NCSC-2025-0020

Oracle heeft kwetsbaarheden verholpen in diverse database producten en subsystemen, zoals de Core Database, Graal, Application Express, GoldenGate en REST data.

De kwetsbaarheden bevinden zich in verschillende componenten van de Oracle Database, waaronder de Data Mining component en de Java VM. Deze kwetsbaarheden stellen laaggeprivilegieerde geauthenticeerde gebruikers in staat om het systeem te compromitteren, wat kan leiden tot ongeautoriseerde toegang en gegevensmanipulatie. De Java VM-kwetsbaarheid kan ook leiden tot ongeautoriseerde wijzigingen van gegevens.

Oracle heeft updates uitgebracht om de kwetsbaarheden te verhelpen. Zie bijgevoegde referenties voor meer informatie.

medium

high

Unchecked Error Condition

Misinterpretation of Input

Return of Pointer Value Outside of Expected Range

Truncation of Security-relevant Information

Incorrect Calculation of Buffer Size

Improper Validation of Specified Type of Input

Insecure Storage of Sensitive Information

Integer Underflow (Wrap or Wraparound)

Insufficient Granularity of Access Control

Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')

Improper Handling of Case Sensitivity

Time-of-check Time-of-use (TOCTOU) Race Condition

Expected Behavior Violation

Improper Validation of Syntactic Correctness of Input

Improper Check or Handling of Exceptional Conditions

Reachable Assertion

Uncontrolled Search Path Element

URL Redirection to Untrusted Site ('Open Redirect')

Authentication Bypass Using an Alternate Path or Channel

Improper Validation of Integrity Check Value

Integer Overflow or Wraparound

Improper Resource Shutdown or Release

Improper Access Control

Improper Restriction of Operations within the Bounds of a Memory Buffer

Inefficient Regular Expression Complexity

Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

NULL Pointer Dereference

Selection of Less-Secure Algorithm During Negotiation ('Algorithm Downgrade')

Improper Control of Generation of Code ('Code Injection')

Uncontrolled Resource Consumption

Allocation of Resources Without Limits or Throttling

Deserialization of Untrusted Data

Uncontrolled Recursion

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Improper Restriction of XML External Entity Reference

Out-of-bounds Write

Exposure of Sensitive Information to an Unauthorized Actor

Heap-based Buffer Overflow

Stack-based Buffer Overflow

Loop with Unreachable Exit Condition ('Infinite Loop')

Improper Input Validation

Incorrect Default Permissions