RT
No
3.5
Network
Medium
Single
None
Partial
None
2.8.0 - 12.0.1
CVE-2013-1560
Oracle FLEXCUBE Direct Banking
HTTP
BASE
No
2.1
Network
High
Single
Partial
None
None
2.8.0 - 4.1.0
CVE-2013-2382
Oracle FLEXCUBE Direct Banking
None
BASE
No
1.7
Local
Low
Single
Partial
None
None
2.8.0 - 12.0.1
CVE-2013-1546
Oracle FLEXCUBE Direct Banking
None
BASE
No
1.5
Local
Medium
Single
Partial
None
None
2.8.0 - 3.1.0, 5.0.2 - 12.0.1
Appendix - Oracle Primavera Products Suite****Oracle Primavera Products Suite Executive Summary
This Critical Patch Update contains 2 new security fixes for the Oracle Primavera Products Suite. 1 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without the need for a username and password. The English text form of this Risk Matrix can be found here.
Oracle Primavera Products Suite Risk Matrix
CVE#
Component
Protocol
Subcomponent
Remote Exploit without Auth.?
CVSS VERSION 2.0 RISK (see Risk Matrix Definitions)
Supported Versions Affected
Notes
Base Score
Access Vector
Access Complexity
Authentication
Confidentiality
Integrity
Availability
CVE-2013-2405
Primavera P6 Enterprise Project Portfolio Management
HTTP
Web Access
No
5.5
Network
Low
Single
Partial+
Partial+
None
7.0, 8.1, 8.2
CVE-2013-2411
Primavera P6 Enterprise Project Portfolio Management
HTTP
Web Access
Yes
4.3
Network
Medium
None
None
Partial
None
7.0, 8.1, 8.2
Appendix - Oracle and Sun Systems Products Suite****Oracle and Sun Systems Products Suite Executive Summary
This Critical Patch Update contains 18 new security fixes for the Oracle and Sun Systems Products Suite divided as follows:
- 16 new security fixes for the Oracle and Sun Systems Products Suite. 2 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without the need for a username and password. The English text form of this Risk Matrix can be found here.
- 2 new security fixes for Oracle Sun Middleware Products. Both of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without the need for a username and password. The English text form of this Risk Matrix can be found here.
Oracle and Sun Systems Products Suite Risk Matrix
CVE#
Component
Protocol
Subcomponent
Remote Exploit without Auth.?
CVSS VERSION 2.0 RISK (see Risk Matrix Definitions)
Supported Versions Affected
Notes
Base Score
Access Vector
Access Complexity
Authentication
Confidentiality
Integrity
Availability
CVE-2013-0405
Solaris
IPv6
Filesystem/NFS
Yes
6.4
Network
Low
None
Partial
Partial
None
8, 9, 10, 11
See Note 1
CVE-2013-0411
Solaris
None
RBAC Configuration
No
5.9
Local
High
Multiple
Complete
Complete
Complete
8, 9, 10
CVE-2013-1507
Solaris
None
Filesystem
No
4.9
Local
Low
None
None
None
Complete
10, 11
CVE-2013-1498
Solaris
None
Kernel/IO
No
4.9
Local
Low
None
None
None
Complete
10, 11
CVE-2013-1496
Solaris
None
Kernel/IO
No
4.9
Local
Low
None
None
None
Complete
10, 11
CVE-2013-1494
Solaris
None
Kernel
No
4.7
Local
Medium
None
None
None
Complete
10
See Note 2
CVE-2013-0408
Solaris
None
CPU performance counters drivers
No
4.6
Local
Low
Single
None
None
Complete
10
CVE-2013-0413
Solaris
None
Remote Execution Service
No
4.4
Local
Medium
None
Partial
Partial
Partial
10, 11
CVE-2013-0406
Solaris
TCP/IP
Kernel/IPsec
Yes
4.3
Network
Medium
None
None
Partial
None
10
CVE-2013-1530
Solaris
None
Kernel
No
3.8
Local
High
Single
None
None
Complete
10
CVE-2013-0404
Solaris
None
Kernel/Boot
No
3.7
Local
High
None
Partial
Partial
Partial
10
CVE-2013-0412
Solaris
None
Utility/pax
No
3.3
Local
Medium
None
None
Partial
Partial
8, 9, 10, 11
CVE-2012-0570
Solaris
None
Libraries/Libc
No
2.1
Local
Low
None
None
None
Partial
8, 9, 10, 11
CVE-2012-0568
Solaris
None
Utility/fdformat
No
2.1
Local
Low
None
Partial
None
None
8, 9, 10
CVE-2013-0403
Solaris
None
Utility
No
1.9
Local
Medium
None
None
None
Partial
8, 9, 10, 11
CVE-2013-1499
Solaris
IPv6
Network Configuration
No
1.7
Local
Low
Single
None
None
Partial
11
Notes:
- CVE-2013-0405 occurs only when the Solaris NFS client mounts the NFS server over IPv6.
