vulnwire
9.0crit

CVE-2007-2114in critical feed

Multiple unspecified vulnerabilities in Oracle Database 10.1.0.5 and 10.2.0.2 have unknown impact and remote authenticated attack vectors,…

Published 19 y ago · modified 4 mo ago · JSON

CVSS
9.0
v2.0 · NVD
CISA KEV
No
not known exploited
EPSS
5.9%
percentile 93%
Public exploits
0
none known

Multiple unspecified vulnerabilities in Oracle Database 10.1.0.5 and 10.2.0.2 have unknown impact and remote authenticated attack vectors, related to (1) Change Data Capture (CDC), aka DB08, and (2) Oracle Instant Client, aka DB11. NOTE: as of 20070424, oracle has not disputed reliable claims that these issues are buffer overflows using a long CHANGE_TABLE_NAME parameter to the DBMS_CDC_IPUBLISH.CHGTAB_CACHE procedure (DB08) and Oracle Instant Client genezi utility (DB11).

Exploit prediction (EPSS)

5.90% probability of exploitation in the next 30 days, higher than 93% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
NVD2.09.0AV:N/AC:L/Au:S/C:C/I:C/A:C

Classification

Technology feeds
Oracle Database (RSS, critical only)

References

  • us-cert.gov /cas/techalerts/TA07-108A.html · third-party-advisory, x_refsource_CERT, x_transferred
  • oracle.com /technetwork/topics/security/cpuapr2007-090632.html · x_refsource_CONFIRM, x_transferred
  • securityfocus.com /bid/23532 · vdb-entry, x_refsource_BID, x_transferred
  • securitytracker.com /id?1017927 · vdb-entry, x_refsource_SECTRACK, x_transferred
  • securityfocus.com /archive/1/466329/100/200/threaded · vendor-advisory, x_refsource_HP, x_transferred
  • red-database-security.com /advisory/oracle_cpu_apr_2007.html · x_refsource_MISC, x_transferred
  • ngssoftware.com /research/papers/NGSSoftware-OracleCPUAPR2007.pdf · x_refsource_MISC, x_transferred
  • vupen.com /english/advisories/2007/1426 · vdb-entry, x_refsource_VUPEN, x_transferred
  • integrigy.com /security-resources/analysis/Integrigy_Oracle_CPU_April_2007_Analysis.pdf · x_refsource_MISC, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.