Oracle Critical Patch Update Advisory - January 2015 - Beta Oracle CVRF Oracle Critical Patch Update Advisory CPUJan2015 Final 1.0 1.0 2015-01-20T13:00:00-07:00 Initial Distribution 2015-01-20T13:00:00-07:00 2015-01-20T13:00:00-07:00 This document contains descriptions of Oracle product security vulnerabilities which have had fixes released for all supported versions and platforms for the associated product. Additional information regarding these vulnerabilities including fix distribution information can be found at the Oracle sites referenced in this document. This document is published at: http://www.oracle.com/ocom/groups/public/@otn/documents/webcontent/2367957.xml http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html URL to html version of Advisory Abdullah Erdem Abdullah Erdem Adam Willard Foreground Security Advanced Threat Research Team, Intel Security Intel Alexander Chizhov Alexander Chizhov Alexander Kornbrust Red Database Security Alexey Makhmutov Wouter Coekaerts Amir Sohail Amir Sohail Arjun V Arjun V Avik Sarkar Avik Sarkar Ayoub Nait Lamine Ayoub Nait Lamine Bart Kulach NN Group N.V. Ben Khlifa Fahmi Ben Khlifa Fahmi Bruce Robb J&B Computing Services Cameron Crowley Cameron Crowley Christian Galeone Christian Galeone David Litchfield Datacom TSS Diego Matos CIPHER Intelligence Lab Edmund Goh KPMG Management Consulting, Singapore Edward Torkington NCC Group Frank Cozijnsen KPN Gabor Pesti Gabor Pesti Gaurav Mishra Gaurav Mishra George Nosenko Digital Security Research Group Gopal Bisht Gopal Bisht Gurjant Singh Sadhra Gurjant Singh Sadhra Joeri de Ruiter Radboud University Nijmegen John Munoz Google Karthik E C Karthik E C Karthikeyan Bhargavan Karthikeyan Bhargavan Khai Tran Netspi Khalifa Al Shamsi Help AG Koutrouss Naddara on gmail Koutrouss Naddara on gmail M.Asim Shahzad M.Asim Shahzad Mohammed Osman Mohammed Osman Monendra Sahu Monendra Sahu Mousab Elhag Mousab Elhag Muhammad Sarmad Shafiq Muhammad Sarmad Shafiq Oliver Gruskovnjak Portcullis Inc Rakesh Singh Zero Day Guys Sandeep Venkatesan Sandeep Venkatesan Sky_BlaCk Sky_BlaCk Sreehari Sreehari Srikanth Y Srikanth Y Tomas Hoger Red Hat Tor Erling Bjorstad Tor Erling Bjorstad Tudor Enache Help AG Vivek Singh FINRA Wouter Coekaerts Wouter Coekaerts Yann CAM Yann CAM Yasumasa Suenaga Yasumasa Suenaga Communications Messaging Server Version 7.0.5.33.0 and earlier Communications Diameter Signaling Router (DSR) Version 3.x Communications Diameter Signaling Router (DSR) Version 4.x Communications Diameter Signaling Router (DSR) Version 5.0 Oracle Database Version 11.1.0.7 Oracle Database Version 11.2.0.3 Oracle Database Version 11.2.0.4 Oracle Database Version 12.1.0.1 Oracle Database Version 12.1.0.2 PL/SQL Version 11.1.0.7 PL/SQL Version 11.2.0.3 PL/SQL Version 11.2.0.4 PL/SQL Version 12.1.0.1 XML Developers Kit Version 11.2.0.3 XML Developers Kit Version 11.2.0.4 XML Developers Kit Version 12.1.0.1 XML Developers Kit Version 12.1.0.2 Workspace Manager Version 11.1.0.7 Workspace Manager Version 11.2.0.3 Workspace Manager Version 11.2.0.4 Workspace Manager Version 12.1.0.1 OLAP Version 11.1.0.7 OLAP Version 11.2.0.3 OLAP Version 11.2.0.4 OLAP Version 12.1.0.1 OLAP Version 12.1.0.2 Applications DBA Version 11.5.10.2 Applications DBA Version 12.0.6 Applications DBA Version 12.1.3 Applications DBA Version 12.2.2 Applications DBA Version 12.2.3 Applications DBA Version 12.2.4 Marketing Version 11.5.10.2 Marketing Version 12.0.4 Marketing Version 12.0.5 Marketing Version 12.0.6 Marketing Version 12.1.1 Marketing Version 12.1.2 Marketing Version 12.1.3. Customer Intelligence Version 11.5.10.2 Customer Intelligence Version 12.0.4 Customer Intelligence Version 12.0.5 Customer Intelligence Version 12.0.6 Customer Intelligence Version 12.1.1 Customer Intelligence Version 12.1.2 Customer Intelligence Version 12.1.3 Customer Intelligence Version 12.2.2 Customer Intelligence Version 12.2.3 Customer Intelligence Version 12.2.4 Application Object Library Version 12.1.3 Web Applications Desktop Integrator Version 11.5.10.2 Web Applications Desktop Integrator Version 12.0.6 Web Applications Desktop Integrator Version 12.1.3 Web Applications Desktop Integrator Version 12.2.2 Web Applications Desktop Integrator Version 12.2.3 Web Applications Desktop Integrator Version 12.2.4 Telecommunications Billing Integrator Version 11.5.10.2 Telecommunications Billing Integrator Version 12.0.4 Telecommunications Billing Integrator Version 12.0.5 Telecommunications Billing Integrator Version 12.0.6 Telecommunications Billing Integrator Version 12.1.1 Telecommunications Billing Integrator Version 12.1.2 Telecommunications Billing Integrator Version 12.1.3 Telecommunications Billing Integrator Version 12.2.2 Telecommunications Billing Integrator Version 12.2.3 Telecommunications Billing Integrator Version 12.2.4 Customer Interaction History Version 12.0.4 Customer Interaction History Version 12.0.5 Customer Interaction History Version 12.0.6 Customer Interaction History Version 12.1.1 Customer Interaction History Version 12.1.2 Customer Interaction History Version 12.1.3 Customer Interaction History Version 12.2.2 Customer Interaction History Version 12.2.3 Customer Interaction History Version 12.2.4 Applications Framework Version 11.5.10.2 Applications Framework Version 12.0.6 Applications Framework Version 12.1.3 Applications Framework Version 12.2.2 Applications Framework Version 12.2.3 Applications Framework Version 12.2.4 HCM Configuration Workbench Version 11.5.10.2 HCM Configuration Workbench Version 12.0.4 HCM Configuration Workbench Version 12.0.5 HCM Configuration Workbench Version 12.0.6 HCM Configuration Workbench Version 12.1.1 HCM Configuration Workbench Version 12.1.2 HCM Configuration Workbench Version 12.1.3 HCM Configuration Workbench Version 12.2.2 HCM Configuration Workbench Version 12.2.3 HCM Configuration Workbench Version 12.2.4 Enterprise Manager Base Platform Version 12.1.0.3 Enterprise Manager Base Platform Version 12.1.0.4 Enterprise Manager Ops Center Version 11.1 Enterprise Manager Ops Center Version 11.1.3 Enterprise Manager Ops Center Version 12.1 Enterprise Manager Ops Center Version 12.1.4 Enterprise Manager Ops Center Version 12.2 Forms Version 11.1.1.7 Forms Version 11.1.2.2 Reports Developer Version 11.1.1.7 Reports Developer Version 11.1.2.2 Security Service Version FMW: 12.1.3 Security Service Version OHS: 12.1.2 HTTP Server Version 10.1.3.5.0 HTTP Server Version 11.1.1.7.0 HTTP Server Version 12.1.2.0 HTTP Server Version 12.1.3.0 SOA Suite Version 11.1.1.7 SOA Suite Version 12.1.3.0 Containers for J2EE Version 10.1.3.5 BI Publisher (formerly XML Publisher) Version 10.1.3.4.2 BI Publisher (formerly XML Publisher) Version 11.1.1.7 Business Intelligence Enterprise Edition Version 10.1.3.4.2 Business Intelligence Enterprise Edition Version 11.1.1.7 Real-Time Decision Server Version 11.1.1.7 Real-Time Decision Server Version RTD Platform 3.0.x WebCenter Content Version 11.1.1.8.0 Adaptive Access Manager Version 11.1.1.5 Adaptive Access Manager Version 11.1.1.7 Adaptive Access Manager Version 11.1.2.1 Adaptive Access Manager Version 11.1.2.2 WebLogic Server Version 10.0.2.0 WebLogic Server Version 10.3.6.0 WebLogic Server Version 12.1.1.0 WebLogic Server Version 12.1.2.0 WebLogic Server Version 12.1.3.0 WebLogic Portal Version 10.0.1.0 WebLogic Portal Version 10.2.1.0 WebLogic Portal Version 10.3.6.0 Access Manager Version 11.1.1.5 Access Manager Version 11.1.1.7 Access Manager Version 11.1.2.1 Access Manager Version 11.1.2.2 GlassFish Server Version 3.0.1 GlassFish Server Version 3.1.2 Directory Server Enterprise Edition Version 11.1.1.7 Directory Server Enterprise Edition Version 7.0 Waveset Version 8.1.1 OpenSSO Version 8.0 Update 2 Patch 5 Exalogic Infrastructure Version 2.0.6.2.0 (for all X2-2 Exalogic Infrastructure Version X3-2 Exalogic Infrastructure Version X4-2) Healthcare Master Person Index Version 1.x Healthcare Master Person Index Version 2.x JD Edwards EnterpriseOne Tools Version 9.1.5 Java Version JRockit 27.8.4 Java Version JRockit 28.3.4 Java Version JRockit R27.8.4 Java Version JRockit R28.3.4 Java Version Java SE 5.0u75 Java Version Java SE 6u85 Java Version Java SE 7u72 Java Version Java SE 8u25 Java Version Java SE Embedded 7u71 Java Version Java SE Embedded 8u6 MySQL Server Version 5.5.38 and earlier MySQL Server Version 5.5.40 and earlier MySQL Server Version 5.6.19 and earlier MySQL Server Version 5.6.21 and earlier PeopleSoft Enterprise HCM Time and Labor Version 9.1 PeopleSoft Enterprise PT PeopleTools Version 8.52 PeopleSoft Enterprise PT PeopleTools Version 8.53 PeopleSoft Enterprise PT PeopleTools Version 8.54 MICROS Retail Version 3.4.2 MICROS Retail Version 3.5.0 MICROS Retail Version 4.0.1 MICROS Retail Version 4.5.1 MICROS Retail Version 4.8.0 MICROS Retail Version 5.0.3 MICROS Retail Version 5.5.3 MICROS Retail Version 6.0.6 MICROS Retail Version 6.5.2 MICROS Retail Version Xstore: 3.2.1 Siebel Core - Server BizLogic Script Version 8.1.1 Siebel Core - Server BizLogic Script Version 8.2.2 Siebel Core - Server Infrastructure Version 8.1.1 Siebel Core - Server Infrastructure Version 8.2.2 Siebel Core - Server OM Svcs Version 8.1.1 Siebel Core - Server OM Svcs Version 8.2.2 Siebel Core - System Management Version 8.1.1 Siebel Core - System Management Version 8.2.2 Siebel UI Framework Version 8.1.1 Siebel UI Framework Version 8.2.2 Siebel Core - Unix/Windows Version 8.1.1 Siebel Core - Unix/Windows Version 8.2.2 Siebel Core - EAI Version 8.1.1 Siebel Core - EAI Version 8.2.2 Siebel Public Sector Version 8.1.1 Siebel Public Sector Version 8.2.2 Siebel Life Sciences Version 8.1.1 Siebel Life Sciences Version 8.2.2 Siebel Core - Common Components Version 8.1.1 Siebel Core - Common Components Version 8.2.2 SPARC - OPL Service Processor (XCP) Version XCP prior to XCP 1118 SPARC - OPL Service Processor (XCP) Version XCP prior to XCP 1119 SSM - (hot-tamale) ILOM: Integrated Lights Out Manager Version ILOM prior to 3.2.4 Solaris Cluster Version 3.3 Solaris Cluster Version 4.1 Solaris Operating System Version 10 Solaris Operating System Version 11 Fujitsu M10 Firmware Version XCP prior to XCP 2232 Fujitsu M10 Firmware Version XCP prior to XCP 2240 Transportation Management Version 6.1 Transportation Management Version 6.2 Transportation Management Version 6.3 Transportation Management Version 6.3.0 Transportation Management Version 6.3.0 6.3.1 Transportation Management Version 6.3.1 Transportation Management Version 6.3.2 Transportation Management Version 6.3.3 Transportation Management Version 6.3.4 Transportation Management Version 6.3.5 Agile Product Collaboration Version 9.3.3 Agile Product Lifecycle Management for Process Version 6.1.0.3 Oracle VM VirtualBox Version 4.0.26 Oracle VM VirtualBox Version 4.0.28 Oracle VM VirtualBox Version 4.1.34 Oracle VM VirtualBox Version 4.1.36 Oracle VM VirtualBox Version 4.2.26 Oracle VM VirtualBox Version 4.2.28 Oracle VM VirtualBox Version 4.3.14 Oracle VM VirtualBox Version VirtualBox prior to 3.2.24 Oracle VM VirtualBox Version VirtualBox prior to 3.2.26 Oracle VM VirtualBox Version VirtualBox prior to 4.3.20 Secure Global Desktop Version 4.63 Secure Global Desktop Version 4.71 Secure Global Desktop Version 5.0 Secure Global Desktop Version 5.1 iLearning Version 6.0 iLearning Version 6.1 Vulnerability in the Solaris component of Oracle Sun Systems Products Suite (subcomponent: AMD pcnet driver). Supported versions that are affected are 10 and 11. Easily exploitable vulnerability allows successful unauthenticated network attacks via TCP/IP. Successful attack of this vulnerability can result in unauthorized read access to a subset of Solaris accessible data. CVSS Base Score 5.0 (Confidentiality impacts). CVSS V2 Vector: (AV:N/AC:L/Au:N/C:P/I:N/A:N). Oracle Vector: (AV:N/AC:L/Au:N/C:P/I:N/A:N). Fix has been released CVE-2003-0001 P-10006V-10 P-10006V-11 5.0 AV:N/AC:L/Au:N/C:P/I:N/A:N CPUJan2015 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html P-10006V-10 P-10006V-11 Vulnerability in the Solaris component of Oracle Sun Systems Products Suite (subcomponent: Network). Supported versions that are affected are 10 and 11. Easily exploitable vulnerability allows successful unauthenticated network attacks via TCP/IP. Successful attack of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Solaris. CVSS Base Score 5.0 (Availability impacts). CVSS V2 Vector: (AV:N/AC:L/Au:N/C:N/I:N/A:P). Oracle Vector: (AV:N/AC:L/Au:N/C:N/I:N/A:P). Fix has been released CVE-2004-0230 P-10006V-10 P-10006V-11 5.0 AV:N/AC:L/Au:N/C:N/I:N/A:P CPUJan2015 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html P-10006V-10 P-10006V-11 Vulnerability in the SPARC Enterprise M3000, M4000, M5000, M8000, M9000 Servers component of Oracle Sun Systems Products Suite (subcomponent: XCP Firmware). The supported version that is affected is XCP prior to XCP 1118. Easily exploitable vulnerability allows successful unauthenticated network attacks via SSH. Successful attack of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of SPARC Enterprise M3000, M4000, M5000, M8000, M9000 Servers. CVSS Base Score 5.0 (Availability impacts). CVSS V2 Vector: (AV:N/AC:L/Au:N/C:N/I:N/A:P). Oracle Vector: (AV:N/AC:L/Au:N/C:N/I:N/A:P). Fix has been released CVE-2010-5107 P-9845V-XCP prior to XCP 1118 5.0 AV:N/AC:L/Au:N/C:N/I:N/A:P CPUJan2015 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html P-9845V-XCP prior to XCP 1118 Vulnerability in the Oracle HTTP Server component of Oracle Fusion Middleware (subcomponent: Web Listener). Supported versions that are affected are 11.1.1.7.0, 12.1.2.0 and 12.1.3.0. Difficult to exploit vulnerability allows successful unauthenticated network attacks via HTTP. Successful attack of this vulnerability can result in unauthorized Operating System takeover including arbitrary code execution. CVSS Base Score 9.3 (Confidentiality, Integrity and Availability impacts). CVSS V2 Vector: (AV:N/AC:M/Au:N/C:C/I:C/A:C). Oracle Vector: (AV:N/AC:M/Au:N/C:C/I:C/A:C). Fix has been released CVE-2011-1944 P-1042V-11.1.1.7.0 P-1042V-12.1.2.0 P-1042V-12.1.3.0 9.3 AV:N/AC:M/Au:N/C:C/I:C/A:C CPUJan2015 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html P-1042V-11.1.1.7.0 P-1042V-12.1.2.0 P-1042V-12.1.3.0 Vulnerability in the SPARC Enterprise M3000, M4000, M5000, M8000, M9000 Servers component of Oracle Sun Systems Products Suite (subcomponent: XCP Firmware). The supported version that is affected is XCP prior to XCP 1118. Easily exploitable vulnerability allows successful unauthenticated network attacks via HTTP. Successful attack of this vulnerability can result in unauthorized read access to a subset of SPARC Enterprise M3000, M4000, M5000, M8000, M9000 Servers accessible data. Note: This fix also addresses CVE-2011-4317 and CVE-2012-0053. CVSS Base Score 5.0 (Confidentiality impacts). CVSS V2 Vector: (AV:N/AC:L/Au:N/C:P/I:N/A:N). Oracle Vector: (AV:N/AC:L/Au:N/C:P/I:N/A:N). Fix has been released CVE-2011-3368 P-9845V-XCP prior to XCP 1118 5.0 AV:N/AC:L/Au:N/C:P/I:N/A:N CPUJan2015 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html P-9845V-XCP prior to XCP 1118 Vulnerability in the Oracle Security Service component of Oracle Fusion Middleware (subcomponent: None). Supported versions that are affected are OHS: 12.1.2 and FMW: 12.1.3. Difficult to exploit vulnerability allows successful unauthenticated network attacks via HTTPS. Successful attack of this vulnerability can result in unauthorized read access to a subset of Oracle Security Service accessible data. CVSS Base Score 4.3 (Confidentiality impacts). CVSS V2 Vector: (AV:N/AC:M/Au:N/C:P/I:N/A:N). Oracle Vector: (AV:N/AC:M/Au:N/C:P/I:N/A:N). Fix has been released CVE-2011-3389 P-991V-OHS: 12.1.2 P-991V-FMW: 12.1.3 4.3 AV:N/AC:M/Au:N/C:P/I:N/A:N CPUJan2015 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html P-991V-OHS: 12.1.2 P-991V-FMW: 12.1.3 Vulnerability in the Oracle HTTP Server component of Oracle Fusion Middleware (subcomponent: Web Listener). Supported versions that are affected are 10.1.3.5.0, 11.1.1.7.0 and 12.1.2.0. Difficult to exploit vulnerability requiring logon to Operating System. Successful attack of this vulnerability can result in unauthorized update, insert or delete access to some Oracle HTTP Server accessible data as well as read access to a subset of Oracle HTTP Server accessible data and ability to cause a partial denial of service (partial DOS) of Oracle HTTP Server. CVSS Base Score 4.4 (Confidentiality, Integrity and Availability impacts). CVSS V2 Vector: (AV:L/AC:M/Au:N/C:P/I:P/A:P). Oracle Vector: (AV:L/AC:M/Au:N/C:P/I:P/A:P). Fix has been released CVE-2011-3607 P-1042V-10.1.3.5.0 P-1042V-11.1.1.7.0 P-1042V-12.1.2.0 4.4 AV:L/AC:M/Au:N/C:P/I:P/A:P CPUJan2015 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html P-1042V-10.1.3.5.0 P-1042V-11.1.1.7.0 P-1042V-12.1.2.0 Vulnerability in the Enterprise Manager Base Platform component of Oracle Enterprise Manager Grid Control (subcomponent: Agent). The supported version that is affected is 12.1.0.3. Easily exploitable vulnerability allows successful unauthenticated network attacks via HTTP. Successful attack of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Enterprise Manager Base Platform. CVSS Base Score 5.0 (Availability impacts). CVSS V2 Vector: (AV:N/AC:L/Au:N/C:N/I:N/A:P). Oracle Vector: (AV:N/AC:L/Au:N/C:N/I:N/A:P). Fix has been released CVE-2011-4461 P-1370V-12.1.0.3 5.0 AV:N/AC:L/Au:N/C:N/I:N/A:P CPUJan2015 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html P-1370V-12.1.0.3 Vulnerability in the Oracle HTTP Server component of Oracle Fusion Middleware (subcomponent: Web Listener). Supported versions that are affected are 11.1.1.7.0, 12.1.2.0 and 12.1.3.0. Difficult to exploit vulnerability allows successful unauthenticated network attacks via HTTP. Successful attack of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle HTTP Server. CVSS Base Score 4.3 (Availability impacts). CVSS V2 Vector: (AV:N/AC:M/Au:N/C:N/I:N/A:P). Oracle Vector: (AV:N/AC:M/Au:N/C:N/I:N/A:P). Fix has been released CVE-2013-0338 P-1042V-11.1.1.7.0 P-1042V-12.1.2.0 P-1042V-12.1.3.0 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P CPUJan2015 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html P-1042V-11.1.1.7.0 P-1042V-12.1.2.0 P-1042V-12.1.3.0 Vulnerability in the Enterprise Manager Ops Center component of Oracle Enterprise Manager Grid Control (subcomponent: Network). Supported versions that are affected are 11.1, 12.1 and 12.2. Difficult to exploit vulnerability allows successful unauthenticated network attacks via SSL/TLS. Successful attack of this vulnerability can result in unauthorized read access to a subset of Enterprise Manager Ops Center accessible data. CVSS Base Score 4.3 (Confidentiality impacts). CVSS V2 Vector: (AV:N/AC:M/Au:N/C:P/I:N/A:N). Oracle Vector: (AV:N/AC:M/Au:N/C:P/I:N/A:N). Fix has been released CVE-2013-1620 P-9835V-11.1 P-9835V-12.1 P-9835V-12.2 4.3 AV:N/AC:M/Au:N/C:P/I:N/A:N CPUJan2015 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html P-9835V-11.1 P-9835V-12.1 P-9835V-12.2 Vulnerability in the Oracle Directory Server Enterprise Edition component of Oracle Fusion Middleware (subcomponent: Admin Server). Supported versions that are affected are 7.0 and 11.1.1.7. Easily exploitable vulnerability allows successful unauthenticated network attacks via HTTPS. Successful attack of this vulnerability can result in unauthorized takeover of Oracle Directory Server Enterprise Edition possibly including arbitrary code execution within the Oracle Directory Server Enterprise Edition. Note: This fix also addresses CVE-2013-1620, CVE-2013-1739,CVE-2013-1740, CVE-2013-5605, CVE-2013-5606,CVE-2014-1490, CVE-2014-1491 and CVE-2014-1492. CVSS Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS V2 Vector: (AV:N/AC:L/Au:N/C:P/I:P/A:P). Oracle Vector: (AV:N/AC:L/Au:N/C:P+/I:P+/A:P+). Fix has been released CVE-2013-1741 P-8512V-7.0 P-8512V-11.1.1.7 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P CPUJan2015 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html P-8512V-7.0 P-8512V-11.1.1.7 Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Config, WLS Console). Supported versions that are affected are 10.3.6.0, 12.1.1.0, 12.1.2.0 and 12.1.3.0. Easily exploitable vulnerability allows successful unauthenticated network attacks via HTTP. Successful attack of this vulnerability can result in unauthorized update, insert or delete access to some Oracle WebLogic Server accessible data as well as read access to a subset of Oracle WebLogic Server accessible data and ability to cause a partial denial of service (partial DOS) of Oracle WebLogic Server. Note: This fix also addresses CVE-2014-0050. The CVSS score is taken from <A HREF="http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-2186">http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-2186</a>. CVSS Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS V2 Vector: (AV:N/AC:L/Au:N/C:P/I:P/A:P). Oracle Vector: (AV:N/AC:L/Au:N/C:P/I:P/A:P). Fix has been released CVE-2013-2186 P-5242V-10.3.6.0 P-5242V-12.1.1.0 P-5242V-12.1.2.0 P-5242V-12.1.3.0 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P CPUJan2015 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html P-5242V-10.3.6.0 P-5242V-12.1.1.0 P-5242V-12.1.2.0 P-5242V-12.1.3.0 Vulnerability in the Oracle Healthcare Master Person Index component of Oracle Health Sciences Applications (subcomponent: Internal Operations). Supported versions that are affected are 1.x and 2.x. Easily exploitable vulnerability allows successful unauthenticated network attacks via HTTP. Successful attack of this vulnerability can result in unauthorized update, insert or delete access to some Oracle Healthcare Master Person Index accessible data as well as read access to a subset of Oracle Healthcare Master Person Index accessible data and ability to cause a partial denial of service (partial DOS) of Oracle Healthcare Master Person Index. Note: This fix also addresses CVE-2014-0050. The CVSS score is taken from <A HREF="http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-2186">http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-2186</a>. CVSS Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS V2 Vector: (AV:N/AC:L/Au:N/C:P/I:P/A:P). Oracle Vector: (AV:N/AC:L/Au:N/C:P/I:P/A:P). Fix has been released CVE-2013-2186 P-8575V-1.x P-8575V-2.x 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P CPUJan2015 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html P-8575V-1.x P-8575V-2.x Vulnerability in the Enterprise Manager Ops Center component of Oracle Enterprise Manager Grid Control (subcomponent: File Upload Utility). Supported versions that are affected are 11.1.3 and 12.1.4. Easily exploitable vulnerability allows successful unauthenticated network attacks via HTTP. Successful attack of this vulnerability can result in unauthorized update, insert or delete access to some Enterprise Manager Ops Center accessible data as well as read access to a subset of Enterprise Manager Ops Center accessible data and ability to cause a partial denial of service (partial DOS) of Enterprise Manager Ops Center. Note: This fix also addresses CVE-2014-0050. The CVSS score is taken from <A HREF="http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-2186">http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-2186</a>. CVSS Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS V2 Vector: (AV:N/AC:L/Au:N/C:P/I:P/A:P). Oracle Vector: (AV:N/AC:L/Au:N/C:P/I:P/A:P). Fix has been released CVE-2013-2186 P-9835V-11.1.3 P-9835V-12.1.4 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P CPUJan2015 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html P-9835V-11.1.3 P-9835V-12.1.4 Vulnerability in the Oracle HTTP Server component of Oracle Fusion Middleware (subcomponent: Web Listener). Supported versions that are affected are 11.1.1.7.0, 12.1.2.0 and 12.1.3.0. Easily exploitable vulnerability allows successful unauthenticated network attacks via HTTP. Successful attack of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle HTTP Server. CVSS Base Score 5.0 (Availability impacts). CVSS V2 Vector: (AV:N/AC:L/Au:N/C:N/I:N/A:P). Oracle Vector: (AV:N/AC:L/Au:N/C:N/I:N/A:P). Fix has been released CVE-2013-2877 P-1042V-11.1.1.7.0 P-1042V-12.1.2.0 P-1042V-12.1.3.0 5.0 AV:N/AC:L/Au:N/C:N/I:N/A:P CPUJan2015 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html P-1042V-11.1.1.7.0 P-1042V-12.1.2.0 P-1042V-12.1.3.0 Vulnerability in the BI Publisher (formerly XML Publisher) component of Oracle Fusion Middleware (subcomponent: BI Publisher Security). Supported versions that are affected are 10.1.3.4.2 and 11.1.1.7. Difficult to exploit vulnerability allows successful unauthenticated network attacks via HTTP. Successful attack of this vulnerability can result in unauthorized update, insert or delete access to some BI Publisher (formerly XML Publisher) accessible data as well as read access to a subset of BI Publisher (formerly XML Publisher) accessible data. CVSS Base Score 5.8 (Confidentiality and Integrity impacts). CVSS V2 Vector: (AV:N/AC:M/Au:N/C:P/I:P/A:N). Oracle Vector: (AV:N/AC:M/Au:N/C:P/I:P/A:N). Fix has been released CVE-2013-4286 P-1479V-10.1.3.4.2 P-1479V-11.1.1.7 5.8 AV:N/AC:M/Au:N/C:P/I:P/A:N CPUJan2015 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html P-1479V-10.1.3.4.2 P-1479V-11.1.1.7 Vulnerability in the Enterprise Manager Ops Center component of Oracle Enterprise Manager Grid Control (subcomponent: Update Provisioning). Supported versions that are affected are 11.1.3 and 12.1.4. Difficult to exploit vulnerability allows successful unauthenticated network attacks via SSL/TLS. Successful attack of this vulnerability can result in unauthorized update, insert or delete access to some Enterprise Manager Ops Center accessible data. Note: This fix also addresses CVE-2014-0015. CVSS Base Score 4.3 (Integrity impacts). CVSS V2 Vector: (AV:N/AC:M/Au:N/C:N/I:P/A:N). Oracle Vector: (AV:N/AC:M/Au:N/C:N/I:P/A:N). Fix has been released CVE-2013-4545 P-9835V-11.1.3 P-9835V-12.1.4 4.3 AV:N/AC:M/Au:N/C:N/I:P/A:N CPUJan2015 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html P-9835V-11.1.3 P-9835V-12.1.4 Vulnerability in the Fujitsu M10-1, M10-4, M10-4S Servers component of Oracle Sun Systems Products Suite (subcomponent: XCP Firmware). The supported version that is affected is XCP prior to XCP 2232. Easily exploitable vulnerability allows successful unauthenticated network attacks via SSL/TLS. Successful attack of this vulnerability can result in unauthorized Operating System takeover including arbitrary code execution. CVSS Base Score 10.0 (Confidentiality, Integrity and Availability impacts). CVSS V2 Vector: (AV:N/AC:L/Au:N/C:C/I:C/A:C). Oracle Vector: (AV:N/AC:L/Au:N/C:C/I:C/A:C). Fix has been released CVE-2013-4784 P-10656V-XCP prior to XCP 2232 10.0 AV:N/AC:L/Au:N/C:C/I:C/A:C CPUJan2015 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html P-10656V-XCP prior to XCP 2232 Vulnerability in the Oracle HTTP Server component of Oracle Fusion Middleware (subcomponent: Web Listener). Supported versions that are affected are 10.1.3.5.0, 11.1.1.7.0, 12.1.2.0 and 12.1.3.0. Easily exploitable vulnerability allows successful unauthenticated network attacks via HTTP. Successful attack of this vulnerability can result in unauthorized update, insert or delete access to some Oracle HTTP Server accessible data. CVSS Base Score 5.0 (Integrity impacts). CVSS V2 Vector: (AV:N/AC:L/Au:N/C:N/I:P/A:N). Oracle Vector: (AV:N/AC:L/Au:N/C:N/I:P/A:N). Fix has been released CVE-2013-5704 P-1042V-10.1.3.5.0 P-1042V-11.1.1.7.0 P-1042V-12.1.2.0 P-1042V-12.1.3.0 5.0 AV:N/AC:L/Au:N/C:N/I:P/A:N CPUJan2015 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html P-1042V-10.1.3.5.0 P-1042V-11.1.1.7.0 P-1042V-12.1.2.0 P-1042V-12.1.3.0 Vulnerability in the Oracle HTTP Server component of Oracle Fusion Middleware (subcomponent: Web Listener). Supported versions that are affected are 10.1.3.5.0, 11.1.1.7.0, 12.1.2.0 and 12.1.3.0. Easily exploitable vulnerability allows successful unauthenticated network attacks via HTTP. Successful attack of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle HTTP Server. CVSS Base Score 5.0 (Availability impacts). CVSS V2 Vector: (AV:N/AC:L/Au:N/C:N/I:N/A:P). Oracle Vector: (AV:N/AC:L/Au:N/C:N/I:N/A:P). Fix has been released CVE-2013-6438 P-1042V-10.1.3.5.0 P-1042V-11.1.1.7.0 P-1042V-12.1.2.0 P-1042V-12.1.3.0 5.0 AV:N/AC:L/Au:N/C:N/I:N/A:P CPUJan2015 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html P-1042V-10.1.3.5.0 P-1042V-11.1.1.7.0 P-1042V-12.1.2.0 P-1042V-12.1.3.0 Vulnerability in the Integrated Lights Out Manager(ILOM) component of Oracle Sun Systems Products Suite (subcomponent: OpenSSL). The supported version that is affected is ILOM prior to 3.2.4. Very difficult to exploit vulnerability allows successful authenticated network attacks via SSL/TLS. Successful attack of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Integrated Lights Out Manager(ILOM). Note: This fix also addresses CVE-2013-6449. CVSS Base Score 2.1 (Availability impacts). CVSS V2 Vector: (AV:N/AC:H/Au:S/C:N/I:N/A:P). Oracle Vector: (AV:N/AC:H/Au:S/C:N/I:N/A:P). Fix has been released CVE-2013-6450 P-9849V-ILOM prior to 3.2.4 2.1 AV:N/AC:H/Au:S/C:N/I:N/A:P CPUJan2015 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html P-9849V-ILOM prior to 3.2.4 Vulnerability in the Oracle HTTP Server component of Oracle Fusion Middleware (subcomponent: Web Listener). Supported versions that are affected are 10.1.3.5.0, 11.1.1.7.0, 12.1.2.0 and 12.1.3.0. Easily exploitable vulnerability allows successful unauthenticated network attacks via HTTP. Successful attack of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle HTTP Server. CVSS Base Score 5.0 (Availability impacts). CVSS V2 Vector: (AV:N/AC:L/Au:N/C:N/I:N/A:P). Oracle Vector: (AV:N/AC:L/Au:N/C:N/I:N/A:P). Fix has been released CVE-2014-0098 P-1042V-10.1.3.5.0 P-1042V-11.1.1.7.0 P-1042V-12.1.2.0 P-1042V-12.1.3.0 5.0 AV:N/AC:L/Au:N/C:N/I:N/A:P CPUJan2015 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html P-1042V-10.1.3.5.0 P-1042V-11.1.1.7.0 P-1042V-12.1.2.0 P-1042V-12.1.3.0 Vulnerability in the Oracle Real-Time Decision Server component of Oracle Fusion Middleware (subcomponent: Decision Server). Supported versions that are affected are 11.1.1.7 and RTD Platform 3.0.x. Easily exploitable vulnerability allows successful unauthenticated network attacks via HTTP. Successful attack of this vulnerability can result in unauthorized update, insert or delete access to some Oracle Real-Time Decision Server accessible data as well as read access to a subset of Oracle Real-Time Decision Server accessible data and ability to cause a partial denial of service (partial DOS) of Oracle Real-Time Decision Server. CVSS Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS V2 Vector: (AV:N/AC:L/Au:N/C:P/I:P/A:P). Oracle Vector: (AV:N/AC:L/Au:N/C:P/I:P/A:P). Fix has been released CVE-2014-0114 P-2104V-11.1.1.7 P-2104V-RTD Platform 3.0.x 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P CPUJan2015 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html P-2104V-11.1.1.7 P-2104V-RTD Platform 3.0.x Vulnerability in the Oracle WebLogic Portal component of Oracle Fusion Middleware (subcomponent: Third Party Tools). Supported versions that are affected are 10.0.1.0, 10.2.1.0 and 10.3.6.0. Easily exploitable vulnerability allows successful unauthenticated network attacks via HTTP. Successful attack of this vulnerability can result in unauthorized takeover of Oracle WebLogic Portal possibly including arbitrary code execution within the Oracle WebLogic Portal. CVSS Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS V2 Vector: (AV:N/AC:L/Au:N/C:P/I:P/A:P). Oracle Vector: (AV:N/AC:L/Au:N/C:P+/I:P+/A:P+). Fix has been released CVE-2014-0114 P-5307V-10.0.1.0 P-5307V-10.2.1.0 P-5307V-10.3.6.0 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P CPUJan2015 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html P-5307V-10.0.1.0 P-5307V-10.2.1.0 P-5307V-10.3.6.0 Vulnerability in the Oracle Waveset component of Oracle Fusion Middleware (subcomponent: Struts). The supported version that is affected is 8.1.1. Easily exploitable vulnerability allows successful unauthenticated network attacks via HTTP. Successful attack of this vulnerability can result in unauthorized update, insert or delete access to some Oracle Waveset accessible data as well as read access to a subset of Oracle Waveset accessible data and ability to cause a partial denial of service (partial DOS) of Oracle Waveset. CVSS Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS V2 Vector: (AV:N/AC:L/Au:N/C:P/I:P/A:P). Oracle Vector: (AV:N/AC:L/Au:N/C:P/I:P/A:P). Fix has been released CVE-2014-0114 P-8518V-8.1.1 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P CPUJan2015 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html P-8518V-8.1.1 Vulnerability in the Oracle HTTP Server component of Oracle Fusion Middleware (subcomponent: Web Listener). Supported versions that are affected are 11.1.1.7.0, 12.1.2.0 and 12.1.3.0. Difficult to exploit vulnerability allows successful unauthenticated network attacks via HTTP. Successful attack of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle HTTP Server. CVSS Base Score 4.3 (Availability impacts). CVSS V2 Vector: (AV:N/AC:M/Au:N/C:N/I:N/A:P). Oracle Vector: (AV:N/AC:M/Au:N/C:N/I:N/A:P). Fix has been released CVE-2014-0191 P-1042V-11.1.1.7.0 P-1042V-12.1.2.0 P-1042V-12.1.3.0 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P CPUJan2015 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html P-1042V-11.1.1.7.0 P-1042V-12.1.2.0 P-1042V-12.1.3.0 Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: OpenSSL). Supported versions that are affected are VirtualBox prior to 3.2.24, 4.0.26, 4.1.34, 4.2.26 and 4.3.14. Difficult to exploit vulnerability allows successful unauthenticated network attacks via SSL/TLS. Successful attack of this vulnerability can result in unauthorized update, insert or delete access to some Oracle VM VirtualBox accessible data as well as read access to a subset of Oracle VM VirtualBox accessible data and ability to cause a partial denial of service (partial DOS) of Oracle VM VirtualBox. Note: This fix also addresses CVE-2014-0221, CVE-2014-0195, CVE-2014-0198, CVE-2010-5298, CVE-2014-3470 and CVE-2014-0076. CVSS Base Score 6.8 (Confidentiality, Integrity and Availability impacts). CVSS V2 Vector: (AV:N/AC:M/Au:N/C:P/I:P/A:P). Oracle Vector: (AV:N/AC:M/Au:N/C:P/I:P/A:P). Fix has been released CVE-2014-0224 P-8370V-VirtualBox prior to 3.2.24 P-8370V-4.0.26 P-8370V-4.1.34 P-8370V-4.2.26 P-8370V-4.3.14 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P CPUJan2015 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html P-8370V-VirtualBox prior to 3.2.24 P-8370V-4.0.26 P-8370V-4.1.34 P-8370V-4.2.26 P-8370V-4.3.14 Vulnerability in the Oracle Exalogic Infrastructure component of Oracle Fusion Middleware (subcomponent: Network Infra Framework). Supported versions that are affected are 2.0.6.2.0 (for all X2-2, X3-2 and X4-2). Very difficult to exploit vulnerability allows successful unauthenticated network attacks via HTTP. Successful attack of this vulnerability can result in unauthorized Operating System takeover including arbitrary code execution. CVSS Base Score 7.6 (Confidentiality, Integrity and Availability impacts). CVSS V2 Vector: (AV:N/AC:H/Au:N/C:C/I:C/A:C). Oracle Vector: (AV:N/AC:H/Au:N/C:C/I:C/A:C). Fix has been released CVE-2014-0224 P-9415V-2.0.6.2.0 (for all X2-2 P-9415V-X3-2 P-9415V-X4-2) 7.6 AV:N/AC:H/Au:N/C:C/I:C/A:C CPUJan2015 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html P-9415V-2.0.6.2.0 (for all X2-2 P-9415V-X3-2 P-9415V-X4-2) Vulnerability in the Enterprise Manager Ops Center component of Oracle Enterprise Manager Grid Control (subcomponent: Networking). Supported versions that are affected are 11.1.3 and 12.1.4. Difficult to exploit vulnerability allows successful unauthenticated network attacks via SSL/TLS. Successful attack of this vulnerability can result in unauthorized update, insert or delete access to some Enterprise Manager Ops Center accessible data as well as read access to a subset of Enterprise Manager Ops Center accessible data and ability to cause a partial denial of service (partial DOS) of Enterprise Manager Ops Center. CVSS Base Score 6.8 (Confidentiality, Integrity and Availability impacts). CVSS V2 Vector: (AV:N/AC:M/Au:N/C:P/I:P/A:P). Oracle Vector: (AV:N/AC:M/Au:N/C:P/I:P/A:P). Fix has been released CVE-2014-0224 P-9835V-11.1.3 P-9835V-12.1.4 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P CPUJan2015 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html P-9835V-11.1.3 P-9835V-12.1.4 Vulnerability in the SPARC Enterprise M3000, M4000, M5000, M8000, M9000 Servers component of Oracle Sun Systems Products Suite (subcomponent: XCP Firmware). The supported version that is affected is XCP prior to XCP 1118. Very difficult to exploit vulnerability allows successful authenticated network attacks via SSL/TLS. Successful attack of this vulnerability can result in unauthorized update, insert or delete access to some SPARC Enterprise M3000, M4000, M5000, M8000, M9000 Servers accessible data as well as read access to a subset of SPARC Enterprise M3000, M4000, M5000, M8000, M9000 Servers accessible data. CVSS Base Score 3.6 (Confidentiality and Integrity impacts). CVSS V2 Vector: (AV:N/AC:H/Au:S/C:P/I:P/A:N). Oracle Vector: (AV:N/AC:H/Au:S/C:P/I:P/A:N). Fix has been released CVE-2014-0224 P-9845V-XCP prior to XCP 1118 3.6 AV:N/AC:H/Au:S/C:P/I:P/A:N CPUJan2015 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html P-9845V-XCP prior to XCP 1118 Vulnerability in the Integrated Lights Out Manager(ILOM) component of Oracle Sun Systems Products Suite (subcomponent: OpenSSL). The supported version that is affected is ILOM prior to 3.2.4. Very difficult to exploit vulnerability allows successful authenticated network attacks via SSL/TLS. Successful attack of this vulnerability can result in unauthorized update, insert or delete access to some Integrated Lights Out Manager(ILOM) accessible data as well as read access to a subset of Integrated Lights Out Manager(ILOM) accessible data. CVSS Base Score 3.6 (Confidentiality and Integrity impacts). CVSS V2 Vector: (AV:N/AC:H/Au:S/C:P/I:P/A:N). Oracle Vector: (AV:N/AC:H/Au:S/C:P/I:P/A:N). Fix has been released CVE-2014-0224 P-9849V-ILOM prior to 3.2.4 3.6 AV:N/AC:H/Au:S/C:P/I:P/A:N CPUJan2015 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html P-9849V-ILOM prior to 3.2.4 Vulnerability in the Oracle HTTP Server component of Oracle Fusion Middleware (subcomponent: Web Listener). Supported versions that are affected are 10.1.3.5.0, 11.1.1.7.0, 12.1.2.0 and 12.1.3.0. Difficult to exploit vulnerability allows successful unauthenticated network attacks via HTTP. Successful attack of this vulnerability can result in unauthorized update, insert or delete access to some Oracle HTTP Server accessible data as well as read access to a subset of Oracle HTTP Server accessible data and ability to cause a partial denial of service (partial DOS) of Oracle HTTP Server. Note: This fix also addresses CVE-2014-0117, CVE-2014-0118 and CVE-2014-0231. CVSS Base Score 6.8 (Confidentiality, Integrity and Availability impacts). CVSS V2 Vector: (AV:N/AC:M/Au:N/C:P/I:P/A:P). Oracle Vector: (AV:N/AC:M/Au:N/C:P/I:P/A:P). Fix has been released CVE-2014-0226 P-1042V-10.1.3.5.0 P-1042V-11.1.1.7.0 P-1042V-12.1.2.0 P-1042V-12.1.3.0 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P CPUJan2015 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html P-1042V-10.1.3.5.0 P-1042V-11.1.1.7.0 P-1042V-12.1.2.0 P-1042V-12.1.3.0 Vulnerability in the Oracle Secure Global Desktop component of Oracle Virtualization (subcomponent: Apache HTTP Server). Supported versions that are affected are 4.63, 4.71, 5.0 and 5.1. Difficult to exploit vulnerability allows successful unauthenticated network attacks via HTTP. Successful attack of this vulnerability can result in unauthorized update, insert or delete access to some Oracle Secure Global Desktop accessible data as well as read access to a subset of Oracle Secure Global Desktop accessible data and ability to cause a partial denial of service (partial DOS) of Oracle Secure Global Desktop. Note: This fix also addresses CVE-2014-0231, CVE-2014-0118 and CVE-2014-5704. CVSS Base Score 6.8 (Confidentiality, Integrity and Availability impacts). CVSS V2 Vector: (AV:N/AC:M/Au:N/C:P/I:P/A:P). Oracle Vector: (AV:N/AC:M/Au:N/C:P/I:P/A:P). Fix has been released CVE-2014-0226 P-8539V-4.63 P-8539V-4.71 P-8539V-5.0 P-8539V-5.1 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P CPUJan2015 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html P-8539V-4.63 P-8539V-4.71 P-8539V-5.0 P-8539V-5.1 Vulnerability in the Enterprise Manager Ops Center component of Oracle Enterprise Manager Grid Control (subcomponent: Update Provisioning). Supported versions that are affected are 11.1.3 and 12.1.4. Difficult to exploit vulnerability allows successful unauthenticated network attacks via HTTP. Successful attack of this vulnerability can result in unauthorized update, insert or delete access to some Enterprise Manager Ops Center accessible data as well as read access to a subset of Enterprise Manager Ops Center accessible data and ability to cause a partial denial of service (partial DOS) of Enterprise Manager Ops Center. Note: This fix also addresses CVE-2014-0117, CVE-2014-0118 and CVE-2014-0231. CVSS Base Score 6.8 (Confidentiality, Integrity and Availability impacts). CVSS V2 Vector: (AV:N/AC:M/Au:N/C:P/I:P/A:P). Oracle Vector: (AV:N/AC:M/Au:N/C:P/I:P/A:P). Fix has been released CVE-2014-0226 P-9835V-11.1.3 P-9835V-12.1.4 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P CPUJan2015 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html P-9835V-11.1.3 P-9835V-12.1.4 Vulnerability in the Oracle Communications Messaging Server component of Oracle Communications Applications (subcomponent: Security). Supported versions that are affected are 7.0.5.33.0 and earlier. Easily exploitable vulnerability allows successful unauthenticated network attacks via SSL/TLS. Successful attack of this vulnerability can result in unauthorized update, insert or delete access to some Oracle Communications Messaging Server accessible data as well as read access to a subset of Oracle Communications Messaging Server accessible data and ability to cause a partial denial of service (partial DOS) of Oracle Communications Messaging Server. CVSS Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS V2 Vector: (AV:N/AC:L/Au:N/C:P/I:P/A:P). Oracle Vector: (AV:N/AC:L/Au:N/C:P/I:P/A:P). Fix has been released CVE-2014-1568 P-8496V-7.0.5.33.0 and earlier 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P CPUJan2015 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html P-8496V-7.0.5.33.0 and earlier Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: JSSE). Supported versions that are affected are Java SE 5.0u75, Java SE 6u85, Java SE 7u72, Java SE 8u25, Java SE Embedded 7u71, Java SE Embedded 8u6, JRockit 27.8.4 and JRockit 28.3.4. Difficult to exploit vulnerability allows successful unauthenticated network attacks via SSL/TLS. Successful attack of this vulnerability can result in unauthorized read access to a subset of Java SE, Java SE Embedded, JRockit accessible data. Note: Applies to client and server deployment of JSSE. CVSS Base Score 4.3 (Confidentiality impacts). CVSS V2 Vector: (AV:N/AC:M/Au:N/C:P/I:N/A:N). Oracle Vector: (AV:N/AC:M/Au:N/C:P/I:N/A:N). Fix has been released CVE-2014-3566 P-856V-Java SE 5.0u75 P-856V-Java SE 6u85 P-856V-Java SE 7u72 P-856V-Java SE 8u25 P-856V-Java SE Embedded 7u71 P-856V-Java SE Embedded 8u6 P-856V-JRockit 27.8.4 P-856V-JRockit 28.3.4 4.3 AV:N/AC:M/Au:N/C:P/I:N/A:N CPUJan2015 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html P-856V-Java SE 5.0u75 P-856V-Java SE 6u85 P-856V-Java SE 7u72 P-856V-Java SE 8u25 P-856V-Java SE Embedded 7u71 P-856V-Java SE Embedded 8u6 P-856V-JRockit 27.8.4 P-856V-JRockit 28.3.4 Vulnerability in the Oracle Secure Global Desktop component of Oracle Virtualization (subcomponent: Client, Gateway JARP module, Gateway Reverse Proxy, Print Servlet (only in 5.0 & 5.1), SSL Daemon (ttassl), Web Server). Supported versions that are affected are 4.63, 4.71, 5.0 and 5.1. Difficult to exploit vulnerability allows successful unauthenticated network attacks via SSL/TLS. Successful attack of this vulnerability can result in unauthorized read access to a subset of Oracle Secure Global Desktop accessible data. CVSS Base Score 4.3 (Confidentiality impacts). CVSS V2 Vector: (AV:N/AC:M/Au:N/C:P/I:N/A:N). Oracle Vector: (AV:N/AC:M/Au:N/C:P/I:N/A:N). Fix has been released CVE-2014-3566 P-8539V-4.63 P-8539V-4.71 P-8539V-5.0 P-8539V-5.1 4.3 AV:N/AC:M/Au:N/C:P/I:N/A:N CPUJan2015 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html P-8539V-4.63 P-8539V-4.71 P-8539V-5.0 P-8539V-5.1 Vulnerability in the Enterprise Manager Ops Center component of Oracle Enterprise Manager Grid Control (subcomponent: Update Provisioning). Supported versions that are affected are 11.1.3 and 12.1.4. Difficult to exploit vulnerability allows successful unauthenticated network attacks via SSL/TLS. Successful attack of this vulnerability can result in unauthorized read access to a subset of Enterprise Manager Ops Center accessible data. CVSS Base Score 4.3 (Confidentiality impacts). CVSS V2 Vector: (AV:N/AC:M/Au:N/C:P/I:N/A:N). Oracle Vector: (AV:N/AC:M/Au:N/C:P/I:N/A:N). Fix has been released CVE-2014-3566 P-9835V-11.1.3 P-9835V-12.1.4 4.3 AV:N/AC:M/Au:N/C:P/I:N/A:N CPUJan2015 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html P-9835V-11.1.3 P-9835V-12.1.4 Vulnerability in the SPARC Enterprise M3000, M4000, M5000, M8000, M9000 Servers component of Oracle Sun Systems Products Suite (subcomponent: XCP Firmware). The supported version that is affected is XCP prior to XCP 1119. Difficult to exploit vulnerability allows successful unauthenticated network attacks via SSL/TLS. Successful attack of this vulnerability can result in unauthorized read access to a subset of SPARC Enterprise M3000, M4000, M5000, M8000, M9000 Servers accessible data. CVSS Base Score 4.3 (Confidentiality impacts). CVSS V2 Vector: (AV:N/AC:M/Au:N/C:P/I:N/A:N). Oracle Vector: (AV:N/AC:M/Au:N/C:P/I:N/A:N). Fix has been released CVE-2014-3566 P-9845V-XCP prior to XCP 1119 4.3 AV:N/AC:M/Au:N/C:P/I:N/A:N CPUJan2015 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html P-9845V-XCP prior to XCP 1119 Vulnerability in the Fujitsu M10-1, M10-4, M10-4S Servers component of Oracle Sun Systems Products Suite (subcomponent: XCP Firmware). The supported version that is affected is XCP prior to XCP 2240. Difficult to exploit vulnerability allows successful unauthenticated network attacks via SSL/TLS. Successful attack of this vulnerability can result in unauthorized read access to a subset of Fujitsu M10-1, M10-4, M10-4S Servers accessible data. CVSS Base Score 4.3 (Confidentiality impacts). CVSS V2 Vector: (AV:N/AC:M/Au:N/C:P/I:N/A:N). Oracle Vector: (AV:N/AC:M/Au:N/C:P/I:N/A:N). Fix has been released CVE-2014-3566 P-10656V-XCP prior to XCP 2240 4.3 AV:N/AC:M/Au:N/C:P/I:N/A:N CPUJan2015 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html P-10656V-XCP prior to XCP 2240 Vulnerability in the Oracle Secure Global Desktop component of Oracle Virtualization (subcomponent: OpenSSL). Supported versions that are affected are 4.63, 4.71, 5.0 and 5.1. Difficult to exploit vulnerability allows successful unauthenticated network attacks via SSL/TLS. Successful attack of this vulnerability can result in unauthorized Operating System hang or frequently repeatable crash (complete DOS). CVSS Base Score 7.1 (Availability impacts). CVSS V2 Vector: (AV:N/AC:M/Au:N/C:N/I:N/A:C). Oracle Vector: (AV:N/AC:M/Au:N/C:N/I:N/A:C). Fix has been released CVE-2014-3567 P-8539V-4.63 P-8539V-4.71 P-8539V-5.0 P-8539V-5.1 7.1 AV:N/AC:M/Au:N/C:N/I:N/A:C CPUJan2015 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html P-8539V-4.63 P-8539V-4.71 P-8539V-5.0 P-8539V-5.1 Vulnerability in the Enterprise Manager Base Platform component of Oracle Enterprise Manager Grid Control (subcomponent: Process Management & Notification). Supported versions that are affected are 12.1.0.3 and 12.1.0.4. Difficult to exploit vulnerability allows successful unauthenticated network attacks via HTTPS. Successful attack of this vulnerability can result in unauthorized read access to a subset of Enterprise Manager Base Platform accessible data. CVSS Base Score 4.3 (Confidentiality impacts). CVSS V2 Vector: (AV:N/AC:M/Au:N/C:P/I:N/A:N). Oracle Vector: (AV:N/AC:M/Au:N/C:P/I:N/A:N). Fix has been released CVE-2014-4212 P-1370V-12.1.0.3 P-1370V-12.1.0.4 4.3 AV:N/AC:M/Au:N/C:P/I:N/A:N CPUJan2015 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html P-1370V-12.1.0.3 P-1370V-12.1.0.4 Vulnerability in the Solaris Cluster component of Oracle Sun Systems Products Suite (subcomponent: System management). Supported versions that are affected are 3.3 and 4.1. Easily exploitable vulnerability allows successful authenticated network attacks via TCP/IP. Successful attack of this vulnerability can result in unauthorized Operating System takeover including arbitrary code execution. CVSS Base Score 9.0 (Confidentiality, Integrity and Availability impacts). CVSS V2 Vector: (AV:N/AC:L/Au:S/C:C/I:C/A:C). Oracle Vector: (AV:N/AC:L/Au:S/C:C/I:C/A:C). Fix has been released CVE-2014-4259 P-10005V-3.3 P-10005V-4.1 9.0 AV:N/AC:L/Au:S/C:C/I:C/A:C CPUJan2015 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html P-10005V-3.3 P-10005V-4.1 Vulnerability in the PeopleSoft Enterprise PeopleTools component of Oracle PeopleSoft Products (subcomponent: PIA Core Technology ). The supported version that is affected is 8.53. Difficult to exploit vulnerability allows successful authenticated network attacks via HTTP. Successful attack of this vulnerability can result in unauthorized update, insert or delete access to some PeopleSoft Enterprise PeopleTools accessible data. CVSS Base Score 3.5 (Integrity impacts). CVSS V2 Vector: (AV:N/AC:M/Au:S/C:N/I:P/A:N). Oracle Vector: (AV:N/AC:M/Au:S/C:N/I:P/A:N). Fix has been released CVE-2014-4279 P-5085V-8.53 3.5 AV:N/AC:M/Au:S/C:N/I:P/A:N CPUJan2015 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html P-5085V-8.53 Vulnerability in the Solaris Cluster component of Oracle Sun Systems Products Suite (subcomponent: System management). Supported versions that are affected are 3.3 and 4.1. Easily exploitable vulnerability requiring logon to Operating System plus additional, multiple logins to components. Successful attack of this vulnerability can escalate attacker privileges resulting in unauthorized Operating System takeover including arbitrary code execution. CVSS Base Score 6.5 (Confidentiality, Integrity and Availability impacts). CVSS V2 Vector: (AV:L/AC:L/Au:M/C:C/I:C/A:C). Oracle Vector: (AV:L/AC:L/Au:M/C:C/I:C/A:C). Fix has been released CVE-2014-6480 P-10005V-3.3 P-10005V-4.1 6.5 AV:L/AC:L/Au:M/C:C/I:C/A:C CPUJan2015 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html P-10005V-3.3 P-10005V-4.1 Vulnerability in the Solaris component of Oracle Sun Systems Products Suite (subcomponent: KSSL). Supported versions that are affected are 10 and 11. Difficult to exploit vulnerability allows successful unauthenticated network attacks via SSL/TLS. Successful attack of this vulnerability can result in unauthorized read access to a subset of Solaris accessible data. CVSS Base Score 4.3 (Confidentiality impacts). CVSS V2 Vector: (AV:N/AC:M/Au:N/C:P/I:N/A:N). Oracle Vector: (AV:N/AC:M/Au:N/C:P/I:N/A:N). Fix has been released CVE-2014-6481 P-10006V-10 P-10006V-11 4.3 AV:N/AC:M/Au:N/C:P/I:N/A:N CPUJan2015 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html P-10006V-10 P-10006V-11 Vulnerability in the Solaris component of Oracle Sun Systems Products Suite (subcomponent: Kernel). The supported version that is affected is 10. Easily exploitable vulnerability requiring logon to Operating System. Successful attack of this vulnerability can result in unauthorized Operating System hang or frequently repeatable crash (complete DOS). CVSS Base Score 4.9 (Availability impacts). CVSS V2 Vector: (AV:L/AC:L/Au:N/C:N/I:N/A:C). Oracle Vector: (AV:L/AC:L/Au:N/C:N/I:N/A:C). Fix has been released CVE-2014-6509 P-10006V-10 4.9 AV:L/AC:L/Au:N/C:N/I:N/A:C CPUJan2015 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html P-10006V-10 Vulnerability in the Solaris component of Oracle Sun Systems Products Suite (subcomponent: Power Management Utility). The supported version that is affected is 11. Easily exploitable vulnerability requiring logon to Operating System. Successful attack of this vulnerability can result in unauthorized Operating System takeover including arbitrary code execution. CVSS Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS V2 Vector: (AV:L/AC:L/Au:N/C:C/I:C/A:C). Oracle Vector: (AV:L/AC:L/Au:N/C:C/I:C/A:C). Fix has been released CVE-2014-6510 P-10006V-11 7.2 AV:L/AC:L/Au:N/C:C/I:C/A:C CPUJan2015 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html P-10006V-11 Vulnerability in the PL/SQL component of Oracle Database Server. This vulnerability requires Create Session privileges for a successful attack. Supported versions that are affected are 11.1.0.7, 11.2.0.3, 11.2.0.4 and 12.1.0.1. Easily exploitable vulnerability allows successful authenticated network attacks via Oracle Net. Successful attack of this vulnerability can result in unauthorized read access to all PL/SQL accessible data. CVSS Base Score 4.0 (Confidentiality impacts). CVSS V2 Vector: (AV:N/AC:L/Au:S/C:P/I:N/A:N). Oracle Vector: (AV:N/AC:L/Au:S/C:P+/I:N/A:N). Fix has been released CVE-2014-6514 P-11V-11.1.0.7 P-11V-11.2.0.3 P-11V-11.2.0.4 P-11V-12.1.0.1 4.0 AV:N/AC:L/Au:S/C:P/I:N/A:N CPUJan2015 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html P-11V-11.1.0.7 P-11V-11.2.0.3 P-11V-11.2.0.4 P-11V-12.1.0.1 Vulnerability in the Solaris component of Oracle Sun Systems Products Suite (subcomponent: Unix File System(UFS)). Supported versions that are affected are 10 and 11. Easily exploitable vulnerability requiring logon to Operating System. Successful attack of this vulnerability can result in unauthorized write access to any arbitrary Operating System location and Operating System hang or frequently repeatable crash (complete DOS). CVSS Base Score 6.6 (Integrity and Availability impacts). CVSS V2 Vector: (AV:L/AC:L/Au:N/C:N/I:C/A:C). Oracle Vector: (AV:L/AC:L/Au:N/C:N/I:C/A:C). Fix has been released CVE-2014-6518 P-10006V-10 P-10006V-11 6.6 AV:L/AC:L/Au:N/C:N/I:C/A:C CPUJan2015 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html P-10006V-10 P-10006V-11 Vulnerability in the Solaris component of Oracle Sun Systems Products Suite (subcomponent: CDE - Power Management Utility). The supported version that is affected is 10. Easily exploitable vulnerability requiring logon to Operating System. Successful attack of this vulnerability can result in unauthorized Operating System takeover including arbitrary code execution. CVSS Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS V2 Vector: (AV:L/AC:L/Au:N/C:C/I:C/A:C). Oracle Vector: (AV:L/AC:L/Au:N/C:C/I:C/A:C). Fix has been released CVE-2014-6521 P-10006V-10 7.2 AV:L/AC:L/Au:N/C:C/I:C/A:C CPUJan2015 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html P-10006V-10 Vulnerability in the Solaris component of Oracle Sun Systems Products Suite (subcomponent: Kernel). The supported version that is affected is 10. Easily exploitable vulnerability requiring logon to Operating System. Successful attack of this vulnerability can result in unauthorized Operating System takeover including arbitrary code execution. CVSS Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS V2 Vector: (AV:L/AC:L/Au:N/C:C/I:C/A:C). Oracle Vector: (AV:L/AC:L/Au:N/C:C/I:C/A:C). Fix has been released CVE-2014-6524 P-10006V-10 7.2 AV:L/AC:L/Au:N/C:C/I:C/A:C CPUJan2015 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html P-10006V-10 Vulnerability in the Oracle Web Applications Desktop Integrator component of Oracle E-Business Suite (subcomponent: Templates). Supported versions that are affected are 11.5.10.2, 12.0.6, 12.1.3, 12.2.2, 12.2.3 and 12.2.4. Difficult to exploit vulnerability allows successful authenticated network attacks via HTTP. Successful attack of this vulnerability can result in unauthorized update, insert or delete access to some Oracle Web Applications Desktop Integrator accessible data. CVSS Base Score 3.5 (Integrity impacts). CVSS V2 Vector: (AV:N/AC:M/Au:S/C:N/I:P/A:N). Oracle Vector: (AV:N/AC:M/Au:S/C:N/I:P/A:N). Fix has been released CVE-2014-6525 P-1171V-11.5.10.2 P-1171V-12.0.6 P-1171V-12.1.3 P-1171V-12.2.2 P-1171V-12.2.3 P-1171V-12.2.4 3.5 AV:N/AC:M/Au:S/C:N/I:P/A:N CPUJan2015 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html P-1171V-11.5.10.2 P-1171V-12.0.6 P-1171V-12.1.3 P-1171V-12.2.2 P-1171V-12.2.3 P-1171V-12.2.4 Vulnerability in the Oracle Directory Server Enterprise Edition component of Oracle Fusion Middleware (subcomponent: Admin Console). The supported version that is affected is 7.0. Difficult to exploit vulnerability allows successful unauthenticated network attacks via HTTP. Successful attack of this vulnerability can result in unauthorized update, insert or delete access to some Oracle Directory Server Enterprise Edition accessible data. CVSS Base Score 4.3 (Integrity impacts). CVSS V2 Vector: (AV:N/AC:M/Au:N/C:N/I:P/A:N). Oracle Vector: (AV:N/AC:M/Au:N/C:N/I:P/A:N). Fix has been released CVE-2014-6526 P-8512V-7.0 4.3 AV:N/AC:M/Au:N/C:N/I:P/A:N CPUJan2015 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html P-8512V-7.0 Vulnerability in the Siebel Core - System Management component of Oracle Siebel CRM (subcomponent: Server Infrastructure). Supported versions that are affected are 8.1.1 and 8.2.2. Easily exploitable vulnerability allows