Oracle Critical Patch Update Advisory - October 2013 - Beta Oracle CVRF Oracle Critical Patch Update Advisory CPUOct2013 Final 1.0 1.0 2013-10-15T13:00:00-07:00 Initial Distribution 2013-10-15T13:00:00-07:00 2013-10-15T13:00:00-07:00 This document contains descriptions of Oracle product security vulnerabilities which have had fixes released for all supported versions and platforms for the associated product. Additional information regarding these vulnerabilities including fix distribution information can be found at the Oracle sites referenced in this document. This document is published at: http://www.oracle.com/ocom/groups/public/@otn/documents/webcontent/1865183.xml http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html URL to html version of Advisory Adam Gowdiak Security Explorations Adam Willard Foreground Security Adi Ludmer McAfee Security Research Ajinkya Patil AVsecurity.in Alex Kouzemtchenko CERT/CC Alex Rajan Network Intelligence (Alex Rajan) Alexander Polyakov ERPScan Alexander Tlyapov Positive Technologies Alexey Osipov Positive Technologies Alexey Tyurin ERPScan (Digital Security Research Group) Alok Saurabh Alok Saurabh Anagha Devale-Vartak AVsecurity.in Andrea Micalizzi HP's Zero Day Initiative Andrew Davies NCC Group Ben Murphy HP's Zero Day Initiative CERT/CC CERT/CC Chris Ries via the Exodus Intelligence Program Exodus Intelligence Daniel Fernández Bleda Internet Security Auditors, S.L. Danish Tariq Danish Tariq Dave Bryant Orion Health Dmitry Sklyarov Positive Technologies Ehraz Ahmed Ehraz Ahmed Esteban Martinez Fayo Application Security, Inc. Faisal ait hamou Faisal ait hamou HUAWEI PSIRT HUAWEI PSIRT Hamza Gheld Hamza Gheld Harsha Vardhan Boppana Harsha Vardhan Boppana James Forshaw Context Information Security Jatinpreet Singh Jatinpreet Singh Jeroen Frijters Jeroen Frijters Jigar Thakkar Jigar Thakkar Jon Passki CERT/CC Juraj Somorovsky Ruhr-University Bochum Kamil Sevi Kamil Sevi Koutrouss Naddara Kotros Nadara Mahadev Subedi Mahadev Subedi Mahesh Darji SRIMCA Manjot Singh Manjot Singh Muhammad Ahmed Siddiqui Muhammad Ahmed Siddiqui Narendra Bhati Narendra Bhati Osanda Malith Jayathissa Osanda Malith Jayathissa Qinglin Jiang Application Security, Inc. Ravi Chandroliya Ravi Chandroliya Ravikumar R. Paghdal SRIMCA Riaz Ebrahim Riaz Ebrahim Rohan Stelling BAE Systems Detica Sam Thomas Pentest Limited Simone Memoli Simone Memoli SimranJeet Singh SimranJeet Singh Sunil Dadhich Sunil Dadhich Timur Yunusov Positive Technologies Tom Parker Orion Health Travis Emmert iDefense Vinesh N. Redkar Vinesh N. Redkar Vitaliy Toropov via the Exodus Intelligence Program Exodus Intelligence Will Dormann CERT/CC Yasir Altaf Zargar Yasir Altaf Zargar Yuki Chen Trend Micro Yury Maryshev Positive Technologies wcypierre wcypierre Oracle Database Version - Oracle Database Version 11.1.0.7 Oracle Database Version 11.2.0.2 Oracle Database Version 11.2.0.3 Oracle Database Version 12.1.0.1 Applications Technology Stack Version 12.1 Enterprise Manager for Oracle Database Version 11.1.0.1 EM DB Control: 11.1.0.7 Enterprise Manager for Oracle Database Version 11.1.0.1EM DB Control: 11.1.0.7 Enterprise Manager for Oracle Database Version 11.2.0.2 Enterprise Manager for Oracle Database Version 11.2.0.3 EM Plugin for DB: 12.1.0.2 Enterprise Manager for Oracle Database Version 11.2.0.3EM Plugin for DB: 12.1.0.2 Enterprise Manager for Oracle Database Version 12.1.0.3 Enterprise Manager for Oracle Database Version 12.1.0.4 Enterprise Manager for Oracle Database Version EM Base Platform: 10.2.0.5 FLEXCUBE Private Banking Version 1.7 FLEXCUBE Private Banking Version 12.0.1 FLEXCUBE Private Banking Version 2.0 FLEXCUBE Private Banking Version 2.0.1 FLEXCUBE Private Banking Version 2.2.0.1 FLEXCUBE Private Banking Version 3.0 Portal Version 11.1.1.6.0 JDeveloper Version 11.1.2.3.0 JDeveloper Version 11.1.2.4.0 JDeveloper Version 12.1.2.0.0 Security Service Version 11.1.1.7 Forms: 11.1.2.1 Security Service Version 11.1.1.7 Forms: 11.1.2.1 OHS: 12.1.2 Security Service Version FMW: 11.1.1.6 Web Cache Version 11.1.1.6 Web Cache Version 11.1.1.7 Containers for J2EE Version 10.1.3.5.0 Web Services Version 10.1.3.5.0 Web Services Version 11.1.1.6.0 Identity Manager Version 11.1.2.0.0 Identity Manager Version 11.1.2.1.0 WebCenter Content Version 10.1.3.5.1 WebCenter Content Version 11.1.1.6.0 WebCenter Content Version 11.1.1.7.0 WebCenter Content Version 11.1.1.8.0 Outside In Technology Version 8.4.0 Outside In Technology Version 8.4.1 WebLogic Server Version 10.3.6.0 WebLogic Server Version 12.1.1.0 Access Manager Version 11.1.1.5.0 Access Manager Version 11.1.2.0.0 GlassFish Server Version 2.1.1 GlassFish Server Version 3.0.1 GlassFish Server Version 3.1.2 Identity Analytics Version 5.0 Identity Analytics Version Oracle Identity Analytics 11.1.1.5 Identity Analytics Version Sun Role Manager 4.1 Retail Invoice Matching Version 10.2 Retail Invoice Matching Version 11.0 Retail Invoice Matching Version 12.0 Retail Invoice Matching Version 12.0IN Retail Invoice Matching Version 12.1 Retail Invoice Matching Version 13.0 Retail Invoice Matching Version 13.1 Retail Invoice Matching Version 13.2 Health Sciences Product Version 4.5 SP3 Health Sciences Product Version 4.5 SP3a-k Health Sciences Product Version 4.6 SP0 Health Sciences Product Version 4.6 SP0a-c Health Sciences Product Version 4.6 SP1 Health Sciences Product Version 4.6 SP1a-c Health Sciences Product Version 4.6 SP2 Health Sciences Product Version 4.6 SP2a-c Health Sciences Product Version 5.0 SP0 Health Sciences Product Version 5.0 SP0a Health Sciences Product Version 5.0 SP1 Health Sciences Product Version 5.0 SP1a-b Health Sciences Product Version 5.0.3 Health Sciences Product Version 5.0.4 Health Sciences Product Version 5.5 SP0 Health Sciences Product Version 5.5 SP0b Health Sciences Product Version 5.5.1 Health Sciences Product Version 6.0.0 Siebel Life Sciences Version 8.1.1.x Java Version JRockit R27.7.6 and earlier Java Version JRockit R28.2.8 and earlier Java Version Java SE 5.0u51 and earlier Java Version Java SE 6u60 and earlier Java Version Java SE 7u25 and earlier Java Version Java SE 7u40 and earlier Java Version Java SE Embedded 7u25 and earlier Java Version Java SE Embedded 7u40 and earlier Java Version JavaFX 2.2.40 and earlier MySQL Server Version 5.1 MySQL Server Version 5.1.70 and earlier MySQL Server Version 5.5.22 and earlier MySQL Server Version 5.5.32 and earlier MySQL Server Version 5.6.11 and earlier MySQL Server Version 5.6.12 and earlier MySQL Enterprise Monitor Version 2.3.13 and earlier PeopleSoft Enterprise HRMS Candidate Gateway Version 9.1 PeopleSoft Enterprise HRMS eCompensation Version 9.1 PeopleSoft Enterprise HRMS eCompensation Version 9.2 PeopleSoft Enterprise PT PeopleTools Version 8.51 PeopleSoft Enterprise PT PeopleTools Version 8.52 PeopleSoft Enterprise PT PeopleTools Version 8.53 Primavera P6 Enterprise Project Portfolio Management Version 8.1 Primavera P6 Enterprise Project Portfolio Management Version 8.2 Primavera P6 Enterprise Project Portfolio Management Version 8.3 Instantis EnterpriseTrack Version 8.0.6 Instantis EnterpriseTrack Version 8.5 Siebel Core - Server BizLogic Script Version 8.1.1 Siebel Core - Server BizLogic Script Version 8.2.2 Siebel Core - Server Infrastructure Version 8.1.1 Siebel Core - Server Infrastructure Version 8.2.2 Siebel UI Framework Version 8.1.1 Siebel UI Framework Version 8.2.2 Siebel Core - EAI Version 8.1.1 Siebel Core - EAI Version 8.2.2 Siebel Server Remote Version 8.1.1 Siebel Server Remote Version 8.2.2 Transportation Management Version 6.3 Transportation Management Version 6.3.1 Agile PLM Framework Version 9.3.2 Oracle VM VirtualBox Version 4.0.20 Oracle VM VirtualBox Version 4.1.28 Oracle VM VirtualBox Version 4.2.18 Oracle VM VirtualBox Version VirtualBox prior to 3.2.18 Secure Global Desktop Version 5 SPARC - Sun System Firmware Version Sun System Firmware before 8.3.0.b SPARC - Sun System Firmware - NPE Version 7.4.6.c SPARC - Sun System Firmware - NPE Version 8.3.0.b SPARC - Sun System Firmware - NPE Version 9.0.0.d and 9.0.1.e SPARC - Sun System Firmware - NPE Version Sun System Firmware before 6.7.13 OPUS 10G Ethernet Switch Family Version Oracle Switch ES1-24 1.3 prior to Patch 17050841 OPUS 10G Ethernet Switch Family Version Sun Blade 6000 10GBE switched NEM 1.2 prior to Patch 13255101 OPUS 10G Ethernet Switch Family Version Sun Network 10GBE Switch 72P 1.2 prior to Patch 13255111 Solaris Operating System Version 10 Solaris Operating System Version 11.1 iLearning Version 5.2.1 iLearning Version 6.0 Vulnerability in the Oracle Security Service component of Oracle Fusion Middleware (subcomponent: None). Supported versions that are affected are FMW: 11.1.1.6 and 11.1.1.7 Forms: 11.1.2.1. Difficult to exploit vulnerability allows successful unauthenticated network attacks via SSL/TLS. Successful attack of this vulnerability can result in unauthorized read access to a subset of Oracle Security Service accessible data. CVSS Base Score 4.3 (Confidentiality impacts). CVSS V2 Vector: (AV:N/AC:M/Au:N/C:P/I:N/A:N). Oracle Vector: (AV:N/AC:M/Au:N/C:P/I:N/A:N). Fix has been released CVE-2011-3389 P-991V-FMW: 11.1.1.6 P-991V-11.1.1.7 Forms: 11.1.2.1 4.3 AV:N/AC:M/Au:N/C:P/I:N/A:N CPUOct2013 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html P-991V-FMW: 11.1.1.6 P-991V-11.1.1.7 Forms: 11.1.2.1 Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Optimizer). Supported versions that are affected are 5.1 and 5.5.22 and earlier. Easily exploitable vulnerability allows successful authenticated network attacks via multiple protocols. Successful attack of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS Base Score 4.0 (Availability impacts). CVSS V2 Vector: (AV:N/AC:L/Au:S/C:N/I:N/A:P). Oracle Vector: (AV:N/AC:L/Au:S/C:N/I:N/A:P+). Fix has been released CVE-2012-2750 P-8478V-5.1 P-8478V-5.5.22 and earlier 4.0 AV:N/AC:L/Au:S/C:N/I:N/A:P CPUOct2013 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html P-8478V-5.1 P-8478V-5.5.22 and earlier Vulnerability in the Sun Blade 6000 10GBE switched NEM, Sun Network 10GBE Switch 72P, Oracle Switch component of Oracle and Sun Systems Products Suite (subcomponent: Switch Platform Software). Supported versions that are affected are Sun Blade 6000 10GBE switched NEM 1.2 prior to Patch 13255101, Sun Network 10GBE Switch 72P 1.2 prior to Patch 13255111 and Oracle Switch ES1-24 1.3 prior to Patch 17050841. Difficult to exploit vulnerability allows successful unauthenticated network attacks via OSPF. Successful attack of this vulnerability can result in unauthorized read access to a subset of Sun Blade 6000 10GBE switched NEM, Sun Network 10GBE Switch 72P, Oracle Switch accessible data and ability to cause a partial denial of service (partial DOS) of Sun Blade 6000 10GBE switched NEM, Sun Network 10GBE Switch 72P, Oracle Switch. CVSS Base Score 5.8 (Confidentiality and Availability impacts). CVSS V2 Vector: (AV:N/AC:M/Au:N/C:P/I:N/A:P). Oracle Vector: (AV:N/AC:M/Au:N/C:P/I:N/A:P). Fix has been released CVE-2013-0149 P-9889V-Sun Blade 6000 10GBE switched NEM 1.2 prior to Patch 13255101 P-9889V-Sun Network 10GBE Switch 72P 1.2 prior to Patch 13255111 P-9889V-Oracle Switch ES1-24 1.3 prior to Patch 17050841 5.8 AV:N/AC:M/Au:N/C:P/I:N/A:P CPUOct2013 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html P-9889V-Sun Blade 6000 10GBE switched NEM 1.2 prior to Patch 13255101 P-9889V-Sun Network 10GBE Switch 72P 1.2 prior to Patch 13255111 P-9889V-Oracle Switch ES1-24 1.3 prior to Patch 17050841 Vulnerability in the Oracle Security Service component of Oracle Fusion Middleware (subcomponent: None). Supported versions that are affected are FMW: 11.1.1.6 and 11.1.1.7 Forms: 11.1.2.1 OHS: 12.1.2. Very difficult to exploit vulnerability allows successful unauthenticated network attacks via SSL/TLS. Successful attack of this vulnerability can result in unauthorized read access to a subset of Oracle Security Service accessible data. CVSS Base Score 2.6 (Confidentiality impacts). CVSS V2 Vector: (AV:N/AC:H/Au:N/C:P/I:N/A:N). Oracle Vector: (AV:N/AC:H/Au:N/C:P/I:N/A:N). Fix has been released CVE-2013-0169 P-991V-FMW: 11.1.1.6 P-991V-11.1.1.7 Forms: 11.1.2.1 OHS: 12.1.2 2.6 AV:N/AC:H/Au:N/C:P/I:N/A:N CPUOct2013 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html P-991V-FMW: 11.1.1.6 P-991V-11.1.1.7 Forms: 11.1.2.1 OHS: 12.1.2 Vulnerability in the Oracle GlassFish Server component of Oracle Fusion Middleware (subcomponent: Metro). Supported versions that are affected are 2.1.1, 3.0.1 and 3.1.2. Difficult to exploit vulnerability