CVE-2009-1012
En bref
- Source
- NVD
- EPSS
- EPSS 3.92 % · centile 90 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- oracle
- Statut NVD
- Modified
Rechercher sur…
Description
Unspecified vulnerability in the plug-ins for Apache and IIS web servers in Oracle BEA WebLogic Server 7.0 Gold through SP7, 8.1 Gold through SP6, 9.0, 9.1, 9.2 Gold through MP3, 10.0 Gold through MP1, and 10.3 allows remote attackers to affect confidentiality, integrity, and availability. NOTE: the previous information was obtained from the April 2009 CPU. Oracle has not commented on claims from a reliable researcher that this is an integer overflow in an unspecified plug-in that parses HTTP requests, which leads to a heap-based buffer overflow.
Références
- http://www.securitytracker.com/id?1022059
- http://www.securityfocus.com/bid/34461
- https://exchange.xforce.ibmcloud.com/vulnerabilities/64935
- http://www.us-cert.gov/cas/techalerts/TA09-105A.html
- http://www.oracle.com/technetwork/topics/security/cpuapr2009-099563.html
- http://secunia.com/secunia_research/2009-22/
- http://www.oracle.com/technology/deploy/security/wls-security/1012.html
- http://osvdb.org/53765
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 2.0 | HIGH 10.0 | AV:N/AC:L/Au:N/C:C/I:C/A:C | NVD · nvd@nist.gov (Primary) |
Références européennes
- ENISA EUVD · EUVD-2009-1013
- GCVE · GCVE-0-2009-1012
Avis du CERT-FR
- CERTA-2009-AVI-154 — Multiples vulnérabilités des produits Oracle · cert.ssi.gouv.fr
Configurations affectées (CPE NVD)
cpe:2.3:a:oracle:bea_product_suite:7.0:sp7:*:*:*:*:*:*cpe:2.3:a:oracle:bea_product_suite:8.1:sp6:*:*:*:*:*:*cpe:2.3:a:oracle:bea_product_suite:9.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:bea_product_suite:9.1:*:*:*:*:*:*:*cpe:2.3:a:oracle:bea_product_suite:9.2:mp3:*:*:*:*:*:*cpe:2.3:a:oracle:bea_product_suite:10.0:mp1:*:*:*:*:*:*cpe:2.3:a:oracle:bea_product_suite:10.3:*:*:*:*:*:*:*
Produits affectés
| Produit | Versions |
|---|---|
| affected n/a |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |