Описание
Buffer overflow in extproc in Oracle 10g allows remote attackers to execute arbitrary code via environment variables in the library name, which are expanded after the length check is performed.
Ссылки
- Mailing List
- Broken Link
- Third Party AdvisoryUS Government Resource
- Broken LinkPatchVendor Advisory
- Broken LinkPatchVendor Advisory
- Broken LinkPatchThird Party AdvisoryVDB Entry
- Broken LinkPatchThird Party AdvisoryUS Government Resource
- Third Party AdvisoryVDB Entry
- Mailing List
- Broken Link
- Third Party AdvisoryUS Government Resource
- Broken LinkPatchVendor Advisory
- Broken LinkPatchVendor Advisory
- Broken LinkPatchThird Party AdvisoryVDB Entry
- Broken LinkPatchThird Party AdvisoryUS Government Resource
- Third Party AdvisoryVDB Entry
Уязвимые конфигурации
Конфигурация 1
Одно из
cpe:2.3:a:oracle:application_server:*:*:*:*:*:*:*:*
cpe:2.3:a:oracle:application_server:9.0.2:*:*:*:*:*:*:*
cpe:2.3:a:oracle:application_server:9.0.2.0.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:application_server:9.0.2.0.1:*:*:*:*:*:*:*
cpe:2.3:a:oracle:application_server:9.0.2.1:*:*:*:*:*:*:*
cpe:2.3:a:oracle:application_server:9.0.2.2:*:*:*:*:*:*:*
cpe:2.3:a:oracle:application_server:9.0.2.3:*:*:*:*:*:*:*
cpe:2.3:a:oracle:application_server:9.0.3:*:*:*:*:*:*:*
cpe:2.3:a:oracle:application_server:9.0.3.1:*:*:*:*:*:*:*
cpe:2.3:a:oracle:application_server:9.0.4:*:*:*:*:*:*:*
cpe:2.3:a:oracle:application_server:9.0.4.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:application_server:9.0.4.1:*:*:*:*:*:*:*
cpe:2.3:a:oracle:collaboration_suite:-:*:*:*:*:*:*:*
cpe:2.3:a:oracle:database_server:8.1.7.4:*:*:*:*:*:*:*
cpe:2.3:a:oracle:database_server:9.0.1.4:*:*:*:*:*:*:*
cpe:2.3:a:oracle:database_server:9.0.1.5:*:*:*:*:*:*:*
cpe:2.3:a:oracle:database_server:9.0.4:*:*:*:*:*:*:*
cpe:2.3:a:oracle:database_server:9.2.0.4:*:*:*:*:*:*:*
cpe:2.3:a:oracle:database_server:9.2.0.5:*:*:*:*:*:*:*
cpe:2.3:a:oracle:database_server:10.1.0.2:*:*:*:*:*:*:*
cpe:2.3:a:oracle:e-business_suite:11.5.1:*:*:*:*:*:*:*
cpe:2.3:a:oracle:e-business_suite:11.5.2:*:*:*:*:*:*:*
cpe:2.3:a:oracle:e-business_suite:11.5.3:*:*:*:*:*:*:*
cpe:2.3:a:oracle:e-business_suite:11.5.4:*:*:*:*:*:*:*
cpe:2.3:a:oracle:e-business_suite:11.5.5:*:*:*:*:*:*:*
cpe:2.3:a:oracle:e-business_suite:11.5.6:*:*:*:*:*:*:*
cpe:2.3:a:oracle:e-business_suite:11.5.7:*:*:*:*:*:*:*
cpe:2.3:a:oracle:e-business_suite:11.5.8:*:*:*:*:*:*:*
cpe:2.3:a:oracle:e-business_suite:11.5.9:*:*:*:*:*:*:*
cpe:2.3:a:oracle:enterprise_manager:9:*:*:*:*:*:*:*
cpe:2.3:a:oracle:enterprise_manager:9.0.1:*:*:*:*:*:*:*
cpe:2.3:a:oracle:enterprise_manager_database_control:10.1.2:*:*:*:*:*:*:*
cpe:2.3:a:oracle:enterprise_manager_grid_control:10.1.0.2:*:*:*:*:*:*:*
EPSS
Процентиль: 96%
0.27664
Средний
9.8 Critical
CVSS3
7.2 High
CVSS2
Дефекты
CWE-131
Связанные уязвимости
CVSS3: 9.8
github
больше 3 лет назад
Buffer overflow in extproc in Oracle 10g allows remote attackers to execute arbitrary code via environment variables in the library name, which are expanded after the length check is performed.
EPSS
Процентиль: 96%
0.27664
Средний
9.8 Critical
CVSS3
7.2 High
CVSS2
Дефекты
CWE-131