allows successful unauthenticated network attacks via SOAP. Successful attack of this vulnerability can result in unauthorized update, insert or delete access to some Oracle GlassFish Server accessible data. Note: CVE-2013-2172 is equivalent to CVE-2013-2461. CVSS Base Score 4.3 (Integrity impacts). CVSS V2 Vector: (AV:N/AC:M/Au:N/C:N/I:P/A:N). Oracle Vector: (AV:N/AC:M/Au:N/C:N/I:P/A:N). Fix has been released CVE-2013-2172 P-8493V-2.1.1 P-8493V-3.0.1 P-8493V-3.1.2 4.3 AV:N/AC:M/Au:N/C:N/I:P/A:N CPUOct2013 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html P-8493V-2.1.1 P-8493V-3.0.1 P-8493V-3.1.2 Vulnerability in the MySQL Enterprise Monitor component of Oracle MySQL (subcomponent: Service Manager). Supported versions that are affected are 2.3.13 and earlier. Difficult to exploit vulnerability allows successful authenticated network attacks via HTTP. Successful attack of this vulnerability can result in unauthorized Operating System takeover including arbitrary code execution. Note: The following CVEs are fixed as a result of upgrading to Struts 2.3.15.1: CVE-2013-2251, CVE-2013-2248, CVE-2013-2135, and CVE-2013-2134. The CVSS score is 8.5 if MySQL Enterprise Monitor runs with admin or root privileges. The score would be 6.0 if MySQL Enterprise Monitor runs with non-admin privileges and the impact on Confidentiality, Integrity and Availability would be Partial. CVSS Base Score 8.5 (Confidentiality, Integrity and Availability impacts). CVSS V2 Vector: (AV:N/AC:M/Au:S/C:C/I:C/A:C). Oracle Vector: (AV:N/AC:M/Au:S/C:C/I:C/A:C). Fix has been released CVE-2013-2251 P-8480V-2.3.13 and earlier 8.5 AV:N/AC:M/Au:S/C:C/I:C/A:C CPUOct2013 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html P-8480V-2.3.13 and earlier Vulnerability in the Oracle FLEXCUBE Private Banking component of Oracle Financial Services Software (subcomponent: Core). Supported versions that are affected are 1.7, 2.0, 2.0.1, 2.2.0.1, 3.0 and 12.0.1. Difficult to exploit vulnerability allows successful authenticated network attacks via HTTP. Successful attack of this vulnerability can result in unauthorized takeover of Oracle FLEXCUBE Private Banking possibly including arbitrary code execution within the Oracle FLEXCUBE Private Banking. Note: The following CVEs are fixed as a result of upgrading to Struts 2.3.15.1: CVE-2013-2251, CVE-2013-2248, CVE-2013-2135, and CVE-2013-2134. CVSS Base Score 6.0 (Confidentiality, Integrity and Availability impacts). CVSS V2 Vector: (AV:N/AC:M/Au:S/C:P/I:P/A:P). Oracle Vector: (AV:N/AC:M/Au:S/C:P+/I:P+/A:P+). Fix has been released CVE-2013-2251 P-9110V-1.7 P-9110V-2.0 P-9110V-2.0.1 P-9110V-2.2.0.1 P-9110V-3.0 P-9110V-12.0.1 6.0 AV:N/AC:M/Au:S/C:P/I:P/A:P CPUOct2013 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html P-9110V-1.7 P-9110V-2.0 P-9110V-2.0.1 P-9110V-2.2.0.1 P-9110V-3.0 P-9110V-12.0.1 Vulnerability in the Enterprise Manager Base Platform component of Oracle Enterprise Manager Grid Control (subcomponent: Schema Management). Supported versions that are affected are EM Base Platform: 10.2.0.5, 11.1.0.1<br/> EM DB Control: 11.1.0.7, 11.2.0.2, 11.2.0.3<br/> EM Plugin for DB: 12.1.0.2, 12.1.0.3 and 12.1.0.4<br/>. Difficult to exploit vulnerability allows successful unauthenticated network attacks via HTTP. Successful attack of this vulnerability can result in unauthorized update, insert or delete access to some Enterprise Manager Base Platform accessible data. CVSS Base Score 4.3 (Integrity impacts). CVSS V2 Vector: (AV:N/AC:M/Au:N/C:N/I:P/A:N). Oracle Vector: (AV:N/AC:M/Au:N/C:N/I:P/A:N). Fix has been released CVE-2013-3762 P-1366V-EM Base Platform: 10.2.0.5 P-1366V-11.1.0.1EM DB Control: 11.1.0.7 P-1366V-11.2.0.2 P-1366V-11.2.0.3EM Plugin for DB: 12.1.0.2 P-1366V-12.1.0.3 P-1366V-12.1.0.4 4.3 AV:N/AC:M/Au:N/C:N/I:P/A:N CPUOct2013 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html P-1366V-EM Base Platform: 10.2.0.5 P-1366V-11.1.0.1EM DB Control: 11.1.0.7 P-1366V-11.2.0.2 P-1366V-11.2.0.3EM Plugin for DB: 12.1.0.2 P-1366V-12.1.0.3 P-1366V-12.1.0.4 Vulnerability in the Primavera P6 Enterprise Project Portfolio Management component of Oracle Primavera Products Suite (subcomponent: Web Access). Supported versions that are affected are 8.1, 8.2 and 8.3. Easily exploitable vulnerability allows successful authenticated network attacks via HTTP. Successful attack of this vulnerability can result in unauthorized update, insert or delete access to some Primavera P6 Enterprise Project Portfolio Management accessible data. CVSS Base Score 4.0 (Integrity impacts). CVSS V2 Vector: (AV:N/AC:L/Au:S/C:N/I:P/A:N). Oracle Vector: (AV:N/AC:L/Au:S/C:N/I:P/A:N). Fix has been released CVE-2013-3766 P-5579V-8.1 P-5579V-8.2 P-5579V-8.3 4.0 AV:N/AC:L/Au:S/C:N/I:P/A:N CPUOct2013 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html P-5579V-8.1 P-5579V-8.2 P-5579V-8.3 Vulnerability in the PeopleSoft Enterprise HRMS component of Oracle PeopleSoft Products (subcomponent: Career's Home). The supported version that is affected is 9.1. Easily exploitable vulnerability allows successful authenticated network attacks via HTTP. Successful attack of this vulnerability can result in unauthorized read access to a subset of PeopleSoft Enterprise HRMS accessible data. CVSS Base Score 4.0 (Confidentiality impacts). CVSS V2 Vector: (AV:N/AC:L/Au:S/C:P/I:N/A:N). Oracle Vector: (AV:N/AC:L/Au:S/C:P/I:N/A:N). Fix has been released CVE-2013-3785 P-5043V-9.1 4.0 AV:N/AC:L/Au:S/C:P/I:N/A:N CPUOct2013 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html P-5043V-9.1 Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Supported versions that are affected are VirtualBox prior to 3.2.18, 4.0.20, 4.1.28 and 4.2.18. Very difficult to exploit vulnerability requiring logon to Operating System plus additional login/authentication to component or subcomponent. Successful attack of this vulnerability can escalate attacker privileges resulting in unauthorized Operating System hang or frequently repeatable crash (complete DOS). CVSS Base Score 3.8 (Availability impacts). CVSS V2 Vector: (AV:L/AC:H/Au:S/C:N/I:N/A:C). Oracle Vector: (AV:L/AC:H/Au:S/C:N/I:N/A:C). Fix has been released CVE-2013-3792 P-8370V-VirtualBox prior to 3.2.18 P-8370V-4.0.20 P-8370V-4.1.28 P-8370V-4.2.18 3.8 AV:L/AC:H/Au:S/C:N/I:N/A:C CPUOct2013 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html P-8370V-VirtualBox prior to 3.2.18 P-8370V-4.0.20 P-8370V-4.1.28 P-8370V-4.2.18 Vulnerability in the Oracle Retail Invoice Matching component of Oracle Industry Applications (subcomponent: System Administration). Supported versions that are affected are 10.2, 11.0, 12.0, 12.0IN, 12.1, 13.0, 13.1 and 13.2. Easily exploitable vulnerability allows successful authenticated network attacks via HTTP. Successful attack of this vulnerability can result in unauthorized update, insert or delete access to all Oracle Retail Invoice Matching accessible data as well as read access to all Oracle Retail Invoice Matching accessible data. CVSS Base Score 5.5 (Confidentiality and Integrity impacts). CVSS V2 Vector: (AV:N/AC:L/Au:S/C:P/I:P/A:N). Oracle Vector: (AV:N/AC:L/Au:S/C:P+/I:P+/A:N). Fix has been released CVE-2013-3814 P-1810V-10.2 P-1810V-11.0 P-1810V-12.0 P-1810V-12.0IN P-1810V-12.1 P-1810V-13.0 P-1810V-13.1 P-1810V-13.2 5.5 AV:N/AC:L/Au:S/C:P/I:P/A:N CPUOct2013 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html P-1810V-10.2 P-1810V-11.0 P-1810V-12.0 P-1810V-12.0IN P-1810V-12.1 P-1810V-13.0 P-1810V-13.1 P-1810V-13.2 Vulnerability in the Core RDBMS component of Oracle Database Server. Supported versions that are affected are 11.1.0.7, 11.2.0.2, 11.2.0.3 and 12.1.0.1. Easily exploitable vulnerability allows successful unauthenticated network attacks via Oracle Net. Successful attack of this vulnerability can result in unauthorized read access to a subset of Core RDBMS accessible data. Note: Network encryption (native network encryption and SSL/TLS) and strong authentication services (Kerberos, PKI, and RADIUS) are no longer part of Oracle Advanced Security and are available in all licensed editions of all supported releases of the Oracle database. To remediate this security vulnerability, customers should configure network encryption in their clients and servers to protect sensitive data sent over untrusted networks. Refer to <A HREF="http://docs.oracle.com/cd/E11882_01/license.112/e47877/options.htm#CIHFDJDG">http://docs.oracle.com/cd/E11882_01/license.112/e47877/options.htm#CIHFDJDG</A> - "Oracle Advanced Security section" of "Oracle Database Licensing Information 11<i>g</i> Release 2 (11.2)" for details of this licensing change. CVSS Base Score 5.0 (Confidentiality impacts). CVSS V2 Vector: (AV:N/AC:L/Au:N/C:P/I:N/A:N). Oracle Vector: (AV:N/AC:L/Au:N/C:P/I:N/A:N). Fix has been released CVE-2013-3826 P-5V-11.1.0.7 P-5V-11.2.0.2 P-5V-11.2.0.3 P-5V-12.1.0.1 5.0 AV:N/AC:L/Au:N/C:P/I:N/A:N CPUOct2013 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html P-5V-11.1.0.7 P-5V-11.2.0.2 P-5V-11.2.0.3 P-5V-12.1.0.1 Vulnerability in the Oracle JDeveloper component of Oracle Fusion Middleware (subcomponent: Java Server Faces). Supported versions that are affected are 11.1.2.3.0, 11.1.2.4.0 and 12.1.2.0.0. Easily exploitable vulnerability allows successful unauthenticated network attacks via HTTP. Successful attack of this vulnerability can result in unauthorized read access to a subset of Oracle JDeveloper accessible data. CVSS Base Score 5.0 (Confidentiality impacts). CVSS V2 Vector: (AV:N/AC:L/Au:N/C:P/I:N/A:N). Oracle Vector: (AV:N/AC:L/Au:N/C:P/I:N/A:N). Fix has been released CVE-2013-3827 P-807V-11.1.2.3.0 P-807V-11.1.2.4.0 P-807V-12.1.2.0.0 5.0 AV:N/AC:L/Au:N/C:P/I:N/A:N CPUOct2013 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html P-807V-11.1.2.3.0 P-807V-11.1.2.4.0 P-807V-12.1.2.0.0 Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Container). Supported versions that are affected are 10.3.6.0 and 12.1.1.0. Easily exploitable vulnerability allows successful unauthenticated network attacks via HTTP. Successful attack of this vulnerability can result in unauthorized read access to a subset of Oracle WebLogic Server accessible data. CVSS Base Score 5.0 (Confidentiality impacts). CVSS V2 Vector: (AV:N/AC:L/Au:N/C:P/I:N/A:N). Oracle Vector: (AV:N/AC:L/Au:N/C:P/I:N/A:N). Fix has been released CVE-2013-3827 P-5242V-10.3.6.0 P-5242V-12.1.1.0 5.0 AV:N/AC:L/Au:N/C:P/I:N/A:N CPUOct2013 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html P-5242V-10.3.6.0 P-5242V-12.1.1.0 Vulnerability in the Oracle GlassFish Server component of Oracle Fusion Middleware (subcomponent: Java Server Faces). Supported versions that are affected are 2.1.1, 3.0.1 and 3.1.2. Easily exploitable vulnerability allows successful unauthenticated network attacks via HTTP. Successful attack of this vulnerability can result in unauthorized read access to a subset of Oracle GlassFish Server accessible data. CVSS Base Score 5.0 (Confidentiality impacts). CVSS V2 Vector: (AV:N/AC:L/Au:N/C:P/I:N/A:N). Oracle Vector: (AV:N/AC:L/Au:N/C:P/I:N/A:N). Fix has been released CVE-2013-3827 P-8493V-2.1.1 P-8493V-3.0.1 P-8493V-3.1.2 5.0 AV:N/AC:L/Au:N/C:P/I:N/A:N CPUOct2013 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html P-8493V-2.1.1 P-8493V-3.0.1 P-8493V-3.1.2 Vulnerability in the Oracle Web Services component of Oracle Fusion Middleware (subcomponent: Test Page). Supported versions that are affected are 10.1.3.5.0 and 11.1.1.6.0. Easily exploitable vulnerability allows successful unauthenticated network attacks via HTTP. Successful attack of this vulnerability can result in unauthorized read access to a subset of Oracle Web Services accessible data. CVSS Base Score 5.0 (Confidentiality impacts). CVSS V2 Vector: (AV:N/AC:L/Au:N/C:P/I:N/A:N). Oracle Vector: (AV:N/AC:L/Au:N/C:P/I:N/A:N). Fix has been released CVE-2013-3828 P-1271V-10.1.3.5.0 P-1271V-11.1.1.6.0 5.0 AV:N/AC:L/Au:N/C:P/I:N/A:N CPUOct2013 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html P-1271V-10.1.3.5.0 P-1271V-11.1.1.6.0 Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Libraries). Supported versions that are affected are Java SE 7u40 and earlier, Java SE 6u60 and earlier, Java SE 5.0u51 and earlier and Java SE Embedded 7u40 and earlier. Easily exploitable vulnerability allows successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability can result in unauthorized update, insert or delete access to some Java SE, Java SE Embedded accessible data as well as read access to a subset of Java SE, Java SE Embedded accessible data. Note: Applies to client deployment of Java only. This vulnerability