Vulnerability in Oracle Application_server
CVE-2004-1363
Buffer overflow in extproc in Oracle 10g allows remote attackers to execute arbitrary code via environment variables in the library name, which are expanded after the length check is performed.
EPSS: 0.091 (94.7th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Oracle Application_server — versions 9.0.2, 9.0.2.0.0, 9.0.2.0.1
- Oracle Collaboration_suite
- Oracle Database_server — versions 8.1.7.4, 9.0.1.4, 9.0.1.5
- Oracle E-business_suite — versions 11.5.1, 11.5.2, 11.5.3
- Oracle Enterprise_manager — versions 9, 9.0.1
- Oracle Enterprise_manager_database_control — versions 10.1.2
- Oracle Enterprise_manager_grid_control — versions 10.1.0.2
- N/a — versions n/a
Weakness classification (CWE)
References
- cve@mitre.org (VDB Entry, Third Party Advisory, vdb-entry, x_refsource_XF)
- cve@mitre.org (Patch, x_refsource_MISC, Broken Link, Vendor Advisory)
- cve@mitre.org (mailing-list, x_refsource_BUGTRAQ, Mailing List)
- cve@mitre.org (US Government Resource, x_refsource_CERT-VN, Third Party Advisory, third-party-advisory)
- cve@mitre.org (US Government Resource, Patch, Third Party Advisory, x_refsource_CERT, Broken Link, third-party-advisory)
- cve@mitre.org (Patch, VDB Entry, Third Party Advisory, vdb-entry, Broken Link, x_refsource_BID)
- cve@mitre.org (x_refsource_CONFIRM, Patch, Broken Link, Vendor Advisory)
- cve@mitre.org (vendor-advisory, x_refsource_SUNALERT, Broken Link)
Frequently asked questions
- What is CVE-2004-1363?
- CVE-2004-1363 is a critical-severity vulnerability in Oracle Application_server, classified under Incorrect Calculation of Buffer Size. CVSS score: 9.8/10. Published 2004-08-04.
- How severe is CVE-2004-1363?
- Critical severity. CVSS v3 base score is 9.8 out of 10.