Oracle Patch Tuesday April 2023 Security Update Review

Oracle has released the second quarterly edition of Critical Patch Update, which contains a group of patches for 433 security vulnerabilities. Some of the vulnerabilities addressed this month impact various products. These patches address vulnerabilities in Oracle code and third-party components...

Vulnerabilities fixed in Oracle Fusion Middleware

Oracle has fixed vulnerabilities in several Oracle Fusion Middleware products. The vulnerabilities allow a malicious potentially able to launch attacks that result in the following categories of damage: Denial-of-Service DoS Manipulation of data Remote code execution Administrator/Root rights...

CVE-2023-21996

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware component: Web Services. Supported versions that are affected are 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Orac...

CVE-2023-21979

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware component: Core. Supported versions that are affected are 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle WebLogi...

CVE-2023-21964

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware component: Core. Supported versions that are affected are 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle WebLogi...

CVE-2023-21956

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware component: Web Container. Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic...

CVE-2023-21931

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware component: Core. Supported versions that are affected are 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle WebLogi...

Code injection

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware component: Web Services. Supported versions that are affected are 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Orac...

Code injection

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware component: Core. Supported versions that are affected are 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle WebLogi...

Design/Logic Flaw

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware component: Core. Supported versions that are affected are 12.2.1.3.0 and 12.2.1.4.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server...

CVE-2023-21996

CVE-2023-21996 affects Oracle WebLogic Server (Web Services component) with affected versions 12.2.1.3.0, 12.2.1.4.0, and 14.1.1.0.0. The vulnerability allows an unauthenticated attacker, over HTTP, to cause a hang or frequent crash (DOS). The F5 advisory consolidates this vulnerability under CVE...

CVE-2023-21979

Oracle WebLogic Server (Core) vulnerability CVE-2023-21979 affects Oracle Fusion Middleware WebLogic Server versions 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. An unauthenticated attacker can exploit over T3 to access or exfiltrate data, per multiple sources in the connected documents. The issue is a...

CVE-2023-21964

CVE-2023-21964 affects Oracle WebLogic Server Core, with vulnerable versions 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. The issue allows unauthenticated network access via T3 to trigger a hang or full crash (DoS). Several connected sources (Oracle APR 2023 CPU advisory, Nessus plugin, PT-2023-2481) c...

CVE-2023-21956

CVE-2023-21956 affects Oracle WebLogic Server (Fusion Middleware) Web Container. Affected: WebLogic Server versions 12.2.1.4.0 and 14.1.1.0.0. An unauthenticated attacker with network access via HTTP can compromise the server; attack requires user interaction and may lead to unauthorized update/i...

Oracle Business Intelligence Enterprise Edition (Oct 2020 CPU)

The version of Oracle Business Intelligence Enterprise Edition 12.2.1.3 and 12.2.1.4 installed on the remote host are affected by a vulnerability as referenced in the October 2020 CPU advisory. The vulnerability lies in the Oracle Business Intelligence Enterprise Edition product of Oracle Fusion...

K21406935: Oracle WebLogic Server vulnerability CVE-2022-21371

Security Advisory Description Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware component: Web Container. Supported versions that are affected are 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with...

SUSE CVE-2012-1768

Unspecified vulnerability in the Oracle Outside In Technology component in Oracle Fusion Middleware 8.3.7 allows context-dependent attackers to affect availability via unknown vectors related to Outside In Filters, a different vulnerability than CVE-2012-3109...

SUSE CVE-2012-3175

Unspecified vulnerability in the Oracle Application Server Single Sign-On component in Oracle Fusion Middleware 10.1.4.3.0 allows remote attackers to affect integrity via unknown vectors related to Redirects, a different vulnerability than CVE-2012-0518...

SUSE CVE-2012-3183

Unspecified vulnerability in the Oracle WebCenter Sites component in Oracle Fusion Middleware 6.1, 6.2, 6.3.x, 7, 7.0.1, 7.0.2, 7.0.3, 7.5, 7.6.1, 7.6.2, and 11.1.1.6.0 allows remote authenticated users to affect confidentiality and integrity via unknown vectors related to Advanced UI, a differen...

SUSE CVE-2012-5065

Unspecified vulnerability in the Oracle WebCenter Sites component in Oracle Fusion Middleware 6.1, 6.2, 6.3.x, 7, 7.0.1, 7.0.2, 7.0.3, 7.5, 7.6.1, 7.6.2, and 11.1.1.6.0 allows local users to affect integrity via unknown vectors related to ImagePicker...