SB2023041850 - Multiple vulnerabilities in Oracle Essbase

Description

This security bulletin contains information about 4 secuirty vulnerabilities.

1) Improper input validation (CVE-ID: CVE-2023-21944)

The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

The vulnerability exists due to improper input validation within the Security and Provisioning component in Oracle Essbase. A remote non-authenticated attacker can exploit this vulnerability to gain access to sensitive information.

2) Improper input validation (CVE-ID: CVE-2023-21943)

The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

The vulnerability exists due to improper input validation within the Security and Provisioning component in Oracle Essbase. A remote non-authenticated attacker can exploit this vulnerability to gain access to sensitive information.

3) Improper input validation (CVE-ID: CVE-2023-21942)

The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

The vulnerability exists due to improper input validation within the Security and Provisioning component in Oracle Essbase. A remote non-authenticated attacker can exploit this vulnerability to gain access to sensitive information.

4) Use-after-free (CVE-ID: CVE-2023-0215)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a use-after-free error within the BIO_new_NDEF function. A remote attacker can trigger a use-after-free error and perform a denial of service (DoS) attack.

Remediation

Install update from vendor's website.

References

• https://www.oracle.com/security-alerts/cpuapr2023.html?917625