successful authenticated network attacks via HTTP. Successful attack of this vulnerability can result in unauthorized read access to a subset of Siebel Core - System Management accessible data. CVSS Base Score 4.0 (Confidentiality impacts). CVSS V2 Vector: (AV:N/AC:L/Au:S/C:P/I:N/A:N). Oracle Vector: (AV:N/AC:L/Au:S/C:P/I:N/A:N). Fix has been released CVE-2014-6528 P-9009V-8.1.1 P-9009V-8.2.2 4.0 AV:N/AC:L/Au:S/C:P/I:N/A:N CPUJan2015 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html P-9009V-8.1.1 P-9009V-8.2.2 Vulnerability in the Recovery component of Oracle Database Server. This vulnerability requires Execute on DBMS_IR privileges for a successful attack. Supported versions that are affected are 11.1.0.7, 11.2.0.3, 11.2.0.4, 12.1.0.1 and 12.1.0.2. Difficult to exploit vulnerability allows successful authenticated network attacks via Oracle Net. Successful attack of this vulnerability can result in unauthorized read access to any arbitrary Operating System location. Note: This vulnerability is only applicable on a Windows operating system. The CVSS score is 6.3 for Database versions prior to 12<i>c</i>. The CVSS is 3.5 (Confidentiality is "Partial+") for Database 12<i>c</i>. CVSS Base Score 6.3 (Confidentiality impacts). CVSS V2 Vector: (AV:N/AC:M/Au:S/C:C/I:N/A:N). Oracle Vector: (AV:N/AC:M/Au:S/C:C/I:N/A:N). Fix has been released CVE-2014-6541 P-5V-11.1.0.7 P-5V-11.2.0.3 P-5V-11.2.0.4 P-5V-12.1.0.1 P-5V-12.1.0.2 6.3 AV:N/AC:M/Au:S/C:C/I:N/A:N CPUJan2015 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html P-5V-11.1.0.7 P-5V-11.2.0.3 P-5V-11.2.0.4 P-5V-12.1.0.1 P-5V-12.1.0.2 Vulnerability in the Oracle SOA Suite component of Oracle Fusion Middleware (subcomponent: B2B Engine). The supported version that is affected is 11.1.1.7. Easily exploitable vulnerability requiring logon to Operating System. Successful attack of this vulnerability can result in unauthorized takeover of Oracle SOA Suite possibly including arbitrary code execution within the Oracle SOA Suite. Note: Please refer to <a href="https://support.oracle.com/CSP/main/article?cmd=show&type=NOT&id=1962206.1">My Oracle Support Note 1962206.1</a> for instructions on how to address this issue. CVSS Base Score 4.6 (Confidentiality, Integrity and Availability impacts). CVSS V2 Vector: (AV:L/AC:L/Au:N/C:P/I:P/A:P). Oracle Vector: (AV:L/AC:L/Au:N/C:P+/I:P+/A:P+). Fix has been released CVE-2014-6548 P-1162V-11.1.1.7 4.6 AV:L/AC:L/Au:N/C:P/I:P/A:P CPUJan2015 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html P-1162V-11.1.1.7 Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Libraries). The supported version that is affected is Java SE 8u25. Easily exploitable vulnerability allows successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability can result in unauthorized Operating System takeover including arbitrary code execution. Note: Applies to client deployment of Java only. This vulnerability can be exploited only through sandboxed Java Web Start applications and sandboxed Java applets. CVSS Base Score 10.0 (Confidentiality, Integrity and Availability impacts). CVSS V2 Vector: (AV:N/AC:L/Au:N/C:C/I:C/A:C). Oracle Vector: (AV:N/AC:L/Au:N/C:C/I:C/A:C). Fix has been released CVE-2014-6549 P-856V-Java SE 8u25 10.0 AV:N/AC:L/Au:N/C:C/I:C/A:C CPUJan2015 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html P-856V-Java SE 8u25 Vulnerability in the Oracle Applications DBA component of Oracle E-Business Suite (subcomponent: AD_DDL). Supported versions that are affected are 11.5.10.2, 12.0.6, 12.1.3, 12.2.2, 12.2.3 and 12.2.4. Very difficult to exploit vulnerability allows successful authenticated network attacks via Oracle Net. Successful attack of this vulnerability can result in unauthorized takeover of Oracle Applications DBA possibly including arbitrary code execution within the Oracle Applications DBA. CVSS Base Score 4.6 (Confidentiality, Integrity and Availability impacts). CVSS V2 Vector: (AV:N/AC:H/Au:S/C:P/I:P/A:P). Oracle Vector: (AV:N/AC:H/Au:S/C:P+/I:P+/A:P+). Fix has been released CVE-2014-6556 P-166V-11.5.10.2 P-166V-12.0.6 P-166V-12.1.3 P-166V-12.2.2 P-166V-12.2.3 P-166V-12.2.4 4.6 AV:N/AC:H/Au:S/C:P/I:P/A:P CPUJan2015 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html P-166V-11.5.10.2 P-166V-12.0.6 P-166V-12.1.3 P-166V-12.2.2 P-166V-12.2.3 P-166V-12.2.4 Vulnerability in the JD Edwards EnterpriseOne Tools component of Oracle JD Edwards Products (subcomponent: Portal SEC). The supported version that is affected is 9.1.5. Easily exploitable vulnerability allows successful unauthenticated network attacks via HTTP. Successful attack of this vulnerability can result in unauthorized update, insert or delete access to some JD Edwards EnterpriseOne Tools accessible data as well as read access to a subset of JD Edwards EnterpriseOne Tools accessible data and ability to cause a partial denial of service (partial DOS) of JD Edwards EnterpriseOne Tools. CVSS Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS V2 Vector: (AV:N/AC:L/Au:N/C:P/I:P/A:P). Oracle Vector: (AV:N/AC:L/Au:N/C:P/I:P/A:P). Fix has been released CVE-2014-6565 P-4781V-9.1.5 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P CPUJan2015 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html P-4781V-9.1.5 Vulnerability in the PeopleSoft Enterprise PeopleTools component of Oracle PeopleSoft Products (subcomponent: Portal). The supported version that is affected is 8.53. Easily exploitable vulnerability allows successful authenticated network attacks via HTTP. Successful attack of this vulnerability can result in unauthorized update, insert or delete access to some PeopleSoft Enterprise PeopleTools accessible data. CVSS Base Score 4.0 (Integrity impacts). CVSS V2 Vector: (AV:N/AC:L/Au:S/C:N/I:P/A:N). Oracle Vector: (AV:N/AC:L/Au:S/C:N/I:P/A:N). Fix has been released CVE-2014-6566 P-5085V-8.53 4.0 AV:N/AC:L/Au:S/C:N/I:P/A:N CPUJan2015 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html P-5085V-8.53 Vulnerability in the Core RDBMS component of Oracle Database Server. This vulnerability requires Create Session privileges for a successful attack. Supported versions that are affected are 11.1.0.7, 11.2.0.3, 11.2.0.4, 12.1.0.1 and 12.1.0.2. Easily exploitable vulnerability allows successful authenticated network attacks via Oracle Net. Successful attack of this vulnerability can result in unauthorized Operating System takeover including arbitrary code execution. Note: The CVSS Score is 9.0 only on Windows for Database versions prior to 12<i>c</i>. The CVSS Base Score is 6.5 (Confidentiality, Integrity and Availability are Partial+) for Database 12<i>c</i> on Windows and for all versions of Database on Linux, Unix and other platforms. CVSS Base Score 9.0 (Confidentiality, Integrity and Availability impacts). CVSS V2 Vector: (AV:N/AC:L/Au:S/C:C/I:C/A:C). Oracle Vector: (AV:N/AC:L/Au:S/C:C/I:C/A:C). Fix has been released CVE-2014-6567 P-1163V-11.1.0.7 P-1163V-11.2.0.3 P-1163V-11.2.0.4 P-1163V-12.1.0.1 P-1163V-12.1.0.2 9.0 AV:N/AC:L/Au:S/C:C/I:C/A:C CPUJan2015 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html P-1163V-11.1.0.7 P-1163V-11.2.0.3 P-1163V-11.2.0.4 P-1163V-12.1.0.1 P-1163V-12.1.0.2 Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server : InnoDB : DML). Supported versions that are affected are 5.5.40 and earlier and 5.6.21 and earlier. Difficult to exploit vulnerability allows successful authenticated network attacks via multiple protocols. Successful attack of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS Base Score 3.5 (Availability impacts). CVSS V2 Vector: (AV:N/AC:M/Au:S/C:N/I:N/A:P). Oracle Vector: (AV:N/AC:M/Au:S/C:N/I:N/A:P+). Fix has been released CVE-2014-6568 P-8478V-5.5.40 and earlier P-8478V-5.6.21 and earlier 3.5 AV:N/AC:M/Au:S/C:N/I:N/A:P CPUJan2015 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html P-8478V-5.5.40 and earlier P-8478V-5.6.21 and earlier Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: CIE Related Components). Supported versions that are affected are 10.0.2.0, 10.3.6.0, 12.1.1.0 and 12.1.2.0. Easily exploitable vulnerability allows successful unauthenticated network attacks via HTTP. Successful attack of this vulnerability can result in unauthorized read access to a subset of Oracle WebLogic Server accessible data. CVSS Base Score 5.0 (Confidentiality impacts). CVSS V2 Vector: (AV:N/AC:L/Au:N/C:P/I:N/A:N). Oracle Vector: (AV:N/AC:L/Au:N/C:P/I:N/A:N). Fix has been released CVE-2014-6569 P-5242V-10.0.2.0 P-5242V-10.3.6.0 P-5242V-12.1.1.0 P-5242V-12.1.2.0 5.0 AV:N/AC:L/Au:N/C:P/I:N/A:N CPUJan2015 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html P-5242V-10.0.2.0 P-5242V-10.3.6.0 P-5242V-12.1.1.0 P-5242V-12.1.2.0 Vulnerability in the Solaris component of Oracle Sun Systems Products Suite (subcomponent: File System). The supported version that is affected is 11. Easily exploitable vulnerability requiring logon to Operating System. Successful attack of this vulnerability can result in unauthorized Operating System hang or frequently repeatable crash (complete DOS). CVSS Base Score 4.9 (Availability impacts). CVSS V2 Vector: (AV:L/AC:L/Au:N/C:N/I:N/A:C). Oracle Vector: (AV:L/AC:L/Au:N/C:N/I:N/A:C). Fix has been released CVE-2014-6570 P-10006V-11 4.9 AV:L/AC:L/Au:N/C:N/I:N/A:C CPUJan2015 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html P-10006V-11 Vulnerability in the Oracle HTTP Server component of Oracle Fusion Middleware (subcomponent: Web Listener). Supported versions that are affected are 11.1.1.7.0, 12.1.2.0 and 12.1.3.0. Difficult to exploit vulnerability allows successful unauthenticated network attacks via HTTP. Successful attack of this vulnerability can result in unauthorized update, insert or delete access to some Oracle HTTP Server accessible data as well as read access to a subset of Oracle HTTP Server accessible data and ability to cause a partial denial of service (partial DOS) of Oracle HTTP Server. CVSS Base Score 6.8 (Confidentiality, Integrity and Availability impacts). CVSS V2 Vector: (AV:N/AC:M/Au:N/C:P/I:P/A:P). Oracle Vector: (AV:N/AC:M/Au:N/C:P/I:P/A:P). Fix has been released CVE-2014-6571 P-1042V-11.1.1.7.0 P-1042V-12.1.2.0 P-1042V-12.1.3.0 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P CPUJan2015 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html P-1042V-11.1.1.7.0 P-1042V-12.1.2.0 P-1042V-12.1.3.0 Vulnerability in the Oracle Customer Interaction History component of Oracle E-Business Suite (subcomponent: List of Values). Supported versions that are affected are 12.0.4, 12.0.5, 12.0.6, 12.1.1, 12.1.2, 12.1.3, 12.2.2, 12.2.3 and 12.2.4. Easily exploitable vulnerability allows successful unauthenticated network attacks via HTTP. Successful attack of this vulnerability can result in unauthorized update, insert or delete access to some Oracle Customer Interaction History accessible data as well as read access to a subset of Oracle Customer Interaction History accessible data. CVSS Base Score 6.4 (Confidentiality and Integrity impacts). CVSS V2 Vector: (AV:N/AC:L/Au:N/C:P/I:P/A:N). Oracle Vector: (AV:N/AC:L/Au:N/C:P/I:P/A:N). Fix has been released CVE-2014-6572 P-1374V-12.0.4 P-1374V-12.0.5 P-1374V-12.0.6 P-1374V-12.1.1 P-1374V-12.1.2 P-1374V-12.1.3 P-1374V-12.2.2 P-1374V-12.2.3 P-1374V-12.2.4 6.4 AV:N/AC:L/Au:N/C:P/I:P/A:N CPUJan2015 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html P-1374V-12.0.4 P-1374V-12.0.5 P-1374V-12.0.6 P-1374V-12.1.1 P-1374V-12.1.2 P-1374V-12.1.3 P-1374V-12.2.2 P-1374V-12.2.3 P-1374V-12.2.4 Vulnerability in the Enterprise Manager Ops Center component of Oracle Enterprise Manager Grid Control (subcomponent: User Interface Framework). Supported versions that are affected are 11.1.3 and 12.1.4. Difficult to exploit vulnerability allows successful unauthenticated network attacks via HTTP. Successful attack of this vulnerability can result in unauthorized update, insert or delete access to some Enterprise Manager Ops Center accessible data. CVSS Base Score 4.3 (Integrity impacts). CVSS V2 Vector: (AV:N/AC:M/Au:N/C:N/I:P/A:N). Oracle Vector: (AV:N/AC:M/Au:N/C:N/I:P/A:N). Fix has been released CVE-2014-6573 P-9835V-11.1.3 P-9835V-12.1.4 4.3 AV:N/AC:M/Au:N/C:N/I:P/A:N CPUJan2015 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html P-9835V-11.1.3 P-9835V-12.1.4 Vulnerability in the Oracle Agile PLM for Process component of Oracle Supply Chain Products Suite (subcomponent: Testing Protocol Library). The supported version that is affected is 6.1.0.3. Difficult to exploit vulnerability allows successful unauthenticated network attacks via HTTP. Successful attack of this vulnerability can result in unauthorized update, insert or delete access to some Oracle Agile PLM for Process accessible data. CVSS Base Score 4.3 (Integrity impacts). CVSS V2 Vector: (AV:N/AC:M/Au:N/C:N/I:P/A:N). Oracle Vector: (AV:N/AC:M/Au:N/C:N/I:P/A:N). Fix has been released CVE-2014-6574 P-4445V-6.1.0.3 4.3 AV:N/AC:M/Au:N/C:N/I:P/A:N CPUJan2015 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html P-4445V-6.1.0.3 Vulnerability in the Solaris component of Oracle Sun Systems Products Suite (subcomponent: Network). Supported versions that are affected are 10 and 11. Easily exploitable vulnerability allows successful unauthenticated network attacks via TCP/IP. Successful attack of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Solaris. CVSS Base Score 5.0 (Availability impacts). CVSS V2 Vector: (AV:N/AC:L/Au:N/C:N/I:N/A:P). Oracle Vector: (AV:N/AC:L/Au:N/C:N/I:N/A:P). Fix has been released CVE-2014-6575 P-10006V-10 P-10006V-11 5.0 AV:N/AC:L/Au:N/C:N/I:N/A:P CPUJan2015 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html P-10006V-10 P-10006V-11 Vulnerability in the Oracle Adaptive Access Manager component of Oracle Fusion Middleware (subcomponent: OAM Integration). Supported versions that are affected are 11.1.1.5, 11.1.1.7, 11.1.2.1 and 11.1.2.2. Easily exploitable vulnerability allows successful authenticated network attacks via HTTP. Successful attack of this vulnerability can result in unauthorized update, insert or delete access to some Oracle Adaptive Access Manager accessible data as well as read access to a subset of Oracle Adaptive Access Manager accessible data. CVSS Base Score 5.5 (Confidentiality and Integrity impacts). CVSS V2 Vector: (AV:N/AC:L/Au:S/C:P/I:P/A:N). Oracle Vector: (AV:N/AC:L/Au:S/C:P/I:P/A:N). Fix has been released CVE-2014-6576 P-4419V-11.1.1.5 P-4419V-11.1.1.7 P-4419V-11.1.2.1 P-4419V-11.1.2.2 5.5 AV:N/AC:L/Au:S/C:P/I:P/A:N CPUJan2015 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html P-4419V-11.1.1.5 P-4419V-11.1.1.7 P-4419V-11.1.2.1 P-4419V-11.1.2.2 Vulnerability in the XML Developer's Kit for C component of Oracle Database Server. This vulnerability requires Valid account privileges for a successful attack. Supported versions that are affected are 11.2.0.3, 11.2.0.4, 12.1.0.1 and 12.1.0.2. Easily exploitable vulnerability allows successful authenticated network attacks via HTTP. Successful attack of this vulnerability can result in unauthorized read access to any arbitrary Operating System location. Note: The CVSS score is 6.8 only on Windows for Database versions prior to 12<i>c</i>. The CVSS is 4.0 (Confidentiality is "Partial+") for Database 12<i>c</i> on Windows and for all versions of Database on Linux, Unix and other platforms. CVSS Base Score 6.8 (Confidentiality impacts). CVSS V2 Vector: (AV:N/AC:L/Au:S/C:C/I:N/A:N). Oracle Vector: (AV:N/AC:L/Au:S/C:C/I:N/A:N). Fix has been released CVE-2014-6577 P-1068V-11.2.0.3 P-1068V-11.2.0.4 P-1068V-12.1.0.1 P-1068V-12.1.0.2 6.8 AV:N/AC:L/Au:S/C:C/I:N/A:N CPUJan2015 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html P-1068V-11.2.0.3 P-1068V-11.2.0.4 P-1068V-12.1.0.1 P-1068V-12.1.0.2 Vulnerability in the Workspace Manager component of Oracle Database Server. This vulnerability requires Create Table, Create Procedure, Execute on SDO_TOPO, Execute on WMSYS.LT privileges for a successful attack. Supported versions that are affected are 11.1.0.7, 11.2.0.3, 11.2.0.4 and 12.1.0.1. Easily exploitable vulnerability allows successful authenticated network attacks via Oracle Net. Successful attack of this vulnerability can result in unauthorized takeover of Workspace Manager possibly including arbitrary code execution within the Workspace Manager. CVSS Base Score 6.5 (Confidentiality, Integrity and Availability impacts). CVSS V2 Vector: (AV:N/AC:L/Au:S/C:P/I:P/A:P). Oracle Vector: (AV:N/AC:L/Au:S/C:P+/I:P+/A:P+). Fix has been released CVE-2014-6578 P-1105V-11.1.0.7 P-1105V-11.2.0.3 P-1105V-11.2.0.4 P-1105V-12.1.0.1 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P CPUJan2015 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html P-1105V-11.1.0.7 P-1105V-11.2.0.3 P-1105V-11.2.0.4 P-1105V-12.1.0.1 Vulnerability in the PeopleSoft Enterprise PeopleTools component of Oracle PeopleSoft Products (subcomponent: Integration Broker). Supported versions that are affected are 8.52 and 8.53. Easily exploitable vulnerability allows successful authenticated network attacks via HTTP. Successful attack of this vulnerability can result in unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data. CVSS Base Score 4.0 (Confidentiality impacts). CVSS V2 Vector: (AV:N/AC:L/Au:S/C:P/I:N/A:N). Oracle Vector: (AV:N/AC:L/Au:S/C:P/I:N/A:N). Fix has been released CVE-2014-6579 P-5085V-8.52 P-5085V-8.53 4.0 AV:N/AC:L/Au:S/C:P/I:N/A:N CPUJan2015 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html P-5085V-8.52 P-5085V-8.53 Vulnerability in the Oracle Reports Developer component of Oracle Fusion Middleware (subcomponent: None). Supported versions that are affected are 11.1.1.7 and 11.1.2.2. Difficult to exploit vulnerability allows successful unauthenticated network attacks via HTTP. Successful attack of this vulnerability can result in unauthorized update, insert or delete access to some Oracle Reports Developer accessible data. CVSS Base Score 4.3 (Integrity impacts). CVSS V2 Vector: (AV:N/AC:M/Au:N/C:N/I:P/A:N). Oracle Vector: (AV:N/AC:M/Au:N/C:N/I:P/A:N). Fix has been released CVE-2014-6580 P-159V-11.1.1.7 P-159V-11.1.2.2 4.3 AV:N/AC:M/Au:N/C:N/I:P/A:N CPUJan2015 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html P-159V-11.1.1.7 P-159V-11.1.2.2 Vulnerability in the Oracle Customer Intelligence component of Oracle E-Business Suite (subcomponent: Extract/Load Programs). Supported versions that are affected are 11.5.10.2, 12.0.4, 12.0.5, 12.0.6, 12.1.1, 12.1.2, 12.1.3, 12.2.2, 12.2.3 and 12.2.4. Easily exploitable vulnerability allows successful unauthenticated network attacks via HTTP. Successful attack of this vulnerability can result in unauthorized update, insert or delete access to all Oracle Customer Intelligence accessible data as well as read access to all Oracle Customer Intelligence accessible data. CVSS Base Score 6.4 (Confidentiality and Integrity impacts). CVSS V2 Vector: (AV:N/AC:L/Au:N/C:P/I:P/A:N). Oracle Vector: (AV:N/AC:L/Au:N/C:P+/I:P+/A:N). Fix has been released CVE-2014-6581 P-390V-11.5.10.2 P-390V-12.0.4 P-390V-12.0.5 P-390V-12.0.6 P-390V-12.1.1 P-390V-12.1.2 P-390V-12.1.3 P-390V-12.2.2 P-390V-12.2.3 P-390V-12.2.4 6.4 AV:N/AC:L/Au:N/C:P/I:P/A:N CPUJan2015 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html P-390V-11.5.10.2 P-390V-12.0.4 P-390V-12.0.5 P-390V-12.0.6 P-390V-12.1.1 P-390V-12.1.2 P-390V-12.1.3 P-390V-12.2.2 P-390V-12.2.3 P-390V-12.2.4 Vulnerability in the Oracle HCM Configuration Workbench component of Oracle E-Business Suite (subcomponent: Rapid Implementation). Supported versions that are affected are 11.5.10.2, 12.0.4, 12.0.5, 12.0.6, 12.1.1,12.1.2, 12.1.3, 12.2.2, 12.2.3 and 12.2.4. Easily exploitable vulnerability allows successful unauthenticated network attacks via HTTP. Successful attack of this vulnerability can result in unauthorized read access to a subset of Oracle HCM Configuration Workbench accessible data. CVSS Base Score 5.0 (Confidentiality impacts). CVSS V2 Vector: (AV:N/AC:L/Au:N/C:P/I:N/A:N). Oracle Vector: (AV:N/AC:L/Au:N/C:P/I:N/A:N). Fix has been released CVE-2014-6582 P-2011V-11.5.10.2 P-2011V-12.0.4 P-2011V-12.0.5 P-2011V-12.0.6 P-2011V-12.1.1 P-2011V-12.1.2 P-2011V-12.1.3 P-2011V-12.2.2 P-2011V-12.2.3 P-2011V-12.2.4 5.0 AV:N/AC:L/Au:N/C:P/I:N/A:N CPUJan2015 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html P-2011V-11.5.10.2 P-2011V-12.0.4 P-2011V-12.0.5 P-2011V-12.0.6 P-2011V-12.1.1 P-2011V-12.1.2 P-2011V-12.1.3 P-2011V-12.2.2 P-2011V-12.2.3 P-2011V-12.2.4 Vulnerability in the Oracle Marketing component of Oracle E-Business Suite (subcomponent: Audience). Supported versions that are affected are 11.5.10.2, 12.0.4, 12.0.5, 12.0.6, 12.1.1, 12.1.2 and 12.1.3.. Easily exploitable vulnerability allows successful unauthenticated network attacks via HTTP. Successful attack of this vulnerability can result in unauthorized update, insert or delete access to all Oracle Marketing accessible data as well as read access to all Oracle Marketing accessible data. CVSS Base Score 6.4 (Confidentiality and Integrity impacts). CVSS V2 Vector: (AV:N/AC:L/Au:N/C:P/I:P/A:N). Oracle Vector: (AV:N/AC:L/Au:N/C:P+/I:P+/A:N). Fix has been released CVE-2014-6583 P-229V-11.5.10.2 P-229V-12.0.4 P-229V-12.0.5 P-229V-12.0.6 P-229V-12.1.1 P-229V-12.1.2 P-229V-12.1.3. 