can be exploited only through sandboxed Java Web Start applications and sandboxed Java applets. CVSS Base Score 6.4 (Confidentiality and Integrity impacts). CVSS V2 Vector: (AV:N/AC:L/Au:N/C:P/I:P/A:N). Oracle Vector: (AV:N/AC:L/Au:N/C:P/I:P/A:N). Fix has been released CVE-2013-3829 P-856V-Java SE 7u40 and earlier P-856V-Java SE 6u60 and earlier P-856V-Java SE 5.0u51 and earlier P-856V-Java SE Embedded 7u40 and earlier 6.4 AV:N/AC:L/Au:N/C:P/I:P/A:N CPUOct2013 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html P-856V-Java SE 7u40 and earlier P-856V-Java SE 6u60 and earlier P-856V-Java SE 5.0u51 and earlier P-856V-Java SE Embedded 7u40 and earlier Vulnerability in the Oracle Portal component of Oracle Fusion Middleware (subcomponent: Demos). The supported version that is affected is 11.1.1.6.0. Easily exploitable vulnerability allows successful authenticated network attacks via HTTP. Successful attack of this vulnerability can result in unauthorized update, insert or delete access to all Oracle Portal accessible data as well as read access to all Oracle Portal accessible data. CVSS Base Score 5.5 (Confidentiality and Integrity impacts). CVSS V2 Vector: (AV:N/AC:L/Au:S/C:P/I:P/A:N). Oracle Vector: (AV:N/AC:L/Au:S/C:P+/I:P+/A:N). Fix has been released CVE-2013-3831 P-96V-11.1.1.6.0 5.5 AV:N/AC:L/Au:S/C:P/I:P/A:N CPUOct2013 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html P-96V-11.1.1.6.0 Vulnerability in the Siebel Server Remote component of Oracle Siebel CRM (subcomponent: File System Management). Supported versions that are affected are 8.1.1 and 8.2.2. Easily exploitable vulnerability allows successful authenticated network attacks via HTTP. Successful attack of this vulnerability can result in unauthorized update, insert or delete access to some Siebel Server Remote accessible data. CVSS Base Score 4.0 (Integrity impacts). CVSS V2 Vector: (AV:N/AC:L/Au:S/C:N/I:P/A:N). Oracle Vector: (AV:N/AC:L/Au:S/C:N/I:P/A:N). Fix has been released CVE-2013-3832 P-9028V-8.1.1 P-9028V-8.2.2 4.0 AV:N/AC:L/Au:S/C:N/I:P/A:N CPUOct2013 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html P-9028V-8.1.1 P-9028V-8.2.2 Vulnerability in the Oracle Access Manager component of Oracle Fusion Middleware (subcomponent: Authentication Engine). Supported versions that are affected are 11.1.1.5.0 and 11.1.2.0.0. Difficult to exploit vulnerability allows successful unauthenticated network attacks via HTTP. Successful attack of this vulnerability can result in unauthorized update, insert or delete access to some Oracle Access Manager accessible data. CVSS Base Score 4.3 (Integrity impacts). CVSS V2 Vector: (AV:N/AC:M/Au:N/C:N/I:P/A:N). Oracle Vector: (AV:N/AC:M/Au:N/C:N/I:P/A:N). Fix has been released CVE-2013-3833 P-5565V-11.1.1.5.0 P-5565V-11.1.2.0.0 4.3 AV:N/AC:M/Au:N/C:N/I:P/A:N CPUOct2013 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html P-5565V-11.1.1.5.0 P-5565V-11.1.2.0.0 Vulnerability in the Oracle Secure Global Desktop component of Oracle Virtualization (subcomponent: ttaauxserv). The supported version that is affected is 5. Easily exploitable vulnerability allows successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Secure Global Desktop. CVSS Base Score 5.0 (Availability impacts). CVSS V2 Vector: (AV:N/AC:L/Au:N/C:N/I:N/A:P). Oracle Vector: (AV:N/AC:L/Au:N/C:N/I:N/A:P). Fix has been released CVE-2013-3834 P-8539V-5 5.0 AV:N/AC:L/Au:N/C:N/I:N/A:P CPUOct2013 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html P-8539V-5 Vulnerability in the PeopleSoft Enterprise PeopleTools component of Oracle PeopleSoft Products (subcomponent: Integration Broker). Supported versions that are affected are 8.51, 8.52 and 8.53. Easily exploitable vulnerability allows successful unauthenticated network attacks via HTTP. Successful attack of this vulnerability can result in unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data. CVSS Base Score 5.0 (Confidentiality impacts). CVSS V2 Vector: (AV:N/AC:L/Au:N/C:P/I:N/A:N). Oracle Vector: (AV:N/AC:L/Au:N/C:P/I:N/A:N). Fix has been released CVE-2013-3835 P-5085V-8.51 P-5085V-8.52 P-5085V-8.53 5.0 AV:N/AC:L/Au:N/C:P/I:N/A:N CPUOct2013 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html P-5085V-8.51 P-5085V-8.52 P-5085V-8.53 Vulnerability in the Oracle Web Cache component of Oracle Fusion Middleware (subcomponent: ESI/Partial Page Caching). Supported versions that are affected are 11.1.1.6 and 11.1.1.7. Difficult to exploit vulnerability allows successful authenticated network attacks via HTTP. Successful attack of this vulnerability can result in unauthorized read access to all Oracle Web Cache accessible data. CVSS Base Score 3.5 (Confidentiality impacts). CVSS V2 Vector: (AV:N/AC:M/Au:S/C:P/I:N/A:N). Oracle Vector: (AV:N/AC:M/Au:S/C:P+/I:N/A:N). Fix has been released CVE-2013-3836 P-1059V-11.1.1.6 P-1059V-11.1.1.7 3.5 AV:N/AC:M/Au:S/C:P/I:N/A:N CPUOct2013 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html P-1059V-11.1.1.6 P-1059V-11.1.1.7 Vulnerability in the Solaris component of Oracle and Sun Systems Products Suite (subcomponent: Cacao). Supported versions that are affected are 10 and 11.1. Difficult to exploit vulnerability allows successful unauthenticated network attacks via SNMP. Successful attack of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Solaris. CVSS Base Score 4.3 (Availability impacts). CVSS V2 Vector: (AV:N/AC:M/Au:N/C:N/I:N/A:P). Oracle Vector: (AV:N/AC:M/Au:N/C:N/I:N/A:P). Fix has been released CVE-2013-3837 P-10006V-10 P-10006V-11.1 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P CPUOct2013 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html P-10006V-10 P-10006V-11.1 Vulnerability in the SPARC Enterprise T & M Series Servers component of Oracle and Sun Systems Products Suite (subcomponent: Sun System Firmware/Hypervisor). Supported versions that are affected are Sun System Firmware before 6.7.13, 7.4.6.c, 8.3.0.b and 9.0.0.d and 9.0.1.e. Very difficult to exploit vulnerability requiring logon to Operating System. Successful attack of this vulnerability can result in unauthorized Operating System hang or frequently repeatable crash (complete DOS). Note: CVE-2013-3838 applies to Sun System Firmware before 6.7.13 for SPARC T1, 7.4.6.c for SPARC T2, 8.3.0.b for SPARC T3 & T4, 9.0.0.d for SPARC T5 and 9.0.1.e for SPARC M5. CVSS Base Score 4.0 (Availability impacts). CVSS V2 Vector: (AV:L/AC:H/Au:N/C:N/I:N/A:C). Oracle Vector: (AV:L/AC:H/Au:N/C:N/I:N/A:C). Fix has been released CVE-2013-3838 P-9847V-Sun System Firmware before 6.7.13 P-9847V-7.4.6.c P-9847V-8.3.0.b P-9847V-9.0.0.d and 9.0.1.e 4.0 AV:L/AC:H/Au:N/C:N/I:N/A:C CPUOct2013 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html P-9847V-Sun System Firmware before 6.7.13 P-9847V-7.4.6.c P-9847V-8.3.0.b P-9847V-9.0.0.d and 9.0.1.e Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Optimizer). Supported versions that are affected are 5.1.70 and earlier, 5.5.32 and earlier and 5.6.12 and earlier. Easily exploitable vulnerability allows successful authenticated network attacks via multiple protocols. Successful attack of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS Base Score 4.0 (Availability impacts). CVSS V2 Vector: (AV:N/AC:L/Au:S/C:N/I:N/A:P). Oracle Vector: (AV:N/AC:L/Au:S/C:N/I:N/A:P+). Fix has been released CVE-2013-3839 P-8478V-5.1.70 and earlier P-8478V-5.5.32 and earlier P-8478V-5.6.12 and earlier 4.0 AV:N/AC:L/Au:S/C:N/I:N/A:P CPUOct2013 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html P-8478V-5.1.70 and earlier P-8478V-5.5.32 and earlier P-8478V-5.6.12 and earlier Vulnerability in the Siebel Core - EAI component of Oracle Siebel CRM (subcomponent: Web Services). Supported versions that are affected are 8.1.1 and 8.2.2. Easily exploitable vulnerability allows successful authenticated network attacks via HTTP. Successful attack of this vulnerability can result in unauthorized read access to a subset of Siebel Core - EAI accessible data. CVSS Base Score 4.0 (Confidentiality impacts). CVSS V2 Vector: (AV:N/AC:L/Au:S/C:P/I:N/A:N). Oracle Vector: (AV:N/AC:L/Au:S/C:P/I:N/A:N). Fix has been released CVE-2013-3840 P-9021V-8.1.1 P-9021V-8.2.2 4.0 AV:N/AC:L/Au:S/C:P/I:N/A:N CPUOct2013 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html P-9021V-8.1.1 P-9021V-8.2.2 Vulnerability in the Siebel Core - EAI component of Oracle Siebel CRM (subcomponent: Web Services). Supported versions that are affected are 8.1.1 and 8.2.2. Easily exploitable vulnerability allows successful unauthenticated network attacks via HTTP. Successful attack of this vulnerability can result in unauthorized read access to a subset of Siebel Core - EAI accessible data. CVSS Base Score 5.0 (Confidentiality impacts). CVSS V2 Vector: (AV:N/AC:L/Au:N/C:P/I:N/A:N). Oracle Vector: (AV:N/AC:L/Au:N/C:P/I:N/A:N). Fix has been released CVE-2013-3841 P-9021V-8.1.1 P-9021V-8.2.2 5.0 AV:N/AC:L/Au:N/C:P/I:N/A:N CPUOct2013 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html P-9021V-8.1.1 P-9021V-8.2.2 Vulnerability in the Solaris component of Oracle and Sun Systems Products Suite (subcomponent: Oracle Configuration Manager (OCM)). The supported version that is affected is 10. Easily exploitable vulnerability requiring logon to Operating System. Successful attack of this vulnerability can result in unauthorized read access to a subset of Solaris accessible data. CVSS Base Score 2.1 (Confidentiality impacts). CVSS V2 Vector: (AV:L/AC:L/Au:N/C:P/I:N/A:N). Oracle Vector: (AV:L/AC:L/Au:N/C:P/I:N/A:N). Fix has been released CVE-2013-3842 P-10006V-10 2.1 AV:L/AC:L/Au:N/C:P/I:N/A:N CPUOct2013 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html P-10006V-10 Vulnerability in the Java SE, JRockit, Java SE Embedded component of Oracle Java SE (subcomponent: JAXP). Supported versions that are affected are Java SE 7u40 and earlier, Java SE 6u60 and earlier, Java SE 5.0u51 and earlier, JRockit R28.2.8 and earlier, JRockit R27.7.6 and earlier and Java SE Embedded 7u40 and earlier. Easily exploitable vulnerability allows successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, JRockit, Java SE Embedded. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS Base Score 5.0 (Availability impacts). CVSS V2 Vector: (AV:N/AC:L/Au:N/C:N/I:N/A:P). Oracle Vector: (AV:N/AC:L/Au:N/C:N/I:N/A:P). Fix has been released CVE-2013-4002 P-856V-Java SE 7u40 and earlier P-856V-Java SE 6u60 and earlier P-856V-Java SE 5.0u51 and earlier P-856V-JRockit R28.2.8 and earlier P-856V-JRockit R27.7.6 and earlier P-856V-Java SE Embedded 7u40 and earlier 5.0 AV:N/AC:L/Au:N/C:N/I:N/A:P CPUOct2013 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html P-856V-Java SE 7u40 and earlier P-856V-Java SE 6u60 and earlier P-856V-Java SE 5.0u51 and earlier P-856V-JRockit R28.2.8 and earlier P-856V-JRockit R27.7.6 and earlier P-856V-Java SE Embedded 7u40 and earlier Vulnerability in the Siebel Core - Server BizLogic Script component of Oracle Siebel CRM (subcomponent: Integration - Scripting). Supported versions that are affected are 8.1.1 and 8.2.2. Difficult to exploit vulnerability allows successful unauthenticated network attacks via HTTP. Successful attack of this vulnerability can result in unauthorized update, insert or delete access to some Siebel Core - Server BizLogic Script accessible data as well as read access to a subset of Siebel Core - Server BizLogic Script accessible data. CVSS Base Score 5.8 (Confidentiality and Integrity impacts). CVSS V2 Vector: (AV:N/AC:M/Au:N/C:P/I:P/A:N). Oracle Vector: (AV:N/AC:M/Au:N/C:P/I:P/A:N). Fix has been released CVE-2013-5761 P-9001V-8.1.1 P-9001V-8.2.2 5.8 AV:N/AC:M/Au:N/C:P/I:P/A:N CPUOct2013 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html P-9001V-8.1.1 P-9001V-8.2.2 Vulnerability in the Oracle Siebel CTMS component of Oracle Industry Applications (subcomponent: SC-OC Integration). The supported version that is affected is 8.1.1.x. Very difficult to exploit vulnerability requiring logon to Operating System plus additional login/authentication to component or subcomponent. Successful attack of this vulnerability can escalate attacker privileges resulting in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Siebel CTMS and read access to a subset of Oracle Siebel CTMS accessible data. CVSS Base Score 2.4 (Confidentiality and Availability impacts). CVSS V2 Vector: (AV:L/AC:H/Au:S/C:P/I:N/A:P). Oracle Vector: (AV:L/AC:H/Au:S/C:P/I:N/A:P+). Fix has been released CVE-2013-5762 P-9173V-8.1.1.x 2.4 AV:L/AC:H/Au:S/C:P/I:N/A:P CPUOct2013 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html P-9173V-8.1.1.x Vulnerability in