Headline

CVE-2015-4734: Oracle Critical Patch Update Advisory - October 2015

Unspecified vulnerability in Oracle Java SE 6u101, 7u85 and 8u60, and Java SE Embedded 8u51, allows remote attackers to affect confidentiality via vectors related to JGSS.

9 years ago

CVE

Open in Source

#sql #vulnerability #web #mac #windows #apple #google #amazon #linux #red_hat #memcached #java #oracle #kubernetes #intel #ldap #pdf #aws #auth #ibm #zero_day #docker #ssl

Click to view our Accessibility Policy
Skip to content
Security Alerts

Oracle Critical Patch Update Advisory - October 2015****Description

A Critical Patch Update (CPU) is a collection of patches for multiple security vulnerabilities. Critical Patch Update patches are usually cumulative, but each advisory describes only the security fixes added since the previous Critical Patch Update advisory. Thus, prior Critical Patch Update advisories should be reviewed for information regarding earlier published security fixes. Please refer to: Critical Patch Updates and Security Alerts for information about Oracle Security Advisories.

Oracle continues to periodically receive reports of malicious exploitation of vulnerabilities for which Oracle has already released fixes. In some instances, it has been reported that malicious attackers have been successful because customers had failed to apply available Oracle patches. Oracle therefore strongly recommends that customers remain on actively-supported versions and apply Critical Patch Update fixes without delay.

This Critical Patch Update contains 270 new security fixes across the product families listed below. Please note that a blog entry summarizing the content of this Critical Patch Update and other Oracle Software Security Assurance activities is located at https://blogs.oracle.com/security.

This Critical Patch Update advisory is also available in an XML format that conforms to the Common Vulnerability Reporting Format (CVRF) version 1.1. More information about Oracle’s use of CVRF is available at: http://www.oracle.com/security-alerts/cpufaq.html#CVRF.

Affected Products and Components

Security vulnerabilities addressed by this Critical Patch Update affect the products listed in the categories below. The product area of the patches for the listed versions is shown in the Patch Availability column corresponding to the specified Products and Versions column. Please click on the link in the Patch Availability column below or in the Patch Availability Table to access the documentation for those patches.

The list of affected product releases and versions that are in Premier Support or Extended Support, under the Oracle Lifetime Support Policy is as follows:

Affected Products and Versions

Patch Availability

Oracle Database Server, version(s) 11.2.0.4, 12.1.0.1, 12.1.0.2

Database

Mobile Server, version(s) 10.3.0.3, 11.3.0.2, 12.1.0.0

Mobile/Lite Server

Oracle Access Manager, version(s) 11.1.2.2, 11.1.2.3

Fusion Middleware

Oracle Business Intelligence Enterprise Edition, version(s) 11.1.1.7, 11.1.1.9

Fusion Middleware

Oracle Endeca Server, version(s) 7.3.0.0, 7.4.0.0, 7.5.1.1, 7.6.1.0.0

Fusion Middleware

Oracle Enterprise Data Quality, version(s) 8.1, 9.0, 11.1.1.7.4, 12.1.3.0.0

Fusion Middleware

Oracle Exalogic Infrastructure, version(s) EECS 2.0.6.2.3

Fusion Middleware

Oracle Fusion Middleware, version(s) 10.1.3.5, 11.1.1.7, 11.1.1.8, 11.1.1.9, 11.1.2.1, 11.1.2.2, 11.1.2.3, 12.1.2.0, 12.1.3.0

Fusion Middleware

Oracle GlassFish Server, version(s) 3.0.1, 3.1.2

Fusion Middleware

Oracle HTTP Server, version(s) 10.1.3.5, 11.1.1.7, 11.1.1.9, 12.1.2.0, 12.1.3.0

Fusion Middleware

Oracle Identity Manager, version(s) 11.1.1.7, 11.1.2.2, 11.1.2.3

Fusion Middleware

Oracle JDeveloper, version(s) 11.1.2.4.0, 12.1.2.0.0, 12.1.3.0.0

Fusion Middleware

Oracle Mobile Security Suite, version(s) MSS 3.0

Fusion Middleware

Oracle Outside In Technology, version(s) 8.5.0, 8.5.1, 8.5.2

Fusion Middleware

Oracle Traffic Director, version(s) 11.1.1.7.0, 11.1.1.9.0

Fusion Middleware

Oracle WebCenter Content, version(s) 10.1.3.5.1

Fusion Middleware

Oracle WebCenter Sites, version(s) 7.6.2, 11.1.1.6.1, 11.1.1.8.0

Fusion Middleware

Hyperion Installation Technology, version(s) 11.1.2.3

Fusion Middleware

Enterprise Manager Base Platform, version(s) 12.1.0.4, 12.1.0.5

Enterprise Manager

Enterprise Manager Ops Center, version(s) 12.1.0.1, 12.2.2

Enterprise Manager

OSS Support Tools, version(s) prior to 8.8.15.7.15

Enterprise Manager

Oracle E-Business Suite, version(s) 11.5.10.2, 12.0.6, 12.1.3, 12.2.3, 12.2.4

E-Business Suite

Oracle Agile Engineering Data Management, version(s) 6.1.2.2, 6.1.3.0, 6.2.0.0

Oracle Supply Chain Products

Oracle Agile PLM, version(s) 9.3.3, 9.3.4

Oracle Supply Chain Products

Oracle Configurator, version(s) 12.0.6, 12.1.3, 12.2.3, 12.2.4

Oracle Supply Chain Products

Oracle Transportation Management, version(s) 6.1, 6.2

Oracle Supply Chain Products

PeopleSoft Enterprise FIN Expenses, version(s) 9.2

PeopleSoft

PeopleSoft Enterprise FSCM, version(s) 9.2

PeopleSoft

PeopleSoft Enterprise HCM, version(s) 9.2

PeopleSoft

PeopleSoft Enterprise HCM Talent Acquistion Managment, version(s) 9.2

PeopleSoft

PeopleSoft Enterprise PeopleTools, version(s) 8.53, 8.54

PeopleSoft

Siebel Applications, version(s) IP2014, IP2015

Siebel

Oracle Fusion Applications, version(s) 11.1.2 through 11.1.9

Fusion Applications

Oracle Utilities Work and Asset Management, version(s) 1.9.1.1.2

Industry Applications

Oracle Communications Convergence, version(s) 2.0, 3.0.1

Communications

Oracle Communications Diameter Signaling Router (DSR), version(s) 4.1.6 and prior, 5.1.0 and prior, 6.0.2 and prior, 7.1.0 and prior

Communications

Oracle Communications LSMS, version(s) 13.1

Communications

Oracle Communications Messaging Server, version(s) 7.0.5, 8.0

Communications

Oracle Communications Performance Intelligence Center Software, version(s) 9.0.3 and prior, 10.1.5 and prior

Communications

Oracle Communications Policy Management, version(s) 9.9.0 and prior, 10.5.0 and prior, 11.5.0 and prior, 12.1.0 and prior

Communications

Oracle Communications Tekelec HLR Router, version(s) 4.0.0

Communications

Oracle Retail Back Office, version(s) 12.0, 12.0IN, 13.0, 13.1, 13.2, 13.3, 13.4, 14.0., RM2.0

Retail

Oracle Retail Central Office, version(s) 12.0, 12.0IN, 13.0, 13.1, 13.2, 13.3, 13.4, 14.0., RM2.0

Retail

Oracle Retail Open Commerce Platform, version(s) 3.0

Retail

Oracle Retail Returns Management:, version(s) 12.0, 12.0IN, 13.0, 13.1, 13.2, 13.3, 13.4, 14.0., RM2.0

Retail

Oracle Java SE, version(s) 6u101, 7u85, 8u60

Oracle Java SE

Oracle Java SE Embedded, version(s) 8u51

Oracle Java SE

Oracle JavaFX, version(s) 2.2.85

Oracle Java SE

Oracle JRockit, version(s) R28.3.7

ROracle Java SE

Fujitsu M10-1, M10-4, M10-4S Servers, version(s) prior to XCP 2271

Oracle and Sun Systems Products Suite

Integrated Lights Out Manager (ILOM), version(s) 3.0, 3.1, 3.2

Oracle and Sun Systems Products Suite

Solaris, version(s) 10, 11.2

Oracle and Sun Systems Products Suite

Oracle FS1-2 Flash Storage System, version(s) 6.1, 6.2, 6.3

Pillar Axiom

Oracle VM VirtualBox, version(s) prior to 4.0.34, prior to 4.1.42, prior to 4.2.34, prior to 4.3.32, prior to 5.0.8

Oracle Linux and Virtualization

MySQL Enterprise Monitor, version(s) 2.3.20 and prior, 3.0.22 and prior

Oracle MySQL Product Suite

MySQL Server, version(s) 5.5.45 and prior, 5.6.26 and prior

Oracle MySQL Product Suite

Patch Availability Table and Risk Matrices****Patch Availability Table

For each administered Oracle product, consult the documentation for patch availability information and installation instructions referenced from the following table. For an overview of the Oracle product documentation related to this Critical Patch Update, please refer to the Oracle Critical Patch Update October 2015 Documentation Map, My Oracle Support Note 2031790.1.

Product Group

Risk Matrix

Patch Availability and Installation Information

Oracle Database

Oracle Database Risk Matrix

Patch Set Update and Critical Patch Update October 2015 Availability Document, My Oracle Support Note 2037108.1

Oracle Fusion Middleware

Oracle Fusion Middleware Risk Matrix

Patch Set Update and Critical Patch Update October 2015 Availability Document, My Oracle Support Note 2037108.1

Oracle Fusion Applications

Oracle Database Risk Matrix and Oracle Fusion Middleware Risk Matrix

Vulnerabilities affecting Oracle Database and Oracle Fusion Middleware may affect Oracle Fusion Applications, so Oracle customers should refer to Oracle Fusion Applications Critical Patch Update Knowledge Document (October 2015) My Oracle Support Note 2067867.1 for information on patches to be applied to Fusion Application environments.

Oracle Enterprise Manager

Oracle Enterprise Manage Risk Matrix

Patch Set Update and Critical Patch Update October 2015 Availability Document, My Oracle Support Note 2037108.1

Oracle Applications - E-Business Suite

Oracle E-Business Suite Risk Matrix

Patch Set Update and Critical Patch Update October 2015 Availability Document, My Oracle Support Note 2051000.1

Oracle Applications - Oracle Supply Chain, PeopleSoft Enterprise and Siebel

Oracle Supply Chain Risk Matrix Oracle PeopleSoft Enterprise Risk Matrix Oracle Siebel Risk Matrix

Critical Patch Update Knowledge Document for Oracle Supply Chain, PeopleSoft Enterprise and Siebel Product Suite, My Oracle Support Note 2066864.1

Oracle Utilities Applications Suite

Oracle Utilities Applications Risk Matrix

Critical Patch Update October 2015 Availability Document, My Oracle Support Note 2063167.1

Oracle Communications Applications Suite

Oracle Communications Applications Risk Matrix

Critical Patch Update October 2015 Availability Document, My Oracle Support Note 2066863.1

Oracle Retail Applications Suite

Oracle Retail Applications Risk Matrix

PCritical Patch Update October 2015 Availability Document, My Oracle Support Note 2067325.1

Oracle Java SE

Oracle Java SE Risk Matrix

Critical Patch Update October 2015 Patch Availability Document for Java SE, My Oracle Support Note 2049800.1
Users running Java SE with a browser can download the latest release from http://java.com. Users on the Windows and Mac OS X platforms can also use automatic updates to get the latest release.
The latest JavaFX release is included with the latest update of JDK and JRE 7 and 8.

Oracle and Sun Systems Products Suite

Oracle and Sun Systems Products Suite Risk Matrix

Critical Patch Update October 2015 Patch Delivery Document for Oracle and Sun Systems Product Suite, My Oracle Support Note 2060027.1

Oracle Pillar Axiom

Oracle Pillar Axiom Risk Matrix

Critical Patch Update October 2015 Patch Delivery Document for Oracle Pillar Axiom, My Oracle Support Note 2060214.1

Oracle Linux and Virtualization Products

Oracle Linux and Virtualization Products Risk Matrix

Critical Patch Update October 2015 Patch Delivery Document for Oracle Linux and Virtualization Products, My Oracle Support Note 2060225.1

Oracle MySQL

Oracle MySQL Risk Matrix

Critical Patch Update October 2015 Patch Availability Document for Oracle MySQL Products, My Oracle Support Note 2048227.1

Risk Matrix Content

Risk matrices list only security vulnerabilities that are newly fixed by the patches associated with this advisory. Risk matrices for previous security fixes can be found in previous Critical Patch Update advisories. An English text version of the risk matrices provided in this document is available here.

Several vulnerabilities addressed in this Critical Patch Update affect multiple products. Each vulnerability is identified by a CVE# which is a unique identifier for a vulnerability. A vulnerability that affects multiple products will appear with the same CVE# in all risk matrices. A CVE# shown in italics indicates that this vulnerability impacts a different product, but also has impact on the product where the italicized CVE# is listed.