6.4 AV:N/AC:L/Au:N/C:P/I:P/A:N CPUJan2015 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html P-229V-11.5.10.2 P-229V-12.0.4 P-229V-12.0.5 P-229V-12.0.6 P-229V-12.1.1 P-229V-12.1.2 P-229V-12.1.3. Vulnerability in the Integrated Lights Out Manager(ILOM) component of Oracle Sun Systems Products Suite (subcomponent: Backup Restore). The supported version that is affected is ILOM prior to 3.2.4. Easily exploitable vulnerability allows successful authenticated network attacks via HTTP. Successful attack of this vulnerability can result in unauthorized read access to a subset of Integrated Lights Out Manager(ILOM) accessible data. CVSS Base Score 4.0 (Confidentiality impacts). CVSS V2 Vector: (AV:N/AC:L/Au:S/C:P/I:N/A:N). Oracle Vector: (AV:N/AC:L/Au:S/C:P/I:N/A:N). Fix has been released CVE-2014-6584 P-9849V-ILOM prior to 3.2.4 4.0 AV:N/AC:L/Au:S/C:P/I:N/A:N CPUJan2015 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html P-9849V-ILOM prior to 3.2.4 Vulnerability in the Java SE component of Oracle Java SE (subcomponent: 2D). Supported versions that are affected are Java SE 5.0u75, Java SE 6u85, Java SE 7u72 and Java SE 8u25. Very difficult to exploit vulnerability allows successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability can result in unauthorized read access to a subset of Java SE accessible data. Note: Applies to client deployment of Java only. This vulnerability can be exploited only through sandboxed Java Web Start applications and sandboxed Java applets. CVSS Base Score 2.6 (Confidentiality impacts). CVSS V2 Vector: (AV:N/AC:H/Au:N/C:P/I:N/A:N). Oracle Vector: (AV:N/AC:H/Au:N/C:P/I:N/A:N). Fix has been released CVE-2014-6585 P-856V-Java SE 5.0u75 P-856V-Java SE 6u85 P-856V-Java SE 7u72 P-856V-Java SE 8u25 2.6 AV:N/AC:H/Au:N/C:P/I:N/A:N CPUJan2015 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html P-856V-Java SE 5.0u75 P-856V-Java SE 6u85 P-856V-Java SE 7u72 P-856V-Java SE 8u25 Vulnerability in the PeopleSoft Enterprise HRMS component of Oracle PeopleSoft Products (subcomponent: Time and Labor). The supported version that is affected is 9.1. Easily exploitable vulnerability allows successful authenticated network attacks via HTTP. Successful attack of this vulnerability can result in unauthorized update, insert or delete access to some PeopleSoft Enterprise HRMS accessible data as well as read access to a subset of PeopleSoft Enterprise HRMS accessible data. CVSS Base Score 5.5 (Confidentiality and Integrity impacts). CVSS V2 Vector: (AV:N/AC:L/Au:S/C:P/I:P/A:N). Oracle Vector: (AV:N/AC:L/Au:S/C:P/I:P/A:N). Fix has been released CVE-2014-6586 P-5079V-9.1 5.5 AV:N/AC:L/Au:S/C:P/I:P/A:N CPUJan2015 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html P-5079V-9.1 Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Libraries). Supported versions that are affected are Java SE 6u85, Java SE 7u72 and Java SE 8u25. Easily exploitable vulnerability requiring logon to Operating System plus additional login/authentication to component or subcomponent. Successful attack of this vulnerability can escalate attacker privileges resulting in unauthorized update, insert or delete access to some Java SE accessible data as well as read access to a subset of Java SE accessible data and ability to cause a partial denial of service (partial DOS) of Java SE. Note: Applies to client deployment of Java only. This vulnerability can be exploited only through sandboxed Java Web Start applications and sandboxed Java applets. CVSS Base Score 4.3 (Confidentiality, Integrity and Availability impacts). CVSS V2 Vector: (AV:L/AC:L/Au:S/C:P/I:P/A:P). Oracle Vector: (AV:L/AC:L/Au:S/C:P/I:P/A:P). Fix has been released CVE-2014-6587 P-856V-Java SE 6u85 P-856V-Java SE 7u72 P-856V-Java SE 8u25 4.3 AV:L/AC:L/Au:S/C:P/I:P/A:P CPUJan2015 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html P-856V-Java SE 6u85 P-856V-Java SE 7u72 P-856V-Java SE 8u25 Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: VMSVGA device). The supported version that is affected is VirtualBox prior to 4.3.20. Easily exploitable vulnerability requiring logon to Operating System plus additional login/authentication to component or subcomponent. Successful attack of this vulnerability can escalate attacker privileges resulting in unauthorized update, insert or delete access to all Oracle VM VirtualBox accessible data and ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox. Note: VMSVGA virtual graphics device is not documented and is disabled by default. CVSS Base Score 3.2 (Integrity and Availability impacts). CVSS V2 Vector: (AV:L/AC:L/Au:S/C:N/I:P/A:P). Oracle Vector: (AV:L/AC:L/Au:S/C:N/I:P+/A:P+). Fix has been released CVE-2014-6588 P-8370V-VirtualBox prior to 4.3.20 3.2 AV:L/AC:L/Au:S/C:N/I:P/A:P CPUJan2015 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html P-8370V-VirtualBox prior to 4.3.20 Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: VMSVGA device). The supported version that is affected is VirtualBox prior to 4.3.20. Easily exploitable vulnerability requiring logon to Operating System plus additional login/authentication to component or subcomponent. Successful attack of this vulnerability can escalate attacker privileges resulting in unauthorized update, insert or delete access to all Oracle VM VirtualBox accessible data and ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox. Note: VMSVGA virtual graphics device is not documented and is disabled by default. CVSS Base Score 3.2 (Integrity and Availability impacts). CVSS V2 Vector: (AV:L/AC:L/Au:S/C:N/I:P/A:P). Oracle Vector: (AV:L/AC:L/Au:S/C:N/I:P+/A:P+). Fix has been released CVE-2014-6589 P-8370V-VirtualBox prior to 4.3.20 3.2 AV:L/AC:L/Au:S/C:N/I:P/A:P CPUJan2015 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html P-8370V-VirtualBox prior to 4.3.20 Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: VMSVGA device). The supported version that is affected is VirtualBox prior to 4.3.20. Easily exploitable vulnerability requiring logon to Operating System plus additional login/authentication to component or subcomponent. Successful attack of this vulnerability can escalate attacker privileges resulting in unauthorized update, insert or delete access to all Oracle VM VirtualBox accessible data and ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox. Note: VMSVGA virtual graphics device is not documented and is disabled by default. CVSS Base Score 3.2 (Integrity and Availability impacts). CVSS V2 Vector: (AV:L/AC:L/Au:S/C:N/I:P/A:P). Oracle Vector: (AV:L/AC:L/Au:S/C:N/I:P+/A:P+). Fix has been released CVE-2014-6590 P-8370V-VirtualBox prior to 4.3.20 3.2 AV:L/AC:L/Au:S/C:N/I:P/A:P CPUJan2015 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html P-8370V-VirtualBox prior to 4.3.20 Vulnerability in the Java SE component of Oracle Java SE (subcomponent: 2D). Supported versions that are affected are Java SE 5.0u75, Java SE 6u85, Java SE 7u72 and Java SE 8u25. Very difficult to exploit vulnerability allows successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability can result in unauthorized read access to a subset of Java SE accessible data. Note: Applies to client deployment of Java only. This vulnerability can be exploited only through sandboxed Java Web Start applications and sandboxed Java applets. CVSS Base Score 2.6 (Confidentiality impacts). CVSS V2 Vector: (AV:N/AC:H/Au:N/C:P/I:N/A:N). Oracle Vector: (AV:N/AC:H/Au:N/C:P/I:N/A:N). Fix has been released CVE-2014-6591 P-856V-Java SE 5.0u75 P-856V-Java SE 6u85 P-856V-Java SE 7u72 P-856V-Java SE 8u25 2.6 AV:N/AC:H/Au:N/C:P/I:N/A:N CPUJan2015 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html P-856V-Java SE 5.0u75 P-856V-Java SE 6u85 P-856V-Java SE 7u72 P-856V-Java SE 8u25 Vulnerability in the Oracle OpenSSO component of Oracle Fusion Middleware (subcomponent: SAML). The supported version that is affected is 8.0 Update 2 Patch 5. Difficult to exploit vulnerability allows successful authenticated network attacks via HTTP. Successful attack of this vulnerability can result in unauthorized update, insert or delete access to some Oracle OpenSSO accessible data. CVSS Base Score 3.5 (Integrity impacts). CVSS V2 Vector: (AV:N/AC:M/Au:S/C:N/I:P/A:N). Oracle Vector: (AV:N/AC:M/Au:S/C:N/I:P/A:N). Fix has been released CVE-2014-6592 P-8520V-8.0 Update 2 Patch 5 3.5 AV:N/AC:M/Au:S/C:N/I:P/A:N CPUJan2015 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html P-8520V-8.0 Update 2 Patch 5 Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: JSSE). Supported versions that are affected are Java SE 5.0u75, Java SE 6u85, Java SE 7u72, Java SE 8u25, Java SE Embedded 7u71, Java SE Embedded 8u6, JRockit 27.8.4 and JRockit 28.3.4. Very difficult to exploit vulnerability allows successful unauthenticated network attacks via SSL/TLS. Successful attack of this vulnerability can result in unauthorized update, insert or delete access to some Java SE, Java SE Embedded, JRockit accessible data as well as read access to a subset of Java SE, Java SE Embedded, JRockit accessible data. Note: Applies to client and server deployment of JSSE. CVSS Base Score 4.0 (Confidentiality and Integrity impacts). CVSS V2 Vector: (AV:N/AC:H/Au:N/C:P/I:P/A:N). Oracle Vector: (AV:N/AC:H/Au:N/C:P/I:P/A:N). Fix has been released CVE-2014-6593 P-856V-Java SE 5.0u75 P-856V-Java SE 6u85 P-856V-Java SE 7u72 P-856V-Java SE 8u25 P-856V-Java SE Embedded 7u71 P-856V-Java SE Embedded 8u6 P-856V-JRockit 27.8.4 P-856V-JRockit 28.3.4 4.0 AV:N/AC:H/Au:N/C:P/I:P/A:N CPUJan2015 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html P-856V-Java SE 5.0u75 P-856V-Java SE 6u85 P-856V-Java SE 7u72 P-856V-Java SE 8u25 P-856V-Java SE Embedded 7u71 P-856V-Java SE Embedded 8u6 P-856V-JRockit 27.8.4 P-856V-JRockit 28.3.4 Vulnerability in the Oracle iLearning component of Oracle iLearning (subcomponent: Learner Pages). Supported versions that are affected are 6.0 and 6.1. Difficult to exploit vulnerability allows successful unauthenticated network attacks via HTTP. Successful attack of this vulnerability can result in unauthorized read access to a subset of Oracle iLearning accessible data. CVSS Base Score 4.3 (Confidentiality impacts). CVSS V2 Vector: (AV:N/AC:M/Au:N/C:P/I:N/A:N). Oracle Vector: (AV:N/AC:M/Au:N/C:P/I:N/A:N). Fix has been released CVE-2014-6594 P-902V-6.0 P-902V-6.1 4.3 AV:N/AC:M/Au:N/C:P/I:N/A:N CPUJan2015 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html P-902V-6.0 P-902V-6.1 Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: VMSVGA device). The supported version that is affected is VirtualBox prior to 4.3.20. Easily exploitable vulnerability requiring logon to Operating System plus additional login/authentication to component or subcomponent. Successful attack of this vulnerability can escalate attacker privileges resulting in unauthorized update, insert or delete access to all Oracle VM VirtualBox accessible data and ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox. Note: VMSVGA virtual graphics device is not documented and is disabled by default. CVSS Base Score 3.2 (Integrity and Availability impacts). CVSS V2 Vector: (AV:L/AC:L/Au:S/C:N/I:P/A:P). Oracle Vector: (AV:L/AC:L/Au:S/C:N/I:P+/A:P+). Fix has been released CVE-2014-6595 P-8370V-VirtualBox prior to 4.3.20 3.2 AV:L/AC:L/Au:S/C:N/I:P/A:P CPUJan2015 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html P-8370V-VirtualBox prior to 4.3.20 Vulnerability in the Siebel UI Framework component of Oracle Siebel CRM (subcomponent: Portal Framework). Supported versions that are affected are 8.1.1 and 8.2.2. Difficult to exploit vulnerability allows successful unauthenticated network attacks via HTTP. Successful attack of this vulnerability can result in unauthorized update, insert or delete access to some Siebel UI Framework accessible data. CVSS Base Score 4.3 (Integrity impacts). CVSS V2 Vector: (AV:N/AC:M/Au:N/C:N/I:P/A:N). Oracle Vector: (AV:N/AC:M/Au:N/C:N/I:P/A:N). Fix has been released CVE-2014-6596 P-9011V-8.1.1 P-9011V-8.2.2 4.3 AV:N/AC:M/Au:N/C:N/I:P/A:N CPUJan2015 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html P-9011V-8.1.1 P-9011V-8.2.2 Vulnerability in the PeopleSoft Enterprise PeopleTools component of Oracle PeopleSoft Products (subcomponent: PIA Core Technology). Supported versions that are affected are 8.52, 8.53 and 8.54. Easily exploitable vulnerability allows successful authenticated network attacks via HTTP. Successful attack of this vulnerability can result in unauthorized update, insert or delete access to some PeopleSoft Enterprise PeopleTools accessible data. CVSS Base Score 4.0 (Integrity impacts). CVSS V2 Vector: (AV:N/AC:L/Au:S/C:N/I:P/A:N). Oracle Vector: (AV:N/AC:L/Au:S/C:N/I:P/A:N). Fix has been released CVE-2014-6597 P-5085V-8.52 P-5085V-8.53 P-5085V-8.54 4.0 AV:N/AC:L/Au:S/C:N/I:P/A:N CPUJan2015 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html P-5085V-8.52 P-5085V-8.53 P-5085V-8.54 Vulnerability in the Oracle Communications Diameter Signaling Router component of Oracle Communications Applications (subcomponent: Signaling - DPI). Supported versions that are affected are 3.x, 4.x and 5.0. Very difficult to exploit vulnerability allows successful unauthenticated network attacks via Diameter. Successful attack of this vulnerability can result in unauthorized Operating System takeover including arbitrary code execution. CVSS Base Score 7.6 (Confidentiality, Integrity and Availability impacts). CVSS V2 Vector: (AV:N/AC:H/Au:N/C:C/I:C/A:C). Oracle Vector: (AV:N/AC:H/Au:N/C:C/I:C/A:C). Fix has been released CVE-2014-6598 P-10899V-3.x P-10899V-4.x P-10899V-5.0 7.6 AV:N/AC:H/Au:N/C:C/I:C/A:C CPUJan2015 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html P-10899V-3.x P-10899V-4.x P-10899V-5.0 Vulnerability in the Siebel Core - Common Components component of Oracle Siebel CRM (subcomponent: Email). Supported versions that are affected are 8.1.1 and 8.2.2. Difficult to exploit vulnerability allows successful authenticated network attacks via HTTP. Successful attack of this vulnerability can result in unauthorized read access to a subset of Siebel Core - Common Components accessible data. CVSS Base Score 3.5 (Confidentiality impacts). CVSS V2 Vector: (AV:N/AC:M/Au:S/C:P/I:N/A:N). Oracle Vector: (AV:N/AC:M/Au:S/C:P/I:N/A:N). Fix has been released CVE-2014-6599 P-9747V-8.1.1 P-9747V-8.2.2 3.5 AV:N/AC:M/Au:S/C:P/I:N/A:N CPUJan2015 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html P-9747V-8.1.1 P-9747V-8.2.2 Vulnerability in the Solaris component of Oracle Sun Systems Products Suite (subcomponent: File System). The supported version that is affected is 11. Easily exploitable vulnerability requiring logon to Operating System. Successful attack of this vulnerability can result in unauthorized Operating System hang or frequently repeatable crash (complete DOS). CVSS Base Score 4.9 (Availability impacts). CVSS V2 Vector: (AV:L/AC:L/Au:N/C:N/I:N/A:C). Oracle Vector: (AV:L/AC:L/Au:N/C:N/I:N/A:C). Fix has been released CVE-2014-6600 P-10006V-11 4.9 AV:L/AC:L/Au:N/C:N/I:N/A:C CPUJan2015 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html P-10006V-11 Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Hotspot). Supported versions that are affected are Java SE 6u85, Java SE 7u72 and Java SE 8u25. Easily exploitable vulnerability allows successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability can result in unauthorized Operating System takeover including arbitrary code execution. Note: Applies to client deployment of Java only. This vulnerability can be exploited only through sandboxed Java Web Start applications and sandboxed Java applets. CVSS Base Score 10.0 (Confidentiality, Integrity and Availability impacts). CVSS V2 Vector: (AV:N/AC:L/Au:N/C:C/I:C/A:C). Oracle Vector: (AV:N/AC:L/Au:N/C:C/I:C/A:C). Fix has been released CVE-2014-6601 P-856V-Java SE 6u85 P-856V-Java SE 7u72 P-856V-Java SE 8u25 10.0 AV:N/AC:L/Au:N/C:C/I:C/A:C CPUJan2015 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html P-856V-Java SE 6u85 P-856V-Java SE 7u72 P-856V-Java SE 8u25 Vulnerability in the BI Publisher (formerly XML Publisher) component of Oracle Fusion Middleware (subcomponent: BI Publisher Security). The supported version that is affected is 11.1.1.7. Easily exploitable vulnerability allows successful unauthenticated network attacks via HTTP. Successful attack of this vulnerability can result in unauthorized read access to a subset of BI Publisher (formerly XML Publisher) accessible data. CVSS Base Score 5.0 (Confidentiality impacts). CVSS V2 Vector: (AV:N/AC:L/Au:N/C:P/I:N/A:N). Oracle Vector: (AV:N/AC:L/Au:N/C:P/I:N/A:N). Fix has been released CVE-2015-0362 P-1479V-11.1.1.7 5.0 AV:N/AC:L/Au:N/C:P/I:N/A:N CPUJan2015 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html P-1479V-11.1.1.7 Vulnerability in the Siebel Core EAI component of Oracle Siebel CRM (subcomponent: Integration Business Services). Supported versions that are affected are 8.1.1 and 8.2.2. Easily exploitable vulnerability allows successful authenticated network attacks via HTTP. Successful attack of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Siebel Core EAI. CVSS Base Score 4.0 (Availability impacts). CVSS V2 Vector: (AV:N/AC:L/Au:S/C:N/I:N/A:P). Oracle Vector: (AV:N/AC:L/Au:S/C:N/I:N/A:P). Fix has been released CVE-2015-0363 P-9021V-8.1.1 P-9021V-8.2.2 4.0 AV:N/AC:L/Au:S/C:N/I:N/A:P CPUJan2015 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html P-9021V-8.1.1 P-9021V-8.2.2 Vulnerability in the Siebel Core - EAI component of Oracle Siebel CRM (subcomponent: Integration Business Services). Supported versions that are affected are 8.1.1 and 8.2.2. Difficult to exploit vulnerability allows successful authenticated network attacks via HTTP. Successful attack of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Siebel Core - EAI. CVSS Base Score 3.5 (Availability impacts). CVSS V2 Vector: (AV:N/AC:M/Au:S/C:N/I:N/A:P). Oracle Vector: (AV:N/AC:M/Au:S/C:N/I:N/A:P). Fix has been released CVE-2015-0364 P-9021V-8.1.1 P-9021V-8.2.2 3.5 AV:N/AC:M/Au:S/C:N/I:N/A:P CPUJan2015 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html P-9021V-8.1.1 P-9021V-8.2.2 Vulnerability in the Siebel Core - Server Infrastructure component of Oracle Siebel CRM (subcomponent: Security). Supported versions that are affected are 8.1.1 and 8.2.2. Difficult to exploit vulnerability allows successful unauthenticated network attacks via HTTP. Successful attack of this vulnerability can result in unauthorized read access to a subset of Siebel Core - Server Infrastructure accessible data. CVSS Base Score 4.3 (Confidentiality impacts). CVSS V2 Vector: (AV:N/AC:M/Au:N/C:P/I:N/A:N). Oracle Vector: (AV:N/AC:M/Au:N/C:P/I:N/A:N). Fix has been released CVE-2015-0365 P-9004V-8.1.1 P-9004V-8.2.2 4.3 AV:N/AC:M/Au:N/C:P/I:N/A:N CPUJan2015 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html P-9004V-8.1.1 P-9004V-8.2.2 Vulnerability in the Siebel Core - EAI component of Oracle Siebel CRM (subcomponent: Java Integration). Supported versions that are affected are 8.1.1 and 8.2.2. Easily exploitable vulnerability allows successful unauthenticated network attacks via HTTP. Successful attack of this vulnerability can result in unauthorized read access to a subset of Siebel Core - EAI accessible data. CVSS Base Score 5.0 (Confidentiality impacts). CVSS V2 Vector: (AV:N/AC:L/Au:N/C:P/I:N/A:N). Oracle Vector: (AV:N/AC:L/Au:N/C:P/I:N/A:N). Fix has been released CVE-2015-0366 P-9021V-8.1.1 P-9021V-8.2.2 5.0 AV:N/AC:L/Au:N/C:P/I:N/A:N CPUJan2015 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html P-9021V-8.1.1 P-9021V-8.2.2 Vulnerability in the Oracle Access Manager component of Oracle Fusion Middleware (subcomponent: SSO Engine). Supported versions that are affected are 11.1.1.5, 11.1.1.7, 11.1.2.1 and 11.1.2.2. Easily exploitable vulnerability allows successful unauthenticated network attacks via HTTP. Successful attack of this vulnerability can result in unauthorized update, insert or delete access to some Oracle Access Manager accessible data. Note: Please refer to <a href="https://support.oracle.com/CSP/main/article?cmd=show&amp;type=NOT&amp;id=1952939.1">My Oracle Support Note 1952939.1</a> for instructions on how to address this issue. CVSS Base Score 5.0 (Integrity impacts). CVSS V2 Vector: (AV:N/AC:L/Au:N/C:N/I:P/A:N). Oracle Vector: (AV:N/AC:L/Au:N/C:N/I:P/A:N). Fix has been released CVE-2015-0367 P-5565V-11.1.1.5 P-5565V-11.1.1.7 P-5565V-11.1.2.1 P-5565V-11.1.2.2 5.0 AV:N/AC:L/Au:N/C:N/I:P/A:N CPUJan2015 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html P-5565V-11.1.1.5 P-5565V-11.1.1.7 P-5565V-11.1.2.1 P-5565V-11.1.2.2 Vulnerability in the Oracle Transportation Management component of Oracle Supply Chain Products Suite (subcomponent: Security). Supported versions that are affected are 6.1, 6.2, 6.3, 6.3.1, 6.3.2, 6.3.3, 6.3.4 and 6.3.5. Easily exploitable vulnerability allows successful unauthenticated network attacks via HTTP. Successful attack of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Transportation Management. CVSS Base Score 5.0 (Availability impacts). CVSS V2 Vector: (AV:N/AC:L/Au:N/C:N/I:N/A:P). Oracle Vector: (AV:N/AC:L/Au:N/C:N/I:N/A:P). Fix has been released CVE-2015-0368 P-1991V-6.1 P-1991V-6.2 P-1991V-6.3 P-1991V-6.3.1 P-1991V-6.3.2 P-1991V-6.3.3 P-1991V-6.3.4 P-1991V-6.3.5 5.0 AV:N/AC:L/Au:N/C:N/I:N/A:P CPUJan2015 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html P-1991V-6.1 P-1991V-6.2 P-1991V-6.3 P-1991V-6.3.1 P-1991V-6.3.2 P-1991V-6.3.3 P-1991V-6.3.4 P-1991V-6.3.5 Vulnerability in the Siebel UI Framework component of Oracle Siebel CRM (subcomponent: AX/HI Web UI). Supported versions that are affected are 8.1.1 and 8.2.2. Difficult to exploit vulnerability allows successful unauthenticated network attacks via HTTP. Successful attack of this vulnerability can result in unauthorized update, insert or delete access to some Siebel UI Framework accessible data. CVSS Base Score 4.3 (Integrity impacts). CVSS V2 Vector: (AV:N/AC:M/Au:N/C:N/I:P/A:N). Oracle Vector: (AV:N/AC:M/Au:N/C:N/I:P/A:N). Fix has been released CVE-2015-0369 P-9011V-8.1.1 P-9011V-8.2.2 4.3 AV:N/AC:M/Au:N/C:N/I:P/A:N CPUJan2015 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html P-9011V-8.1.1 P-9011V-8.2.2 Vulnerability in the Core RDBMS component of Oracle Database Server. This vulnerability requires Create Session privileges for a successful attack. Supported versions that are affected are 11.1.0.7, 11.2.0.3, 11.2.0.4 and 12.1.0.1. Difficult to exploit vulnerability allows successful authenticated network attacks via Oracle Net. Successful attack of this vulnerability can result in unauthorized update, insert or delete access to some Core RDBMS accessible data. CVSS Base Score 3.5 (Integrity impacts). CVSS V2 Vector: (AV:N/AC:M/Au:S/C:N/I:P/A:N). Oracle Vector: (AV:N/AC:M/Au:S/C:N/I:P/A:N). Fix has been released CVE-2015-0370 P-11V-11.1.0.7 P-11V-11.2.0.3 P-11V-11.2.0.4 P-11V-12.1.0.1 3.5 AV:N/AC:M/Au:S/C:N/I:P/A:N CPUJan2015 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html P-11V-11.1.0.7 P-11V-11.2.0.3 P-11V-11.2.0.4 P-11V-12.1.0.1 Vulnerability in the Core RDBMS component of Oracle Database Server. This vulnerability requires Create Session, Create Table privileges for a successful attack. Supported versions that are affected are 11.1.0.7, 11.2.0.3, 11.2.0.4 and 12.1.0.1. Difficult to exploit vulnerability allows successful authenticated network attacks via Oracle Net. Successful attack of this vulnerability can result in unauthorized update, insert or delete access to all Core RDBMS accessible data and ability to cause a partial denial of service (partial DOS) of Core RDBMS. CVSS Base Score 4.9 (Integrity and Availability impacts). CVSS V2 Vector: (AV:N/AC:M/Au:S/C:N/I:P/A:P). Oracle Vector: (AV:N/AC:M/Au:S/C:N/I:P+/A:P). Fix has been released CVE-2015-0371 P-11V-11.1.0.7 P-11V-11.2.0.3 P-11V-11.2.0.4 P-11V-12.1.0.1 4.9 AV:N/AC:M/Au:S/C:N/I:P/A:P CPUJan2015 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html P-11V-11.1.0.7 P-11V-11.2.0.3 P-11V-11.2.0.4 P-11V-12.1.0.1 Vulnerability in the Oracle Containers for J2EE component of Oracle Fusion Middleware (subcomponent: None). The supported version that is affected is 10.1.3.5. Easily exploitable vulnerability allows successful unauthenticated network attacks via HTTP. Successful attack of this vulnerability can result in unauthorized read access to all Oracle Containers for J2EE accessible data. CVSS Base Score 5.0 (Confidentiality impacts). CVSS V2 Vector: (AV:N/AC:L/Au:N/C:P/I:N/A:N). Oracle Vector: (AV:N/AC:L/Au:N/C:P+/I:N/A:N). Fix has been released CVE-2015-0372 P-1270V-10.1.3.5 5.0 AV:N/AC:L/Au:N/C:P/I:N/A:N CPUJan2015 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html P-1270V-10.1.3.5 Vulnerability in the OJVM component of Oracle Database Server. This vulnerability requires Create Session privileges for a successful attack. Supported versions that are affected are 11.1.0.7, 11.2.0.3, 11.2.0.4, 12.1.0.1 and 12.1.0.2. Easily exploitable vulnerability allows successful authenticated network attacks via Oracle Net. Successful attack of this vulnerability can result in unauthorized takeover of OJVM possibly including arbitrary code execution within the OJVM. Note: This brings the OJVM component of Database in line with Java SE security fixes delivered as of January CPU 2015. CVSS Base Score 6.5 (Confidentiality, Integrity and Availability impacts). CVSS V2 Vector: (AV:N/AC:L/Au:S/C:P/I:P/A:P). Oracle Vector: (AV:N/AC:L/Au:S/C:P+/I:P+/A:P+). Fix has been released CVE-2015-0373 P-5V-11.1.0.7 P-5V-11.2.0.3 P-5V-11.2.0.4 P-5V-12.1.0.1 P-5V-12.1.0.2 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P CPUJan2015 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html P-5V-11.1.0.7 P-5V-11.2.0.3 P-5V-11.2.0.4 P-5V-12.1.0.1 P-5V-12.1.0.2 Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server : Security : Privileges : Foreign Key). Supported versions that are affected are 5.5.40 and earlier and 5.6.21 and earlier. Difficult to exploit vulnerability allows successful authenticated network attacks via multiple protocols. Successful attack of this vulnerability can result in unauthorized read access to a subset of MySQL Server accessible data. CVSS Base Score 3.5 (Confidentiality impacts). CVSS V2 Vector: (AV:N/AC:M/Au:S/C:P/I:N/A:N). Oracle Vector: (AV:N/AC:M/Au:S/C:P/I:N/A:N). Fix has been released CVE-2015-0374 P-8478V-5.5.40 and earlier P-8478V-5.6.21 and earlier 3.5 AV:N/AC:M/Au:S/C:P/I:N/A:N CPUJan2015 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html P-8478V-5.5.40 and earlier P-8478V-5.6.21 and earlier Vulnerability in the Solaris component of Oracle Sun Systems Products Suite (subcomponent: Network). Supported versions that are affected are 10 and 11. Easily exploitable vulnerability allows successful unauthenticated network attacks via TCP/IP. Successful attack of this vulnerability can result in unauthorized read access to a subset of Solaris accessible data. CVSS Base Score 5.0 (Confidentiality impacts). CVSS V2 Vector: (AV:N/AC:L/Au:N/C:P/I:N/A:N). Oracle Vector: (AV:N/AC:L/Au:N/C:P/I:N/A:N). Fix has been released CVE-2015-0375 P-10006V-10 P-10006V-11 5.0 AV:N/AC:L/Au:N/C:P/I:N/A:N CPUJan2015 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html P-10006V-10 P-10006V-11 Vulnerability in the Oracle WebCenter Content component of Oracle Fusion Middleware (subcomponent: Content Server). The supported version that is affected is 11.1.1.8.0. Difficult to exploit vulnerability allows successful unauthenticated network attacks via HTTP. Successful attack of this vulnerability can result in unauthorized update, insert or delete access to some Oracle WebCenter Content accessible data. CVSS Base Score 4.3 (Integrity impacts). CVSS V2 Vector: (AV:N/AC:M/Au:N/C:N/I:P/A:N). Oracle Vector: (AV:N/AC:M/Au:N/C:N/I:P/A:N). Fix has been released CVE-2015-0376 P-2271V-11.1.1.8.0 4.3 AV:N/AC:M/Au:N/C:N/I:P/A:N CPUJan2015 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html P-2271V-11.1.1.8.0 Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Supported versions that are affected are VirtualBox prior to 3.2.26, 4.0.28, 4.1.36 and 4.2.28. Difficult to exploit vulnerability requiring logon to Operating System plus additional login/authentication to component or subcomponent. Successful attack of this vulnerability can escalate attacker privileges resulting in unauthorized Operating System hang or frequently repeatable crash (complete DOS). CVSS Base Score 4.4 (Availability impacts). CVSS V2 Vector: (AV:L/AC:M/Au:S/C:N/I:N/A:C). Oracle Vector: (AV:L/AC:M/Au:S/C:N/I:N/A:C). Fix has been released CVE-2015-0377 P-8370V-VirtualBox prior to 3.2.26 P-8370V-4.0.28 P-8370V-4.1.36 P-8370V-4.2.28 4.4 AV:L/AC:M/Au:S/C:N/I:N/A:C CPUJan2015 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html P-8370V-VirtualBox prior to 3.2.26 P-8370V-4.0.28 P-8370V-4.1.36 P-8370V-4.2.28 Vulnerability in the Solaris component of Oracle Sun Systems Products Suite (subcomponent: Libc). The supported version that is affected is 11. Easily exploitable vulnerability requiring logon to Operating System. Successful attack of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Solaris. CVSS Base Score 2.1 (Availability impacts). CVSS V2 Vector: (AV:L/AC:L/Au:N/C:N/I:N/A:P). Oracle Vector: (AV:L/AC:L/Au:N/C:N/I:N/A:P). Fix has been released CVE-2015-0378 P-10006V-11 2.1 AV:L/AC:L/Au:N/C:N/I:N/A:P CPUJan2015 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html P-10006V-11 Vulnerability in the PeopleSoft Enterprise PeopleTools component of Oracle PeopleSoft Products (subcomponent: PIA Core Technology). The supported version that is affected is 8.54. Difficult to exploit vulnerability allows successful unauthenticated network attacks via HTTP. Successful attack of this vulnerability can result in unauthorized update, insert or delete access to some PeopleSoft Enterprise PeopleTools accessible data. CVSS Base Score 4.3 (Integrity impacts). CVSS V2 Vector: (AV:N/AC:M/Au:N/C:N/I:P/A:N). Oracle Vector: (AV:N/AC:M/Au:N/C:N/I:P/A:N). Fix has been released CVE-2015-0379 P-5085V-8.54 4.3 AV:N/AC:M/Au:N/C:N/I:P/A:N CPUJan2015 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html P-5085V-8.54 Vulnerability in the Oracle Telecommunications Billing Integrator component of Oracle E-Business Suite (subcomponent: OA Based UI for Bill Summary). Supported versions that are affected are 11.5.10.2, 12.0.4, 12.0.5, 12.0.6, 12.1.1, 12.1.2, 12.1.3, 12.2.2, 12.2.3 and 12.2.4. Difficult to exploit vulnerability allows successful unauthenticated network attacks via HTTP. Successful attack of this vulnerability can result in unauthorized update, insert or delete access to some Oracle Telecommunications Billing Integrator accessible data. CVSS Base Score 4.3 (Integrity impacts). CVSS V2 Vector: (AV:N/AC:M/Au:N/C:N/I:P/A:N). Oracle Vector: (AV:N/AC:M/Au:N/C:N/I:P/A:N). Fix has been released CVE-2015-0380 P-1300V-11.5.10.2 P-1300V-12.0.4 P-1300V-12.0.5 P-1300V-12.0.6 P-1300V-12.1.1 P-1300V-12.1.2 P-1300V-12.1.3 P-1300V-12.2.2 P-1300V-12.2.3 P-1300V-12.2.4 4.3 AV:N/AC:M/Au:N/C:N/I:P/A:N CPUJan2015 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html P-1300V-11.5.10.2 P-1300V-12.0.4 P-1300V-12.0.5 P-1300V-12.0.6 P-1300V-12.1.1 P-1300V-12.1.2 P-1300V-12.1.3 P-1300V-12.2.2 P-1300V-12.2.3 P-1300V-12.2.4 Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server : Replication). Supported versions that are affected are 5.5.40 and earlier and 5.6.21 and earlier. Difficult to exploit vulnerability allows successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS Base Score 4.3 (Availability impacts). CVSS V2 Vector: (AV:N/AC:M/Au:N/C:N/I:N/A:P). Oracle Vector: (AV:N/AC:M/Au:N/C:N/I:N/A:P+). Fix has been released CVE-2015-0381 P-8478V-5.5.40 and earlier P-8478V-5.6.21 and earlier 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P CPUJan2015 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html P-8478V-5.5.40 and earlier P-8478V-5.6.21 and earlier Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server : Replication). Supported versions that are affected are 5.5.40 and earlier and 5.6.21 and earlier. Difficult to exploit vulnerability allows successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS Base Score 4.3 (Availability impacts). CVSS V2 Vector: (AV:N/AC:M/Au:N/C:N/I:N/A:P). Oracle Vector: (AV:N/AC:M/Au:N/C:N/I:N/A:P+). Fix has been released CVE-2015-0382 P-8478V-5.5.40 and earlier P-8478V-5.6.21 and earlier 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P CPUJan2015 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html P-8478V-5.5.40 and earlier P-8478V-5.6.21 and earlier Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Hotspot). Supported versions that are affected are Java SE 5.0u75, Java SE 6u85, Java SE 7u72, Java SE 8u25, Java SE Embedded 7u71, Java SE Embedded 8u6, JRockit R27.8.4 and JRockit R28.3.4. Difficult to exploit vulnerability requiring logon to Operating System. Successful attack of this vulnerability can result in unauthorized Operating System hang or frequently repeatable crash (complete DOS) as well as update, insert or delete access to some Java SE, Java SE Embedded, JRockit accessible data. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS Base Score 5.4 (Integrity and Availability impacts). CVSS V2 Vector: (AV:L/AC:M/Au:N/C:N/I:P/A:C). Oracle Vector: (AV:L/AC:M/Au:N/C:N/I:P/A:C). Fix has been released CVE-2015-0383 P-856V-Java SE 5.0u75 P-856V-Java SE 6u85 P-856V-Java SE 7u72 P-856V-Java SE 8u25 P-856V-Java SE Embedded 7u71 P-856V-Java SE Embedded 8u6 P-856V-JRockit R27.8.4 P-856V-JRockit R28.3.4 5.4 AV:L/AC:M/Au:N/C:N/I:P/A:C CPUJan2015 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html P-856V-Java SE 5.0u75 P-856V-Java SE 6u85 P-856V-Java SE 7u72 P-856V-Java SE 8u25 P-856V-Java SE Embedded 7u71 P-856V-Java SE Embedded 8u6 P-856V-JRockit R27.8.4 P-856V-JRockit R28.3.4 Vulnerability in the Siebel Public Sector component of Oracle Siebel CRM (subcomponent: Public Sector Portal). Supported versions that are affected are 8.1.1 and 8.2.2. Difficult to exploit vulnerability allows successful authenticated network attacks via HTTP. Successful attack of this vulnerability can result in unauthorized update, insert or delete access to some Siebel Public Sector accessible data. CVSS Base Score 3.5 (Integrity impacts). CVSS V2 Vector: (AV:N/AC:M/Au:S/C:N/I:P/A:N). Oracle Vector: (AV:N/AC:M/Au:S/C:N/I:P/A:N). Fix has been released CVE-2015-0384 P-9165V-8.1.1 P-9165V-8.2.2 3.5 AV:N/AC:M/Au:S/C:N/I:P/A:N CPUJan2015 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html P-9165V-8.1.1 P-9165V-8.2.2 Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server : Pluggable Auth). Supported versions that are affected are 5.6.21 and earlier. Difficult to exploit vulnerability allows successful authenticated network attacks via multiple protocols. Successful attack of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS Base Score 3.5 (Availability impacts). CVSS V2 Vector: (AV:N/AC:M/Au:S/C:N/I:N/A:P). Oracle Vector: (AV:N/AC:M/Au:S/C:N/I:N/A:P+). Fix has been released CVE-2015-0385 P-8478V-5.6.21 and earlier 3.5 AV:N/AC:M/Au:S/C:N/I:N/A:P CPUJan2015 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html P-8478V-5.6.21 and earlier Vulnerability in the Oracle HTTP Server component of Oracle Fusion Middleware (subcomponent: Web Listener). Supported versions that are affected are 11.1.1.7.0, 12.1.2.0 and 12.1.3.0. Difficult to exploit vulnerability allows successful unauthenticated network attacks via HTTP. Successful attack of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle HTTP Server. CVSS Base Score 4.3 (Availability impacts). CVSS V2 Vector: (AV:N/AC:M/Au:N/C:N/I:N/A:P). Oracle Vector: (AV:N/AC:M/Au:N/C:N/I:N/A:P). Fix has been released CVE-2015-0386 P-1042V-11.1.1.7.0 P-1042V-12.1.2.0 P-1042V-12.1.3.0 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P CPUJan2015 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html P-1042V-11.1.1.7.0 P-1042V-12.1.2.0 P-1042V-12.1.3.0 Vulnerability in the Siebel Core - Server OM Services component of Oracle Siebel CRM (subcomponent: Security - LDAP Security Adapter). Supported versions that are affected are 8.1.1 and 8.2.2. Easily exploitable vulnerability allows successful authenticated network attacks via HTTP. Successful attack of this vulnerability can result in unauthorized read access to a subset of Siebel Core - Server OM Services accessible data. CVSS Base Score 4.0 (Confidentiality impacts). CVSS V2 Vector: (AV:N/AC:L/Au:S/C:P/I:N/A:N). Oracle Vector: (AV:N/AC:L/Au:S/C:P/I:N/A:N). Fix has been released CVE-2015-0387 P-9006V-8.1.1 P-9006V-8.2.2 4.0 AV:N/AC:L/Au:S/C:P/I:N/A:N CPUJan2015 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html P-9006V-8.1.1 P-9006V-8.2.2 Vulnerability in the Siebel UI Framework component of Oracle Siebel CRM (subcomponent: Portal Framework). Supported