the Oracle Outside In Technology component of Oracle Fusion Middleware (subcomponent: Outside In Maintenance). The supported version that is affected is 8.4.0. Difficult to exploit vulnerability requiring logon to Operating System plus additional login/authentication to component or subcomponent. Successful attack of this vulnerability can escalate attacker privileges resulting in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Outside In Technology. Note: Outside In Technology is a suite of software development kits (SDKs). It does not have any particular associated protocol. If the hosting software passes data received over the network to Outside In Technology code, the CVSS Base Score would increase to 6.8. CVSS Base Score 1.5 (Availability impacts). CVSS V2 Vector: (AV:L/AC:M/Au:S/C:N/I:N/A:P). Oracle Vector: (AV:L/AC:M/Au:S/C:N/I:N/A:P). Fix has been released CVE-2013-5763 P-2276V-8.4.0 1.5 AV:L/AC:M/Au:S/C:N/I:N/A:P CPUOct2013 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html P-2276V-8.4.0 Vulnerability in the PeopleSoft Enterprise PeopleTools component of Oracle PeopleSoft Products (subcomponent: XML Publisher). Supported versions that are affected are 8.51, 8.52 and 8.53. Easily exploitable vulnerability allows successful unauthenticated network attacks via HTTP. Successful attack of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of PeopleSoft Enterprise PeopleTools. CVSS Base Score 5.0 (Availability impacts). CVSS V2 Vector: (AV:N/AC:L/Au:N/C:N/I:N/A:P). Oracle Vector: (AV:N/AC:L/Au:N/C:N/I:N/A:P). Fix has been released CVE-2013-5765 P-5085V-8.51 P-5085V-8.52 P-5085V-8.53 5.0 AV:N/AC:L/Au:N/C:N/I:N/A:P CPUOct2013 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html P-5085V-8.51 P-5085V-8.52 P-5085V-8.53 Vulnerability in the Enterprise Manager Base Platform component of Oracle Enterprise Manager Grid Control (subcomponent: DB Performance Advisories/UIs). Supported versions that are affected are EM Base Platform: 10.2.0.5, 11.1.0.1 <br/> EM DB Control: 11.1.0.7, 11.2.0.2, 11.2.0.3 <br/> EM Plugin for DB: 12.1.0.2 and 12.1.0.3. Difficult to exploit vulnerability allows successful unauthenticated network attacks via HTTP. Successful attack of this vulnerability can result in unauthorized update, insert or delete access to some Enterprise Manager Base Platform accessible data. CVSS Base Score 4.3 (Integrity impacts). CVSS V2 Vector: (AV:N/AC:M/Au:N/C:N/I:P/A:N). Oracle Vector: (AV:N/AC:M/Au:N/C:N/I:P/A:N). Fix has been released CVE-2013-5766 P-1366V-EM Base Platform: 10.2.0.5 P-1366V-11.1.0.1 EM DB Control: 11.1.0.7 P-1366V-11.2.0.2 P-1366V-11.2.0.3 EM Plugin for DB: 12.1.0.2 P-1366V-12.1.0.3 4.3 AV:N/AC:M/Au:N/C:N/I:P/A:N CPUOct2013 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html P-1366V-EM Base Platform: 10.2.0.5 P-1366V-11.1.0.1 EM DB Control: 11.1.0.7 P-1366V-11.2.0.2 P-1366V-11.2.0.3 EM Plugin for DB: 12.1.0.2 P-1366V-12.1.0.3 Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Optimizer). Supported versions that are affected are 5.6.12 and earlier. Easily exploitable vulnerability allows successful authenticated network attacks via multiple protocols. Successful attack of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS Base Score 4.0 (Availability impacts). CVSS V2 Vector: (AV:N/AC:L/Au:S/C:N/I:N/A:P). Oracle Vector: (AV:N/AC:L/Au:S/C:N/I:N/A:P+). Fix has been released CVE-2013-5767 P-8478V-5.6.12 and earlier 4.0 AV:N/AC:L/Au:S/C:N/I:N/A:P CPUOct2013 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html P-8478V-5.6.12 and earlier Vulnerability in the Siebel UI Framework component of Oracle Siebel CRM (subcomponent: ActiveX Controls). Supported versions that are affected are 8.1.1 and 8.2.2. Easily exploitable vulnerability allows successful authenticated network attacks via HTTP. Successful attack of this vulnerability can result in unauthorized update, insert or delete access to some Siebel UI Framework accessible data. CVSS Base Score 4.0 (Integrity impacts). CVSS V2 Vector: (AV:N/AC:L/Au:S/C:N/I:P/A:N). Oracle Vector: (AV:N/AC:L/Au:S/C:N/I:P/A:N). Fix has been released CVE-2013-5768 P-9011V-8.1.1 P-9011V-8.2.2 4.0 AV:N/AC:L/Au:S/C:N/I:P/A:N CPUOct2013 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html P-9011V-8.1.1 P-9011V-8.2.2 Vulnerability in the Siebel Core - EAI component of Oracle Siebel CRM (subcomponent: Web Services). The supported version that is affected is 8.1.1. Easily exploitable vulnerability allows successful authenticated network attacks via HTTP. Successful attack of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Siebel Core - EAI. CVSS Base Score 4.0 (Availability impacts). CVSS V2 Vector: (AV:N/AC:L/Au:S/C:N/I:N/A:P). Oracle Vector: (AV:N/AC:L/Au:S/C:N/I:N/A:P). Fix has been released CVE-2013-5769 P-9021V-8.1.1 4.0 AV:N/AC:L/Au:S/C:N/I:N/A:P CPUOct2013 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html P-9021V-8.1.1 Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Locking). Supported versions that are affected are 5.6.11 and earlier. Very difficult to exploit vulnerability allows successful authenticated network attacks via multiple protocols. Successful attack of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS Base Score 2.1 (Availability impacts). CVSS V2 Vector: (AV:N/AC:H/Au:S/C:N/I:N/A:P). Oracle Vector: (AV:N/AC:H/Au:S/C:N/I:N/A:P+). Fix has been released CVE-2013-5770 P-8478V-5.6.11 and earlier 2.1 AV:N/AC:H/Au:S/C:N/I:N/A:P CPUOct2013 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html P-8478V-5.6.11 and earlier Vulnerability in the XML Parser component of Oracle Database Server. For supported versions that are affected see note. Easily exploitable vulnerability allows successful unauthenticated network attacks via Oracle Net. Successful attack of this vulnerability can result in unauthorized read access to a subset of XML Parser accessible data and ability to cause a partial denial of service (partial DOS) of XML Parser. Note: Fixed in all supported releases and patchsets. CVSS Base Score 6.4 (Confidentiality and Availability impacts). CVSS V2 Vector: (AV:N/AC:L/Au:N/C:P/I:N/A:P). Oracle Vector: (AV:N/AC:L/Au:N/C:P/I:N/A:P). Fix has been released CVE-2013-5771 P-5V-- 6.4 AV:N/AC:L/Au:N/C:P/I:N/A:P CPUOct2013 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html P-5V-- Vulnerability in the Java SE component of Oracle Java SE (subcomponent: jhat). Supported versions that are affected are Java SE 7u40 and earlier and Java SE 6u60 and earlier. Very difficult to exploit vulnerability allows successful unauthenticated network attacks via HTTP. Successful attack of this vulnerability can result in unauthorized update, insert or delete access to some Java SE accessible data. Note: Applies to the jhat developer tool. CVSS Base Score 2.6 (Integrity impacts). CVSS V2 Vector: (AV:N/AC:H/Au:N/C:N/I:P/A:N). Oracle Vector: (AV:N/AC:H/Au:N/C:N/I:P/A:N). Fix has been released CVE-2013-5772 P-856V-Java SE 7u40 and earlier P-856V-Java SE 6u60 and earlier 2.6 AV:N/AC:H/Au:N/C:N/I:P/A:N CPUOct2013 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html P-856V-Java SE 7u40 and earlier P-856V-Java SE 6u60 and earlier Vulnerability in the Oracle Containers for J2EE component of Oracle Fusion Middleware (subcomponent: Servlet Runtime). The supported version that is affected is 10.1.3.5.0. Difficult to exploit vulnerability allows successful unauthenticated network attacks via HTTP. Successful attack of this vulnerability can result in unauthorized update, insert or delete access to some Oracle Containers for J2EE accessible data. Note: Please refer to MOS note <A HREF="https://support.oracle.com/epmos/faces/DocumentDisplay?id=1586861.1">https://support.oracle.com/epmos/faces/DocumentDisplay?id=1586861.1</A> for configuration. CVSS Base Score 4.3 (Integrity impacts). CVSS V2 Vector: (AV:N/AC:M/Au:N/C:N/I:P/A:N). Oracle Vector: (AV:N/AC:M/Au:N/C:N/I:P/A:N). Fix has been released CVE-2013-5773 P-1270V-10.1.3.5.0 4.3 AV:N/AC:M/Au:N/C:N/I:P/A:N CPUOct2013 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html P-1270V-10.1.3.5.0 Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Libraries). Supported versions that are affected are Java SE 7u40 and earlier, Java SE 6u60 and earlier, Java SE 5.0u51 and earlier and Java SE Embedded 7u40 and earlier. Easily exploitable vulnerability allows successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability can result in unauthorized update, insert or delete access to some Java SE, Java SE Embedded accessible data. Note: Applies to client deployment of Java only. This vulnerability can be exploited only through sandboxed Java Web Start applications and sandboxed Java applets. CVSS Base Score 5.0 (Integrity impacts). CVSS V2 Vector: (AV:N/AC:L/Au:N/C:N/I:P/A:N). Oracle Vector: (AV:N/AC:L/Au:N/C:N/I:P/A:N). Fix has been released CVE-2013-5774 P-856V-Java SE 7u40 and earlier P-856V-Java SE 6u60 and earlier P-856V-Java SE 5.0u51 and earlier P-856V-Java SE Embedded 7u40 and earlier 5.0 AV:N/AC:L/Au:N/C:N/I:P/A:N CPUOct2013 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html P-856V-Java SE 7u40 and earlier P-856V-Java SE 6u60 and earlier P-856V-Java SE 5.0u51 and earlier P-856V-Java SE Embedded 7u40 and earlier Vulnerability in the Java SE, JavaFX component of Oracle Java SE (subcomponent: JavaFX). Supported versions that are affected are Java SE 7u40 and earlier and JavaFX 2.2.40 and earlier. Easily exploitable vulnerability allows successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability can result in unauthorized update, insert or delete access to some Java SE, JavaFX accessible data as well as read access to a subset of Java SE, JavaFX accessible data and ability to cause a partial denial of service (partial DOS) of Java SE, JavaFX. Note: Applies to client deployment of Java only. This vulnerability can be exploited only through sandboxed Java Web Start applications and sandboxed Java applets. CVSS Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS V2 Vector: (AV:N/AC:L/Au:N/C:P/I:P/A:P). Oracle Vector: (AV:N/AC:L/Au:N/C:P/I:P/A:P). Fix has been released CVE-2013-5775 P-856V-Java SE 7u40 and earlier P-856V-JavaFX 2.2.40 and earlier 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P CPUOct2013 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html P-856V-Java SE 7u40 and earlier P-856V-JavaFX 2.2.40 and earlier Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Deployment). Supported versions that are affected are Java SE 7u40 and earlier, Java SE 6u60 and earlier and Java SE Embedded 7u40 and earlier. Easily exploitable vulnerability allows successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability can result in unauthorized update, insert or delete access to some Java SE, Java SE Embedded accessible data. Note: Applies to client deployment of Java only. This vulnerability can be exploited only through sandboxed Java Web Start applications and sandboxed Java applets. CVSS Base Score 5.0 (Integrity impacts). CVSS V2 Vector: (AV:N/AC:L/Au:N/C:N/I:P/A:N). Oracle Vector: (AV:N/AC:L/Au:N/C:N/I:P/A:N). Fix has been released CVE-2013-5776 P-856V-Java SE 7u40 and earlier P-856V-Java SE 6u60 and earlier P-856V-Java SE Embedded 7u40 and earlier 5.0 AV:N/AC:L/Au:N/C:N/I:P/A:N CPUOct2013 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html P-856V-Java SE 7u40 and earlier P-856V-Java SE 6u60 and earlier P-856V-Java SE Embedded 7u40 and earlier Vulnerability in the Java SE, JavaFX component of Oracle Java SE (subcomponent: JavaFX). Supported versions that are affected are Java SE 7u40 and earlier and JavaFX 2.2.40 and earlier. Difficult to exploit vulnerability allows successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability can result in unauthorized Operating System takeover including arbitrary code execution. Note: Applies to client deployment of Java only. This vulnerability can be exploited only through sandboxed Java Web Start applications and sandboxed Java applets. CVSS Base Score 9.3 (Confidentiality, Integrity and Availability impacts). CVSS V2 Vector: (AV:N/AC:M/Au:N/C:C/I:C/A:C). Oracle Vector: (AV:N/AC:M/Au:N/C:C/I:C/A:C). Fix has been released CVE-2013-5777 P-856V-Java SE 7u40 and earlier P-856V-JavaFX 2.2.40 and earlier 9.3 AV:N/AC:M/Au:N/C:C/I:C/A:C CPUOct2013 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html P-856V-Java SE 7u40 and earlier P-856V-JavaFX 2.2.40 and earlier Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: 2D). Supported versions that are affected are Java SE 7u40 and earlier, Java SE 6u60 and earlier, Java SE 5.0u51 and earlier and Java SE Embedded 