- CVE-2013-1494 only affects Solaris 10 running on SPARC T4 servers.
Oracle Sun Middleware Products Executive Summary
This Critical Patch Update contains 2 new security fixes for Oracle Sun Middleware Products. Both of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without the need for a username and password. The English text form of this Risk Matrix can be found here.
Oracle Sun Middleware Products Risk Matrix
CVE#
Component
Protocol
Subcomponent
Remote Exploit without Auth.?
CVSS VERSION 2.0 RISK (see Risk Matrix Definitions)
Supported Versions Affected
Notes
Base Score
Access Vector
Access Complexity
Authentication
Confidentiality
Integrity
Availability
CVE-2013-1515
Oracle GlassFish Server
HTTP
ADMIN Interface
Yes
4.3
Network
Medium
None
None
Partial
None
3.0.1, 3.1.2
CVE-2013-1508
Oracle GlassFish Server
HTTP
REST Interface
Yes
4.3
Network
Medium
None
None
Partial
None
3.0.1, 3.1.2
Appendix - Oracle MySQL****Oracle MySQL Executive Summary
This Critical Patch Update contains 25 new security fixes for Oracle MySQL. 1 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without the need for a username and password. The English text form of this Risk Matrix can be found here.
Oracle MySQL Risk Matrix
CVE#
Component
Protocol
Subcomponent
Remote Exploit without Auth.?
CVSS VERSION 2.0 RISK (see Risk Matrix Definitions)
Supported Versions Affected
Notes
Base Score
Access Vector
Access Complexity
Authentication
Confidentiality
Integrity
Availability
CVE-2013-2395
MySQL Server
MySQL Protocol
Data Manipulation Language
No
6.8
Network
Low
Single
None
None
Complete
5.6.10 and earlier
CVE-2013-1521
MySQL Server
MySQL Protocol
Server Locking
No
6.5
Network
Low
Single
Partial+
Partial+
Partial+
5.1.67 and earlier, 5.5.29 and earlier
CVE-2013-2378
MySQL Server
MySQL Protocol
Information Schema
No
6.0
Network
Medium
Single
Partial+
Partial+
Partial+
5.1.67 and earlier, 5.5.29 and earlier, 5.6.10 and earlier
CVE-2013-1552
MySQL Server
MySQL Protocol
Server
No
6.0
Network
Medium
Single
Partial
Partial
Partial
5.1.67 and earlier, 5.5.29 and earlier
CVE-2013-1531
MySQL Server
MySQL Protocol
Server Privileges
No
6.0
Network
Medium
Single
Partial
Partial
Partial
5.1.66 and earlier, 5.5.28 and earlier
CVE-2013-2375
MySQL Server
MySQL Protocol
Server Privileges
No
6.0
Network
Medium
Single
Partial+
Partial+
Partial+
5.1.68 and earlier, 5.5.30 and earlier, 5.6.10 and earlier
CVE-2013-1570
MySQL Server
MySQL Protocol
MemCached
Yes
5.0
Network
Low
None
None
None
Partial+
5.6.10 and earlier
CVE-2013-1523
MySQL Server
MySQL Protocol
Server Optimizer
No
4.6
Network
High
Single
Partial+
Partial+
Partial+
5.5.29 and earlier, 5.6.10 and earlier
CVE-2013-1544
MySQL Server
MySQL Protocol
Data Manipulation Language
No
4.0
Network
Low
Single
None
None
Partial+
5.1.68 and earlier, 5.5.30 and earlier, 5.6.10 and earlier
CVE-2013-1512
MySQL Server
MySQL Protocol
Data Manipulation Language
No
4.0
Network
Low
Single
None
None
Partial+
5.5.29 and earlier
CVE-2013-1532
MySQL Server
MySQL Protocol
Information Schema
No
4.0
Network
Low
Single
None
None
Partial+
5.1.68 and earlier, 5.5.30 and earlier, 5.6.10 and earlier
CVE-2013-2389
MySQL Server
MySQL Protocol
InnoDB
No
4.0
Network
Low
Single
None
None
Partial+
5.1.68 and earlier, 5.5.30 and earlier, 5.6.10 and earlier