Security vulnerabilities are scored using CVSS version 2.0 (see Oracle CVSS Scoring for an explanation of how Oracle applies CVSS 2.0). Oracle conducts an analysis of each security vulnerability addressed by a Critical Patch Update (CPU). Oracle does not disclose information about the security analysis, but the resulting Risk Matrix and associated documentation provide information about the type of vulnerability, the conditions required to exploit it, and the potential impact of a successful exploit. Oracle provides this information, in part, so that customers may conduct their own risk analysis based on the particulars of their product usage. For more information, see Oracle vulnerability disclosure policies .

The protocol in the risk matrix implies that all of its secure variants (if applicable) are affected as well. For example, if HTTP is listed as an affected protocol, it implies that HTTPS (if applicable) is also affected. The secure variant of a protocol is listed in the risk matrix only if it is the only variant affected, e.g. HTTPS will typically be listed for vulnerabilities in SSL and TLS.

Workarounds

Due to the threat posed by a successful attack, Oracle strongly recommends that customers apply CPU fixes as soon as possible. Until you apply the CPU fixes, it may be possible to reduce the risk of successful attack by blocking network protocols required by an attack. For attacks that require certain privileges or access to certain packages, removing the privileges or the ability to access the packages from users that do not need the privileges may help reduce the risk of successful attack. Both approaches may break application functionality, so Oracle strongly recommends that customers test changes on non-production systems. Neither approach should be considered a long-term solution as neither corrects the underlying problem.

Skipped Critical Patch Updates

Oracle strongly recommends that customers apply security fixes as soon as possible. For customers that have skipped one or more Critical Patch Updates and are concerned about products that do not have security fixes announced in this CPU, please review previous Critical Patch Update advisories to determine appropriate actions.

Product Dependencies

Oracle products may have dependencies on other Oracle products. Hence security vulnerability fixes announced in this Critical Patch Update may affect one or more dependent Oracle products. For details regarding these dependencies and how to apply patches to dependent products, please refer to Patch Set Update and Critical Patch Update October 2015 Availability Document, My Oracle Support Note 2037108.1.

Critical Patch Update Supported Products and Versions

Patches released through the Critical Patch Update program are provided only for product versions that are covered under the Premier Support or Extended Support phases of the Lifetime Support Policy. We recommend that customers plan product upgrades to ensure that patches released through the Critical Patch Update program are available for the versions they are currently running.

Product releases that are not under Premier Support or Extended Support are not tested for the presence of vulnerabilities addressed by this Critical Patch Update. However, it is likely that earlier versions of affected releases are also affected by these vulnerabilities. As a result, Oracle recommends that customers upgrade to supported versions.

Supported Database, Fusion Middleware, Oracle Enterprise Manager Base Platform (formerly “Oracle Enterprise Manager Grid Control”) and Collaboration Suite products are patched in accordance with the Software Error Correction Support Policy explained in My Oracle Support Note 209768.1. Please review the Technical Support Policies for further guidelines regarding support policies and phases of support.

Products in Extended Support

Patches released through the Critical Patch Update program are available to customers who have Extended Support under the Lifetime Support Policy. Customers must have a valid Extended Support service contract to download patches released through the Critical Patch Update program for products in the Extended Support Phase.

Credit Statement

The following people or organizations reported security vulnerabilities addressed by this Critical Patch Update to Oracle: Aaron Portnoy of Exodus Intelligence; Adam Gowdiak of Security Explorations; Adam Willard of Foreground Security; Advanced Threat Research Team, Intel Security; Aleksandr Dubinsky of SyncWords; Alexey Tyurin of ERPScan; Andrea Palazzo of Truel IT; Behzad Najjarpour Jabbari of Secunia Research; Borked of the Google Security Team; Brooks Li of Trend Micro; Cihan Öncü of Biznet Bilisim A.S.; Colm O hEigeartaigh; Dan Peled; David Litchfield of Google; Egor Karbutov of ERPScan; Erlend Oftedal; FortiGuard Labs of Fortinet, Inc.; Francis Provencher from COSIG; Francois Goichon of Context Information Security; G. Geshev from MWR Labs; Gregory Golds; Guido Vranken; Ivan Chalykin of ERPScan; Jacob Smith; Jakub Palaczynski from ING Services Polska; Jeff Kayser of Jibe Consulting; Kana Toko; Khai Tran of Netspi; Leopold von Niebelschuetz-Godlewski of Trustwave; Marcin Gebarowski; Martin Rakhmanov of Trustwave; Nikita Kelesis of ERPScan; Osanda Malith Jayathissa; Oscar Andersson; Red Hat Product Security; Sergey Gorbaty of Salesforce.com; Travis Emmert of Salesforce.com; and Ugur Cihan Koc - Avea Iletisim Hizmetleri A.S.

Security-In-Depth Contributors

Oracle provides recognition to people that have contributed to our Security-In-Depth program (see FAQ). People are recognized for Security-In-Depth contributions if they provide information, observations or suggestions pertaining to security vulnerability issues that result in significant modification of Oracle code or documentation in future releases, but are not of such a critical nature that they are distributed in Critical Patch Updates.

In this Critical Patch Update Advisory, Oracle recognizes Greg Rubin of Amazon Web Services IT Security; Karthikeyan Bhargavan; and Steven Seeley of HP’s Zero Day Initiative for contributions to Oracle’s Security-In-Depth program.

On-Line Presence Security Contributors

Oracle provides recognition to people that have contributed to our On-Line Presence Security program (see FAQ). People are recognized for contributions relating to Oracle’s on-line presence if they provide information, observations or suggestions pertaining to security-related issues that result in significant modification to Oracle’s on-line external-facing systems.

For this quarter, Oracle recognizes Adam Willard of Foreground Security; Jerold Camacho; Jon Lamendola of ^Lift Security; Mehmet Nurcan; Nicolas Francois; Pratyush Anjan Sarangi; Roberto Zanga; Rodolfo Godalle Jr.; Treasure Priyamal; and Weijun Lin of Future-Sec for contributions to Oracle’s On-Line Presence Security program.

Critical Patch Update Schedule

Critical Patch Updates are released on the Tuesday closest to the 17th day of January, April, July and October. The next four dates are:

19 January 2016
19 April 2016
19 July 2016
18 October 2016

References

Oracle Critical Patch Updates and Security Alerts main page [ Oracle Technology Network ]
Critical Patch Update - October 2015 Documentation Map [ My Oracle Support Note 2031790.1 ]
Oracle Critical Patch Updates and Security Alerts - Frequently Asked Questions [ CPU FAQ ]
Risk Matrix definitions [ Risk Matrix Definitions ]
Use of Common Vulnerability Scoring System (CVSS) by Oracle [ Oracle CVSS Scoring ]
English text version of the risk matrices [ Oracle Technology Network ]
CVRF XML version of the risk matrices [ Oracle Technology Network ]
The Oracle Software Security Assurance Blog [ The Oracle Software Security Assurance Blog ]
List of public vulnerabilities fixed in Critical Patch Updates and Security Alerts [ Oracle Technology Network ]
Software Error Correction Support Policy [ My Oracle Support Note 209768.1 ]

Modification History

Date

Note

2016-September-29

Rev 7. Removed Oracle Communications User Data Repository from the set of products affected by CVE-2015-2608

2015-October-27

Rev 6. Modified CVSS score for CVE-2015-4798 and CVE-2015-4839

2015-October-23

Rev 5. Modified CVSS score for CVE-2015-4873

2015-October-22

Rev 4. Modified Credit Statement

2015-October-21

Rev 3. Modified affected version for CVE-2015-4841

2015-October-21

Rev 2. Modified CVSS score for CVE-2015-4896

2015-October-20

Rev 1. Initial Release

Appendix - Oracle Database Server****Oracle Database Server Executive Summary

This Critical Patch Update contains 8 new security fixes for the Oracle Database Server divided as follows:

7 new security fixes for the Oracle Database Server. 1 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without the need for a username and password. None of these fixes are applicable to client-only installations, i.e., installations that do not have the Oracle Database Server installed. The English text form of this Risk Matrix can be found here .
1 new security fix for the Oracle Database Mobile/Lite Server. This vulnerability is not remotely exploitable without authentication, i.e., may not be exploited over a network without the need for a username and password. The English text form of this Risk Matrix can be found here.

Oracle Database Server Risk Matrix

CVE#

Component

Protocol

Package and/or Privilege Required

Remote Exploit without Auth.?

CVSS VERSION 2.0 RISK (see Risk Matrix Definitions)

Supported Versions Affected

Notes

Base Score

Access Vector

Access Complexity

Authen-tication

Confiden-tiality

Integrity

Avail-ability

CVE-2015-4863

Portable Clusterware

Oracle Net

None

Yes

10.0

Network

Low

None

Complete

11.2.0.4, 12.1.0.1, 12.1.0.2

CVE-2015-4794

Java VM

Multiple

Create Session

9.0

Network

Low

Single

Complete

11.2.0.4, 12.1.0.1, 12.1.0.2

See Note 1

CVE-2015-4796

Java VM

Oracle Net

Create Session

9.0

Network

Low

Single

Complete

11.2.0.4, 12.1.0.1, 12.1.0.2

See Note 2

CVE-2015-4873

Database Scheduler

None

7.2

Local

Low

None

Complete

11.2.0.4, 12.1.0.1, 12.1.0.2

CVE-2015-4888

Java VM

Oracle Net

Create Session

6.5

Network

Low

Single

Partial

11.2.0.4, 12.1.0.1, 12.1.0.2

See Note 2

CVE-2015-4900

XDB - XML Database

Oracle Net

Create Session, Create Procedure, Create Table, Create Public Synonym

6.5

Network

Low

Single

Partial+

11.2.0.4, 12.1.0.1, 12.1.0.2

CVE-2015-4857

RDBMS

Oracle Net

Create Session

5.5

Network

Low

Single

Partial+

None

12.1.0.1, 12.1.0.2

Notes:

The CVSS score is 9.0 only on Windows for Database versions prior to 12c. The CVSS is 6.5 (Confidentiality, Integrity and Availability is “Partial+”) for Database 12c on Windows and for all versions of Database on Linux, Unix and other platforms.
This issue impacts the Windows platform only.

Oracle Database Mobile/Lite Server Executive Summary

This Critical Patch Update contains 1 new security fix for the Oracle Database Mobile/Lite Server. This vulnerability is not remotely exploitable without authentication, i.e., may not be exploited over a network without the need for a username and password. The English text form of this Risk Matrix can be found here.

Oracle Database Mobile/Lite Server Risk Matrix

CVE#

Component

Protocol

Package and/or Privilege Required

Remote Exploit without Auth.?

CVSS VERSION 2.0 RISK (see Risk Matrix Definitions)

Supported Versions Affected

Notes

Base Score

Access Vector

Access Complexity

Authen-tication

Confiden-tiality

Integrity

Avail-ability

CVE-2015-4894

Mobile Server

Oracle Net

Create Session, Create Table, Index

4.9

Network

Medium

Single

None

Partial+

Partial

10.3.0.3, 11.3.0.2, 12.1.0.0

Appendix - Oracle Fusion Middleware****Oracle Fusion Middleware Executive Summary

This Critical Patch Update contains 23 new security fixes for Oracle Fusion Middleware. 16 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without the need for a username and password. The English text form of this Risk Matrix can be found here.

Oracle Fusion Middleware products include Oracle Database components that are affected by the vulnerabilities listed in the Oracle Database section. The exposure of Oracle Fusion Middleware products is dependent on the Oracle Database version being used. Oracle Database security fixes are not listed in the Oracle Fusion Middleware risk matrix. However, since vulnerabilities affecting Oracle Database versions may affect Oracle Fusion Middleware products, Oracle recommends that customers apply the October 2015 Critical Patch Update to the Oracle Database components of Oracle Fusion Middleware products. For information on what patches need to be applied to your environments, refer to Critical Patch Update October 2015 Patch Availability Document for Oracle Products, My Oracle Support Note 2037108.1.

Oracle Fusion Middleware Risk Matrix

CVE#

Component

Protocol

Sub- component

Remote Exploit without Auth.?