7u40 and earlier. Easily exploitable vulnerability allows successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability can result in unauthorized read access to a subset of Java SE, Java SE Embedded accessible data. Note: Applies to client deployment of Java only. This vulnerability can be exploited only through sandboxed Java Web Start applications and sandboxed Java applets. CVSS Base Score 5.0 (Confidentiality impacts). CVSS V2 Vector: (AV:N/AC:L/Au:N/C:P/I:N/A:N). Oracle Vector: (AV:N/AC:L/Au:N/C:P/I:N/A:N). Fix has been released CVE-2013-5778 P-856V-Java SE 7u40 and earlier P-856V-Java SE 6u60 and earlier P-856V-Java SE 5.0u51 and earlier P-856V-Java SE Embedded 7u40 and earlier 5.0 AV:N/AC:L/Au:N/C:P/I:N/A:N CPUOct2013 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html P-856V-Java SE 7u40 and earlier P-856V-Java SE 6u60 and earlier P-856V-Java SE 5.0u51 and earlier P-856V-Java SE Embedded 7u40 and earlier Vulnerability in the PeopleSoft Enterprise PeopleTools component of Oracle PeopleSoft Products (subcomponent: PIA Core Technology). Supported versions that are affected are 8.51, 8.52 and 8.53. Easily exploitable vulnerability allows successful authenticated network attacks via HTTP. Successful attack of this vulnerability can result in unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data. CVSS Base Score 4.0 (Confidentiality impacts). CVSS V2 Vector: (AV:N/AC:L/Au:S/C:P/I:N/A:N). Oracle Vector: (AV:N/AC:L/Au:S/C:P/I:N/A:N). Fix has been released CVE-2013-5779 P-5085V-8.51 P-5085V-8.52 P-5085V-8.53 4.0 AV:N/AC:L/Au:S/C:P/I:N/A:N CPUOct2013 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html P-5085V-8.51 P-5085V-8.52 P-5085V-8.53 Vulnerability in the Java SE, JRockit, Java SE Embedded component of Oracle Java SE (subcomponent: Libraries). Supported versions that are affected are Java SE 7u40 and earlier, Java SE 6u60 and earlier, Java SE 5.0u51 and earlier, JRockit R28.2.8 and earlier, JRockit R27.7.6 and earlier and Java SE Embedded 7u40 and earlier. Difficult to exploit vulnerability allows successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability can result in unauthorized read access to a subset of Java SE, JRockit, Java SE Embedded accessible data. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS Base Score 4.3 (Confidentiality impacts). CVSS V2 Vector: (AV:N/AC:M/Au:N/C:P/I:N/A:N). Oracle Vector: (AV:N/AC:M/Au:N/C:P/I:N/A:N). Fix has been released CVE-2013-5780 P-856V-Java SE 7u40 and earlier P-856V-Java SE 6u60 and earlier P-856V-Java SE 5.0u51 and earlier P-856V-JRockit R28.2.8 and earlier P-856V-JRockit R27.7.6 and earlier P-856V-Java SE Embedded 7u40 and earlier 4.3 AV:N/AC:M/Au:N/C:P/I:N/A:N CPUOct2013 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html P-856V-Java SE 7u40 and earlier P-856V-Java SE 6u60 and earlier P-856V-Java SE 5.0u51 and earlier P-856V-JRockit R28.2.8 and earlier P-856V-JRockit R27.7.6 and earlier P-856V-Java SE Embedded 7u40 and earlier Vulnerability in the SPARC Enterprise T4 Servers component of Oracle and Sun Systems Products Suite (subcomponent: Sun System Firmware/Integrated Lights Out Manager (ILOM)). The supported version that is affected is Sun System Firmware before 8.3.0.b. Difficult to exploit vulnerability requiring logon to Operating System. Successful attack of this vulnerability can result in unauthorized Operating System takeover including arbitrary code execution. CVSS Base Score 6.9 (Confidentiality, Integrity and Availability impacts). CVSS V2 Vector: (AV:L/AC:M/Au:N/C:C/I:C/A:C). Oracle Vector: (AV:L/AC:M/Au:N/C:C/I:C/A:C). Fix has been released CVE-2013-5781 P-9846V-Sun System Firmware before 8.3.0.b 6.9 AV:L/AC:M/Au:N/C:C/I:C/A:C CPUOct2013 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html P-9846V-Sun System Firmware before 8.3.0.b Vulnerability in the Java SE, JRockit, Java SE Embedded component of Oracle Java SE (subcomponent: 2D). Supported versions that are affected are Java SE 7u40 and earlier, Java SE 6u60 and earlier, Java SE 5.0u51 and earlier, JRockit R28.2.8 and earlier, JRockit R27.7.6 and earlier and Java SE Embedded 7u40 and earlier. Easily exploitable vulnerability allows successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability can result in unauthorized Operating System takeover including arbitrary code execution. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS Base Score 10.0 (Confidentiality, Integrity and Availability impacts). CVSS V2 Vector: (AV:N/AC:L/Au:N/C:C/I:C/A:C). Oracle Vector: (AV:N/AC:L/Au:N/C:C/I:C/A:C). Fix has been released CVE-2013-5782 P-856V-Java SE 7u40 and earlier P-856V-Java SE 6u60 and earlier P-856V-Java SE 5.0u51 and earlier P-856V-JRockit R28.2.8 and earlier P-856V-JRockit R27.7.6 and earlier P-856V-Java SE Embedded 7u40 and earlier 10.0 AV:N/AC:L/Au:N/C:C/I:C/A:C CPUOct2013 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html P-856V-Java SE 7u40 and earlier P-856V-Java SE 6u60 and earlier P-856V-Java SE 5.0u51 and earlier P-856V-JRockit R28.2.8 and earlier P-856V-JRockit R27.7.6 and earlier P-856V-Java SE Embedded 7u40 and earlier Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Swing). Supported versions that are affected are Java SE 7u40 and earlier, Java SE 6u60 and earlier, Java SE 5.0u51 and earlier and Java SE Embedded 7u40 and earlier. Easily exploitable vulnerability allows successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability can result in unauthorized update, insert or delete access to some Java SE, Java SE Embedded accessible data as well as read access to a subset of Java SE, Java SE Embedded accessible data. Note: Applies to client deployment of Java only. This vulnerability can be exploited only through sandboxed Java Web Start applications and sandboxed Java applets. CVSS Base Score 6.4 (Confidentiality and Integrity impacts). CVSS V2 Vector: (AV:N/AC:L/Au:N/C:P/I:P/A:N). Oracle Vector: (AV:N/AC:L/Au:N/C:P/I:P/A:N). Fix has been released CVE-2013-5783 P-856V-Java SE 7u40 and earlier P-856V-Java SE 6u60 and earlier P-856V-Java SE 5.0u51 and earlier P-856V-Java SE Embedded 7u40 and earlier 6.4 AV:N/AC:L/Au:N/C:P/I:P/A:N CPUOct2013 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html P-856V-Java SE 7u40 and earlier P-856V-Java SE 6u60 and earlier P-856V-Java SE 5.0u51 and earlier P-856V-Java SE Embedded 7u40 and earlier Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: SCRIPTING). Supported versions that are affected are Java SE 7u40 and earlier, Java SE 6u60 and earlier and Java SE Embedded 7u40 and earlier. Difficult to exploit vulnerability allows successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability can result in unauthorized update, insert or delete access to some Java SE, Java SE Embedded accessible data. Note: Applies to client deployment of Java only. This vulnerability can be exploited only through sandboxed Java Web Start applications and sandboxed Java applets. CVSS Base Score 4.3 (Integrity impacts). CVSS V2 Vector: (AV:N/AC:M/Au:N/C:N/I:P/A:N). Oracle Vector: (AV:N/AC:M/Au:N/C:N/I:P/A:N). Fix has been released CVE-2013-5784 P-856V-Java SE 7u40 and earlier P-856V-Java SE 6u60 and earlier P-856V-Java SE Embedded 7u40 and earlier 4.3 AV:N/AC:M/Au:N/C:N/I:P/A:N CPUOct2013 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html P-856V-Java SE 7u40 and earlier P-856V-Java SE 6u60 and earlier P-856V-Java SE Embedded 7u40 and earlier Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: InnoDB). Supported versions that are affected are 5.6.12 and earlier. Easily exploitable vulnerability allows successful authenticated network attacks via multiple protocols. Successful attack of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS Base Score 4.0 (Availability impacts). CVSS V2 Vector: (AV:N/AC:L/Au:S/C:N/I:N/A:P). Oracle Vector: (AV:N/AC:L/Au:S/C:N/I:N/A:P+). Fix has been released CVE-2013-5786 P-8478V-5.6.12 and earlier 4.0 AV:N/AC:L/Au:S/C:N/I:N/A:P CPUOct2013 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html P-8478V-5.6.12 and earlier Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Deployment). Supported versions that are affected are Java SE 7u40 and earlier, Java SE 6u60 and earlier and Java SE Embedded 7u40 and earlier. Easily exploitable vulnerability allows successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability can result in unauthorized Operating System takeover including arbitrary code execution. Note: Applies to client deployment of Java only. This vulnerability can be exploited only through sandboxed Java Web Start applications and sandboxed Java applets. CVSS Base Score 10.0 (Confidentiality, Integrity and Availability impacts). CVSS V2 Vector: (AV:N/AC:L/Au:N/C:C/I:C/A:C). Oracle Vector: (AV:N/AC:L/Au:N/C:C/I:C/A:C). Fix has been released CVE-2013-5787 P-856V-Java SE 7u40 and earlier P-856V-Java SE 6u60 and earlier P-856V-Java SE Embedded 7u40 and earlier 10.0 AV:N/AC:L/Au:N/C:C/I:C/A:C CPUOct2013 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html P-856V-Java SE 7u40 and earlier P-856V-Java SE 6u60 and earlier P-856V-Java SE Embedded 7u40 and earlier Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Deployment). Supported versions that are affected are Java SE 7u40 and earlier and Java SE Embedded 7u40 and earlier. Easily exploitable vulnerability allows successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability can result in unauthorized Operating System takeover including arbitrary code execution. Note: Applies to client deployment of Java only. This vulnerability can be exploited only through sandboxed Java Web Start applications and sandboxed Java applets. CVSS Base Score 10.0 (Confidentiality, Integrity and Availability impacts). CVSS V2 Vector: (AV:N/AC:L/Au:N/C:C/I:C/A:C). Oracle Vector: (AV:N/AC:L/Au:N/C:C/I:C/A:C). Fix has been released CVE-2013-5788 P-856V-Java SE 7u40 and earlier P-856V-Java SE Embedded 7u40 and earlier 10.0 AV:N/AC:L/Au:N/C:C/I:C/A:C CPUOct2013 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html P-856V-Java SE 7u40 and earlier P-856V-Java SE Embedded 7u40 and earlier Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Deployment). Supported versions that are affected are Java SE 7u40 and earlier, Java SE 6u60 and earlier and Java SE Embedded 7u40 and earlier. Easily exploitable vulnerability allows successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability can result in unauthorized Operating System takeover including arbitrary code execution. Note: Applies to client deployment of Java only. This vulnerability can be exploited only through sandboxed Java Web Start applications and sandboxed Java applets. CVSS Base Score 10.0 (Confidentiality, Integrity and Availability impacts). CVSS V2 Vector: (AV:N/AC:L/Au:N/C:C/I:C/A:C). Oracle Vector: (AV:N/AC:L/Au:N/C:C/I:C/A:C). Fix has been released CVE-2013-5789 P-856V-Java SE 7u40 and earlier P-856V-Java SE 6u60 and earlier P-856V-Java SE Embedded 7u40 and earlier 10.0 AV:N/AC:L/Au:N/C:C/I:C/A:C CPUOct2013 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html P-856V-Java SE 7u40 and earlier P-856V-Java SE 6u60 and earlier P-856V-Java SE Embedded 7u40 and earlier Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: BEANS). Supported versions that are affected are Java SE 7u40 and earlier, Java SE 6u60 and earlier, Java SE 5.0u51 and earlier and Java SE Embedded 7u40 and earlier. Difficult to exploit vulnerability allows successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability can result in unauthorized read access to a subset of Java SE, Java SE Embedded accessible data. Note: Applies to client deployment of Java only. This vulnerability can be exploited only through sandboxed Java Web Start applications and sandboxed Java applets. CVSS Base Score 4.3 (Confidentiality impacts). CVSS V2 Vector: (AV:N/AC:M/Au:N/C:P/I:N/A:N). Oracle Vector: (AV:N/AC:M/Au:N/C:P/I:N/A:N). Fix has been released CVE-2013-5790 P-856V-Java SE 7u40 and earlier P-856V-Java SE 6u60 and earlier P-856V-Java SE 5.0u51 and earlier P-856V-Java SE Embedded 7u40 and earlier 4.3 AV:N/AC:M/Au:N/C:P/I:N/A:N CPUOct2013 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html P-856V-Java SE 7u40 and earlier P-856V-Java SE 6u60 and earlier P-856V-Java SE 5.0u51 and earlier P-856V-Java SE Embedded 7u40 and earlier Vulnerability in the Oracle Outside In Technology component of Oracle Fusion Middleware (subcomponent: Outside In Filters). Supported versions that are affected are 8.4.0 and 8.4.1. Difficult to exploit vulnerability requiring logon to Operating System plus additional login/authentication to component or