NCSC-2025-0123

Oracle heeft kwetsbaarheden verholpen in diverse Oracle Database Producten en subsystemen, zoals Oracle Server, NoSQL, TimesTen, Secure Backup en Essbase.

De kwetsbaarheden stellen ongeauthenticeerde kwaadwillenden in staat om een Denial-of-Service te veroorzaken of om ongeautoriseerde toegang te verkrijgen tot gevoelige gegevens en gegevens te manipuleren. Subcomponenten als de RDBMS Listener, Java VM, en andere componenten zijn specifiek kwetsbaar, met CVSS-scores variërend van 5.3 tot 7.5, wat duidt op een gematigd tot hoog risico.

Oracle heeft updates uitgebracht om de kwetsbaarheden te verhelpen. Zie bijgevoegde referenties voor meer informatie.

medium

high

Covert Timing Channel

Improper Verification of Cryptographic Signature

Improper Validation of Syntactic Correctness of Input

Out-of-bounds Read

Improper Resource Shutdown or Release

Uncontrolled Resource Consumption

Deserialization of Untrusted Data

Server-Side Request Forgery (SSRF)

Out-of-bounds Write

Improper Input Validation

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Path Equivalence: 'file.name' (Internal Dot)

Sensitive Information in Resource Not Removed Before Reuse

Use of Incorrectly-Resolved Name or Reference

Incorrect Resource Transfer Between Spheres

Improper Handling of Exceptional Conditions

Improper Handling of Case Sensitivity

Off-by-one Error

URL Redirection to Untrusted Site ('Open Redirect')

Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

Unprotected Transport of Credentials

Integer Overflow or Wraparound

Sensitive Cookie in HTTPS Session Without 'Secure' Attribute

Improper Authorization

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Improper Access Control

Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

NULL Pointer Dereference

Incomplete Cleanup

Improper Control of Generation of Code ('Code Injection')

Allocation of Resources Without Limits or Throttling

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Uncontrolled Recursion

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Exposure of Sensitive Information to an Unauthorized Actor

Heap-based Buffer Overflow

Stack-based Buffer Overflow

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

Improper Privilege Management

Improper Authentication