CVSS VERSION 2.0 RISK (see Risk Matrix Definitions)

Supported Versions Affected

Notes

Base Score

Access Vector

Access Complexity

Authen-tication

Confiden-tiality

Integrity

Avail-ability

CVE-2014-3576

Oracle Enterprise Data Quality

HTTP

Installation

Yes

7.5

Network

Low

None

Partial

8.1, 9.0, 11.1.1.7.4, 12.1.3.0.0

See Note 1

CVE-2014-1569

Oracle Traffic Director

HTTPS

Security

Yes

7.5

Network

Low

None

Partial

11.1.1.7.0, 11.1.1.9.0

CVE-2015-1791

Oracle Exalogic Infrastructure

HTTPS

Network Infra Framework

Yes

6.8

Network

Medium

None

Partial

EECS 2.0.6.2.3

See Note 2

CVE-2015-0286

Oracle Business Intelligence Enterprise Edition

HTTPS

BI Platform Security

Yes

5.0

Network

Low

None

Partial

11.1.1.7, 11.1.1.9

See Note 3

CVE-2015-0286

Oracle Endeca Server

HTTPS

Data Enrichment

Yes

5.0

Network

Low

None

Partial

7.3.0.0, 7.4.0.0, 7.5.1.1, 7.6.1.0.0

See Note 3

CVE-2015-1829

Oracle HTTP Server

HTTP

Web Listener

Yes

5.0

Network

Low

None

Partial

10.1.3.5, 11.1.1.7, 11.1.1.9, 12.1.2.0, 12.1.3.0

See Note 4

CVE-2015-4909

Oracle JDeveloper

HTTP

ADF Faces

Yes

5.0

Network

Low

None

Partial

None

11.1.2.4.0, 12.1.2.0.0, 12.1.3.0.0

CVE-2014-3571

Oracle Mobile Security Suite

HTTPS

Common Libraries

Yes

5.0

Network

Low

None

Partial

MSS 3.0

See Note 5

CVE-2010-1622

Oracle WebCenter Sites

HTTP

Security

4.9

Network

Medium

Single

Partial+

None

7.6.2, 11.1.1.6.1, 11.1.1.8.0

CVE-2015-4912

Oracle Access Manager

HTTP

SSO Engine

Yes

4.3

Network

Medium

None

Partial

None

11.1.2.2, 11.1.2.3

CVE-2015-4899

Oracle GlassFish Server

LDAP

Security

Yes

4.3

Network

Medium

None

Partial

None

3.0.1, 3.1.2

CVE-2014-0191

Oracle HTTP Server

HTTP

Web Listener

Yes

4.3

Network

Medium

None

Partial

11.1.1.7, 12.1.2.0, 12.1.3.0

CVE-2015-4832

Oracle Identity Manager

HTTP

OIM Legacy UI

Yes

4.3

Network

Medium

None

Partial

None

11.1.1.7, 11.1.2.2, 11.1.2.3

CVE-2015-4867

Oracle WebCenter Content

HTTP

Content Server

Yes

4.3

Network

Medium

None

Partial

None

10.1.3.5.1

CVE-2015-4880

Oracle WebCenter Content

HTTP

Content Server

Yes

4.3

Network

Medium

None

Partial

None

10.1.3.5.1

CVE-2015-4799

Oracle WebCenter Sites

HTTP

Security

Yes

4.3

Network

Medium

None

Partial

None

7.6.2, 11.1.1.6.1, 11.1.1.8.0

CVE-2015-4838

Oracle JDeveloper

HTTP

ADF Faces

4.0

Network

Low

Single

Partial

None

11.1.2.4.0, 12.1.2.0.0, 12.1.3.0.0

CVE-2015-4914

Oracle HTTP Server

HTTPS

Web Listener

3.5

Network

Medium

Single

Partial

None

10.1.3.5, 11.1.1.7, 11.1.1.9, 12.1.2.0, 12.1.3.0

CVE-2015-4812

Oracle HTTP Server

HTTPS

OSSL Module

Yes

2.6

Network

High

None

Partial

None

11.1.1.9

CVE-2015-4877

Oracle Outside In Technology

None

Outside In Filters

1.5

Local

Medium

Single

None

Partial

8.5.0, 8.5.1, 8.5.2

See Note 6

CVE-2015-4878

Oracle Outside In Technology

None

Outside In Filters

1.5

Local

Medium

Single

None

Partial

8.5.0, 8.5.1, 8.5.2

See Note 6

CVE-2015-4809

Oracle Outside In Technology

None

Outside In PDF Export SDK

1.5

Local

Medium

Single

None

Partial

8.5.0, 8.5.1, 8.5.2

See Note 6

CVE-2015-4811

Oracle Outside In Technology

None

Outside In PDF Export SDK

1.5

Local

Medium

Single

None

Partial

8.5.0, 8.5.1, 8.5.2

See Note 6

Notes:

Please refer to My Oracle Support Note 2056927.1 for instructions on how to address this issue.
The fix also addresses CVE-2015-1788, CVE-2015-1789, CVE-2015-1790 and CVE-2015-1792.
The fix also addresses CVE-2015-0204,CVE-2015-0207,CVE-2015-0208,CVE-2015-0209,CVE-2015-0285,CVE-2015-0287,CVE-2015-0288,CVE-2015-0289,CVE-2015-0290,CVE-2015-0291,CVE-2015-0292,CVE-2015-0293 and CVE-2015-1787.
The fix also addresses CVE-2015-3183.
The fix also addresses CVE-2015-0204,CVE-2015-0205,CVE-2015-0206,CVE-2014-3569,CVE-2014-3570,CVE-2014-3572 and CVE-2014-8275.
Outside In Technology is a suite of software development kits (SDKs). It does not have any particular associated protocol. If the hosting software passes data received over the network to Outside In Technology code, the CVSS v2.0 Base Score would increase to 6.8.

Appendix - Oracle Hyperion****Oracle Hyperion Executive Summary

This Critical Patch Update contains 1 new security fix for Oracle Hyperion. This vulnerability is not remotely exploitable without authentication, i.e., may not be exploited over a network without the need for a username and password. The English text form of this Risk Matrix can be found here.

Oracle Hyperion Risk Matrix

CVE#

Component

Protocol

Sub- component

Remote Exploit without Auth.?

CVSS VERSION 2.0 RISK (see Risk Matrix Definitions)

Supported Versions Affected

Notes

Base Score

Access Vector

Access Complexity

Authen-tication

Confiden-tiality

Integrity

Avail-ability

CVE-2015-4823

Hyperion Installation Technology

None

Essbase Rapid Deploy

1.2

Local

High

None

Partial

None

11.1.2.3

Appendix - Oracle Enterprise Manager Grid Control****Oracle Enterprise Manager Grid Control Executive Summary

This Critical Patch Update contains 5 new security fixes for Oracle Enterprise Manager Grid Control. 3 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without the need for a username and password. None of these fixes are applicable to client-only installations, i.e., installations that do not have Oracle Enterprise Manager Grid Control installed. The English text form of this Risk Matrix can be found here.

Oracle Enterprise Manager products include Oracle Database and Oracle Fusion Middleware components that are affected by the vulnerabilities listed in the Oracle Database and Oracle Fusion Middleware sections. The exposure of Oracle Enterprise Manager products is dependent on the Oracle Database and Oracle Fusion Middleware versions being used. Oracle Database and Oracle Fusion Middleware security fixes are not listed in the Oracle Enterprise Manager risk matrix. However, since vulnerabilities affecting Oracle Database and Oracle Fusion Middleware versions may affect Oracle Enterprise Manager products, Oracle recommends that customers apply the October 2015 Critical Patch Update to the Oracle Database and Oracle Fusion Middleware components of Enterprise Manager. For information on what patches need to be applied to your environments, refer to Critical Patch Update October 2015 Patch Availability Document for Oracle Products, My Oracle Support Note 2037108.1.

Oracle Enterprise Manager Grid Control Risk Matrix

CVE#

Component

Protocol

Sub- component

Remote Exploit without Auth.?

CVSS VERSION 2.0 RISK (see Risk Matrix Definitions)

Supported Versions Affected

Notes

Base Score

Access Vector

Access Complexity

Authen-tication

Confiden-tiality

Integrity

Avail-ability

CVE-2015-1793

OSS Support Tools

HTTPS

Oracle Explorer

Yes

6.8

Network

Medium

None

Partial

Prior to 8.8.15.7.15

CVE-2015-4859

Enterprise Manager Base Platform

HTTP

Agent Next Gen

Yes

5.8

Network

Medium

None

Partial+

None

12.1.0.4, 12.1.0.5

CVE-2015-4875

Enterprise Manager Base Platform

HTTP

Agent Next Gen

Yes

5.0

Network

Low

None

Partial+

12.1.0.4, 12.1.0.5

CVE-2015-4874

Enterprise Manager Base Platform

HTTP

Agent Next Gen

4.1

Local

Medium

Single

Partial+

12.1.0.4, 12.1.0.5

CVE-2015-2633

Enterprise Manager Ops Center

HTTP

Ops Center

3.6

Network

High

Single

Partial+

Partial

None

12.1.0.1, 12.2.2

Appendix - Oracle Applications****Oracle E-Business Suite Executive Summary

This Critical Patch Update contains 12 new security fixes for the Oracle E-Business Suite. 6 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without the need for a username and password. The English text form of this Risk Matrix can be found here.

Oracle E-Business Suite products include Oracle Database and Oracle Fusion Middleware components that are affected by the vulnerabilities listed in the Oracle Database and Oracle Fusion Middleware sections. The exposure of Oracle E-Business Suite products is dependent on the Oracle Database and Oracle Fusion Middleware versions being used. Oracle Database and Oracle Fusion Middleware security fixes are not listed in the Oracle E-Business Suite risk matrix. However, since vulnerabilities affecting Oracle Database and Oracle Fusion Middleware versions may affect Oracle E-Business Suite products, Oracle recommends that customers apply the October 2015 Critical Patch Update to the Oracle Database and Oracle Fusion Middleware components of Oracle E-Business Suite. For information on what patches need to be applied to your environments, refer to Oracle E-Business Suite Releases 11i and 12 Critical Patch Update Knowledge Document (October 2015), My Oracle Support Note 2051000.1.

Oracle E-Business Suite Risk Matrix

CVE#

Component

Protocol

Sub- component

Remote Exploit without Auth.?

CVSS VERSION 2.0 RISK (see Risk Matrix Definitions)

Supported Versions Affected

Notes

Base Score

Access Vector

Access Complexity

Authen-tication

Confiden-tiality

Integrity

Avail-ability

CVE-2015-4798

Oracle Applications Technology Stack

SQLNet

DB Listener

Yes

10.0

Network

Low

None

Complete

11.5.10.2

See Note 1

CVE-2015-4839

Oracle Applications Technology Stack

SQLNet

DB Listener

Yes

10.0

Network

Low

None

Complete

11.5.10.2

See Note 1

CVE-2015-4849

Oracle Payments

HTTP

Punch-in

Yes

6.8

Network

Medium

None

Partial+

11.5.10.2, 12.0.6, 12.1.3, 12.2.3, 12.2.4

CVE-2015-4851

Oracle iSupplier Portal

HTTP

XML input

Yes

6.8

Network

Medium

None

Partial+

12.0.6, 12.1.3, 12.2.3, 12.2.4

CVE-2015-4886

Oracle Report Manager

HTTP

Reports Security

Yes

6.4

Network

Low

None

Partial

None

11.5.10.2, 12.0.6, 12.1.3, 12.2.3, 12.2.4

CVE-2015-4884

Oracle Application Object Library

HTTP

Single Signon

Yes

5.0

Network

Low

None

Partial

None

11.5.10.2, 12.0.6, 12.1.3, 12.2.3, 12.2.4

CVE-2015-4845

Oracle Application Object Library

HTTP

Java APIs - AOL/J

Yes

4.3

Network

Medium

None

Partial

None

11.5.10.2, 12.0.6, 12.1.3, 12.2.3, 12.2.4

CVE-2015-4854

Oracle Application Object Library

HTTP

Single Signon

Yes

4.3

Network

Medium

None

Partial

None

12.0.6, 12.1.3, 12.2.3, 12.2.4

CVE-2015-4762

Oracle Applications DBA

HTTP

Online patching

4.0

Network

Low

Single

Partial

None

12.2.3, 12.2.4

CVE-2015-4898

Oracle Applications Framework

HTTP

Diagnostics, DMZ

4.0

Network

Low

Single

None

Partial

None

11.5.10.2, 12.0.6, 12.1.3, 12.2.3, 12.2.4

CVE-2015-4846

Oracle Applications Manager

HTTP

SQL Extensions

3.6

Network

High

Single

Partial

None

11.5.10.2, 12.0.6, 12.1.3, 12.2.3, 12.2.4

CVE-2015-4865

Oracle Applications Framework

HTTP

Business Objects - BC4J

2.1

Network

High

Single

Partial

None

12.1.3, 12.2.3, 12.2.4

Notes:

The CVSS score is 10.0 for the Windows platform. The CVSS score is 7.5 (Confidentiality, Integrity and Availability is “Partial+”) for Linux, Unix and other platforms.

Oracle Supply Chain Products Suite Executive Summary

This Critical Patch Update contains 8 new security fixes for the Oracle Supply Chain Products Suite. 3 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without the need for a username and password. The English text form of this Risk Matrix can be found here.

Oracle Supply Chain Products Suite Risk Matrix

CVE#

Component

Protocol

Sub- component

Remote Exploit without Auth.?

