SB2022110114 - Multiple vulnerabilities in Oracle Database Server

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2022110114

SB2022110114 - Multiple vulnerabilities in Oracle Database Server

Published: November 1, 2022 Updated: January 19, 2024

Security Bulletin ID SB2022110114
Severity
High
Patch available
YES
Number of vulnerabilities 7
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

High 29% Medium 29% Low 43%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 7 secuirty vulnerabilities.


1) Improper input validation (CVE-ID: CVE-2022-21432)

The vulnerability allows a remote privileged user to perform service disruption.

The vulnerability exists due to improper input validation within the Oracle Database - Enterprise Edition RDBMS Security in Oracle Database Server. A remote privileged user can exploit this vulnerability to perform service disruption.


2) Heap-based buffer overflow (CVE-ID: CVE-2021-45943)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error within the PCIDSK::CPCIDSKFile::ReadFromFile() function in frmts/pcidsk/sdk/segment/cpcidskbinarysegment.cpp. A remote attacker can create a specially crafted file, trick the victim into opening it, trigger heap-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.


3) Improper input validation (CVE-ID: CVE-2022-0839)

The vulnerability allows a local authenticated user to gain access to sensitive information.

The vulnerability exists due to improper input validation within the Oracle SQLcl (Liquibase) in Oracle Database Server. A local authenticated user can exploit this vulnerability to gain access to sensitive information.


4) Improper input validation (CVE-ID: CVE-2022-21565)

The vulnerability allows a remote authenticated user to manipulate data.

The vulnerability exists due to improper input validation within the Java VM in Oracle Database Server. A remote authenticated user can exploit this vulnerability to manipulate data.


5) Improper input validation (CVE-ID: CVE-2022-21511)

The vulnerability allows a remote privileged user to execute arbitrary code.

The vulnerability exists due to improper input validation within the Oracle Database - Enterprise Edition Recovery in Oracle Database Server. A remote privileged user can exploit this vulnerability to execute arbitrary code.


6) Improper input validation (CVE-ID: CVE-2022-21510)

The vulnerability allows a local authenticated user to execute arbitrary code.

The vulnerability exists due to improper input validation within the Oracle Database - Enterprise Edition Sharding in Oracle Database Server. A local authenticated user can exploit this vulnerability to execute arbitrary code.


7) Improper input validation (CVE-ID: CVE-2020-35169)

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

The vulnerability exists due to improper input validation. A remote non-authenticated attacker can exploit this vulnerability to read and manipulate data.


Remediation

Install update from vendor's website.

References