CVE-2017-3246
published 2017-01-27CVE-2017-3246: Vulnerability in the Oracle Application Object Library component of Oracle E-Business Suite (subcomponent: Patching). Supported versions that are affected are…
PriorityP426medium6CVSS 3.0
AVLACLPRHUINSUCHIHAN
EPSS
0.41%
32.8th percentile
Vulnerability in the Oracle Application Object Library component of Oracle E-Business Suite (subcomponent: Patching). Supported versions that are affected are 12.1.3, 12.2.3, 12.2.4, 12.2.5 and 12.2.6. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle Application Object Library executes to compromise Oracle Application Object Library. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Application Object Library accessible data as well as unauthorized access to critical data or complete access to all Oracle Application Object Library accessible data. CVSS v3.0 Base Score 6.0 (Confidentiality and Integrity impacts).
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| oracle | application_object_library | — | — |
| oracle | application_object_library | — | — |
| oracle | application_object_library | — | — |
| oracle | application_object_library | — | — |
| oracle | application_object_library | — | — |
CVSS provenance
nvdv3.06.0MEDIUMCVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
nvdv2.03.2LOWAV:L/AC:L/Au:S/C:P/I:P/A:N
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2017-18198 libcdio: Heap-based buffer over-read in print_iso9660_recurse function in iso-info.c
bugzilla·2018-02-27·CVSS 8.8
CVE-2017-18198 [HIGH] CVE-2017-18198 libcdio: Heap-based buffer over-read in print_iso9660_recurse function in iso-info.c
CVE-2017-18198 libcdio: Heap-based buffer over-read in print_iso9660_recurse function in iso-info.c
A heap corruption bug was found in the way libcdio handled processing of ISO files. An attacker could potentially use this flaw to crash applications using libcdio by tricking them into processing crafted ISO files, thus resulting in local DoS.
Upstream issue:
https://savannah.gnu.org/bugs/?52265
Upstream release:
http://ftp.gnu.org/gnu/libcdio/libcdio-1.0.0.tar.gz
Discussion:
Created libcdio tracking bugs for this issue:
Affects: fedora-all [bug 1549713]
---
This issue has been addressed in the following products:
Red Hat Enterprise Linux 7
Via RHSA-2018:3246 https://access.redhat.com/errata/RHSA-2018:3246
Bugzilla
CVE-2017-18199 libcdio: NULL pointer dereference in realloc_symlink in rock.c
bugzilla·2018-02-27·CVSS 6.5
CVE-2017-18199 [MEDIUM] CVE-2017-18199 libcdio: NULL pointer dereference in realloc_symlink in rock.c
CVE-2017-18199 libcdio: NULL pointer dereference in realloc_symlink in rock.c
The realloc_symlink in rock.c in GNU libcdio before 1.0.0 allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted ISO file.
Upstream issue:
https://savannah.gnu.org/bugs/?52264
Discussion:
Created libcdio tracking bugs for this issue:
Affects: fedora-all [bug 1549713]
---
This issue has been addressed in the following products:
Red Hat Enterprise Linux 7
Via RHSA-2018:3246 https://access.redhat.com/errata/RHSA-2018:3246
http://www.oracle.com/technetwork/security-advisory/cpujan2017-2881727.htmlhttp://www.securityfocus.com/bid/95604http://www.securitytracker.com/id/1037639http://www.oracle.com/technetwork/security-advisory/cpujan2017-2881727.htmlhttp://www.securityfocus.com/bid/95604http://www.securitytracker.com/id/1037639
2017-01-27
Published