CVE-2015-0393
First published: Wed Jan 21 2015(Updated: )
Unspecified vulnerability in the Oracle Applications DBA component in Oracle E-Business Suite 11.5.10.2, 12.0.6, 12.1.3, 12.2.2, 12.2.3, and 12.2.4 allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors related to DB Privileges. NOTE: the previous information is from the January 2015 CPU. Oracle has not commented on the researcher's claim that the PUBLIC role is granted the INDEX privilege for the DUAL table during a "seeded install," which allows remote authenticated users to gain SYSDBA privileges and execute arbitrary code.
Credit: secalert_us@oracle.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Oracle E-Business Suite | =11.5.10.2 | |
| Oracle E-Business Suite | =12.0.6 | |
| Oracle E-Business Suite | =12.1.3 | |
| Oracle E-Business Suite | =12.2.2 | |
| Oracle E-Business Suite | =12.2.3 | |
| Oracle E-Business Suite | =12.2.4 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- collector/nvd-index
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/last-modified-date
- agent/references
- agent/author
- agent/remedy
- agent/description
- agent/tags
- agent/event
- agent/first-publish-date
- agent/source
- vendor/oracle
- canonical/oracle e-business suite
- version/oracle e-business suite/11.5.10.2
- version/oracle e-business suite/12.0.6
- version/oracle e-business suite/12.1.3
- version/oracle e-business suite/12.2.2
- version/oracle e-business suite/12.2.3
- version/oracle e-business suite/12.2.4