subcomponent. Successful attack of this vulnerability can escalate attacker privileges resulting in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Outside In Technology. Note: Outside In Technology is a suite of software development kits (SDKs). It does not have any particular associated protocol. If the hosting software passes data received over the network to Outside In Technology code, the CVSS Base Score would increase to 6.8. CVSS Base Score 1.5 (Availability impacts). CVSS V2 Vector: (AV:L/AC:M/Au:S/C:N/I:N/A:P). Oracle Vector: (AV:L/AC:M/Au:S/C:N/I:N/A:P+). Fix has been released CVE-2013-5791 P-2276V-8.4.0 P-2276V-8.4.1 1.5 AV:L/AC:M/Au:S/C:N/I:N/A:P CPUOct2013 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html P-2276V-8.4.0 P-2276V-8.4.1 Vulnerability in the Techstack component of Oracle E-Business Suite (subcomponent: Apache). The supported version that is affected is 12.1. Easily exploitable vulnerability allows successful unauthenticated network attacks via HTTP. Successful attack of this vulnerability can result in unauthorized read access to a subset of Techstack accessible data. CVSS Base Score 5.0 (Confidentiality impacts). CVSS V2 Vector: (AV:N/AC:L/Au:N/C:P/I:N/A:N). Oracle Vector: (AV:N/AC:L/Au:N/C:P/I:N/A:N). Fix has been released CVE-2013-5792 P-1745V-12.1 5.0 AV:N/AC:L/Au:N/C:P/I:N/A:N CPUOct2013 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html P-1745V-12.1 Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: InnoDB). Supported versions that are affected are 5.6.12 and earlier. Difficult to exploit vulnerability allows successful authenticated network attacks via multiple protocols. Successful attack of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS Base Score 3.5 (Availability impacts). CVSS V2 Vector: (AV:N/AC:M/Au:S/C:N/I:N/A:P). Oracle Vector: (AV:N/AC:M/Au:S/C:N/I:N/A:P+). Fix has been released CVE-2013-5793 P-8478V-5.6.12 and earlier 3.5 AV:N/AC:M/Au:S/C:N/I:N/A:P CPUOct2013 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html P-8478V-5.6.12 and earlier Vulnerability in the PeopleSoft Enterprise PeopleTools component of Oracle PeopleSoft Products (subcomponent: Portal). Supported versions that are affected are 8.51, 8.52 and 8.53. Easily exploitable vulnerability allows successful unauthenticated network attacks via HTTP. Successful attack of this vulnerability can result in unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data. CVSS Base Score 5.0 (Confidentiality impacts). CVSS V2 Vector: (AV:N/AC:L/Au:N/C:P/I:N/A:N). Oracle Vector: (AV:N/AC:L/Au:N/C:P/I:N/A:N). Fix has been released CVE-2013-5794 P-5085V-8.51 P-5085V-8.52 P-5085V-8.53 5.0 AV:N/AC:L/Au:N/C:P/I:N/A:N CPUOct2013 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html P-5085V-8.51 P-5085V-8.52 P-5085V-8.53 Vulnerability in the Siebel Core - EAI component of Oracle Siebel CRM (subcomponent: Web Services). Supported versions that are affected are 8.1.1 and 8.2.2. Difficult to exploit vulnerability allows successful unauthenticated network attacks via HTTP. Successful attack of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Siebel Core - EAI. CVSS Base Score 4.3 (Availability impacts). CVSS V2 Vector: (AV:N/AC:M/Au:N/C:N/I:N/A:P). Oracle Vector: (AV:N/AC:M/Au:N/C:N/I:N/A:P). Fix has been released CVE-2013-5796 P-9021V-8.1.1 P-9021V-8.2.2 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P CPUOct2013 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html P-9021V-8.1.1 P-9021V-8.2.2 Vulnerability in the Java SE, JRockit, JavaFX component of Oracle Java SE (subcomponent: Javadoc). Supported versions that are affected are Java SE 7u40 and earlier, Java SE 6u60 and earlier, Java SE 5.0u51 and earlier, JRockit R28.2.8 and earlier, JRockit R27.7.6 and earlier and JavaFX 2.2.40 and earlier. Difficult to exploit vulnerability allows successful authenticated network attacks via HTTP. Successful attack of this vulnerability can result in unauthorized update, insert or delete access to some Java SE, JRockit, JavaFX accessible data. Note: Applies to sites that run the Javadoc tool as a service and then host the resulting documentation. It is recommended that sites filter HTML where it is not explicitly allowed for javadocs. CVSS Base Score 3.5 (Integrity impacts). CVSS V2 Vector: (AV:N/AC:M/Au:S/C:N/I:P/A:N). Oracle Vector: (AV:N/AC:M/Au:S/C:N/I:P/A:N). Fix has been released CVE-2013-5797 P-856V-Java SE 7u40 and earlier P-856V-Java SE 6u60 and earlier P-856V-Java SE 5.0u51 and earlier P-856V-JRockit R28.2.8 and earlier P-856V-JRockit R27.7.6 and earlier P-856V-JavaFX 2.2.40 and earlier 3.5 AV:N/AC:M/Au:S/C:N/I:P/A:N CPUOct2013 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html P-856V-Java SE 7u40 and earlier P-856V-Java SE 6u60 and earlier P-856V-Java SE 5.0u51 and earlier P-856V-JRockit R28.2.8 and earlier P-856V-JRockit R27.7.6 and earlier P-856V-JavaFX 2.2.40 and earlier Vulnerability in the Oracle Identity Manager component of Oracle Fusion Middleware (subcomponent: End User Self Service). Supported versions that are affected are 11.1.2.0.0 and 11.1.2.1.0. Difficult to exploit vulnerability allows successful unauthenticated network attacks via HTTP. Successful attack of this vulnerability can result in unauthorized update, insert or delete access to some Oracle Identity Manager accessible data. CVSS Base Score 4.3 (Integrity impacts). CVSS V2 Vector: (AV:N/AC:M/Au:N/C:N/I:P/A:N). Oracle Vector: (AV:N/AC:M/Au:N/C:N/I:P/A:N). Fix has been released CVE-2013-5798 P-1980V-11.1.2.0.0 P-1980V-11.1.2.1.0 4.3 AV:N/AC:M/Au:N/C:N/I:P/A:N CPUOct2013 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html P-1980V-11.1.2.0.0 P-1980V-11.1.2.1.0 Vulnerability in the Oracle Agile PLM Framework component of Oracle Supply Chain Products Suite (subcomponent: Security). The supported version that is affected is 9.3.2. Difficult to exploit vulnerability allows successful unauthenticated network attacks via HTTP. Successful attack of this vulnerability can result in unauthorized update, insert or delete access to some Oracle Agile PLM Framework accessible data. CVSS Base Score 4.3 (Integrity impacts). CVSS V2 Vector: (AV:N/AC:M/Au:N/C:N/I:P/A:N). Oracle Vector: (AV:N/AC:M/Au:N/C:N/I:P/A:N). Fix has been released CVE-2013-5799 P-4461V-9.3.2 4.3 AV:N/AC:M/Au:N/C:N/I:P/A:N CPUOct2013 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html P-4461V-9.3.2 Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: JGSS). Supported versions that are affected are Java SE 7u40 and earlier and Java SE Embedded 7u40 and earlier. Difficult to exploit vulnerability allows successful unauthenticated network attacks via Kerberos. Successful attack of this vulnerability can result in unauthorized read access to a subset of Java SE, Java SE Embedded accessible data. Note: Applies to client deployment of Java only. This vulnerability can be exploited only through sandboxed Java Web Start applications and sandboxed Java applets. CVSS Base Score 4.3 (Confidentiality impacts). CVSS V2 Vector: (AV:N/AC:M/Au:N/C:P/I:N/A:N). Oracle Vector: (AV:N/AC:M/Au:N/C:P/I:N/A:N). Fix has been released CVE-2013-5800 P-856V-Java SE 7u40 and earlier P-856V-Java SE Embedded 7u40 and earlier 4.3 AV:N/AC:M/Au:N/C:P/I:N/A:N CPUOct2013 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html P-856V-Java SE 7u40 and earlier P-856V-Java SE Embedded 7u40 and earlier Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: 2D). Supported versions that are affected are Java SE 7u40 and earlier, Java SE 6u60 and earlier, Java SE 5.0u51 and earlier and Java SE Embedded 7u40 and earlier. Easily exploitable vulnerability allows successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability can result in unauthorized read access to a subset of Java SE, Java SE Embedded accessible data. Note: Applies to client deployment of Java only. This vulnerability can be exploited only through sandboxed Java Web Start applications and sandboxed Java applets. CVSS Base Score 5.0 (Confidentiality impacts). CVSS V2 Vector: (AV:N/AC:L/Au:N/C:P/I:N/A:N). Oracle Vector: (AV:N/AC:L/Au:N/C:P/I:N/A:N). Fix has been released CVE-2013-5801 P-856V-Java SE 7u40 and earlier P-856V-Java SE 6u60 and earlier P-856V-Java SE 5.0u51 and earlier P-856V-Java SE Embedded 7u40 and earlier 5.0 AV:N/AC:L/Au:N/C:P/I:N/A:N CPUOct2013 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html P-856V-Java SE 7u40 and earlier P-856V-Java SE 6u60 and earlier P-856V-Java SE 5.0u51 and earlier P-856V-Java SE Embedded 7u40 and earlier Vulnerability in the Java SE, JRockit, Java SE Embedded component of Oracle Java SE (subcomponent: JAXP). Supported versions that are affected are Java SE 7u40 and earlier, Java SE 6u60 and earlier, Java SE 5.0u51 and earlier, JRockit R28.2.8 and earlier, JRockit R27.7.6 and earlier and Java SE Embedded 7u40 and earlier. Easily exploitable vulnerability allows successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability can result in unauthorized update, insert or delete access to some Java SE, JRockit, Java SE Embedded accessible data as well as read access to a subset of Java SE, JRockit, Java SE Embedded accessible data and ability to cause a partial denial of service (partial DOS) of Java SE, JRockit, Java SE Embedded. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS V2 Vector: (AV:N/AC:L/Au:N/C:P/I:P/A:P). Oracle Vector: (AV:N/AC:L/Au:N/C:P/I:P/A:P). Fix has been released CVE-2013-5802 P-856V-Java SE 7u40 and earlier P-856V-Java SE 6u60 and earlier P-856V-Java SE 5.0u51 and earlier P-856V-JRockit R28.2.8 and earlier P-856V-JRockit R27.7.6 and earlier P-856V-Java SE Embedded 7u40 and earlier 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P CPUOct2013 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html P-856V-Java SE 7u40 and earlier P-856V-Java SE 6u60 and earlier P-856V-Java SE 5.0u51 and earlier P-856V-JRockit R28.2.8 and earlier P-856V-JRockit R27.7.6 and earlier P-856V-Java SE Embedded 7u40 and earlier Vulnerability in the Java SE, JRockit, Java SE Embedded component of Oracle Java SE (subcomponent: JGSS). Supported versions that are affected are Java SE 7u40 and earlier, Java SE 6u60 and earlier, Java SE 5.0u51 and earlier, JRockit R28.2.8 and earlier, JRockit R27.7.6 and earlier and Java SE Embedded 7u40 and earlier. Very difficult to exploit vulnerability allows successful unauthenticated network attacks via Kerberos. Successful attack of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, JRockit, Java SE Embedded. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS Base Score 2.6 (Availability impacts). CVSS V2 Vector: (AV:N/AC:H/Au:N/C:N/I:N/A:P). Oracle Vector: (AV:N/AC:H/Au:N/C:N/I:N/A:P). Fix has been released CVE-2013-5803 P-856V-Java SE 7u40 and earlier P-856V-Java SE 6u60 and earlier P-856V-Java SE 5.0u51 and earlier P-856V-JRockit R28.2.8 and earlier P-856V-JRockit R27.7.6 and earlier P-856V-Java SE Embedded 7u40 and earlier 2.6 AV:N/AC:H/Au:N/C:N/I:N/A:P CPUOct2013 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html P-856V-Java SE 7u40 and earlier P-856V-Java SE 6u60 and earlier P-856V-Java SE 5.0u51 and earlier P-856V-JRockit R28.2.8 and earlier P-856V-JRockit R27.7.6 and earlier P-856V-Java SE Embedded 7u40 and earlier Vulnerability in the Java SE, JRockit component of Oracle Java SE (subcomponent: Javadoc). Supported versions that are affected are Java SE 7u40 and earlier, Java SE 6u60 and earlier, Java SE 5.0u51 and earlier, JRockit R28.2.8 and earlier and JRockit R27.7.6 and earlier. Easily exploitable vulnerability allows successful unauthenticated network attacks via HTTP. Successful attack of this vulnerability can result in unauthorized update, insert or delete access to some Java SE, JRockit accessible data as well as read access to a subset of Java SE, JRockit accessible data. Note: Applies to sites that run the Javadoc tool as a service and then host the resulting documentation. It is recommended that sites filter HTML where it is not explicitly allowed for javadocs. CVSS Base Score 6.4 (Confidentiality and Integrity impacts). CVSS V2 Vector: (AV:N/AC:L/Au:N/C:P/I:P/A:N). Oracle Vector: (AV:N/AC:L/Au:N/C:P/I:P/A:N). Fix has been released CVE-2013-5804 P-856V-Java SE 7u40 and earlier P-856V-Java SE 6u60 and earlier P-856V-Java SE 5.0u51 and earlier P-856V-JRockit R28.2.8 and earlier P-856V-JRockit R27.7.6 and earlier 6.4 AV:N/AC:L/Au:N/C:P/I:P/A:N CPUOct2013 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html P-856V-Java SE 7u40 and earlier P-856V-Java SE 6u60 and earlier P-856V-Java SE 5.0u51 and earlier P-856V-JRockit R28.2.8 and earlier P-856V-JRockit