CVSS VERSION 2.0 RISK (see Risk Matrix Definitions)

Supported Versions Affected

Notes

Base Score

Access Vector

Access Complexity

Authen-tication

Confiden-tiality

Integrity

Avail-ability

CVE-2015-1791

Oracle Transportation Management

HTTP

Install

Yes

6.8

Network

Medium

None

Partial

6.1, 6.2

See Note 1

CVE-2015-4848

Oracle Configurator

HTTP

Integration with Peoplesoft

Yes

5.0

Network

Low

None

Partial

None

12.0.6, 12.1.3, 12.2.3, 12.2.4

CVE-2015-1793

Oracle Agile Engineering Data Management

HTTP

Install

4.9

Network

Medium

Single

Partial

None

6.1.2.2, 6.1.3.0, 6.2.0.0

CVE-2015-4847

Oracle Configurator

HTTP

OCI

Yes

4.3

Network

Medium

None

Partial

None

12.0.6, 12.1.3, 12.2.3, 12.2.4

CVE-2015-4892

Oracle Agile PLM

HTTP

Security

3.5

Network

Medium

Single

None

Partial

None

9.3.4

CVE-2015-4797

Oracle Agile PLM

HTTP

Security

3.5

Network

Medium

Single

None

Partial

None

9.3.3

CVE-2015-4917

Oracle Agile PLM

HTTP

Security

3.5

Network

Medium

Single

None

Partial

None

9.3.4

CVE-2015-4824

Oracle Agile PLM

HTTP

Security

2.1

Network

High

Single

Partial+

None

9.3.4

Notes:

This fix also addresses CVE-2015-1788, CVE-2015-1789, CVE-2015-1790 and CVE-2015-1792 and CVE-2015-1793.

Oracle PeopleSoft Products Executive Summary

This Critical Patch Update contains 8 new security fixes for Oracle PeopleSoft Products. 1 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without the need for a username and password. The English text form of this Risk Matrix can be found here.

Oracle PeopleSoft Products Risk Matrix

CVE#

Component

Protocol

Sub- component

Remote Exploit without Auth.?

CVSS VERSION 2.0 RISK (see Risk Matrix Definitions)

Supported Versions Affected

Notes

Base Score

Access Vector

Access Complexity

Authen-tication

Confiden-tiality

Integrity

Avail-ability

CVE-2015-1791

PeopleSoft Enterprise PeopleTools

HTTP

Security

Yes

6.8

Network

Medium

None

Partial

8.53, 8.54

See Note 1

CVE-2015-4887

PeopleSoft Enterprise HCM

HTTP

ePerformance

6.0

Network

Medium

Single

Partial+

9.2

CVE-2015-4850

PeopleSoft Enterprise HCM

HTTP

Talent Acquisition Management

5.5

Network

Low

Single

Partial

None

9.2

CVE-2015-4818

PeopleSoft Enterprise PeopleTools

HTTP

PIA Core Technology

5.5

Network

Low

Single

Partial

None

8.54

CVE-2015-4828

PeopleSoft Enterprise FSCM

HTTP

FIN Resource Management (Security)

4.0

Network

Low

Single

Partial

None

9.2

CVE-2015-4804

PeopleSoft Enterprise HCM Talent Acquistion Managment

HTTP

Security

4.0

Network

Low

Single

Partial

None

9.2

CVE-2015-4876

PeopleSoft Enterprise PeopleTools

HTTP

Pivot Grid

4.0

Network

Low

Single

None

Partial

None

8.53, 8.54

CVE-2015-4825

PeopleSoft Enterprise FIN Expenses

HTTP

Expense Report General

3.5

Network

Medium

Single

Partial

None

9.2

Notes:

This fix also addresses CVE-2015-1788, CVE-2015-1789, CVE-2015-1790 and CVE-2015-1792 and CVE-2015-1793.

Oracle Siebel CRM Executive Summary

This Critical Patch Update contains 1 new security fix for Oracle Siebel CRM. This vulnerability is remotely exploitable without authentication, i.e., may be exploited over a network without the need for a username and password. The English text form of this Risk Matrix can be found here.

Oracle Siebel CRM Risk Matrix

CVE#

Component

Protocol

Sub- component

Remote Exploit without Auth.?

CVSS VERSION 2.0 RISK (see Risk Matrix Definitions)

Supported Versions Affected

Notes

Base Score

Access Vector

Access Complexity

Authen-tication

Confiden-tiality

Integrity

Avail-ability

CVE-2015-4841

Siebel Core - Server Framework

HTTP

Services

Yes

4.3

Network

Medium

None

Partial

None

IP2014, IP2015

Appendix - Oracle Industry Applications****Oracle Industry Applications Executive Summary

This Critical Patch Update contains 14 new security fixes for the Oracle Industry Applications divided as follows:

1 new security fix for Oracle Industry Applications. This vulnerability is remotely exploitable without authentication, i.e., may be exploited over a network without the need for a username and password. The English text form of this Risk Matrix can be found here.
9 new security fixes for Oracle Communications Applications. 8 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without the need for a username and password. The English text form of this Risk Matrix can be found here.
4 new security fixes for Oracle Retail Applications. All of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without the need for a username and password. The English text form of this Risk Matrix can be found here.

Oracle Industry Applications Risk Matrix

CVE#

Component

Protocol

Sub- component

Remote Exploit without Auth.?

CVSS VERSION 2.0 RISK (see Risk Matrix Definitions)

Supported Versions Affected

Notes

Base Score

Access Vector

Access Complexity

Authen-tication

Confiden-tiality

Integrity

Avail-ability

CVE-2015-4795

Oracle Utilities Work and Asset Management

HTTP

Add-On Applications

Yes

7.5

Network

Low

None

Partial

1.9.1.1.2

Oracle Communications Applications Executive Summary

This Critical Patch Update contains 8 new security fixes for Oracle Communications Applications. 7 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without the need for a username and password. The English text form of this Risk Matrix can be found here.

Oracle Communications Applications Risk Matrix

CVE#

Component

Protocol

Sub- component

Remote Exploit without Auth.?

CVSS VERSION 2.0 RISK (see Risk Matrix Definitions)

Supported Versions Affected

Notes

Base Score

Access Vector

Access Complexity

Authen-tication

Confiden-tiality

Integrity

Avail-ability

CVE-2015-2608

Oracle Communications Diameter Signaling Router (DSR)

HTTP

PMAC

Yes

10.0

Network

Low

None

Complete

4.1.6 and earlier, 5.1.0 and earlier, 6.0.2 and earlier, 7.1.0 and earlier

CVE-2015-2608

Oracle Communications Performance Intelligence Center Software

HTTP

PMAC

Yes

10.0

Network

Low

None

Complete

9.0.3 and earlier, 10.1.5 and earlier

CVE-2015-2608

Oracle Communications Policy Management

HTTP

PMAC

Yes

10.0

Network

Low

None

Complete

9.9.0 and earlier, 10.5.0 and earlier, 11.5.0 and earlier, 12.1.0 and earlier

CVE-2015-2608

Oracle Communications Tekelec HLR Router

HTTP

PMAC

Yes

10.0

Network

Low

None

Complete

4.0.0

CVE-2014-7940

Oracle Communications Messaging Server

HTTP

Libraries

Yes

7.5

Network

Low

None

Partial

7.0.5, 8.0

See Note 1

CVE-2015-0235

Oracle Communications LSMS

Multiple

Glibc

6.0

Network

Medium

Single

Partial

13.1

CVE-2015-4793

Oracle Communications Convergence

HTTP

Mail Proxy

Yes

4.3

Network

Medium

None

Partial

None

2.0, 3.0.1

CVE-2015-4000

Oracle Communications Messaging Server

SSL/TLS

Security

Yes

4.3

Network

Medium

None

Partial

None

7.0.5, 8.0

See Note 2

Notes:

This fix also addresses CVE-2014-7923, CVE-2014-7926, CVE-2014-8146 and CVE-2014-8147.
This fix also addresses CVE-2015-2522.

Oracle Retail Applications Executive Summary

This Critical Patch Update contains 4 new security fixes for Oracle Retail Applications. All of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without the need for a username and password. The English text form of this Risk Matrix can be found here.

Oracle Retail Applications Risk Matrix

CVE#

Component

Protocol

Sub- component

Remote Exploit without Auth.?

CVSS VERSION 2.0 RISK (see Risk Matrix Definitions)

Supported Versions Affected

Notes

Base Score

Access Vector

Access Complexity

Authen-tication

Confiden-tiality

Integrity

Avail-ability

CVE-2014-0050

Oracle Retail Back Office

HTTP

Security

Yes

7.5

Network

Low

None

Partial

RM2.0, 12.0IN, 12.0, 13.0, 13.1, 13.2, 13.3, 13.4, 14.0.

CVE-2014-0050

Oracle Retail Central Office

HTTP

Security

Yes

7.5

Network

Low

None

Partial

RM2.0, 12.0IN, 12.0, 13.0, 13.1, 13.2, 13.3, 13.4, 14.0.

CVE-2014-0050

Oracle Retail Returns Management:

HTTP

Security

Yes

7.5

Network

Low

None

Partial

RM2.0, 12.0IN, 12.0, 13.0, 13.1, 13.2, 13.3, 13.4, 14.0.

CVE-2015-4827

Oracle Retail Open Commerce Platform

HTTP

Framework

Yes

6.4

Network

Low

None

Partial

None

3.0

Appendix - Oracle Java SE****Oracle Java SE Executive Summary

This Critical Patch Update contains 25 new security fixes for Oracle Java SE. 24 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without the need for a username and password. The English text form of this Risk Matrix can be found here.

The CVSS scores below assume that a user running a Java applet or Java Web Start application has administrator privileges (typical on Windows). When the user does not run with administrator privileges (typical on Solaris and Linux), the corresponding CVSS impact scores for Confidentiality, Integrity, and Availability are “Partial” instead of "Complete", lowering the CVSS Base Score. For example, a Base Score of 10.0 becomes 7.5.

Users should only use the default Java Plug-in and Java Web Start from the latest JDK or JRE 7 and 8 releases.

Oracle Java SE Risk Matrix

CVE#

Component

Protocol

Sub- component

Remote Exploit without Auth.?

CVSS VERSION 2.0 RISK (see Risk Matrix Definitions)

Supported Versions Affected

Notes

Base Score

Access Vector

Access Complexity

Authen-tication

Confiden-tiality

Integrity

Avail-ability

CVE-2015-4835

Java SE, Java SE Embedded

Multiple

CORBA

Yes

10.0

Network

Low

None

Complete

Java SE 6u101, Java SE 7u85, Java SE 8u60, Java SE Embedded 8u51

See Note 1

CVE-2015-4881

Java SE, Java SE Embedded

Multiple

CORBA

Yes

10.0

Network

Low

None

Complete

Java SE 6u101, Java SE 7u85, Java SE 8u60, Java SE Embedded 8u51

See Note 1

CVE-2015-4843

Java SE, Java SE Embedded

Multiple

Libraries

Yes

10.0

Network

Low

None

Complete

Java SE 6u101, Java SE 7u85, Java SE 8u60, Java SE Embedded 8u51

See Note 1

CVE-2015-4883

Java SE, Java SE Embedded

Multiple

RMI

Yes

10.0

Network

Low

None

Complete

Java SE 6u101, Java SE 7u85, Java SE 8u60, Java SE Embedded 8u51

See Note 1

CVE-2015-4860

Java SE, Java SE Embedded

Multiple

RMI

Yes

10.0

Network

Low

None

Complete

Java SE 6u101, Java SE 7u85, Java SE 8u60, Java SE Embedded 8u51

See Note 1

CVE-2015-4805

Java SE, Java SE Embedded

Multiple

Serialization

Yes

10.0

Network

Low

None

Complete

Java SE 6u101, Java SE 7u85, Java SE 8u60, Java SE Embedded 8u51

See Note 1

CVE-2015-4844

Java SE, Java SE Embedded

Mutiple

Yes

10.0

Network

Low

None

Complete

Java SE 6u101, Java SE 7u85, Java SE 8u60, Java SE Embedded 8u51

See Note 1

CVE-2015-4901

Java SE

Multiple

JavaFX

Yes

9.3

Network

Medium

None

Complete

Java SE 8u60

See Note 1

CVE-2015-4868

Java SE, Java SE Embedded

Multiple

Libraries

Yes

7.6

Network

High

None

Complete

Java SE 8u60, Java SE Embedded 8u51

See Note 2

CVE-2015-4810

Java SE

None

Deployment

6.9

Local

Medium

None

Complete

Java SE 7u85, Java SE 8u60

See Note 1

CVE-2015-4806

Java SE, Java SE Embedded

Multiple

Libraries

Yes

6.4

Network

Low

None

Partial

None

Java SE 6u101, Java SE 7u85, Java SE 8u60, Java SE Embedded 8u51

See Note 1

CVE-2015-4871

Java SE

Multiple

Libraries

Yes

5.8

Network

Medium

None

Partial

None

Java SE 7u85

See Note 1

CVE-2015-4902

Java SE

Multiple

Deployment

Yes

5.0

Network

Low

None

Partial

None

Java SE 6u101, Java SE 7u85, Java SE 8u60

See Note 1

CVE-2015-4840

Java SE, Java SE Embedded

Multiple

Yes

5.0

Network

Low

None

Partial

None

Java SE 7u85, Java SE 8u60, Java SE Embedded 8u51

See Note 1

CVE-2015-4882

Java SE, Java SE Embedded

Multiple

CORBA

Yes

5.0

Network

Low

None

Partial

Java SE 6u101, Java SE 7u85, Java SE 8u60, Java SE Embedded 8u51

See Note 1

CVE-2015-4842

Java SE, Java SE Embedded

Multiple

JAXP

Yes

5.0

Network

Low

None

Partial

None

Java SE 6u101, Java SE 7u85, Java SE 8u60, Java SE Embedded 8u51

See Note 1

CVE-2015-4734

Java SE, Java SE Embedded

Multiple

JGSS

Yes

5.0

Network

Low

None

Partial

None

Java SE 6u101, Java SE 7u85, Java SE 8u60, Java SE Embedded 8u51

See Note 1

CVE-2015-4903

Java SE, Java SE Embedded

Multiple

RMI

Yes

5.0

Network

Low

None

Partial

None

Java SE 6u101, Java SE 7u85, Java SE 8u60, Java SE Embedded 8u51

See Note 1

CVE-2015-4803

Java SE, Java SE Embedded, JRockit

Multiple

JAXP

Yes

5.0

Network

Low

None

Partial

Java SE 6u101, Java SE 7u85, Java SE 8u60, Java SE Embedded 8u51, JRockit R28.3.7

See Note 2

CVE-2015-4893

Java SE, Java SE Embedded, JRockit

Multiple

JAXP

Yes

5.0

Network

Low

None

Partial

Java SE 6u101, Java SE 7u85, Java SE 8u60, Java SE Embedded 8u51, JRockit R28.3.7

See Note 2

CVE-2015-4911

Java SE, Java SE Embedded, JRockit

Multiple

JAXP

Yes

5.0

Network

Low

None

Partial

Java SE 6u101, Java SE 7u85, Java SE 8u60, Java SE Embedded 8u51, JRockit R28.3.7

See Note 2

CVE-2015-4872

Java SE, Java SE Embedded, JRockit

Multiple

Security

Yes

5.0

Network

Low

None

Partial

None

Java SE 6u101, Java SE 7u85, Java SE 8u60, Java SE Embedded 8u51, JRockit R28.3.7

See Note 2

CVE-2015-4906

Java SE, JavaFX

Multiple

JavaFX

Yes

5.0

Network

Low

None

Partial

None

Java SE 8u60, JavaFX 2.2.85

See Note 1

CVE-2015-4916

Java SE, JavaFX

Multiple

JavaFX

Yes

5.0

Network

Low

None

Partial

None

Java SE 8u60, JavaFX 2.2.85

See Note 1

CVE-2015-4908

Java SE, JavaFX

Multiple

JavaFX

Yes

5.0

Network

Low

None

Partial

None

Java SE 8u60, JavaFX 2.2.85

See Note 1

Notes:

Applies to client deployment of Java only. This vulnerability can be exploited only through sandboxed Java Web Start applications and sandboxed Java applets.
Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service.

Appendix - Oracle Sun Systems Products Suite****Oracle Sun Systems Products Suite Executive Summary

This Critical Patch Update contains 15 new security fixes for the Oracle Sun Systems Products Suite. 4 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without the need for a username and password. The English text form of this Risk Matrix can be found here.

Oracle Sun Systems Products Suite Risk Matrix

CVE#

Component

Protocol

Sub- component

Remote Exploit without Auth.?

CVSS VERSION 2.0 RISK (see Risk Matrix Definitions)

Supported Versions Affected

Notes

Base Score

Access Vector

Access Complexity

Authen-tication

Confiden-tiality

Integrity

Avail-ability

CVE-2015-4915

Integrated Lights Out Manager (ILOM)

Multiple

System Management

Yes

10.0

Network

Low

None

Complete

3.0, 3.1, 3.2

CVE-2015-4821

Integrated Lights Out Manager (ILOM)

HTTP

Web

Yes

9.3

Network

Medium

None

Complete

3.0, 3.1, 3.2

CVE-2015-4837

Solaris

None

Utility/Security

6.6

Local

Medium

Single

Complete

11.2

CVE-2015-4817

Solaris

None

Kernel Zones virtualized NIC driver

6.2

Local

High

None

Complete

11.2

CVE-2015-4820

Solaris

None

Solaris Kernel Zones

6.2

Local

High

None

Complete

11.2

CVE-1999-0377

Solaris

Multiple

INETD

Yes

5.0

Network

Low

None

Partial

10, 11.2

CVE-2015-4869

Solaris

None

Kernel

4.9

Local

Low

None

Complete

10, 11.2

CVE-2015-4831

Solaris

None

Solaris Kernel Zones

4.9

Local

Low

None

Complete

11.2

CVE-2015-4891

Solaris

None

NSCD

4.6

Local

Low

None

Partial

11.2

CVE-2015-4907

Solaris

None

Solaris Kernel Zones

4.6

Local

Low

None

Partial

Partial+

11.2

CVE-2015-2642

Solaris

Multiple

Gzip

4.4

Local

Medium

None

Partial

10, 11.2

CVE-2015-4000

Fujitsu M10-1, M10-4, M10-4S Servers

SSL/TLS

XCP Firmware

Yes

4.3

Network

Medium

None

Partial

None

XCP prior to XCP 2271

CVE-2015-4834

Solaris

None

Utility/Zones

3.7

Local

High

None

Partial

11.2

CVE-2015-4801

Solaris

None

Solaris Kernel Zones

2.1

Local

Low

None

Partial

None

11.2

CVE-2015-4822

Solaris

None

Solaris Kernel Zones

1.2

Local

High

None

Partial

11.2

Appendix - Oracle Pillar Axiom****Oracle Pillar Axiom Executive Summary

This Critical Patch Update contains 1 new security fix for Oracle Pillar Axiom. This vulnerability is remotely exploitable without authentication, i.e., may be exploited over a network without the need for a username and password. The English text form of this Risk Matrix can be found here.

Oracle Pillar Axiom Risk Matrix

CVE#

Component

Protocol

Sub- component

Remote Exploit without Auth.?

CVSS VERSION 2.0 RISK (see Risk Matrix Definitions)

Supported Versions Affected

Notes

Base Score

Access Vector

Access Complexity

Authen-tication

Confiden-tiality

Integrity

Avail-ability

CVE-2015-0235<

Oracle FS1-2 Flash Storage System

Multiple

Glibc

Yes

10.0

Network

Low

None

Complete

6.1, 6.2, 6.3

Appendix - Oracle Linux and Virtualization****Oracle Virtualization Executive Summary

This Critical Patch Update contains 3 new security fixes for Oracle Virtualization. 1 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without the need for a username and password. The English text form of this Risk Matrix can be found here.

Oracle Virtualization Risk Matrix

CVE#

Component

Protocol

Sub- component

Remote Exploit without Auth.?

CVSS VERSION 2.0 RISK (see Risk Matrix Definitions)

Supported Versions Affected

Notes

Base Score

Access Vector

Access Complexity

Authen-tication

Confiden-tiality

Integrity

Avail-ability

CVE-2015-4896

Oracle VM VirtualBox

None

Core

Yes

5.0

Network

Low

None

Partial+

VirtualBox prior to 4.0.34, 4.1.42, 4.2.34, 4.3.32, 5.0.8

See Note 1

CVE-2015-4856

Oracle VM VirtualBox

None

Core

4.9

Local

Low

None

Complete

VirtualBox prior to 4.0.30, 4.1.38, 4.2.30, 4.3.26, 5.0.0

CVE-2015-4813

Oracle VM VirtualBox

None

Core

2.1

Local

Low

None

Partial+

VirtualBox prior to 4.0.34, 4.1.42, 4.2.34, 4.3.32, 5.0.8

See Note 2

Notes:

Only VMs with Remote Display feature (RDP) enabled are impacted by CVE-2015-4896.
Only Windows guests are impacted by CVE-2015-4813. Windows guests without VirtualBox Guest Additions installed are not affected.

Appendix - Oracle MySQL****Oracle MySQL Executive Summary

This Critical Patch Update contains 30 new security fixes for Oracle MySQL. 2 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without the need for a username and password. The English text form of this Risk Matrix can be found here.

Oracle MySQL Risk Matrix

CVE#

Component

Protocol

Sub- component

Remote Exploit without Auth.?

CVSS VERSION 2.0 RISK (see Risk Matrix Definitions)

Supported Versions Affected

Notes

Base Score

Access Vector

Access Complexity

Authen-tication

Confiden-tiality

Integrity

Avail-ability

CVE-2015-3144

MySQL Enterprise Monitor

HTTP

C-Agent

9.0

Network

Low

Single

Complete

2.3.20 and earlier, 3.0.22 and earlier

See Note 1

CVE-2015-4819

MySQL Server

None

Client programs

7.2

Local

Low

None

Complete

5.5.44 and earlier, 5.6.25 and earlier

See Note 2

CVE-2015-1793

MySQL Server

MySQL Protocol

Server : Security : Encryption

Yes

6.4

Network

Low

None

Partial

None

5.6.25 and earlier

See Note 3

CVE-2015-0286

MySQL Enterprise Monitor

HTTPS

C-Agent / Service Manager

Yes

5.0

Network

Low

None

Partial

2.3.20 and earlier, 3.0.20 and earlier

See Note 4

CVE-2015-4879

MySQL Server

MySQL Protocol

Server : DML

4.6

Network

High

Single

Partial+

5.5.44 and earlier, 5.6.25 and earlier

CVE-2015-4815

MySQL Server

MySQL Protocol

Server : DDL

4.0

Network

Low

Single

None

Partial+

5.5.45 and earlier, 5.6.26 and earlier

CVE-2015-4905

MySQL Server

MySQL Protocol

Server : DML

4.0

Network

Low

Single

None

Partial+

5.6.23 and earlier

CVE-2015-4858

MySQL Server

MySQL Protocol

Server : DML

4.0

Network

Low

Single

None

Partial+

5.5.45 and earlier, 5.6.26 and earlier

CVE-2015-4862

MySQL Server

MySQL Protocol

Server : DML

4.0

Network

Low

Single

None

Partial+

5.6.26 and earlier

CVE-2015-4866

MySQL Server

MySQL Protocol

Server : InnoDB

4.0

Network

Low

Single

None

Partial+

5.6.23 and earlier

CVE-2015-4816

MySQL Server

MySQL Protocol

Server : InnoDB

4.0

Network

Low

Single

None

Partial+

5.5.44 and earlier

CVE-2015-4800

MySQL Server

MySQL Protocol

Server : Optimizer

4.0

Network

Low

Single

None

Partial+

5.6.26 and earlier

CVE-2015-4870

MySQL Server

MySQL Protocol

Server : Parser

4.0

Network

Low

Single

None

Partial+

5.5.45 and earlier, 5.6.26 and earlier

CVE-2015-4802

MySQL Server

MySQL Protocol

Server : Partition

4.0

Network

Low

Single

None

Partial+

5.5.45 and earlier, 5.6.26 and earlier

CVE-2015-4833

MySQL Server

MySQL Protocol

Server : Partition

4.0

Network

Low

Single

None

Partial+

5.6.25 and earlier

CVE-2015-4830

MySQL Server

MySQL Protocol

Server : Security : Privileges

4.0

Network

Low

Single

None

Partial

None

5.5.45 and earlier, 5.6.26 and earlier

CVE-2015-4730

MySQL Server

MySQL Protocol

Server : Types

4.0

Network

Low

Single

None

Partial+

5.6.20 and earlier

CVE-2015-4826

MySQL Server

MySQL Protocol

Server : Types

4.0

Network

Low

Single

Partial

None

5.5.45 and earlier, 5.6.26 and earlier

CVE-2015-4904

MySQL Server

MySQL Protocol

libmysqld

4.0

Network

Low

Single

None

Partial+

5.6.25 and earlier

CVE-2015-4913

MySQL Server

MySQL Protocol

Server : DML

3.5

Network

Medium

Single

None

Partial+

5.5.45 and earlier, 5.6.26 and earlier

CVE-2015-4895

MySQL Server

MySQL Protocol

Server : InnoDB

3.5

Network

Medium

Single

None

Partial+

5.6.25 and earlier

CVE-2015-4861

MySQL Server

MySQL Protocol

Server : InnoDB

3.5

Network

Medium

Single

None

Partial+

5.5.45 and earlier, 5.6.26 and earlier

CVE-2015-4807

MySQL Server

MySQL Protocol

Server : Query Cache

3.5

Network

Medium

Single

None

Partial+

5.5.45 and earlier, 5.6.26 and earlier

See Note 5

CVE-2015-4890

MySQL Server

MySQL Protocol

Server : Replication

3.5

Network

Medium

Single

None

Partial+

5.6.26 and earlier

CVE-2015-4791

MySQL Server

MySQL Protocol

Server : Security : Privileges

3.5

Network

Medium

Single

None

Partial+

5.6.26 and earlier

See Note 5

CVE-2015-4864

MySQL Server

MySQL Protocol

Server : Security : Privileges

3.5

Network

Medium

Single

None

Partial

None

5.5.43 and earlier, 5.6.24 and earlier

CVE-2015-4836

MySQL Server

MySQL Protocol

Server : SP

2.8

Network

Medium

Multiple

None

Partial+

5.5.45 and earlier, 5.6.26 and earlier

CVE-2015-4910

MySQL Server

Memcached

Server : Memcached

2.1

Network

High

Single

None

Partial+

5.6.26 and earlier

CVE-2015-4766

MySQL Server

MySQL Protocol

Server : Security : Firewall

1.9

Local

Medium

None

Partial+

5.6.25 and earlier

CVE-2015-4792

MySQL Server

MySQL Protocol

Server : Partition

1.7

Network

High

Multiple

None

Partial+

5.5.45 and earlier, 5.6.26 and earlier

Notes:

This fix also addresses CVE-2014-3707, CVE-2014-8150, CVE-2015-3153 and CVE-2015-3236. The CVSS score is 9.0 if MySQL Enterprise Monitor runs with admin or root privileges. The score would be 6.5 if MySQL Enterprise Monitor runs with non-admin privileges and the impact on Confidentiality, Integrity and Availability would be Partial+. The Sub-Component for version 3.0.x is 'Proxy/Aggregator’.
The CVSS score is 7.2 if the Utility runs with admin or root privileges. The score would be 4.6 if the Utility runs with non-admin privileges and the impact on Confidentiality, Integrity and Availability would be Partial+.
This fix also addresses CVE-2015-0286, CVE-2015-0288 and CVE-2015-1789.
This fix also addresses CVE-2015-0288. The fix for version 2.3 also addresses CVE-2015-1793.
This issue impacts the Windows platform only.

Why Oracle

Analyst Reports
Gartner MQ for Cloud ERP
Cloud Economics
Corporate Responsibility
Diversity and Inclusion
Security Practices

Learn

What is cloud computing?
What is CRM?
What is Docker?
What is Kubernetes?
What is Python?
What is SaaS?

What’s New

Oracle Supports Ukraine
Oracle CloudWorld
Oracle and Premier League
Oracle Red Bull Racing
Employee Experience Platform
Oracle Support Rewards
© 2022 Oracle
Site Map
Privacy/Do Not Sell My Info
Ad Choices
Careers
Facebook
Twitter
LinkedIn
YouTube

An issue in Zimbra Collaboration ZCS v.8.8.15 and v.9.0 allows an attacker to execute arbitrary code via the sfdc_preauth.jsp component.

CVE-2022-33159: Security Bulletin: IBM Security Directory Suite is vulnerable to multiple issues

IBM Security Directory Suite VA 8.0.1 through 8.0.1.19 stores user credentials in plain clear text which can be read by an authenticated user. IBM X-Force ID: 228567.

1 year ago

CVE

Open in Source

#xss #vulnerability #web #dos #apache #js #java #xpath #ldap #ssrf #vmware #auth #ibm #ssl

CVE-2022-32985: Hardcoded Backdoor User and Outdated Software Components in Nexans FTTO GigaSwitch series

libnx_apl.so on Nexans FTTO GigaSwitch before 6.02N and 7.x before 7.02 implements a Backdoor Account for SSH logins on port 50200 or 50201.

2 years ago

CVE

Open in Source

#vulnerability #js #git #backdoor #buffer_overflow #ssh #telnet #ssl

CVE-2022-32535: Multiple Vulnerabilities PRA-ES8P2S Ethernet-Switch

The Bosch Ethernet switch PRA-ES8P2S with software version 1.01.05 runs its web server with root privilege. In combination with CVE-2022-23534 this could give an attacker root access to the switch.

2 years ago

CVE

Open in Source

#vulnerability #web #mac #windows #microsoft #linux #cisco #red_hat #dos #git #oracle #intel #perl #buffer_overflow #auth #ssh #ssl

Nexans FTTO GigaSwitch Outdated Components / Hardcoded Backdoor

Nexans FTTO GigaSwitch industrial/office switches HW version 5 suffer from having a hardcoded backdoor user and multiple outdated vulnerable software components.

2 years ago

Packet Storm

Open in Source

#vulnerability #web #js #git #php #backdoor #buffer_overflow #ssh #telnet #ssl

CVE-2022-29855: Security Advisories

Mitel 6800 and 6900 Series SIP phone devices through 2022-04-27 have "undocumented functionality." A vulnerability in Mitel 6800 Series and 6900 Series SIP phones excluding 6970, versions 5.1 SP8 (5.1.0.8016) and earlier, and 6.0 (6.0.0.368) through 6.1 HF4 (6.1.0.165), could allow a unauthenticated attacker with physical access to the phone to gain root access due to insufficient access control for test functionality during system startup. A successful exploit could allow access to sensitive information and code execution.

2 years ago

CVE

Open in Source

#sql #xss #vulnerability #web #android #windows #microsoft #linux #dos #apache #java #oracle #php #rce #ldap #samba #ssrf #log4j #buffer_overflow #auth #ssh #ssl

CVE-2022-29855: Security Advisories

2 years ago

CVE

Open in Source

#sql #xss #vulnerability #web #android #windows #microsoft #linux #dos #apache #java #oracle #php #rce #ldap #samba #ssrf #log4j #buffer_overflow #auth #ssh #ssl

CVE-2022-29855: Security Advisories

2 years ago

CVE

Open in Source

#sql #xss #vulnerability #web #android #windows #microsoft #linux #dos #apache #java #oracle #php #rce #ldap #samba #ssrf #log4j #buffer_overflow #auth #ssh #ssl

CVE-2022-29855: Security Advisories

2 years ago

CVE

Open in Source

#sql #xss #vulnerability #web #android #windows #microsoft #linux #dos #apache #java #oracle #php #rce #ldap #samba #ssrf #log4j #buffer_overflow #auth #ssh #ssl

CVE-2022-29855: Security Advisories

2 years ago

CVE

Open in Source

#sql #xss #vulnerability #web #android #windows #microsoft #linux #dos #apache #java #oracle #php #rce #ldap #samba #ssrf #log4j #buffer_overflow #auth #ssh #ssl

CVE-2022-29855: Security Advisories

2 years ago

CVE

Open in Source

#sql #xss #vulnerability #web #android #windows #microsoft #linux #dos #apache #java #oracle #php #rce #ldap #samba #ssrf #log4j #buffer_overflow #auth #ssh #ssl

CVE-2022-29855: Security Advisories

2 years ago

CVE

Open in Source

#sql #xss #vulnerability #web #android #windows #microsoft #linux #dos #apache #java #oracle #php #rce #ldap #samba #ssrf #log4j #buffer_overflow #auth #ssh #ssl

CVE-2022-29855: Security Advisories

2 years ago

CVE

Open in Source

#sql #xss #vulnerability #web #android #windows #microsoft #linux #dos #apache #java #oracle #php #rce #ldap #samba #ssrf #log4j #buffer_overflow #auth #ssh #ssl

CVE-2022-29855: Security Advisories

2 years ago

CVE

Open in Source

#sql #xss #vulnerability #web #android #windows #microsoft #linux #dos #apache #java #oracle #php #rce #ldap #samba #ssrf #log4j #buffer_overflow #auth #ssh #ssl

CVE-2022-29855: Security Advisories

2 years ago

CVE

Open in Source

#sql #xss #vulnerability #web #android #windows #microsoft #linux #dos #apache #java #oracle #php #rce #ldap #samba #ssrf #log4j #buffer_overflow #auth #ssh #ssl

CVE-2022-29855: Security Advisories

2 years ago

CVE

Open in Source

#sql #xss #vulnerability #web #android #windows #microsoft #linux #dos #apache #java #oracle #php #rce #ldap #samba #ssrf #log4j #buffer_overflow #auth #ssh #ssl

CVE-2022-29855: Security Advisories

2 years ago

CVE

Open in Source

#sql #xss #vulnerability #web #android #windows #microsoft #linux #dos #apache #java #oracle #php #rce #ldap #samba #ssrf #log4j #buffer_overflow #auth #ssh #ssl

CVE-2022-29855: Security Advisories

2 years ago

CVE

Open in Source

#sql #xss #vulnerability #web #android #windows #microsoft #linux #dos #apache #java #oracle #php #rce #ldap #samba #ssrf #log4j #buffer_overflow #auth #ssh #ssl

CVE-2022-29855: Security Advisories

2 years ago

CVE

Open in Source

#sql #xss #vulnerability #web #android #windows #microsoft #linux #dos #apache #java #oracle #php #rce #ldap #samba #ssrf #log4j #buffer_overflow #auth #ssh #ssl

CVE-2022-29855: Security Advisories

2 years ago

CVE

Open in Source

#sql #xss #vulnerability #web #android #windows #microsoft #linux #dos #apache #java #oracle #php #rce #ldap #samba #ssrf #log4j #buffer_overflow #auth #ssh #ssl

CVE-2022-29855: Security Advisories

2 years ago

CVE

Open in Source

#sql #xss #vulnerability #web #android #windows #microsoft #linux #dos #apache #java #oracle #php #rce #ldap #samba #ssrf #log4j #buffer_overflow #auth #ssh #ssl

CVE-2022-29855: Security Advisories

2 years ago

CVE

Open in Source

#sql #xss #vulnerability #web #android #windows #microsoft #linux #dos #apache #java #oracle #php #rce #ldap #samba #ssrf #log4j #buffer_overflow #auth #ssh #ssl

CVE-2022-29855: Security Advisories

2 years ago

CVE

Open in Source

#sql #xss #vulnerability #web #android #windows #microsoft #linux #dos #apache #java #oracle #php #rce #ldap #samba #ssrf #log4j #buffer_overflow #auth #ssh #ssl

CVE-2022-29855: Security Advisories

2 years ago

CVE

Open in Source

#sql #xss #vulnerability #web #android #windows #microsoft #linux #dos #apache #java #oracle #php #rce #ldap #samba #ssrf #log4j #buffer_overflow #auth #ssh #ssl

CVE-2022-29855: Security Advisories

2 years ago

CVE

Open in Source

#sql #xss #vulnerability #web #android #windows #microsoft #linux #dos #apache #java #oracle #php #rce #ldap #samba #ssrf #log4j #buffer_overflow #auth #ssh #ssl

CVE-2022-22721: Apache HTTP Server 2.4 vulnerabilities

If LimitXMLRequestBody is set to allow request bodies larger than 350MB (defaults to 1M) on 32 bit systems an integer overflow happens which later causes out of bounds writes. This issue affects Apache HTTP Server 2.4.52 and earlier.

2 years ago

CVE

Open in Source

#xss #vulnerability #web #ios #mac #windows #google #dos #apache #oracle #php #rce #ldap #ssrf #buffer_overflow #auth #ibm #zero_day #ssl

CVE-2022-24052: Security Vulnerabilities Fixed in MariaDB

MariaDB CONNECT Storage Engine Heap-based Buffer Overflow Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of MariaDB. Authentication is required to exploit this vulnerability. The specific flaw exists within the processing of SQL queries. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the service account. Was ZDI-CAN-16190.

2 years ago

CVE

Open in Source

#sql #vulnerability #oracle #buffer_overflow #auth

CVE-2021-44790: Apache HTTP Server 2.4 vulnerabilities

A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser (r:parsebody() called from Lua scripts). The Apache httpd team is not aware of an exploit for the vulnerabilty though it might be possible to craft one. This issue affects Apache HTTP Server 2.4.51 and earlier.

2 years ago

CVE

Open in Source

#xss #vulnerability #web #ios #mac #windows #google #dos #apache #oracle #php #rce #ldap #ssrf #buffer_overflow #auth #ibm #zero_day #ssl

CVE-2021-2119: Oracle Critical Patch Update Advisory - January 2021

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is Prior to 6.1.18. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data. CVSS 3.1 Base Score 6.0 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N).

3 years ago

CVE

Open in Source

#sql #vulnerability #web #mac #windows #google #apache #redis #nodejs #js #git #java #oracle #kubernetes #intel #php #perl #ldap #log4j #graalvm #alibaba #oauth #auth #zero_day #docker #sap #ssl

CVE-2020-9490: Apache HTTP Server 2.4 vulnerabilities

Apache HTTP Server versions 2.4.20 to 2.4.43. A specially crafted value for the 'Cache-Digest' header in a HTTP/2 request would result in a crash when the server actually tries to HTTP/2 PUSH a resource afterwards. Configuring the HTTP/2 feature via "H2Push off" will mitigate this vulnerability for unpatched servers.

