Информационная безопасность
[RU] switch to English


Очередной пакет обновлений к Oracle
дополнено с 18 апреля 2007 г.
Опубликовано:20 апреля 2007 г.
Источник:
SecurityVulns ID:7601
Тип:удаленная
Уровень опасности:
7/10
Описание:Очередной пакет исправлений устраняет 36 уязвимостей в продуктах Oracle, включая 13 уязвимостей сервера баз данных.
Затронутые продукты:ORACLE : Oracle 9i
 ORACLE : Oracle 10g
 ORACLE : Oracle Secure Enterprise Search 10g
 ORACLE : Oracle Application Server 10g
 ORACLE : Oracle10g Collaboration Suite
 ORACLE : Oracle E-Business Suite Release 11i
 ORACLE : Oracle E-Business Suite Release 12
 ORACLE : Oracle Enterprise Manager 9i
 ORACLE : PeopleTools 8.48
 ORACLE : PeopleTools 8.47
 ORACLE : PeopleTools 8.22
 ORACLE : Human Capital Management 8.9
 ORACLE : JD Edwards EnterpriseOne Tools 8.96
CVE:CVE-2007-2170 (The APPLSYS.FND_DM_NODES package in Oracle E-Business Suite does not check for valid sessions, which allows remote attackers to delete arbitrary nodes. NOTE: due to lack of details from Oracle, it is not clear whether this issue is related to other CVE identifiers such as CVE-2007-2126, CVE-2007-2127, or CVE-2007-2128.)
 CVE-2007-2135 (The ADI_BINARY component in the Oracle E-Business Suite allows remote attackers to download arbitrary documents from the APPS.FND_DOCUMENTS table via the ADI_DISPLAY_REPORT function, when passed a certain parameter. NOTE: due to lack of details from Oracle, it is not clear whether this issue is related to other CVE identifiers such as CVE-2007-2126, CVE-2007-2127, or CVE-2007-2128.)
Оригинальный текстdocumentSHATTER, Oracle Database Buffer overflow vulnerabilities in package DBMS_SNAP_INTERNAL (20.04.2007)
 documentZDI, ZDI-07-016: Oracle E-Business Suite Arbitrary Node Deletion Vulnerability (20.04.2007)
 document3COM, ZDI-07-017: Oracle E-Business Suite Arbitrary Document Download Vulnerability (20.04.2007)
 documentKornbrust, Alexander, Bypass Oracle Logon Trigger (18.04.2007)
 documentKornbrust, Alexander, SQL Injection in package SYS.DBMS_AQADM_SYS (18.04.2007)
 documentKornbrust, Alexander, SQL Injection in package SYS.DBMS_UPGRADE_INTERNAL (18.04.2007)
 documentKornbrust, Alexander, Cross-Site-Scripting Vulnerability in Oracle Secure Enterprise Search (SES) (18.04.2007)
 documentKornbrust, Alexander, Shutdown unprotected Oracle TNS Listener via Oracle Discoverer Servlet [AS01] (18.04.2007)
 documentORACLE, Oracle Critical Patch Update - April 2007 (18.04.2007)
Файлы:Details Oracle Critical Patch Update April 2007

О сайте | Условия использования
© SecurityVulns, 3APA3A, Владимир Дубровин
Нижний Новгород