R27.7.6 and earlier Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Swing). Supported versions that are affected are Java SE 7u40 and earlier and Java SE Embedded 7u40 and earlier. Difficult to exploit vulnerability allows successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability can result in unauthorized Operating System takeover including arbitrary code execution. Note: Applies to client deployment of Java only. This vulnerability can be exploited only through sandboxed Java Web Start applications and sandboxed Java applets. CVSS Base Score 9.3 (Confidentiality, Integrity and Availability impacts). CVSS V2 Vector: (AV:N/AC:M/Au:N/C:C/I:C/A:C). Oracle Vector: (AV:N/AC:M/Au:N/C:C/I:C/A:C). Fix has been released CVE-2013-5805 P-856V-Java SE 7u40 and earlier P-856V-Java SE Embedded 7u40 and earlier 9.3 AV:N/AC:M/Au:N/C:C/I:C/A:C CPUOct2013 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html P-856V-Java SE 7u40 and earlier P-856V-Java SE Embedded 7u40 and earlier Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Swing). Supported versions that are affected are Java SE 7u40 and earlier and Java SE Embedded 7u40 and earlier. Difficult to exploit vulnerability allows successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability can result in unauthorized Operating System takeover including arbitrary code execution. Note: Applies to client deployment of Java only. This vulnerability can be exploited only through sandboxed Java Web Start applications and sandboxed Java applets. CVSS Base Score 9.3 (Confidentiality, Integrity and Availability impacts). CVSS V2 Vector: (AV:N/AC:M/Au:N/C:C/I:C/A:C). Oracle Vector: (AV:N/AC:M/Au:N/C:C/I:C/A:C). Fix has been released CVE-2013-5806 P-856V-Java SE 7u40 and earlier P-856V-Java SE Embedded 7u40 and earlier 9.3 AV:N/AC:M/Au:N/C:C/I:C/A:C CPUOct2013 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html P-856V-Java SE 7u40 and earlier P-856V-Java SE Embedded 7u40 and earlier Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Replication). Supported versions that are affected are 5.5.32 and earlier and 5.6.12 and earlier. Difficult to exploit vulnerability allows successful authenticated network attacks via multiple protocols. Successful attack of this vulnerability can result in unauthorized update, insert or delete access to all MySQL Server accessible data as well as read access to all MySQL Server accessible data. CVSS Base Score 4.9 (Confidentiality and Integrity impacts). CVSS V2 Vector: (AV:N/AC:M/Au:S/C:P/I:P/A:N). Oracle Vector: (AV:N/AC:M/Au:S/C:P+/I:P+/A:N). Fix has been released CVE-2013-5807 P-8478V-5.5.32 and earlier P-8478V-5.6.12 and earlier 4.9 AV:N/AC:M/Au:S/C:P/I:P/A:N CPUOct2013 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html P-8478V-5.5.32 and earlier P-8478V-5.6.12 and earlier Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: 2D). Supported versions that are affected are Java SE 7u40 and earlier, Java SE 6u60 and earlier, Java SE 5.0u51 and earlier and Java SE Embedded 7u40 and earlier. Easily exploitable vulnerability allows successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability can result in unauthorized Operating System takeover including arbitrary code execution. Note: Applies to client deployment of Java only. This vulnerability can be exploited only through sandboxed Java Web Start applications and sandboxed Java applets. CVSS Base Score 10.0 (Confidentiality, Integrity and Availability impacts). CVSS V2 Vector: (AV:N/AC:L/Au:N/C:C/I:C/A:C). Oracle Vector: (AV:N/AC:L/Au:N/C:C/I:C/A:C). Fix has been released CVE-2013-5809 P-856V-Java SE 7u40 and earlier P-856V-Java SE 6u60 and earlier P-856V-Java SE 5.0u51 and earlier P-856V-Java SE Embedded 7u40 and earlier 10.0 AV:N/AC:L/Au:N/C:C/I:C/A:C CPUOct2013 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html P-856V-Java SE 7u40 and earlier P-856V-Java SE 6u60 and earlier P-856V-Java SE 5.0u51 and earlier P-856V-Java SE Embedded 7u40 and earlier Vulnerability in the Java SE, JavaFX component of Oracle Java SE (subcomponent: JavaFX). Supported versions that are affected are Java SE 7u40 and earlier and JavaFX 2.2.40 and earlier. Difficult to exploit vulnerability allows successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability can result in unauthorized Operating System takeover including arbitrary code execution. Note: Applies to client deployment of Java only. This vulnerability can be exploited only through sandboxed Java Web Start applications and sandboxed Java applets. CVSS Base Score 9.3 (Confidentiality, Integrity and Availability impacts). CVSS V2 Vector: (AV:N/AC:M/Au:N/C:C/I:C/A:C). Oracle Vector: (AV:N/AC:M/Au:N/C:C/I:C/A:C). Fix has been released CVE-2013-5810 P-856V-Java SE 7u40 and earlier P-856V-JavaFX 2.2.40 and earlier 9.3 AV:N/AC:M/Au:N/C:C/I:C/A:C CPUOct2013 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html P-856V-Java SE 7u40 and earlier P-856V-JavaFX 2.2.40 and earlier Vulnerability in the Oracle Health Sciences InForm component of Oracle Industry Applications (subcomponent: Web). Supported versions that are affected are 4.5 SP3, 4.5 SP3a-k, 4.6 SP0, 4.6 SP0a-c, 4.6 SP1, 4.6 SP1a-c, 4.6 SP2, 4.6 SP2a-c, 5.0 SP0, 5.0 SP0a, 5.0 SP1 and 5.0 SP1a-b. Difficult to exploit vulnerability allows successful authenticated network attacks via HTTP. Successful attack of this vulnerability can result in unauthorized read access to all Oracle Health Sciences InForm accessible data. CVSS Base Score 3.5 (Confidentiality impacts). CVSS V2 Vector: (AV:N/AC:M/Au:S/C:P/I:N/A:N). Oracle Vector: (AV:N/AC:M/Au:S/C:P+/I:N/A:N). Fix has been released CVE-2013-5811 P-9132V-4.5 SP3 P-9132V-4.5 SP3a-k P-9132V-4.6 SP0 P-9132V-4.6 SP0a-c P-9132V-4.6 SP1 P-9132V-4.6 SP1a-c P-9132V-4.6 SP2 P-9132V-4.6 SP2a-c P-9132V-5.0 SP0 P-9132V-5.0 SP0a P-9132V-5.0 SP1 P-9132V-5.0 SP1a-b 3.5 AV:N/AC:M/Au:S/C:P/I:N/A:N CPUOct2013 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html P-9132V-4.5 SP3 P-9132V-4.5 SP3a-k P-9132V-4.6 SP0 P-9132V-4.6 SP0a-c P-9132V-4.6 SP1 P-9132V-4.6 SP1a-c P-9132V-4.6 SP2 P-9132V-4.6 SP2a-c P-9132V-5.0 SP0 P-9132V-5.0 SP0a P-9132V-5.0 SP1 P-9132V-5.0 SP1a-b Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Deployment). Supported versions that are affected are Java SE 7u40 and earlier, Java SE 6u60 and earlier and Java SE Embedded 7u40 and earlier. Easily exploitable vulnerability allows successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability can result in unauthorized read access to a subset of Java SE, Java SE Embedded accessible data and ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: Applies to client deployment of Java only. This vulnerability can be exploited only through sandboxed Java Web Start applications and sandboxed Java applets. CVSS Base Score 6.4 (Confidentiality and Availability impacts). CVSS V2 Vector: (AV:N/AC:L/Au:N/C:P/I:N/A:P). Oracle Vector: (AV:N/AC:L/Au:N/C:P/I:N/A:P). Fix has been released CVE-2013-5812 P-856V-Java SE 7u40 and earlier P-856V-Java SE 6u60 and earlier P-856V-Java SE Embedded 7u40 and earlier 6.4 AV:N/AC:L/Au:N/C:P/I:N/A:P CPUOct2013 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html P-856V-Java SE 7u40 and earlier P-856V-Java SE 6u60 and earlier P-856V-Java SE Embedded 7u40 and earlier Vulnerability in the Oracle WebCenter Content component of Oracle Fusion Middleware (subcomponent: Content Server). Supported versions that are affected are 10.1.3.5.1, 11.1.1.6.0, 11.1.1.7.0 and 11.1.1.8.0. Easily exploitable vulnerability allows successful authenticated network attacks via HTTP. Successful attack of this vulnerability can result in unauthorized update, insert or delete access to all Oracle WebCenter Content accessible data as well as read access to all Oracle WebCenter Content accessible data. CVSS Base Score 5.5 (Confidentiality and Integrity impacts). CVSS V2 Vector: (AV:N/AC:L/Au:S/C:P/I:P/A:N). Oracle Vector: (AV:N/AC:L/Au:S/C:P+/I:P+/A:N). Fix has been released CVE-2013-5813 P-2271V-10.1.3.5.1 P-2271V-11.1.1.6.0 P-2271V-11.1.1.7.0 P-2271V-11.1.1.8.0 5.5 AV:N/AC:L/Au:S/C:P/I:P/A:N CPUOct2013 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html P-2271V-10.1.3.5.1 P-2271V-11.1.1.6.0 P-2271V-11.1.1.7.0 P-2271V-11.1.1.8.0 Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: CORBA). Supported versions that are affected are Java SE 7u40 and earlier, Java SE 6u60 and earlier, Java SE 5.0u51 and earlier and Java SE Embedded 7u40 and earlier. Easily exploitable vulnerability allows successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability can result in unauthorized Operating System takeover including arbitrary code execution. Note: Applies to client deployment of Java only. This vulnerability can be exploited only through sandboxed Java Web Start applications and sandboxed Java applets. CVSS Base Score 10.0 (Confidentiality, Integrity and Availability impacts). CVSS V2 Vector: (AV:N/AC:L/Au:N/C:C/I:C/A:C). Oracle Vector: (AV:N/AC:L/Au:N/C:C/I:C/A:C). Fix has been released CVE-2013-5814 P-856V-Java SE 7u40 and earlier P-856V-Java SE 6u60 and earlier P-856V-Java SE 5.0u51 and earlier P-856V-Java SE Embedded 7u40 and earlier 10.0 AV:N/AC:L/Au:N/C:C/I:C/A:C CPUOct2013 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html P-856V-Java SE 7u40 and earlier P-856V-Java SE 6u60 and earlier P-856V-Java SE 5.0u51 and earlier P-856V-Java SE Embedded 7u40 and earlier Vulnerability in the Oracle Identity Analytics component of Oracle Fusion Middleware (subcomponent: Security). Supported versions that are affected are Oracle Identity Analytics 11.1.1.5, Sun Role Manager 4.1 and 5.0. Easily exploitable vulnerability allows successful unauthenticated network attacks via HTTP. Successful attack of this vulnerability can result in unauthorized update, insert or delete access to all Oracle Identity Analytics accessible data as well as read access to a subset of Oracle Identity Analytics accessible data and ability to cause a partial denial of service (partial DOS) of Oracle Identity Analytics. CVSS Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS V2 Vector: (AV:N/AC:L/Au:N/C:P/I:P/A:P). Oracle Vector: (AV:N/AC:L/Au:N/C:P/I:P+/A:P). Fix has been released CVE-2013-5815 P-8522V-Oracle Identity Analytics 11.1.1.5 P-8522V-Sun Role Manager 4.1 P-8522V-5.0 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P CPUOct2013 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html P-8522V-Oracle Identity Analytics 11.1.1.5 P-8522V-Sun Role Manager 4.1 P-8522V-5.0 Vulnerability in the Oracle GlassFish Server component of Oracle Fusion Middleware (subcomponent: Metro). Supported versions that are affected are 2.1.1, 3.0.1 and 3.1.2. Easily exploitable vulnerability allows successful unauthenticated network attacks via SOAP. Successful attack of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle GlassFish Server. CVSS Base Score 5.0 (Availability impacts). CVSS V2 Vector: (AV:N/AC:L/Au:N/C:N/I:N/A:P). Oracle Vector: (AV:N/AC:L/Au:N/C:N/I:N/A:P). Fix has been released CVE-2013-5816 P-8493V-2.1.1 P-8493V-3.0.1 P-8493V-3.1.2 5.0 AV:N/AC:L/Au:N/C:N/I:N/A:P CPUOct2013 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html P-8493V-2.1.1 P-8493V-3.0.1 P-8493V-3.1.2 Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: JNDI). Supported versions that are affected are Java SE 7u40 and earlier, Java SE 6u60 and earlier, Java SE 5.0u51 and earlier and Java SE Embedded 7u40 and earlier. Easily exploitable vulnerability allows successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability can result in unauthorized Operating System takeover including arbitrary code execution. Note: Applies to client deployment of Java only. This vulnerability can be exploited only through sandboxed Java Web Start applications and sandboxed Java applets. CVSS Base Score 10.0 (Confidentiality, Integrity and Availability impacts). CVSS V2 Vector: (AV:N/AC:L/Au:N/C:C/I:C/A:C). Oracle Vector: (AV:N/AC:L/Au:N/C:C/I:C/A:C). Fix has been released CVE-2013-5817 P-856V-Java SE 7u40 and earlier P-856V-Java SE 6u60 and earlier P-856V-Java SE 5.0u51 and earlier P-856V-Java SE Embedded 7u40 and earlier 10.0 AV:N/AC:L/Au:N/C:C/I:C/A:C CPUOct2013 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html P-856V-Java SE 7u40 and earlier P-856V-Java SE 6u60 and earlier P-856V-Java SE 5.0u51 and earlier P-856V-Java SE Embedded 7u40 and earlier Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Deployment). Supported versions that are affected are Java SE 7u40 and earlier, Java SE 6u60 and earlier and Java SE Embedded 7u40 and earlier. Easily exploitable vulnerability