4 years ago

CVE

Open in Source

#xss #vulnerability #web #ios #mac #windows #google #dos #apache #oracle #php #rce #ldap #ssrf #buffer_overflow #auth #ibm #zero_day #sap #ssl

CVE-2019-2628: Oracle Critical Patch Update Advisory - April 2019

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: InnoDB). Supported versions that are affected are 5.7.25 and prior and 8.0.15 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

5 years ago

CVE

Open in Source

#sql #vulnerability #web #mac #windows #apple #google #microsoft #linux #apache #redis #java #oracle #kubernetes #intel #log4j #auth #ssh #ibm #zero_day #docker #ssl

CVE-2018-3133: Oracle Critical Patch Update - October 2018

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Parser). Supported versions that are affected are 5.5.61 and prior, 5.6.41 and prior, 5.7.23 and prior and 8.0.12 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).

6 years ago

CVE

Open in Source

#sql #vulnerability #web #ios #mac #windows #apple #google #linux #apache #memcached #js #java #oracle #kubernetes #intel #log4j #bios #auth #zero_day #docker #ssl

CVE-2018-3064: CPU July 2018

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: InnoDB). Supported versions that are affected are 5.6.40 and prior, 5.7.22 and prior and 8.0.11 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server as well as unauthorized update, insert or delete access to some of MySQL Server accessible data. CVSS 3.0 Base Score 7.1 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H).

6 years ago

CVE

Open in Source

#sql #vulnerability #web #ios #android #mac #windows #apple #google #apache #memcached #js #java #oracle #kubernetes #log4j #bios #alibaba #auth #ssh #zero_day #docker #wifi #ssl

CVE-2018-2637: Oracle Critical Patch Update - January 2018

Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: JMX). Supported versions that are affected are Java SE: 6u171, 7u161, 8u152 and 9.0.1; Java SE Embedded: 8u151; JRockit: R28.3.16. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Java SE, Java SE Embedded, JRockit accessible data as well as unauthorized access to critical data or complete access to all Java SE, Java SE Embedded, JRockit accessible data. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.0 Base Score 7.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/A...

6 years ago

CVE

Open in Source

#sql #vulnerability #web #ios #mac #windows #apple #google #linux #red_hat #apache #java #oracle #intel #ldap #log4j #bios #auth #zero_day #wifi #ssl

CVE-2017-10378: Oracle Critical Patch Update - October 2017

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Optimizer). Supported versions that are affected are 5.5.57 and earlier, 5.6.37 and earlier and 5.7.11 and earlier. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).

7 years ago

CVE

Open in Source

#sql #vulnerability #web #ios #mac #windows #apple #microsoft #linux #apache #memcached #java #oracle #kubernetes #intel #perl #auth #postgres #docker #ssl

CVE-2017-3636: Oracle Critical Patch Update Advisory - July 2017

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Client programs). Supported versions that are affected are 5.5.56 and earlier and 5.6.36 and earlier. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where MySQL Server executes to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of MySQL Server accessible data as well as unauthorized read access to a subset of MySQL Server accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Server. CVSS 3.0 Base Score 5.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L).

7 years ago

CVE

Open in Source

#sql #vulnerability #web #ios #android #mac #windows #apple #google #linux #cisco #dos #apache #memcached #java #oracle #kubernetes #intel #ldap #bios #alibaba #auth #docker #ssl

CVE-2017-3600: Oracle Critical Patch Update Advisory - April 2017

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Client mysqldump). Supported versions that are affected are 5.5.54 and earlier, 5.6.35 and earlier and 5.7.17 and earlier. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in takeover of MySQL Server. Note: CVE-2017-3600 is equivalent to CVE-2016-5483. CVSS 3.0 Base Score 6.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H).

CVE-2017-3238: Oracle Critical Patch Update Advisory - January 2017

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Optimizer). Supported versions that are affected are 5.5.53 and earlier, 5.6.34 and earlier and 5.7.16 and earlier. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS v3.0 Base Score 6.5 (Availability impacts).

7 years ago

CVE

Open in Source

#sql #vulnerability #web #mac #windows #apple #google #linux #cisco #red_hat #apache #java #oracle #kubernetes #intel #php #ldap #alibaba #auth #zero_day #docker #ssl

CVE-2016-5612: Oracle Critical Patch Update - October 2016

Unspecified vulnerability in Oracle MySQL 5.5.50 and earlier, 5.6.31 and earlier, and 5.7.13 and earlier allows remote authenticated users to affect availability via vectors related to DML.

8 years ago

CVE

Open in Source

#sql #vulnerability #web #mac #windows #apple #google #linux #apache #memcached #git #java #oracle #kubernetes #intel #ldap #huawei #auth #ssh #zero_day #docker #ssl

CVE-2016-5771: PHP: PHP 5 ChangeLog

spl_array.c in the SPL extension in PHP before 5.5.37 and 5.6.x before 5.6.23 improperly interacts with the unserialize implementation and garbage collection, which allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free and application crash) via crafted serialized data.

CVE-2016-3471: Oracle Critical Patch Update - July 2016

Unspecified vulnerability in Oracle MySQL 5.5.45 and earlier and 5.6.26 and earlier allows local users to affect confidentiality, integrity, and availability via vectors related to Server: Option.

8 years ago

CVE

Open in Source

#sql #vulnerability #web #mac #windows #apple #google #linux #cisco #js #java #oracle #kubernetes #intel #auth #ssh #zero_day #postgres #docker #sap #ssl

CVE-2016-0642: Oracle Critical Patch Update Advisory - April 2016

Unspecified vulnerability in Oracle MySQL 5.5.48 and earlier, 5.6.29 and earlier, and 5.7.11 and earlier allows local users to affect integrity and availability via vectors related to Federated.

8 years ago

CVE

Open in Source

#sql #vulnerability #web #mac #windows #apple #google #amazon #linux #cisco #js #java #oracle #kubernetes #intel #ldap #aws #auth #ssh #zero_day #docker #ssl

CVE-2016-0502: Oracle Critical Patch Update - January 2016

Unspecified vulnerability in Oracle MySQL 5.5.31 and earlier and 5.6.11 and earlier allows remote authenticated users to affect availability via unknown vectors related to Optimizer.

8 years ago

CVE

Open in Source

#sql #vulnerability #web #mac #windows #apple #google #linux #apache #java #oracle #kubernetes #intel #auth #zero_day #docker #ssl

CVE-2015-4879: Oracle Critical Patch Update Advisory - October 2015

Unspecified vulnerability in Oracle MySQL Server 5.5.44 and earlier, and 5.6.25 and earlier, allows remote authenticated users to affect confidentiality, integrity, and availability via vectors related to DML.

9 years ago

CVE

Open in Source

#sql #vulnerability #web #mac #windows #apple #google #amazon #linux #red_hat #memcached #java #oracle #kubernetes #intel #ldap #pdf #aws #auth #ibm #zero_day #docker #ssl

CVE-2015-2590: Oracle Critical Patch Update Advisory - July 2015

Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45, and Java SE Embedded 7u75 and 8u33 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries, a different vulnerability than CVE-2015-4732.

9 years ago

CVE

Open in Source

#sql #vulnerability #web #mac #windows #apple #google #microsoft #linux #red_hat #apache #memcached #js #java #oracle #kubernetes #intel #ldap #auth #zero_day #docker #wifi #ssl

CVE-2015-2590: Oracle Critical Patch Update Advisory - July 2015

9 years ago

CVE

Open in Source

#sql #vulnerability #web #mac #windows #apple #google #microsoft #linux #red_hat #apache #memcached #js #java #oracle #kubernetes #intel #ldap #auth #zero_day #docker #wifi #ssl

CVE-2015-2590: Oracle Critical Patch Update Advisory - July 2015

9 years ago

CVE

Open in Source

#sql #vulnerability #web #mac #windows #apple #google #microsoft #linux #red_hat #apache #memcached #js #java #oracle #kubernetes #intel #ldap #auth #zero_day #docker #wifi #ssl

CVE-2015-2590: Oracle Critical Patch Update Advisory - July 2015

9 years ago

CVE

Open in Source

#sql #vulnerability #web #mac #windows #apple #google #microsoft #linux #red_hat #apache #memcached #js #java #oracle #kubernetes #intel #ldap #auth #zero_day #docker #wifi #ssl

CVE-2015-2582: Oracle Critical Patch Update Advisory - July 2015

Unspecified vulnerability in Oracle MySQL Server 5.5.43 and earlier and 5.6.24 and earlier allows remote authenticated users to affect availability via vectors related to GIS.

9 years ago

CVE

Open in Source

#sql #vulnerability #web #mac #windows #apple #google #microsoft #linux #red_hat #apache #memcached #js #java #oracle #kubernetes #intel #ldap #auth #zero_day #docker #wifi #ssl

CVE-2015-2590: Oracle Critical Patch Update Advisory - July 2015

9 years ago

CVE

Open in Source

#sql #vulnerability #web #mac #windows #apple #google #microsoft #linux #red_hat #apache #memcached #js #java #oracle #kubernetes #intel #ldap #auth #zero_day #docker #wifi #ssl

CVE-2015-2590: Oracle Critical Patch Update Advisory - July 2015

9 years ago

CVE

Open in Source

#sql #vulnerability #web #mac #windows #apple #google #microsoft #linux #red_hat #apache #memcached #js #java #oracle #kubernetes #intel #ldap #auth #zero_day #docker #wifi #ssl

CVE-2015-2590: Oracle Critical Patch Update Advisory - July 2015

9 years ago

CVE

Open in Source

#sql #vulnerability #web #mac #windows #apple #google #microsoft #linux #red_hat #apache #memcached #js #java #oracle #kubernetes #intel #ldap #auth #zero_day #docker #wifi #ssl

CVE-2015-2590: Oracle Critical Patch Update Advisory - July 2015

9 years ago

CVE

Open in Source

#sql #vulnerability #web #mac #windows #apple #google #microsoft #linux #red_hat #apache #memcached #js #java #oracle #kubernetes #intel #ldap #auth #zero_day #docker #wifi #ssl

CVE-2015-2590: Oracle Critical Patch Update Advisory - July 2015

9 years ago

CVE

Open in Source

#sql #vulnerability #web #mac #windows #apple #google #microsoft #linux #red_hat #apache #memcached #js #java #oracle #kubernetes #intel #ldap #auth #zero_day #docker #wifi #ssl

CVE-2015-2590: Oracle Critical Patch Update Advisory - July 2015

9 years ago

CVE

Open in Source

#sql #vulnerability #web #mac #windows #apple #google #microsoft #linux #red_hat #apache #memcached #js #java #oracle #kubernetes #intel #ldap #auth #zero_day #docker #wifi #ssl

CVE-2015-2590: Oracle Critical Patch Update Advisory - July 2015

9 years ago

CVE

Open in Source

#sql #vulnerability #web #mac #windows #apple #google #microsoft #linux #red_hat #apache #memcached #js #java #oracle #kubernetes #intel #ldap #auth #zero_day #docker #wifi #ssl

CVE-2015-2590: Oracle Critical Patch Update Advisory - July 2015

9 years ago

CVE

Open in Source

#sql #vulnerability #web #mac #windows #apple #google #microsoft #linux #red_hat #apache #memcached #js #java #oracle #kubernetes #intel #ldap #auth #zero_day #docker #wifi #ssl

CVE-2015-2590: Oracle Critical Patch Update Advisory - July 2015

9 years ago

CVE

Open in Source

#sql #vulnerability #web #mac #windows #apple #google #microsoft #linux #red_hat #apache #memcached #js #java #oracle #kubernetes #intel #ldap #auth #zero_day #docker #wifi #ssl

CVE-2015-2590: Oracle Critical Patch Update Advisory - July 2015

9 years ago

CVE

Open in Source

#sql #vulnerability #web #mac #windows #apple #google #microsoft #linux #red_hat #apache #memcached #js #java #oracle #kubernetes #intel #ldap #auth #zero_day #docker #wifi #ssl

CVE-2015-2590: Oracle Critical Patch Update Advisory - July 2015

9 years ago

CVE

Open in Source

#sql #vulnerability #web #mac #windows #apple #google #microsoft #linux #red_hat #apache #memcached #js #java #oracle #kubernetes #intel #ldap #auth #zero_day #docker #wifi #ssl

CVE-2015-2590: Oracle Critical Patch Update Advisory - July 2015

9 years ago

CVE

Open in Source

#sql #vulnerability #web #mac #windows #apple #google #microsoft #linux #red_hat #apache #memcached #js #java #oracle #kubernetes #intel #ldap #auth #zero_day #docker #wifi #ssl

CVE-2015-2590: Oracle Critical Patch Update Advisory - July 2015

9 years ago

CVE

Open in Source

#sql #vulnerability #web #mac #windows #apple #google #microsoft #linux #red_hat #apache #memcached #js #java #oracle #kubernetes #intel #ldap #auth #zero_day #docker #wifi #ssl

