CVE-2014-6567 Unspecified vulnerability in the Core RDBMS component in Oracle Database Server 11.1.0.7, 11.2.0.3, 11.2.0.4, 12.1.0.1, and 12.1.0.2 allows remote authenticated users to affect confidentiality, integr...
HighCVSS 9.0
EPSS 4.6%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Unspecified vulnerability in the Core RDBMS component in Oracle Database Server 11.1.0.7, 11.2.0.3, 11.2.0.4, 12.1.0.1, and 12.1.0.2 allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information is from the January 2015 CPU. Oracle has not commented on the researcher's claim that this is a stack-based buffer overflow in DBMS_AW.EXECUTE, which allows code execution via a long Current Directory Alias (CDA) command.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| oracle database server | = 11.1.0.7 | No fix listed |
| oracle database server | = 11.2.0.3 | No fix listed |
| oracle database server | = 11.2.0.4 | No fix listed |
| oracle database server | = 12.1.0.1 | No fix listed |
| oracle database server | = 12.1.0.2 | No fix listed |
References
- www.databaseforensics.com patch
- www.oracle.com patch vendor-advisory
- 72134 vdb-entry
- 1031572 vdb-entry