CVE-2013-2392
MySQL Server
MySQL Protocol
Server Optimizer
No
4.0
Network
Low
Single
None
None
Partial+
5.1.68 and earlier, 5.5.30 and earlier, 5.6.10 and earlier
CVE-2013-1555
MySQL Server
MySQL Protocol
Server Partition
No
4.0
Network
Low
Single
None
None
Partial+
5.1.67 and earlier, 5.5.29 and earlier
CVE-2013-1526
MySQL Server
MySQL Protocol
Server Replication
No
4.0
Network
Low
Single
None
None
Partial
5.5.29 and earlier
CVE-2012-5614
MySQL Server
MySQL Protocol
Server XML
No
4.0
Network
Low
Single
None
None
Partial+
5.1.67 and earlier, 5.5.29 and earlier
CVE-2013-2376
MySQL Server
MySQL Protocol
Stored Procedure
No
4.0
Network
Low
Single
None
None
Partial+
5.5.30 and earlier, 5.6.10 and earlier
CVE-2013-1567
MySQL Server
MySQL Protocol
Data Manipulation Language
No
3.5
Network
Medium
Single
None
None
Partial+
5.6.10 and earlier
CVE-2013-1511
MySQL Server
MySQL Protocol
InnoDB
No
3.5
Network
Medium
Single
None
None
Partial+
5.5.30 and earlier, 5.6.10 and earlier
CVE-2013-1566
MySQL Server
MySQL Protocol
InnoDB
No
3.5
Network
Medium
Single
None
None
Partial+
5.6.10 and earlier
CVE-2013-2381
MySQL Server
MySQL Protocol
Server Privileges
No
3.5
Network
Medium
Single
None
Partial
None
5.6.10 and earlier
CVE-2013-1548
MySQL Server
MySQL Protocol
Server Types
No
3.5
Network
Medium
Single
None
None
Partial+
5.1.63 and earlier
CVE-2013-2391
MySQL Server
MySQL Protocol
Server Install
No
3.0
Local
Medium
Single
Partial+
Partial+
None
5.1.68 and earlier, 5.5.30 and earlier, 5.6.10 and earlier
CVE-2013-1506
MySQL Server
MySQL Protocol
Server Locking
No
2.8
Network
Medium
Multiple
None
None
Partial
5.1.67 and earlier, 5.5.29 and earlier, 5.6.10 and earlier
CVE-2013-1502
MySQL Server
MySQL Protocol
Server Partition
No
1.5
Local
Medium
Single
None
None
Partial+
5.5.30 and earlier, 5.6.9 and earlier
Appendix - Oracle Support Tools****Oracle Support Tools Executive Summary
This Critical Patch Update contains 1 new security fix for Oracle Support Tools. This vulnerability is not remotely exploitable without authentication, i.e., may not be exploited over a network without the need for a username and password. The English text form of this Risk Matrix can be found here.
Oracle provides Oracle Support Tools for customers to enable faster problem resolution. Starting April 2013, Critical Patch Updates will include security vulnerability fixes for Oracle Support Tools.
Oracle Support Tools Risk Matrix
CVE#
Component
Protocol
Subcomponent
Remote Exploit without Auth.?
CVSS VERSION 2.0 RISK (see Risk Matrix Definitions)
Supported Versions Affected
Notes
Base Score
Access Vector
Access Complexity
Authentication
Confidentiality
Integrity
Availability
CVE-2013-1495
Automatic Service Request
None
None
No
6.9
Local
Medium
None
Complete
Complete
Complete
All versions prior to 4.3.2
See Note 1
Notes:
- Oracle Auto Service Request (ASR) is a support feature that automatically generates a service request for specific hardware faults. All systems on which ASR has been installed must follow the patching guidance in My Oracle Support Note 1541430.1.
Why Oracle
- Analyst Reports
- Gartner MQ for Cloud ERP
- Cloud Economics
- Corporate Responsibility
- Diversity and Inclusion
- Security Practices
Learn
- What is cloud computing?