CVE-2015-2590: Oracle Critical Patch Update Advisory - July 2015

9 years ago

CVE

Open in Source

#sql #vulnerability #web #mac #windows #apple #google #microsoft #linux #red_hat #apache #memcached #js #java #oracle #kubernetes #intel #ldap #auth #zero_day #docker #wifi #ssl

CVE-2015-2590: Oracle Critical Patch Update Advisory - July 2015

9 years ago

CVE

Open in Source

#sql #vulnerability #web #mac #windows #apple #google #microsoft #linux #red_hat #apache #memcached #js #java #oracle #kubernetes #intel #ldap #auth #zero_day #docker #wifi #ssl

CVE-2015-2590: Oracle Critical Patch Update Advisory - July 2015

9 years ago

CVE

Open in Source

#sql #vulnerability #web #mac #windows #apple #google #microsoft #linux #red_hat #apache #memcached #js #java #oracle #kubernetes #intel #ldap #auth #zero_day #docker #wifi #ssl

CVE-2015-2590: Oracle Critical Patch Update Advisory - July 2015

9 years ago

CVE

Open in Source

#sql #vulnerability #web #mac #windows #apple #google #microsoft #linux #red_hat #apache #memcached #js #java #oracle #kubernetes #intel #ldap #auth #zero_day #docker #wifi #ssl

CVE-2015-2590: Oracle Critical Patch Update Advisory - July 2015

9 years ago

CVE

Open in Source

#sql #vulnerability #web #mac #windows #apple #google #microsoft #linux #red_hat #apache #memcached #js #java #oracle #kubernetes #intel #ldap #auth #zero_day #docker #wifi #ssl

CVE-2015-2590: Oracle Critical Patch Update Advisory - July 2015

9 years ago

CVE

Open in Source

#sql #vulnerability #web #mac #windows #apple #google #microsoft #linux #red_hat #apache #memcached #js #java #oracle #kubernetes #intel #ldap #auth #zero_day #docker #wifi #ssl

CVE-2015-2590: Oracle Critical Patch Update Advisory - July 2015

9 years ago

CVE

Open in Source

#sql #vulnerability #web #mac #windows #apple #google #microsoft #linux #red_hat #apache #memcached #js #java #oracle #kubernetes #intel #ldap #auth #zero_day #docker #wifi #ssl

CVE-2015-2590: Oracle Critical Patch Update Advisory - July 2015

9 years ago

CVE

Open in Source

#sql #vulnerability #web #mac #windows #apple #google #microsoft #linux #red_hat #apache #memcached #js #java #oracle #kubernetes #intel #ldap #auth #zero_day #docker #wifi #ssl

CVE-2015-4000

The TLS protocol 1.2 and earlier, when a DHE_EXPORT ciphersuite is enabled on a server but not on a client, does not properly convey a DHE_EXPORT choice, which allows man-in-the-middle attackers to conduct cipher-downgrade attacks by rewriting a ClientHello with DHE replaced by DHE_EXPORT and then rewriting a ServerHello with DHE_EXPORT replaced by DHE, aka the "Logjam" issue.

9 years ago

CVE

Open in Source

#perl #ssl

CVE-2015-0480: Oracle Critical Patch Update - April 2015

Unspecified vulnerability in Oracle Java SE 5.0u81, 6u91, 7u76, and 8u40 allows remote attackers to affect integrity and availability via unknown vectors related to Tools.

9 years ago

CVE

Open in Source

#sql #vulnerability #web #mac #windows #apple #google #linux #cisco #red_hat #memcached #js #java #oracle #kubernetes #ldap #auth #zero_day #docker #ssl

CVE-2015-0480: Oracle Critical Patch Update - April 2015

Unspecified vulnerability in Oracle Java SE 5.0u81, 6u91, 7u76, and 8u40 allows remote attackers to affect integrity and availability via unknown vectors related to Tools.

9 years ago

CVE

Open in Source

#sql #vulnerability #web #mac #windows #apple #google #linux #cisco #red_hat #memcached #js #java #oracle #kubernetes #ldap #auth #zero_day #docker #ssl

CVE-2015-0501: Oracle Critical Patch Update - April 2015

Unspecified vulnerability in Oracle MySQL Server 5.5.42 and earlier, and 5.6.23 and earlier, allows remote authenticated users to affect availability via unknown vectors related to Server : Compiling.

9 years ago

CVE

Open in Source

#sql #vulnerability #web #mac #windows #apple #google #linux #cisco #red_hat #memcached #js #java #oracle #kubernetes #ldap #auth #zero_day #docker #ssl

CVE-2015-0480: Oracle Critical Patch Update - April 2015

Unspecified vulnerability in Oracle Java SE 5.0u81, 6u91, 7u76, and 8u40 allows remote attackers to affect integrity and availability via unknown vectors related to Tools.

9 years ago

CVE

Open in Source

#sql #vulnerability #web #mac #windows #apple #google #linux #cisco #red_hat #memcached #js #java #oracle #kubernetes #ldap #auth #zero_day #docker #ssl

CVE-2015-0480: Oracle Critical Patch Update - April 2015

Unspecified vulnerability in Oracle Java SE 5.0u81, 6u91, 7u76, and 8u40 allows remote attackers to affect integrity and availability via unknown vectors related to Tools.

9 years ago

CVE

Open in Source

#sql #vulnerability #web #mac #windows #apple #google #linux #cisco #red_hat #memcached #js #java #oracle #kubernetes #ldap #auth #zero_day #docker #ssl

CVE-2015-0480: Oracle Critical Patch Update - April 2015

Unspecified vulnerability in Oracle Java SE 5.0u81, 6u91, 7u76, and 8u40 allows remote attackers to affect integrity and availability via unknown vectors related to Tools.

9 years ago

CVE

Open in Source

#sql #vulnerability #web #mac #windows #apple #google #linux #cisco #red_hat #memcached #js #java #oracle #kubernetes #ldap #auth #zero_day #docker #ssl

CVE-2015-0480: Oracle Critical Patch Update - April 2015

Unspecified vulnerability in Oracle Java SE 5.0u81, 6u91, 7u76, and 8u40 allows remote attackers to affect integrity and availability via unknown vectors related to Tools.

9 years ago

CVE

Open in Source

#sql #vulnerability #web #mac #windows #apple #google #linux #cisco #red_hat #memcached #js #java #oracle #kubernetes #ldap #auth #zero_day #docker #ssl

CVE-2015-0480: Oracle Critical Patch Update - April 2015

Unspecified vulnerability in Oracle Java SE 5.0u81, 6u91, 7u76, and 8u40 allows remote attackers to affect integrity and availability via unknown vectors related to Tools.

9 years ago

CVE

Open in Source

#sql #vulnerability #web #mac #windows #apple #google #linux #cisco #red_hat #memcached #js #java #oracle #kubernetes #ldap #auth #zero_day #docker #ssl

CVE-2015-0480: Oracle Critical Patch Update - April 2015

Unspecified vulnerability in Oracle Java SE 5.0u81, 6u91, 7u76, and 8u40 allows remote attackers to affect integrity and availability via unknown vectors related to Tools.

9 years ago

CVE

Open in Source

#sql #vulnerability #web #mac #windows #apple #google #linux #cisco #red_hat #memcached #js #java #oracle #kubernetes #ldap #auth #zero_day #docker #ssl

CVE-2015-0480: Oracle Critical Patch Update - April 2015

Unspecified vulnerability in Oracle Java SE 5.0u81, 6u91, 7u76, and 8u40 allows remote attackers to affect integrity and availability via unknown vectors related to Tools.

9 years ago

CVE

Open in Source

#sql #vulnerability #web #mac #windows #apple #google #linux #cisco #red_hat #memcached #js #java #oracle #kubernetes #ldap #auth #zero_day #docker #ssl

CVE-2015-0480: Oracle Critical Patch Update - April 2015

Unspecified vulnerability in Oracle Java SE 5.0u81, 6u91, 7u76, and 8u40 allows remote attackers to affect integrity and availability via unknown vectors related to Tools.

9 years ago

CVE

Open in Source

#sql #vulnerability #web #mac #windows #apple #google #linux #cisco #red_hat #memcached #js #java #oracle #kubernetes #ldap #auth #zero_day #docker #ssl

CVE-2015-0235: oss-sec: Qualys Security Advisory CVE-2015-0235

Heap-based buffer overflow in the __nss_hostname_digits_dots function in glibc 2.2, and other 2.x versions before 2.18, allows context-dependent attackers to execute arbitrary code via vectors related to the (1) gethostbyname or (2) gethostbyname2 function, aka "GHOST."

9 years ago

CVE

Open in Source

#vulnerability #mac #ubuntu #linux #debian #red_hat #git #c++#rce #buffer_overflow #telnet

CVE-2015-0391: Oracle Critical Patch Update Advisory - January 2015

Unspecified vulnerability in Oracle MySQL Server 5.5.38 and earlier, and 5.6.19 and earlier, allows remote authenticated users to affect availability via vectors related to DDL.

9 years ago

CVE

Open in Source

#sql #vulnerability #web #mac #windows #apple #google #microsoft #linux #red_hat #apache #js #git #java #oracle #kubernetes #intel #ldap #pdf #auth #ssh #zero_day #docker #ssl

CVE-2015-0395: Oracle Critical Patch Update Advisory - January 2015

Unspecified vulnerability in Oracle Java SE 5.0u75, 6u85, 7u72, and 8u25 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Hotspot.

9 years ago

CVE

Open in Source

#sql #vulnerability #web #mac #windows #apple #google #microsoft #linux #red_hat #apache #js #git #java #oracle #kubernetes #intel #ldap #pdf #auth #ssh #zero_day #docker #ssl

CVE-2015-0395: Oracle Critical Patch Update Advisory - January 2015

Unspecified vulnerability in Oracle Java SE 5.0u75, 6u85, 7u72, and 8u25 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Hotspot.

9 years ago

CVE

Open in Source

#sql #vulnerability #web #mac #windows #apple #google #microsoft #linux #red_hat #apache #js #git #java #oracle #kubernetes #intel #ldap #pdf #auth #ssh #zero_day #docker #ssl

CVE-2014-4288: Oracle Critical Patch Update - October 2014

Unspecified vulnerability in Oracle Java SE 6u81, 7u67, and 8u20 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment, a different vulnerability than CVE-2014-6493, CVE-2014-6503, and CVE-2014-6532.

10 years ago

CVE

Open in Source

#sql #vulnerability #web #mac #windows #apple #google #linux #red_hat #memcached #js #java #oracle #kubernetes #auth #ssh #zero_day #docker #firefox #ssl

CVE-2014-6469: Oracle Critical Patch Update - October 2014

Unspecified vulnerability in Oracle MySQL Server 5.5.39 and earlier and 5.6.20 and earlier allows remote authenticated users to affect availability via vectors related to SERVER:OPTIMIZER.

10 years ago

CVE

Open in Source

#sql #vulnerability #web #mac #windows #apple #google #linux #red_hat #memcached #js #java #oracle #kubernetes #auth #ssh #zero_day #docker #firefox #ssl

CVE-2014-4265: Oracle Critical Patch Update - July 2014

Unspecified vulnerability in Oracle Java SE 6u75, 7u60, and 8u5 allows remote attackers to affect integrity via unknown vectors related to Deployment.

10 years ago

CVE

Open in Source

#sql #vulnerability #web #mac #windows #apple #google #linux #red_hat #apache #js #git #java #oracle #kubernetes #auth #zero_day #docker #ssl

CVE-2014-4260: Oracle Critical Patch Update - July 2014

Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.5.37 and earlier, and 5.6.17 and earlier, allows remote authenticated users to affect integrity and availability via vectors related to SRCHAR.

10 years ago

CVE

Open in Source

#sql #vulnerability #web #mac #windows #apple #google #linux #red_hat #apache #js #git #java #oracle #kubernetes #auth #zero_day #docker #ssl

CVE-2012-0053: Apache HTTP Server 2.2 vulnerabilities

protocol.c in the Apache HTTP Server 2.2.x through 2.2.21 does not properly restrict header information during construction of Bad Request (aka 400) error documents, which allows remote attackers to obtain the values of HTTPOnly cookies via vectors involving a (1) long or (2) malformed header in conjunction with crafted web script.

12 years ago

CVE

Open in Source

#xss #csrf #vulnerability #web #ios #windows #google #dos #apache #perl #ldap #vmware #buffer_overflow #auth #ibm #sap #ssl

CVE-2011-2729: Apache Tomcat® - Apache Tomcat 7 vulnerabilities

native/unix/native/jsvc-unix.c in jsvc in the Daemon component 1.0.3 through 1.0.6 in Apache Commons, as used in Apache Tomcat 5.5.32 through 5.5.33, 6.0.30 through 6.0.32, and 7.0.x before 7.0.20 on Linux, does not drop capabilities, which allows remote attackers to bypass read permissions for files via a request to an application.

13 years ago

CVE

Open in Source