NCSC-2024-0414

Oracle heeft kwetsbaarheden verholpen in diverse Communications producten en systemen.

Een kwaadwillende kan de kwetsbaarheden misbruiken om aanvallen uit te voeren die kunnen leiden tot de volgende categorieën schade:

• Denial-of-Service (DoS)
• Manipuleren van gegevens
• Uitvoer van willekeurige code (Gebruikersrechten)
• Uitvoer van willekeurige code (Administratorrechten)
• Toegang tot gevoelige gegevens

Oracle heeft updates uitgebracht om de kwetsbaarheden te verhelpen. Zie bijgevoegde referenties voor meer informatie.

medium

high

Heap-based Buffer Overflow

Loop with Unreachable Exit Condition ('Infinite Loop')

Improper Input Validation

Return of Pointer Value Outside of Expected Range

Unchecked Input for Loop Condition

Detection of Error Condition Without Action

Asymmetric Resource Consumption (Amplification)

Truncation of Security-relevant Information

Signal Handler Race Condition

Multiple Interpretations of UI Input

Improper Handling of Length Parameter Inconsistency

Missing Release of Resource after Effective Lifetime

Incorrect Resource Transfer Between Spheres

Buffer Over-read

Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')

Acceptance of Extraneous Untrusted Data With Trusted Data

Improper Handling of Exceptional Conditions

Excessive Iteration

Inefficient Algorithmic Complexity

Improper Check for Unusual or Exceptional Conditions

Improper Check or Handling of Exceptional Conditions

Uncontrolled Search Path Element

URL Redirection to Untrusted Site ('Open Redirect')

Signed to Unsigned Conversion Error

Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

Improper Encoding or Escaping of Output

Insufficient Verification of Data Authenticity

Improper Neutralization of Special Elements used in a Command ('Command Injection')

Integer Overflow or Wraparound

UNIX Symbolic Link (Symlink) Following

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Out-of-bounds Read

Improper Resource Shutdown or Release

Improper Access Control

Improper Restriction of Operations within the Bounds of a Memory Buffer

Use After Free

Missing Release of Memory after Effective Lifetime

NULL Pointer Dereference

Incomplete Cleanup

Improper Control of Generation of Code ('Code Injection')

Uncontrolled Resource Consumption

Allocation of Resources Without Limits or Throttling

Uncaught Exception

Uncontrolled Recursion

Server-Side Request Forgery (SSRF)

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Out-of-bounds Write

Exposure of Sensitive Information to an Unauthorized Actor