SB2025102177 - Multiple vulnerabilities in Oracle Solaris

Description

This security bulletin contains information about 7 secuirty vulnerabilities.

1) Heap-based buffer overflow (CVE-ID: CVE-2025-54874)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error within the opj_jp2_read_header() function in src/lib/openjp2/jp2.c. A remote attacker can pass specially crafted image to the application, trigger a heap-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

2) Resource exhaustion (CVE-ID: CVE-2025-48989)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources when handling HTTP/2 requests. A remote attacker can send specially crafted HTTP request to the web server and consume all available memory resources, leading to a denial of service. 

Note, this vulnerability is known as HTTP/2 Made You Reset Attack.

3) Heap-based buffer overflow (CVE-ID: CVE-2025-7345)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error within the gdk_pixbuf__jpeg_image_load_increment() function in io-jpeg.c. A remote attacker can pass a specially crafted JPEG mage to the application, trigger a heap-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

4) SQL injection (CVE-ID: CVE-2025-57833)

The vulnerability allows a remote attacker to execute arbitrary SQL queries in database.

The vulnerability exists due to insufficient sanitization of user-supplied data in FilteredRelation column aliases. A remote attacker can send a specially crafted request to the affected application and execute arbitrary SQL commands within the application database.

Successful exploitation of this vulnerability may allow a remote attacker to read, delete, modify data in database and gain complete control over the affected application.

5) Input validation error (CVE-ID: CVE-2025-52434)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input when handling HTTP/2 requests with APR/Native. A remote attacker can send specially crafted HTTP requests to the server and perform a denial of service (DoS) attack.

6) Resource management error (CVE-ID: CVE-2025-52520)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to overflow in file upload limit. A remote attacker can send specially crafted requests to the server and perform a denial of service (DoS) attack.

7) Resource exhaustion (CVE-ID: CVE-2025-53506)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources when handling excessive HTTP/2 streams. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.

Remediation

Install update from vendor's website.

References

• https://www.oracle.com/security-alerts/bulletinoct2025.html