- What is CRM?
- What is Docker?
- What is Kubernetes?
- What is Python?
- What is SaaS?
What’s New
News
Oracle CloudWorld
Oracle Supports Ukraine
Oracle Red Bull Racing
Oracle Sustainability
Employee Experience Platform
© 2022 Oracle
Site Map
Privacy/Do Not Sell My Info
Ad Choices
Careers
Facebook
Twitter
LinkedIn
YouTube
Related news
MariaDB CONNECT Storage Engine Heap-based Buffer Overflow Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of MariaDB. Authentication is required to exploit this vulnerability. The specific flaw exists within the processing of SQL queries. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the service account. Was ZDI-CAN-16190.
MariaDB CONNECT Storage Engine Heap-based Buffer Overflow Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of MariaDB. Authentication is required to exploit this vulnerability. The specific flaw exists within the processing of SQL queries. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the service account. Was ZDI-CAN-16190.
MariaDB CONNECT Storage Engine Heap-based Buffer Overflow Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of MariaDB. Authentication is required to exploit this vulnerability. The specific flaw exists within the processing of SQL queries. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the service account. Was ZDI-CAN-16190.
MariaDB CONNECT Storage Engine Heap-based Buffer Overflow Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of MariaDB. Authentication is required to exploit this vulnerability. The specific flaw exists within the processing of SQL queries. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the service account. Was ZDI-CAN-16190.
MariaDB CONNECT Storage Engine Heap-based Buffer Overflow Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of MariaDB. Authentication is required to exploit this vulnerability. The specific flaw exists within the processing of SQL queries. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the service account. Was ZDI-CAN-16190.
MariaDB CONNECT Storage Engine Heap-based Buffer Overflow Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of MariaDB. Authentication is required to exploit this vulnerability. The specific flaw exists within the processing of SQL queries. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the service account. Was ZDI-CAN-16190.
MariaDB CONNECT Storage Engine Heap-based Buffer Overflow Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of MariaDB. Authentication is required to exploit this vulnerability. The specific flaw exists within the processing of SQL queries. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the service account. Was ZDI-CAN-16190.
MariaDB CONNECT Storage Engine Heap-based Buffer Overflow Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of MariaDB. Authentication is required to exploit this vulnerability. The specific flaw exists within the processing of SQL queries. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the service account. Was ZDI-CAN-16190.
MariaDB CONNECT Storage Engine Heap-based Buffer Overflow Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of MariaDB. Authentication is required to exploit this vulnerability. The specific flaw exists within the processing of SQL queries. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the service account. Was ZDI-CAN-16190.
MariaDB CONNECT Storage Engine Heap-based Buffer Overflow Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of MariaDB. Authentication is required to exploit this vulnerability. The specific flaw exists within the processing of SQL queries. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the service account. Was ZDI-CAN-16190.
MariaDB CONNECT Storage Engine Heap-based Buffer Overflow Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of MariaDB. Authentication is required to exploit this vulnerability. The specific flaw exists within the processing of SQL queries. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the service account. Was ZDI-CAN-16190.
MariaDB CONNECT Storage Engine Heap-based Buffer Overflow Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of MariaDB. Authentication is required to exploit this vulnerability. The specific flaw exists within the processing of SQL queries. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the service account. Was ZDI-CAN-16190.
MariaDB CONNECT Storage Engine Heap-based Buffer Overflow Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of MariaDB. Authentication is required to exploit this vulnerability. The specific flaw exists within the processing of SQL queries. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the service account. Was ZDI-CAN-16190.
MariaDB CONNECT Storage Engine Heap-based Buffer Overflow Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of MariaDB. Authentication is required to exploit this vulnerability. The specific flaw exists within the processing of SQL queries. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the service account. Was ZDI-CAN-16190.
MariaDB CONNECT Storage Engine Heap-based Buffer Overflow Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of MariaDB. Authentication is required to exploit this vulnerability. The specific flaw exists within the processing of SQL queries. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the service account. Was ZDI-CAN-16190.
MariaDB CONNECT Storage Engine Heap-based Buffer Overflow Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of MariaDB. Authentication is required to exploit this vulnerability. The specific flaw exists within the processing of SQL queries. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the service account. Was ZDI-CAN-16190.
MariaDB CONNECT Storage Engine Heap-based Buffer Overflow Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of MariaDB. Authentication is required to exploit this vulnerability. The specific flaw exists within the processing of SQL queries. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the service account. Was ZDI-CAN-16190.
MariaDB CONNECT Storage Engine Heap-based Buffer Overflow Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of MariaDB. Authentication is required to exploit this vulnerability. The specific flaw exists within the processing of SQL queries. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the service account. Was ZDI-CAN-16190.
MariaDB CONNECT Storage Engine Heap-based Buffer Overflow Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of MariaDB. Authentication is required to exploit this vulnerability. The specific flaw exists within the processing of SQL queries. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the service account. Was ZDI-CAN-16190.
MariaDB CONNECT Storage Engine Heap-based Buffer Overflow Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of MariaDB. Authentication is required to exploit this vulnerability. The specific flaw exists within the processing of SQL queries. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the service account. Was ZDI-CAN-16190.
Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.5.30 and earlier and 5.6.10 allows remote authenticated users to affect availability via unknown vectors related to Server Options.
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier and 6 Update 43 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment, a different vulnerability than CVE-2013-2440.
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier and 6 Update 43 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment, a different vulnerability than CVE-2013-2440.
Heap-based buffer overflow in Oracle MySQL 5.5.19 and other versions through 5.5.28, and MariaDB 5.5.28a and possibly other versions, allows remote authenticated users to cause a denial of service (memory corruption and crash) and possibly execute arbitrary code, as demonstrated using certain variations of the (1) USE, (2) SHOW TABLES, (3) DESCRIBE, (4) SHOW FIELDS FROM, (5) SHOW COLUMNS FROM, (6) SHOW INDEX FROM, (7) CREATE TABLE, (8) DROP TABLE, (9) ALTER TABLE, (10) DELETE FROM, (11) UPDATE, and (12) SET PASSWORD commands.
** DISPUTED ** MySQL 5.5.19 and possibly other versions, and MariaDB 5.5.28a and possibly other versions, when configured to assign the FILE privilege to users who should not have administrative privileges, allows remote authenticated users to gain privileges by leveraging the FILE privilege to create files as the MySQL administrator. NOTE: the vendor disputes this issue, stating that this is only a vulnerability when the administrator does not follow recommendations in the product's installation documentation. NOTE: it could be argued that this should not be included in CVE because it is a configuration issue.
protocol.c in the Apache HTTP Server 2.2.x through 2.2.21 does not properly restrict header information during construction of Bad Request (aka 400) error documents, which allows remote attackers to obtain the values of HTTPOnly cookies via vectors involving a (1) long or (2) malformed header in conjunction with crafted web script.
The ap_proxy_ajp_request function in mod_proxy_ajp.c in mod_proxy_ajp in the Apache HTTP Server 2.2.x before 2.2.15 does not properly handle certain situations in which a client sends no request body, which allows remote attackers to cause a denial of service (backend server outage) via a crafted request, related to use of a 500 error code instead of the appropriate 400 error code.
The Solaris pollset feature in the Event Port backend in poll/unix/port.c in the Apache Portable Runtime (APR) library before 1.3.9, as used in the Apache HTTP Server before 2.2.14 and other products, does not properly handle errors, which allows remote attackers to cause a denial of service (daemon hang) via unspecified HTTP requests, related to the prefork and event MPMs.
The mod_deflate module in Apache httpd 2.2.11 and earlier compresses large files until completion even after the associated network connection is closed, which allows remote attackers to cause a denial of service (CPU consumption).
The stream_reqbody_cl function in mod_proxy_http.c in the mod_proxy module in the Apache HTTP Server before 2.3.3, when a reverse proxy is configured, does not properly handle an amount of streamed data that exceeds the Content-Length value, which allows remote attackers to cause a denial of service (CPU consumption) via crafted requests.
Off-by-one error in the apr_brigade_vprintf function in Apache APR-util before 1.3.5 on big-endian platforms allows remote attackers to obtain sensitive information or cause a denial of service (application crash) via crafted input.
The expat XML parser in the apr_xml_* interface in xml/apr_xml.c in Apache APR-util before 1.3.7, as used in the mod_dav and mod_dav_svn modules in the Apache HTTP Server, allows remote attackers to cause a denial of service (memory consumption) via a crafted XML document containing a large number of nested entity references, as demonstrated by a PROPFIND request, a similar issue to CVE-2003-1564.