versions that are affected are 8.1.1 and 8.2.2. Easily exploitable vulnerability allows successful authenticated network attacks via HTTP. Successful attack of this vulnerability can result in unauthorized read access to a subset of Siebel UI Framework accessible data. CVSS Base Score 4.0 (Confidentiality impacts). CVSS V2 Vector: (AV:N/AC:L/Au:S/C:P/I:N/A:N). Oracle Vector: (AV:N/AC:L/Au:S/C:P/I:N/A:N). Fix has been released CVE-2015-0388 P-9011V-8.1.1 P-9011V-8.2.2 4.0 AV:N/AC:L/Au:S/C:P/I:N/A:N CPUJan2015 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html P-9011V-8.1.1 P-9011V-8.2.2 Vulnerability in the Oracle OpenSSO component of Oracle Fusion Middleware (subcomponent: SAML). The supported version that is affected is 8.0 Update 2 Patch 5. Difficult to exploit vulnerability allows successful authenticated network attacks via HTTP. Successful attack of this vulnerability can result in unauthorized update, insert or delete access to some Oracle OpenSSO accessible data. CVSS Base Score 3.5 (Integrity impacts). CVSS V2 Vector: (AV:N/AC:M/Au:S/C:N/I:P/A:N). Oracle Vector: (AV:N/AC:M/Au:S/C:N/I:P/A:N). Fix has been released CVE-2015-0389 P-8520V-8.0 Update 2 Patch 5 3.5 AV:N/AC:M/Au:S/C:N/I:P/A:N CPUJan2015 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html P-8520V-8.0 Update 2 Patch 5 Vulnerability in the MICROS Retail component of Oracle Retail Applications (subcomponent: Xstore Point of Sale). Supported versions that are affected are Xstore: 3.2.1, 3.4.2, 3.5.0, 4.0.1, 4.5.1, 4.8.0, 5.0.3, 5.5.3, 6.0.6 and 6.5.2. Difficult to exploit vulnerability allows successful unauthenticated network attacks via Proprietary XML. Successful attack of this vulnerability can result in unauthorized update, insert or delete access to some MICROS Retail accessible data as well as read access to a subset of MICROS Retail accessible data and ability to cause a partial denial of service (partial DOS) of MICROS Retail. CVSS Base Score 6.8 (Confidentiality, Integrity and Availability impacts). CVSS V2 Vector: (AV:N/AC:M/Au:N/C:P/I:P/A:P). Oracle Vector: (AV:N/AC:M/Au:N/C:P/I:P/A:P). Fix has been released CVE-2015-0390 P-11435V-Xstore: 3.2.1 P-11435V-3.4.2 P-11435V-3.5.0 P-11435V-4.0.1 P-11435V-4.5.1 P-11435V-4.8.0 P-11435V-5.0.3 P-11435V-5.5.3 P-11435V-6.0.6 P-11435V-6.5.2 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P CPUJan2015 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html P-11435V-Xstore: 3.2.1 P-11435V-3.4.2 P-11435V-3.5.0 P-11435V-4.0.1 P-11435V-4.5.1 P-11435V-4.8.0 P-11435V-5.0.3 P-11435V-5.5.3 P-11435V-6.0.6 P-11435V-6.5.2 Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server : DDL). Supported versions that are affected are 5.5.38 and earlier and 5.6.19 and earlier. Easily exploitable vulnerability allows successful authenticated network attacks via multiple protocols. Successful attack of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS Base Score 4.0 (Availability impacts). CVSS V2 Vector: (AV:N/AC:L/Au:S/C:N/I:N/A:P). Oracle Vector: (AV:N/AC:L/Au:S/C:N/I:N/A:P+). Fix has been released CVE-2015-0391 P-8478V-5.5.38 and earlier P-8478V-5.6.19 and earlier 4.0 AV:N/AC:L/Au:S/C:N/I:N/A:P CPUJan2015 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html P-8478V-5.5.38 and earlier P-8478V-5.6.19 and earlier Vulnerability in the Siebel Core - Server BizLogic Script component of Oracle Siebel CRM (subcomponent: Config - Scripting). Supported versions that are affected are 8.1.1 and 8.2.2. Very difficult to exploit vulnerability allows successful authenticated network attacks via HTTP. Successful attack of this vulnerability can result in unauthorized update, insert or delete access to some Siebel Core - Server BizLogic Script accessible data as well as read access to a subset of Siebel Core - Server BizLogic Script accessible data and ability to cause a partial denial of service (partial DOS) of Siebel Core - Server BizLogic Script. CVSS Base Score 4.6 (Confidentiality, Integrity and Availability impacts). CVSS V2 Vector: (AV:N/AC:H/Au:S/C:P/I:P/A:P). Oracle Vector: (AV:N/AC:H/Au:S/C:P/I:P/A:P). Fix has been released CVE-2015-0392 P-9001V-8.1.1 P-9001V-8.2.2 4.6 AV:N/AC:H/Au:S/C:P/I:P/A:P CPUJan2015 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html P-9001V-8.1.1 P-9001V-8.2.2 Vulnerability in the Oracle Applications DBA component of Oracle E-Business Suite (subcomponent: DB Privileges). Supported versions that are affected are 11.5.10.2, 12.0.6, 12.1.3, 12.2.2, 12.2.3 and 12.2.4. Difficult to exploit vulnerability allows successful authenticated network attacks via Oracle Net. Successful attack of this vulnerability can result in unauthorized takeover of Oracle Applications DBA possibly including arbitrary code execution within the Oracle Applications DBA. CVSS Base Score 6.0 (Confidentiality, Integrity and Availability impacts). CVSS V2 Vector: (AV:N/AC:M/Au:S/C:P/I:P/A:P). Oracle Vector: (AV:N/AC:M/Au:S/C:P+/I:P+/A:P+). Fix has been released CVE-2015-0393 P-166V-11.5.10.2 P-166V-12.0.6 P-166V-12.1.3 P-166V-12.2.2 P-166V-12.2.3 P-166V-12.2.4 6.0 AV:N/AC:M/Au:S/C:P/I:P/A:P CPUJan2015 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html P-166V-11.5.10.2 P-166V-12.0.6 P-166V-12.1.3 P-166V-12.2.2 P-166V-12.2.3 P-166V-12.2.4 Vulnerability in the PeopleSoft Enterprise PeopleTools component of Oracle PeopleSoft Products (subcomponent: Report Distribution). Supported versions that are affected are 8.52 and 8.53. Easily exploitable vulnerability allows successful authenticated network attacks via HTTP. Successful attack of this vulnerability can result in unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data. CVSS Base Score 4.0 (Confidentiality impacts). CVSS V2 Vector: (AV:N/AC:L/Au:S/C:P/I:N/A:N). Oracle Vector: (AV:N/AC:L/Au:S/C:P/I:N/A:N). Fix has been released CVE-2015-0394 P-5085V-8.52 P-5085V-8.53 4.0 AV:N/AC:L/Au:S/C:P/I:N/A:N CPUJan2015 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html P-5085V-8.52 P-5085V-8.53 Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Hotspot). Supported versions that are affected are Java SE 5.0u75, Java SE 6u85, Java SE 7u72 and Java SE 8u25. Difficult to exploit vulnerability allows successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability can result in unauthorized Operating System takeover including arbitrary code execution. Note: Applies to client deployment of Java only. This vulnerability can be exploited only through sandboxed Java Web Start applications and sandboxed Java applets. CVSS Base Score 9.3 (Confidentiality, Integrity and Availability impacts). CVSS V2 Vector: (AV:N/AC:M/Au:N/C:C/I:C/A:C). Oracle Vector: (AV:N/AC:M/Au:N/C:C/I:C/A:C). Fix has been released CVE-2015-0395 P-856V-Java SE 5.0u75 P-856V-Java SE 6u85 P-856V-Java SE 7u72 P-856V-Java SE 8u25 9.3 AV:N/AC:M/Au:N/C:C/I:C/A:C CPUJan2015 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html P-856V-Java SE 5.0u75 P-856V-Java SE 6u85 P-856V-Java SE 7u72 P-856V-Java SE 8u25 Vulnerability in the Oracle GlassFish Server component of Oracle Fusion Middleware (subcomponent: Admin Console). Supported versions that are affected are 3.0.1 and 3.1.2. Easily exploitable vulnerability allows successful unauthenticated network attacks via HTTP. Successful attack of this vulnerability can result in unauthorized update, insert or delete access to some Oracle GlassFish Server accessible data as well as read access to a subset of Oracle GlassFish Server accessible data and ability to cause a partial denial of service (partial DOS) of Oracle GlassFish Server. CVSS Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS V2 Vector: (AV:N/AC:L/Au:N/C:P/I:P/A:P). Oracle Vector: (AV:N/AC:L/Au:N/C:P/I:P/A:P). Fix has been released CVE-2015-0396 P-8493V-3.0.1 P-8493V-3.1.2 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P CPUJan2015 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html P-8493V-3.0.1 P-8493V-3.1.2 Vulnerability in the Solaris component of Oracle Sun Systems Products Suite (subcomponent: File System). The supported version that is affected is 11. Easily exploitable vulnerability requiring logon to Operating System. Successful attack of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Solaris. CVSS Base Score 2.1 (Availability impacts). CVSS V2 Vector: (AV:L/AC:L/Au:N/C:N/I:N/A:P). Oracle Vector: (AV:L/AC:L/Au:N/C:N/I:N/A:P). Fix has been released CVE-2015-0397 P-10006V-11 2.1 AV:L/AC:L/Au:N/C:N/I:N/A:P CPUJan2015 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html P-10006V-11 Vulnerability in the Siebel Life Sciences component of Oracle Siebel CRM (subcomponent: Clinical Trip Report). Supported versions that are affected are 8.1.1 and 8.2.2. Easily exploitable vulnerability allows successful authenticated network attacks via HTTP. Successful attack of this vulnerability can result in unauthorized read access to a subset of Siebel Life Sciences accessible data. CVSS Base Score 4.0 (Confidentiality impacts). CVSS V2 Vector: (AV:N/AC:L/Au:S/C:P/I:N/A:N). Oracle Vector: (AV:N/AC:L/Au:S/C:P/I:N/A:N). Fix has been released CVE-2015-0398 P-9173V-8.1.1 P-9173V-8.2.2 4.0 AV:N/AC:L/Au:S/C:P/I:N/A:N CPUJan2015 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html P-9173V-8.1.1 P-9173V-8.2.2 Vulnerability in the Oracle Business Intelligence Enterprise Edition component of Oracle Fusion Middleware (subcomponent: Analytics Web General). Supported versions that are affected are 10.1.3.4.2 and 11.1.1.7. Easily exploitable vulnerability allows successful authenticated network attacks via HTTP. Successful attack of this vulnerability can result in unauthorized read access to a subset of Oracle Business Intelligence Enterprise Edition accessible data. CVSS Base Score 4.0 (Confidentiality impacts). CVSS V2 Vector: (AV:N/AC:L/Au:S/C:P/I:N/A:N). Oracle Vector: (AV:N/AC:L/Au:S/C:P/I:N/A:N). Fix has been released CVE-2015-0399 P-2025V-10.1.3.4.2 P-2025V-11.1.1.7 4.0 AV:N/AC:L/Au:S/C:P/I:N/A:N CPUJan2015 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html P-2025V-10.1.3.4.2 P-2025V-11.1.1.7 Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Libraries). Supported versions that are affected are Java SE 6u85, Java SE 7u72 and Java SE 8u25. Easily exploitable vulnerability allows successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability can result in unauthorized read access to a subset of Java SE accessible data. Note: Applies to client deployment of Java only. This vulnerability can be exploited only through sandboxed Java Web Start applications and sandboxed Java applets. CVSS Base Score 5.0 (Confidentiality impacts). CVSS V2 Vector: (AV:N/AC:L/Au:N/C:P/I:N/A:N). Oracle Vector: (AV:N/AC:L/Au:N/C:P/I:N/A:N). Fix has been released CVE-2015-0400 P-856V-Java SE 6u85 P-856V-Java SE 7u72 P-856V-Java SE 8u25 5.0 AV:N/AC:L/Au:N/C:P/I:N/A:N CPUJan2015 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html P-856V-Java SE 6u85 P-856V-Java SE 7u72 P-856V-Java SE 8u25 Vulnerability in the Oracle Directory Server Enterprise Edition component of Oracle Fusion Middleware (subcomponent: Admin Console). Supported versions that are affected are 7.0 and 11.1.1.7. Easily exploitable vulnerability allows successful authenticated network attacks via HTTP. Successful attack of this vulnerability can result in unauthorized update, insert or delete access to all Oracle Directory Server Enterprise Edition accessible data. CVSS Base Score 4.0 (Integrity impacts). CVSS V2 Vector: (AV:N/AC:L/Au:S/C:N/I:P/A:N). Oracle Vector: (AV:N/AC:L/Au:S/C:N/I:P+/A:N). Fix has been released CVE-2015-0401 P-8512V-7.0 P-8512V-11.1.1.7 4.0 AV:N/AC:L/Au:S/C:N/I:P/A:N CPUJan2015 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html P-8512V-7.0 P-8512V-11.1.1.7 Vulnerability in the Siebel Core - Server BizLogic Script component of Oracle Siebel CRM (subcomponent: Integration - COM). Supported versions that are affected are 8.1.1 and 8.2.2. Difficult to exploit vulnerability allows successful unauthenticated network attacks via HTTP. Successful attack of this vulnerability can result in unauthorized update, insert or delete access to some Siebel Core - Server BizLogic Script accessible data. CVSS Base Score 4.3 (Integrity impacts). CVSS V2 Vector: (AV:N/AC:M/Au:N/C:N/I:P/A:N). Oracle Vector: (AV:N/AC:M/Au:N/C:N/I:P/A:N). Fix has been released CVE-2015-0402 P-9001V-8.1.1 P-9001V-8.2.2 4.3 AV:N/AC:M/Au:N/C:N/I:P/A:N CPUJan2015 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html P-9001V-8.1.1 P-9001V-8.2.2 Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Deployment). Supported versions that are affected are Java SE 6u85, Java SE 7u72 and Java SE 8u25. Difficult to exploit vulnerability requiring logon to Operating System. Successful attack of this vulnerability can result in unauthorized Operating System takeover including arbitrary code execution. Note: Applies to client deployment of Java only. This vulnerability can be exploited only through sandboxed Java Web Start applications and sandboxed Java applets. CVSS Base Score 6.9 (Confidentiality, Integrity and Availability impacts). CVSS V2 Vector: (AV:L/AC:M/Au:N/C:C/I:C/A:C). Oracle Vector: (AV:L/AC:M/Au:N/C:C/I:C/A:C). Fix has been released CVE-2015-0403 P-856V-Java SE 6u85 P-856V-Java SE 7u72 P-856V-Java SE 8u25 6.9 AV:L/AC:M/Au:N/C:C/I:C/A:C CPUJan2015 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html P-856V-Java SE 6u85 P-856V-Java SE 7u72 P-856V-Java SE 8u25 Vulnerability in the Oracle Applications Framework component of Oracle E-Business Suite (subcomponent: Error Messages). Supported versions that are affected are 11.5.10.2, 12.0.6, 12.1.3, 12.2.2, 12.2.3 and 12.2.4. Difficult to exploit vulnerability allows successful unauthenticated network attacks via HTTP. Successful attack of this vulnerability can result in unauthorized update, insert or delete access to some Oracle Applications Framework accessible data. CVSS Base Score 4.3 (Integrity impacts). CVSS V2 Vector: (AV:N/AC:M/Au:N/C:N/I:P/A:N). Oracle Vector: (AV:N/AC:M/Au:N/C:N/I:P/A:N). Fix has been released CVE-2015-0404 P-1472V-11.5.10.2 P-1472V-12.0.6 P-1472V-12.1.3 P-1472V-12.2.2 P-1472V-12.2.3 P-1472V-12.2.4 4.3 AV:N/AC:M/Au:N/C:N/I:P/A:N CPUJan2015 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html P-1472V-11.5.10.2 P-1472V-12.0.6 P-1472V-12.1.3 P-1472V-12.2.2 P-1472V-12.2.3 P-1472V-12.2.4 Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Deployment). Supported versions that are affected are Java SE 6u85, Java SE 7u72 and Java SE 8u25. Difficult to exploit vulnerability allows successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability can result in unauthorized read access to a subset of Java SE accessible data and ability to cause a partial denial of service (partial DOS) of Java SE. Note: Applies to client deployment of Java only. This vulnerability can be exploited only through sandboxed Java Web Start applications and sandboxed Java applets. CVSS Base Score 5.8 (Confidentiality and Availability impacts). CVSS V2 Vector: (AV:N/AC:M/Au:N/C:P/I:N/A:P). Oracle Vector: (AV:N/AC:M/Au:N/C:P/I:N/A:P). Fix has been released CVE-2015-0406 P-856V-Java SE 6u85 P-856V-Java SE 7u72 P-856V-Java SE 8u25 5.8 AV:N/AC:M/Au:N/C:P/I:N/A:P CPUJan2015 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html P-856V-Java SE 6u85 P-856V-Java SE 7u72 P-856V-Java SE 8u25 Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Swing). Supported versions that are affected are Java SE 5.0u75, Java SE 6u85, Java SE 7u72 and Java SE 8u25. Easily exploitable vulnerability allows successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability can result in unauthorized read access to a subset of Java SE accessible data. Note: Applies to client deployment of Java only. This vulnerability can be exploited only through sandboxed Java Web Start applications and sandboxed Java applets. CVSS Base Score 5.0 (Confidentiality impacts). CVSS V2 Vector: (AV:N/AC:L/Au:N/C:P/I:N/A:N). Oracle Vector: (AV:N/AC:L/Au:N/C:P/I:N/A:N). Fix has been released CVE-2015-0407 P-856V-Java SE 5.0u75 P-856V-Java SE 6u85 P-856V-Java SE 7u72 P-856V-Java SE 8u25 5.0 AV:N/AC:L/Au:N/C:P/I:N/A:N CPUJan2015 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html P-856V-Java SE 5.0u75 P-856V-Java SE 6u85 P-856V-Java SE 7u72 P-856V-Java SE 8u25 Vulnerability in the Java SE component of Oracle Java SE (subcomponent: RMI). Supported versions that are affected are Java SE 5.0u75, Java SE 6u85, Java SE 7u72 and Java SE 8u25. Easily exploitable vulnerability allows successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability can result in unauthorized Operating System takeover including arbitrary code execution. Note: Applies to client deployment of Java only. This vulnerability can be exploited only through sandboxed Java Web Start applications and sandboxed Java applets. CVSS Base Score 10.0 (Confidentiality, Integrity and Availability impacts). CVSS V2 Vector: (AV:N/AC:L/Au:N/C:C/I:C/A:C). Oracle Vector: (AV:N/AC:L/Au:N/C:C/I:C/A:C). Fix has been released CVE-2015-0408 P-856V-Java SE 5.0u75 P-856V-Java SE 6u85 P-856V-Java SE 7u72 P-856V-Java SE 8u25 10.0 AV:N/AC:L/Au:N/C:C/I:C/A:C CPUJan2015 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html P-856V-Java SE 5.0u75 P-856V-Java SE 6u85 P-856V-Java SE 7u72 P-856V-Java SE 8u25 Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server : Optimizer). Supported versions that are affected are 5.6.21 and earlier. Easily exploitable vulnerability allows successful authenticated network attacks via multiple protocols. Successful attack of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS Base Score 4.0 (Availability impacts). CVSS V2 Vector: (AV:N/AC:L/Au:S/C:N/I:N/A:P). Oracle Vector: (AV:N/AC:L/Au:S/C:N/I:N/A:P+). Fix has been released CVE-2015-0409 P-8478V-5.6.21 and earlier 4.0 AV:N/AC:L/Au:S/C:N/I:N/A:P CPUJan2015 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html P-8478V-5.6.21 and earlier Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Security). Supported versions that are affected are Java SE 5.0u75, Java SE 6u85, Java SE 7u72, Java SE 8u25, Java SE Embedded 7u71, Java SE Embedded 8u6, JRockit R27.8.4 and JRockit R28.3.4. Easily exploitable vulnerability allows successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded, JRockit. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS Base Score 5.0 (Availability impacts). CVSS V2 Vector: (AV:N/AC:L/Au:N/C:N/I:N/A:P). Oracle Vector: (AV:N/AC:L/Au:N/C:N/I:N/A:P). Fix has been released CVE-2015-0410 P-856V-Java SE 5.0u75 P-856V-Java SE 6u85 P-856V-Java SE 7u72 P-856V-Java SE 8u25 P-856V-Java SE Embedded 7u71 P-856V-Java SE Embedded 8u6 P-856V-JRockit R27.8.4 P-856V-JRockit R28.3.4 5.0 AV:N/AC:L/Au:N/C:N/I:N/A:P CPUJan2015 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html P-856V-Java SE 5.0u75 P-856V-Java SE 6u85 P-856V-Java SE 7u72 P-856V-Java SE 8u25 P-856V-Java SE Embedded 7u71 P-856V-Java SE Embedded 8u6 P-856V-JRockit R27.8.4 P-856V-JRockit R28.3.4 Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server : Security : Encryption). Supported versions that are affected are 5.5.40 and earlier and 5.6.21 and earlier. Easily exploitable vulnerability allows successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability can result in unauthorized update, insert or delete access to some MySQL Server accessible data as well as read access to a subset of MySQL Server accessible data and ability to cause a partial denial of service (partial DOS) of MySQL Server. CVSS Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS V2 Vector: (AV:N/AC:L/Au:N/C:P/I:P/A:P). Oracle Vector: (AV:N/AC:L/Au:N/C:P/I:P/A:P). Fix has been released CVE-2015-0411 P-8478V-5.5.40 and earlier P-8478V-5.6.21 and earlier 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P CPUJan2015 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html P-8478V-5.5.40 and earlier P-8478V-5.6.21 and earlier Vulnerability in the Java SE component of Oracle Java SE (subcomponent: JAX-WS). Supported versions that are affected are Java SE 6u85, Java SE 7u72 and Java SE 8u25. Easily exploitable vulnerability allows successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability can result in unauthorized Operating System takeover including arbitrary code execution. Note: Applies to client deployment of Java only. This vulnerability can be exploited only through sandboxed Java Web Start applications and sandboxed Java applets. CVSS Base Score 10.0 (Confidentiality, Integrity and Availability impacts). CVSS V2 Vector: (AV:N/AC:L/Au:N/C:C/I:C/A:C). Oracle Vector: (AV:N/AC:L/Au:N/C:C/I:C/A:C). Fix has been released CVE-2015-0412 P-856V-Java SE 6u85 P-856V-Java SE 7u72 P-856V-Java SE 8u25 10.0 AV:N/AC:L/Au:N/C:C/I:C/A:C CPUJan2015 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html P-856V-Java SE 6u85 P-856V-Java SE 7u72 P-856V-Java SE 8u25 Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Serviceability ). Supported versions that are affected are Java SE 7u72 and Java SE 8u25. Difficult to exploit vulnerability requiring logon to Operating System. Successful attack of this vulnerability can result in unauthorized update, insert or delete access to some Java SE accessible data. Note: Applies to client deployment of Java only. This vulnerability can be exploited only through sandboxed Java Web Start applications and sandboxed Java applets. CVSS Base Score 1.9 (Integrity impacts). CVSS V2 Vector: (AV:L/AC:M/Au:N/C:N/I:P/A:N). Oracle Vector: (AV:L/AC:M/Au:N/C:N/I:P/A:N). Fix has been released CVE-2015-0413 P-856V-Java SE 7u72 P-856V-Java SE 8u25 1.9 AV:L/AC:M/Au:N/C:N/I:P/A:N CPUJan2015 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html P-856V-Java SE 7u72 P-856V-Java SE 8u25 Vulnerability in the Oracle SOA Suite component of Oracle Fusion Middleware (subcomponent: Fabric Layer). Supported versions that are affected are 11.1.1.7 and 12.1.3.0. Difficult to exploit vulnerability allows successful authenticated network attacks via HTTP. Successful attack of this vulnerability can result in unauthorized read access to all Oracle SOA Suite accessible data. CVSS Base Score 3.5 (Confidentiality impacts). CVSS V2 Vector: (AV:N/AC:M/Au:S/C:P/I:N/A:N). Oracle Vector: (AV:N/AC:M/Au:S/C:P+/I:N/A:N). Fix has been released CVE-2015-0414 P-1162V-11.1.1.7 P-1162V-12.1.3.0 3.5 AV:N/AC:M/Au:S/C:P/I:N/A:N CPUJan2015 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html P-1162V-11.1.1.7 P-1162V-12.1.3.0 Vulnerability in the Oracle Application Object Library component of Oracle E-Business Suite (subcomponent: Session Management). The supported version that is affected is 12.1.3. Easily exploitable vulnerability allows successful authenticated network attacks via HTTP. Successful attack of this vulnerability can result in unauthorized update, insert or delete access to some Oracle Application Object Library accessible data. CVSS Base Score 4.0 (Integrity impacts). CVSS V2 Vector: (AV:N/AC:L/Au:S/C:N/I:P/A:N). Oracle Vector: (AV:N/AC:L/Au:S/C:N/I:P/A:N). Fix has been released CVE-2015-0415 P-510V-12.1.3 4.0 AV:N/AC:L/Au:S/C:N/I:P/A:N CPUJan2015 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html P-510V-12.1.3 Vulnerability in the Oracle Agile PLM component of Oracle Supply Chain Products Suite (subcomponent: Roles & Privileges). The supported version that is affected is 9.3.3. Difficult to exploit vulnerability allows successful authenticated network attacks via HTTP. Successful attack of this vulnerability can result in unauthorized update, insert or delete access to all Oracle Agile PLM accessible data. CVSS Base Score 3.5 (Integrity impacts). CVSS V2 Vector: (AV:N/AC:M/Au:S/C:N/I:P/A:N). Oracle Vector: (AV:N/AC:M/Au:S/C:N/I:P+/A:N). Fix has been released CVE-2015-0416 P-4429V-9.3.3 3.5 AV:N/AC:M/Au:S/C:N/I:P/A:N CPUJan2015 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html P-4429V-9.3.3 Vulnerability in the Siebel UI Framework component of Oracle Siebel CRM (subcomponent: Portal Framework). Supported versions that are affected are 8.1.1 and 8.2.2. Easily exploitable vulnerability allows successful authenticated network attacks via HTTP. Successful attack of this vulnerability can result in unauthorized read access to a subset of Siebel UI Framework accessible data. CVSS Base Score 4.0 (Confidentiality impacts). CVSS V2 Vector: (AV:N/AC:L/Au:S/C:P/I:N/A:N). Oracle Vector: (AV:N/AC:L/Au:S/C:P/I:N/A:N). Fix has been released CVE-2015-0417 P-9011V-8.1.1 P-9011V-8.2.2 4.0 AV:N/AC:L/Au:S/C:P/I:N/A:N CPUJan2015 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html P-9011V-8.1.1 P-9011V-8.2.2 Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Supported versions that are affected are VirtualBox prior to 3.2.26, 4.0.28, 4.1.36 and 4.2.28. Easily exploitable vulnerability requiring logon to Operating System. Successful attack of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox. CVSS Base Score 2.1 (Availability impacts). CVSS V2 Vector: (AV:L/AC:L/Au:N/C:N/I:N/A:P). Oracle Vector: (AV:L/AC:L/Au:N/C:N/I:N/A:P+). Fix has been released CVE-2015-0418 P-8370V-VirtualBox prior to 3.2.26 P-8370V-4.0.28 P-8370V-4.1.36 P-8370V-4.2.28 2.1 AV:L/AC:L/Au:N/C:N/I:N/A:P CPUJan2015 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html P-8370V-VirtualBox prior to 3.2.26 P-8370V-4.0.28 P-8370V-4.1.36 P-8370V-4.2.28 Vulnerability in the Siebel UI Framework component of Oracle Siebel CRM (subcomponent: Portal Framework). Supported versions that are affected are 8.1.1 and 8.2.2. Difficult to exploit vulnerability allows successful unauthenticated network attacks via HTTP. Successful attack of this vulnerability can result in unauthorized read access to a subset of Siebel UI Framework accessible data. CVSS Base Score 4.3 (Confidentiality impacts). CVSS V2 Vector: (AV:N/AC:M/Au:N/C:P/I:N/A:N). Oracle Vector: (AV:N/AC:M/Au:N/C:P/I:N/A:N). Fix has been released CVE-2015-0419 P-9011V-8.1.1 P-9011V-8.2.2 4.3 AV:N/AC:M/Au:N/C:P/I:N/A:N CPUJan2015 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html P-9011V-8.1.1 P-9011V-8.2.2 Vulnerability in the Oracle Forms component of Oracle Fusion Middleware (subcomponent: Forms Services). Supported versions that are affected are 11.1.1.7 and 11.1.2.2. Difficult to exploit vulnerability allows successful unauthenticated network attacks via HTTP. Successful attack of this vulnerability can result in unauthorized read access to a subset of Oracle Forms accessible data. CVSS Base Score 4.3 (Confidentiality impacts). CVSS V2 Vector: (AV:N/AC:M/Au:N/C:P/I:N/A:N). Oracle Vector: (AV:N/AC:M/Au:N/C:P/I:N/A:N). Fix has been released CVE-2015-0420 P-45V-11.1.1.7 P-45V-11.1.2.2 4.3 AV:N/AC:M/Au:N/C:P/I:N/A:N CPUJan2015 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html P-45V-11.1.1.7 P-45V-11.1.2.2 Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Install). The supported version that is affected is Java SE 8u25. Difficult to exploit vulnerability requiring logon to Operating System. Successful attack of this vulnerability can result in unauthorized Operating System takeover including arbitrary code execution. Note: Applies to installation process on client deployment of Java. CVSS Base Score 6.9 (Confidentiality, Integrity and Availability impacts). CVSS V2 Vector: (AV:L/AC:M/Au:N/C:C/I:C/A:C). Oracle Vector: (AV:L/AC:M/Au:N/C:C/I:C/A:C). Fix has been released CVE-2015-0421 P-856V-Java SE 8u25 6.9 AV:L/AC:M/Au:N/C:C/I:C/A:C CPUJan2015 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html P-856V-Java SE 8u25 Vulnerability in the Oracle Transportation Management component of Oracle Supply Chain Products Suite (subcomponent: UI Infrastructure). Supported versions that are affected are 6.1, 6.2, 6.3.0, 6.3.1, 6.3.2, 6.3.3, 6.3.4 and 6.3.5. Easily exploitable vulnerability allows successful authenticated network attacks via HTTP. Successful attack of this vulnerability can result in unauthorized read access to a subset of Oracle Transportation Management accessible data. CVSS Base Score 4.0 (Confidentiality impacts). CVSS V2 Vector: (AV:N/AC:L/Au:S/C:P/I:N/A:N). Oracle Vector: (AV:N/AC:L/Au:S/C:P/I:N/A:N). Fix has been released CVE-2015-0422 P-1991V-6.1 P-1991V-6.2 P-1991V-6.3.0 P-1991V-6.3.1 P-1991V-6.3.2 P-1991V-6.3.3 P-1991V-6.3.4 P-1991V-6.3.5 4.0 AV:N/AC:L/Au:S/C:P/I:N/A:N CPUJan2015 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html P-1991V-6.1 P-1991V-6.2 P-1991V-6.3.0 P-1991V-6.3.1 P-1991V-6.3.2 P-1991V-6.3.3 P-1991V-6.3.4 P-1991V-6.3.5 Vulnerability in the Integrated Lights Out Manager(ILOM) component of Oracle Sun Systems Products Suite (subcomponent: IPMI). The supported version that is affected is ILOM prior to 3.2.4. Difficult to exploit vulnerability allows successful authenticated network attacks via SSL/TLS. Successful attack of this vulnerability can result in unauthorized Operating System hang or frequently repeatable crash (complete DOS) as well as update, insert or delete access to some Integrated Lights Out Manager(ILOM) accessible data and read access to a subset of Integrated Lights Out Manager(ILOM) accessible data. CVSS Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS V2 Vector: (AV:N/AC:M/Au:S/C:P/I:P/A:C). Oracle Vector: (AV:N/AC:M/Au:S/C:P/I:P/A:C). Fix has been released CVE-2015-0424 P-9849V-ILOM prior to 3.2.4 7.5 AV:N/AC:M/Au:S/C:P/I:P/A:C CPUJan2015 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html P-9849V-ILOM prior to 3.2.4 Vulnerability in the Oracle Enterprise Asset Management component of Oracle Siebel CRM (subcomponent: Siebel Core - Unix/Windows). Supported versions that are affected are 8.1.1 and 8.2.2. Difficult to exploit vulnerability allows successful unauthenticated network attacks via HTTP. Successful attack of this vulnerability can result in unauthorized read access to a subset of Oracle Enterprise Asset Management accessible data. CVSS Base Score 4.3 (Confidentiality impacts). CVSS V2 Vector: (AV:N/AC:M/Au:N/C:P/I:N/A:N). Oracle Vector: (AV:N/AC:M/Au:N/C:P/I:N/A:N). Fix has been released CVE-2015-0425 P-9016V-8.1.1 P-9016V-8.2.2 4.3 AV:N/AC:M/Au:N/C:P/I:N/A:N CPUJan2015 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html P-9016V-8.1.1 P-9016V-8.2.2 Vulnerability in the Enterprise Manager Base Platform component of Oracle Enterprise Manager Grid Control (subcomponent: UI Framework). Supported versions that are affected are 12.1.0.3 and 12.1.0.4. Easily exploitable vulnerability allows successful unauthenticated network attacks via HTTP. Successful attack of this vulnerability can result in unauthorized read access to a subset of Enterprise Manager Base Platform accessible data. CVSS Base Score 5.0 (Confidentiality impacts). CVSS V2 Vector: (AV:N/AC:L/Au:N/C:P/I:N/A:N). Oracle Vector: (AV:N/AC:L/Au:N/C:P/I:N/A:N). Fix has been released CVE-2015-0426 P-1370V-12.1.0.3 P-1370V-12.1.0.4 5.0 AV:N/AC:L/Au:N/C:P/I:N/A:N CPUJan2015 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html P-1370V-12.1.0.3 P-1370V-12.1.0.4 Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: VMSVGA device). The supported version that is affected is VirtualBox prior to 4.3.20. Easily exploitable vulnerability requiring logon to Operating System plus additional login/authentication to component or subcomponent. Successful attack of this vulnerability can escalate attacker privileges resulting in unauthorized update, insert or delete access to all Oracle VM VirtualBox accessible data and ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox. Note: VMSVGA virtual graphics device is not documented and is disabled by default. CVSS Base Score 3.2 (Integrity and Availability impacts). CVSS V2 Vector: (AV:L/AC:L/Au:S/C:N/I:P/A:P). Oracle Vector: (AV:L/AC:L/Au:S/C:N/I:P+/A:P+). Fix has been released CVE-2015-0427 P-8370V-VirtualBox prior to 4.3.20 3.2 AV:L/AC:L/Au:S/C:N/I:P/A:P CPUJan2015 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html P-8370V-VirtualBox prior to 4.3.20 Vulnerability in the Solaris component of Oracle Sun Systems Products Suite (subcomponent: Resource Control). Supported versions that are affected are 10 and 11. Easily exploitable vulnerability requiring logon to Operating System. Successful attack of this vulnerability can result in unauthorized Operating System hang or frequently repeatable crash (complete DOS). CVSS Base Score 4.9 (Availability impacts). CVSS V2 Vector: (AV:L/AC:L/Au:N/C:N/I:N/A:C). Oracle Vector: (AV:L/AC:L/Au:N/C:N/I:N/A:C). Fix has been released CVE-2015-0428 P-10006V-10 P-10006V-11 4.9 AV:L/AC:L/Au:N/C:N/I:N/A:C CPUJan2015 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html P-10006V-10 P-10006V-11 Vulnerability in the Solaris component of Oracle Sun Systems Products Suite (subcomponent: RPC Utility). Supported versions that are affected are 10 and 11. Difficult to exploit vulnerability requiring logon to Operating System. Successful attack of this vulnerability can result in unauthorized update, insert or delete access to some Solaris accessible data and ability to cause a partial denial of service (partial DOS) of Solaris. CVSS Base Score 3.3 (Integrity and Availability impacts). CVSS V2 Vector: (AV:L/AC:M/Au:N/C:N/I:P/A:P). Oracle Vector: (AV:L/AC:M/Au:N/C:N/I:P/A:P). Fix has been released CVE-2015-0429 P-10006V-10 P-10006V-11 3.3 AV:L/AC:M/Au:N/C:N/I:P/A:P CPUJan2015 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html P-10006V-10 P-10006V-11 Vulnerability in the Solaris component of Oracle Sun Systems Products Suite (subcomponent: RPC Utility). Supported versions that are affected are 10 and 11. Difficult to exploit vulnerability requiring logon to Operating System. Successful attack of this vulnerability can result in unauthorized read access to a subset of Solaris accessible data. CVSS Base Score 1.9 (Confidentiality impacts). CVSS V2 Vector: (AV:L/AC:M/Au:N/C:P/I:N/A:N). Oracle Vector: (AV:L/AC:M/Au:N/C:P/I:N/A:N). Fix has been released CVE-2015-0430 P-10006V-10 P-10006V-11 1.9 AV:L/AC:M/Au:N/C:P/I:N/A:N CPUJan2015 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html P-10006V-10 P-10006V-11 Vulnerability in the Oracle Transportation Management component of Oracle Supply Chain Products Suite (subcomponent: UI Infrastructure). Supported versions that are affected are 6.1, 6.2, 6.3.0 6.3.1, 6.3.2, 6.3.4 and 6.3.5. Difficult to exploit vulnerability allows successful unauthenticated network attacks via HTTP. Successful attack of this vulnerability can result in unauthorized update, insert or delete access to some Oracle Transportation Management accessible data. CVSS Base Score 4.3 (Integrity impacts). CVSS V2 Vector: (AV:N/AC:M/Au:N/C:N/I:P/A:N). Oracle Vector: (AV:N/AC:M/Au:N/C:N/I:P/A:N). Fix has been released CVE-2015-0431 P-1991V-6.1 P-1991V-6.2 P-1991V-6.3.0 6.3.1 P-1991V-6.3.2 P-1991V-6.3.4 P-1991V-6.3.5 4.3 AV:N/AC:M/Au:N/C:N/I:P/A:N CPUJan2015 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html P-1991V-6.1 P-1991V-6.2 P-1991V-6.3.0 6.3.1 P-1991V-6.3.2 P-1991V-6.3.4 P-1991V-6.3.5 Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server : InnoDB : DDL : Foreign Key). Supported versions that are affected are 5.5.40 and earlier. Easily exploitable vulnerability allows successful authenticated network attacks via multiple protocols. Successful attack of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS Base Score 4.0 (Availability impacts). CVSS V2 Vector: (AV:N/AC:L/Au:S/C:N/I:N/A:P). Oracle Vector: (AV:N/AC:L/Au:S/C:N/I:N/A:P+). Fix has been released CVE-2015-0432 P-8478V-5.5.40 and earlier 4.0 AV:N/AC:L/Au:S/C:N/I:N/A:P CPUJan2015 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html P-8478V-5.5.40 and earlier Vulnerability in the Oracle Access Manager component of Oracle Fusion Middleware (subcomponent: Integration with OAM). Supported versions that are affected are 11.1.1.5, 11.1.1.7, 11.1.2.1 and 11.1.2.2. Difficult to exploit vulnerability allows successful unauthenticated network attacks via HTTP. Successful attack of this vulnerability can result in unauthorized read access to a subset of Oracle Access Manager accessible data. CVSS Base Score 4.3 (Confidentiality impacts). CVSS V2 Vector: (AV:N/AC:M/Au:N/C:P/I:N/A:N). Oracle Vector: (AV:N/AC:M/Au:N/C:P/I:N/A:N). Fix has been released CVE-2015-0434 P-5565V-11.1.1.5 P-5565V-11.1.1.7 P-5565V-11.1.2.1 P-5565V-11.1.2.2 4.3 AV:N/AC:M/Au:N/C:P/I:N/A:N CPUJan2015 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html P-5565V-11.1.1.5 P-5565V-11.1.1.7 P-5565V-11.1.2.1 P-5565V-11.1.2.2 Vulnerability in the Oracle Transportation Management component of Oracle Supply Chain Products Suite (subcomponent: Security). Supported versions that are affected are 6.1, 6.2, 6.3.0, 6.3.1, 6.3.2, 6.3.3, 6.3.4 and 6.3.5. Easily exploitable vulnerability allows successful authenticated network attacks via HTTP. Successful attack of this vulnerability can result in unauthorized read access to any arbitrary Operating System location. CVSS Base Score 6.8 (Confidentiality impacts). CVSS V2 Vector: (AV:N/AC:L/Au:S/C:C/I:N/A:N). Oracle Vector: (AV:N/AC:L/Au:S/C:C/I:N/A:N). Fix has been released CVE-2015-0435 P-1991V-6.1 P-1991V-6.2 P-1991V-6.3.0 P-1991V-6.3.1 P-1991V-6.3.2 P-1991V-6.3.3 P-1991V-6.3.4 P-1991V-6.3.5 6.8 AV:N/AC:L/Au:S/C:C/I:N/A:N CPUJan2015 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html P-1991V-6.1 P-1991V-6.2 P-1991V-6.3.0 P-1991V-6.3.1 P-1991V-6.3.2 P-1991V-6.3.3 P-1991V-6.3.4 P-1991V-6.3.5 Vulnerability in the Oracle iLearning component of Oracle iLearning (subcomponent: Login). Supported versions that are affected are 6.0 and 6.1. Difficult to exploit vulnerability allows successful unauthenticated network attacks via HTTP. Successful attack of this vulnerability can result in unauthorized read access to a subset of Oracle iLearning accessible data. CVSS Base Score 4.3 (Confidentiality impacts). CVSS V2 Vector: (AV:N/AC:M/Au:N/C:P/I:N/A:N). Oracle Vector: (AV:N/AC:M/Au:N/C:P/I:N/A:N). Fix has been released CVE-2015-0436 P-902V-6.0 P-902V-6.1 4.3 AV:N/AC:M/Au:N/C:P/I:N/A:N CPUJan2015 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html P-902V-6.0 P-902V-6.1 Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Hotspot). The supported version that is affected is Java SE 8u25. Difficult to exploit vulnerability allows successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability can result in unauthorized Operating System takeover including arbitrary code execution. Note: Applies to client deployment of Java only. This vulnerability can be exploited only through sandboxed Java Web Start applications and sandboxed Java applets. CVSS Base Score 9.3 (Confidentiality, Integrity and Availability impacts). CVSS V2 Vector: (AV:N/AC:M/Au:N/C:C/I:C/A:C). Oracle Vector: (AV:N/AC:M/Au:N/C:C/I:C/A:C). Fix has been released CVE-2015-0437 P-856V-Java SE 8u25 9.3 AV:N/AC:M/Au:N/C:C/I:C/A:C CPUJan2015 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html P-856V-Java SE 8u25