NCSC-2024-0411

Oracle heeft kwetsbaarheden verholpen in diverse Database producten en subsystemen, zoals de Core database, Application Express, Autonomous Health Framework, Essbase, GoldenGate, SQL Developer en Secure Backup.

Een kwaadwillende kan de kwetsbaarheden misbruiken om aanvallen uit te voeren die kunnen leiden tot de volgende categorieën schade:

• Denial-of-Service (DoS)
• Manipuleren van data
• Toegang tot gevoelige gegevens

Oracle heeft updates uitgebracht om de kwetsbaarheden te verhelpen. Zie bijgevoegde referenties voor meer informatie.

medium

high

Improper Handling of Length Parameter Inconsistency

Observable Timing Discrepancy

Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')

Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')

Improper Handling of Exceptional Conditions

Excessive Iteration

Inefficient Algorithmic Complexity

Improper Handling of Case Sensitivity

Incorrect Permission Assignment for Critical Resource

Double Free

Missing Encryption of Sensitive Data

Uncontrolled Search Path Element

Encoding Error

Integer Overflow to Buffer Overflow

Untrusted Search Path

Access of Resource Using Incompatible Type ('Type Confusion')

Improper Encoding or Escaping of Output

Insufficient Verification of Data Authenticity

Improper Neutralization of Special Elements used in a Command ('Command Injection')

Observable Discrepancy

Integer Overflow or Wraparound

Files or Directories Accessible to External Parties

Authorization Bypass Through User-Controlled Key

Out-of-bounds Read

Improper Resource Shutdown or Release

CWE-275

Improper Access Control

Improper Restriction of Operations within the Bounds of a Memory Buffer

Inefficient Regular Expression Complexity

Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

Use After Free

Missing Release of Memory after Effective Lifetime

NULL Pointer Dereference

Improper Certificate Validation

Exposure of Resource to Wrong Sphere

Inclusion of Functionality from Untrusted Control Sphere

Use of a Broken or Risky Cryptographic Algorithm

Uncontrolled Resource Consumption

Allocation of Resources Without Limits or Throttling

Deserialization of Untrusted Data

Server-Side Request Forgery (SSRF)

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Out-of-bounds Write

Exposure of Sensitive Information to an Unauthorized Actor

Heap-based Buffer Overflow

Stack-based Buffer Overflow

Incorrect Conversion between Numeric Types

Loop with Unreachable Exit Condition ('Infinite Loop')

Improper Privilege Management

Improper Input Validation

Improper Neutralization of Alternate XSS Syntax

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CWE-18

Covert Timing Channel

Unchecked Input for Loop Condition

Integer Coercion Error

Detection of Error Condition Without Action

Improperly Controlled Sequential Memory Allocation

Truncation of Security-relevant Information

Incorrect Calculation of Buffer Size

Improper Link Resolution Before File Access ('Link Following')

Missing Critical Step in Authentication