allows successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability can result in unauthorized update, insert or delete access to some Java SE, Java SE Embedded accessible data. Note: Applies to client deployment of Java only. This vulnerability can be exploited only through sandboxed Java Web Start applications and sandboxed Java applets. CVSS Base Score 5.0 (Integrity impacts). CVSS V2 Vector: (AV:N/AC:L/Au:N/C:N/I:P/A:N). Oracle Vector: (AV:N/AC:L/Au:N/C:N/I:P/A:N). Fix has been released CVE-2013-5818 P-856V-Java SE 7u40 and earlier P-856V-Java SE 6u60 and earlier P-856V-Java SE Embedded 7u40 and earlier 5.0 AV:N/AC:L/Au:N/C:N/I:P/A:N CPUOct2013 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html P-856V-Java SE 7u40 and earlier P-856V-Java SE 6u60 and earlier P-856V-Java SE Embedded 7u40 and earlier Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Deployment). Supported versions that are affected are Java SE 7u40 and earlier, Java SE 6u60 and earlier and Java SE Embedded 7u40 and earlier. Easily exploitable vulnerability allows successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability can result in unauthorized update, insert or delete access to some Java SE, Java SE Embedded accessible data. Note: Applies to client deployment of Java only. This vulnerability can be exploited only through sandboxed Java Web Start applications and sandboxed Java applets. CVSS Base Score 5.0 (Integrity impacts). CVSS V2 Vector: (AV:N/AC:L/Au:N/C:N/I:P/A:N). Oracle Vector: (AV:N/AC:L/Au:N/C:N/I:P/A:N). Fix has been released CVE-2013-5819 P-856V-Java SE 7u40 and earlier P-856V-Java SE 6u60 and earlier P-856V-Java SE Embedded 7u40 and earlier 5.0 AV:N/AC:L/Au:N/C:N/I:P/A:N CPUOct2013 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html P-856V-Java SE 7u40 and earlier P-856V-Java SE 6u60 and earlier P-856V-Java SE Embedded 7u40 and earlier Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: JAX-WS). Supported versions that are affected are Java SE 7u40 and earlier, Java SE 6u60 and earlier and Java SE Embedded 7u40 and earlier. Easily exploitable vulnerability allows successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability can result in unauthorized update, insert or delete access to some Java SE, Java SE Embedded accessible data. Note: Applies to client deployment of Java only. This vulnerability can be exploited only through sandboxed Java Web Start applications and sandboxed Java applets. CVSS Base Score 5.0 (Integrity impacts). CVSS V2 Vector: (AV:N/AC:L/Au:N/C:N/I:P/A:N). Oracle Vector: (AV:N/AC:L/Au:N/C:N/I:P/A:N). Fix has been released CVE-2013-5820 P-856V-Java SE 7u40 and earlier P-856V-Java SE 6u60 and earlier P-856V-Java SE Embedded 7u40 and earlier 5.0 AV:N/AC:L/Au:N/C:N/I:P/A:N CPUOct2013 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html P-856V-Java SE 7u40 and earlier P-856V-Java SE 6u60 and earlier P-856V-Java SE Embedded 7u40 and earlier Vulnerability in the Oracle iLearning component of Oracle iLearning (subcomponent: Learner Administration). Supported versions that are affected are 5.2.1 and 6.0. Difficult to exploit vulnerability allows successful unauthenticated network attacks via HTTP. Successful attack of this vulnerability can result in unauthorized update, insert or delete access to some Oracle iLearning accessible data as well as read access to a subset of Oracle iLearning accessible data and ability to cause a partial denial of service (partial DOS) of Oracle iLearning. CVSS Base Score 6.8 (Confidentiality, Integrity and Availability impacts). CVSS V2 Vector: (AV:N/AC:M/Au:N/C:P/I:P/A:P). Oracle Vector: (AV:N/AC:M/Au:N/C:P/I:P/A:P). Fix has been released CVE-2013-5822 P-902V-5.2.1 P-902V-6.0 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P CPUOct2013 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html P-902V-5.2.1 P-902V-6.0 Vulnerability in the Java SE, JRockit, Java SE Embedded component of Oracle Java SE (subcomponent: Security). Supported versions that are affected are Java SE 7u40 and earlier, Java SE 6u60 and earlier, JRockit R28.2.8 and earlier, JRockit R27.7.6 and earlier and Java SE Embedded 7u40 and earlier. Easily exploitable vulnerability allows successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, JRockit, Java SE Embedded. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS Base Score 5.0 (Availability impacts). CVSS V2 Vector: (AV:N/AC:L/Au:N/C:N/I:N/A:P). Oracle Vector: (AV:N/AC:L/Au:N/C:N/I:N/A:P). Fix has been released CVE-2013-5823 P-856V-Java SE 7u40 and earlier P-856V-Java SE 6u60 and earlier P-856V-JRockit R28.2.8 and earlier P-856V-JRockit R27.7.6 and earlier P-856V-Java SE Embedded 7u40 and earlier 5.0 AV:N/AC:L/Au:N/C:N/I:N/A:P CPUOct2013 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html P-856V-Java SE 7u40 and earlier P-856V-Java SE 6u60 and earlier P-856V-JRockit R28.2.8 and earlier P-856V-JRockit R27.7.6 and earlier P-856V-Java SE Embedded 7u40 and earlier Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Deployment). Supported versions that are affected are Java SE 7u40 and earlier, Java SE 6u60 and earlier and Java SE Embedded 7u40 and earlier. Easily exploitable vulnerability allows successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability can result in unauthorized Operating System takeover including arbitrary code execution. Note: Applies to client deployment of Java only. This vulnerability can be exploited only through sandboxed Java Web Start applications and sandboxed Java applets. CVSS Base Score 10.0 (Confidentiality, Integrity and Availability impacts). CVSS V2 Vector: (AV:N/AC:L/Au:N/C:C/I:C/A:C). Oracle Vector: (AV:N/AC:L/Au:N/C:C/I:C/A:C). Fix has been released CVE-2013-5824 P-856V-Java SE 7u40 and earlier P-856V-Java SE 6u60 and earlier P-856V-Java SE Embedded 7u40 and earlier 10.0 AV:N/AC:L/Au:N/C:C/I:C/A:C CPUOct2013 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html P-856V-Java SE 7u40 and earlier P-856V-Java SE 6u60 and earlier P-856V-Java SE Embedded 7u40 and earlier Vulnerability in the Java SE, JRockit, Java SE Embedded component of Oracle Java SE (subcomponent: JAXP). Supported versions that are affected are Java SE 7u40 and earlier, Java SE 6u60 and earlier, Java SE 5.0u51 and earlier, JRockit R28.2.8 and earlier, JRockit R27.7.6 and earlier and Java SE Embedded 7u40 and earlier. Easily exploitable vulnerability allows successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, JRockit, Java SE Embedded. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS Base Score 5.0 (Availability impacts). CVSS V2 Vector: (AV:N/AC:L/Au:N/C:N/I:N/A:P). Oracle Vector: (AV:N/AC:L/Au:N/C:N/I:N/A:P). Fix has been released CVE-2013-5825 P-856V-Java SE 7u40 and earlier P-856V-Java SE 6u60 and earlier P-856V-Java SE 5.0u51 and earlier P-856V-JRockit R28.2.8 and earlier P-856V-JRockit R27.7.6 and earlier P-856V-Java SE Embedded 7u40 and earlier 5.0 AV:N/AC:L/Au:N/C:N/I:N/A:P CPUOct2013 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html P-856V-Java SE 7u40 and earlier P-856V-Java SE 6u60 and earlier P-856V-Java SE 5.0u51 and earlier P-856V-JRockit R28.2.8 and earlier P-856V-JRockit R27.7.6 and earlier P-856V-Java SE Embedded 7u40 and earlier Vulnerability in the Oracle Transportation Management component of Oracle Supply Chain Products Suite (subcomponent: Install / Installation). Supported versions that are affected are 6.3 and 6.3.1. Easily exploitable vulnerability allows successful unauthenticated network attacks via HTTP. Successful attack of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Transportation Management. CVSS Base Score 5.0 (Availability impacts). CVSS V2 Vector: (AV:N/AC:L/Au:N/C:N/I:N/A:P). Oracle Vector: (AV:N/AC:L/Au:N/C:N/I:N/A:P). Fix has been released CVE-2013-5826 P-1991V-6.3 P-1991V-6.3.1 5.0 AV:N/AC:L/Au:N/C:N/I:N/A:P CPUOct2013 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html P-1991V-6.3 P-1991V-6.3.1 Vulnerability in the Enterprise Manager Base Platform component of Oracle Enterprise Manager Grid Control (subcomponent: Storage Management). Supported versions that are affected are EM Base Platform: 10.2.0.5, 11.1.0.1<br/> EM DB Control: 11.1.0.7, 11.2.0.2 and 11.2.0.3<br/> EM Plugin for DB: 12.1.0.2. Difficult to exploit vulnerability allows successful unauthenticated network attacks via HTTP. Successful attack of this vulnerability can result in unauthorized update, insert or delete access to all Enterprise Manager Base Platform accessible data. CVSS Base Score 4.3 (Integrity impacts). CVSS V2 Vector: (AV:N/AC:M/Au:N/C:N/I:P/A:N). Oracle Vector: (AV:N/AC:M/Au:N/C:N/I:P+/A:N). Fix has been released CVE-2013-5827 P-1366V-EM Base Platform: 10.2.0.5 P-1366V-11.1.0.1EM DB Control: 11.1.0.7 P-1366V-11.2.0.2 P-1366V-11.2.0.3EM Plugin for DB: 12.1.0.2 4.3 AV:N/AC:M/Au:N/C:N/I:P/A:N CPUOct2013 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html P-1366V-EM Base Platform: 10.2.0.5 P-1366V-11.1.0.1EM DB Control: 11.1.0.7 P-1366V-11.2.0.2 P-1366V-11.2.0.3EM Plugin for DB: 12.1.0.2 Vulnerability in the Enterprise Manager Base Platform component of Oracle Enterprise Manager Grid Control (subcomponent: Storage Management). Supported versions that are affected are EM Base Platform: 10.2.0.5, 11.1.0.1<br/>EM DB Control: 11.1.0.7, 11.2.0.2, 11.2.0.3<br/>EM Plugin for DB: 12.1.0.2 and 12.1.0.3. Difficult to exploit vulnerability allows successful unauthenticated network attacks via HTTP. Successful attack of this vulnerability can result in unauthorized update, insert or delete access to all Enterprise Manager Base Platform accessible data. CVSS Base Score 4.3 (Integrity impacts). CVSS V2 Vector: (AV:N/AC:M/Au:N/C:N/I:P/A:N). Oracle Vector: (AV:N/AC:M/Au:N/C:N/I:P+/A:N). Fix has been released CVE-2013-5828 P-1366V-EM Base Platform: 10.2.0.5 P-1366V-11.1.0.1EM DB Control: 11.1.0.7 P-1366V-11.2.0.2 P-1366V-11.2.0.3EM Plugin for DB: 12.1.0.2 P-1366V-12.1.0.3 4.3 AV:N/AC:M/Au:N/C:N/I:P/A:N CPUOct2013 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html P-1366V-EM Base Platform: 10.2.0.5 P-1366V-11.1.0.1EM DB Control: 11.1.0.7 P-1366V-11.2.0.2 P-1366V-11.2.0.3EM Plugin for DB: 12.1.0.2 P-1366V-12.1.0.3 Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: 2D). Supported versions that are affected are Java SE 7u40 and earlier, Java SE 6u60 and earlier, Java SE 5.0u51 and earlier and Java SE Embedded 7u40 and earlier. Easily exploitable vulnerability allows successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability can result in unauthorized Operating System takeover including arbitrary code execution. Note: Applies to client deployment of Java only. This vulnerability can be exploited only through sandboxed Java Web Start applications and sandboxed Java applets. CVSS Base Score 10.0 (Confidentiality, Integrity and Availability impacts). CVSS V2 Vector: (AV:N/AC:L/Au:N/C:C/I:C/A:C). Oracle Vector: (AV:N/AC:L/Au:N/C:C/I:C/A:C). Fix has been released CVE-2013-5829 P-856V-Java SE 7u40 and earlier P-856V-Java SE 6u60 and earlier P-856V-Java SE 5.0u51 and earlier P-856V-Java SE Embedded 7u40 and earlier 10.0 AV:N/AC:L/Au:N/C:C/I:C/A:C CPUOct2013 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html P-856V-Java SE 7u40 and earlier P-856V-Java SE 6u60 and earlier P-856V-Java SE 5.0u51 and earlier P-856V-Java SE Embedded 7u40 and earlier Vulnerability in the Java SE, JRockit, Java SE Embedded component of Oracle Java SE (subcomponent: Libraries). Supported versions that are affected are Java SE 7u40 and earlier, Java SE 6u60 and earlier, Java SE 5.0u51 and earlier, JRockit R28.2.8 and earlier, JRockit R27.7.6 and earlier and Java SE Embedded 7u40 and earlier. Easily exploitable vulnerability allows successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability can result in unauthorized Operating System takeover including arbitrary code execution. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS Base Score 10.0 (Confidentiality, Integrity and Availability impacts). CVSS V2 Vector: (AV:N/AC:L/Au:N/C:C/I:C/A:C). Oracle Vector: (AV:N/AC:L/Au:N/C:C/I:C/A:C). Fix has been released CVE-2013-5830 P-856V-Java SE 7u40 and earlier P-856V-Java SE 6u60 and earlier P-856V-Java SE 5.0u51 and earlier P-856V-JRockit R28.2.8 and earlier P-856V-JRockit R27.7.6 and earlier P-856V-Java SE Embedded 7u40 and earlier 10.0 AV:N/AC:L/Au:N/C:C/I:C/A:C CPUOct2013 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html P-856V-Java SE 7u40 and earlier P-856V-Java SE 6u60 and earlier P-856V-Java SE 5.0u51 and earlier P-856V-JRockit R28.2.8 and earlier P-856V-JRockit R27.7.6 and earlier P-856V-Java SE Embedded 7u40 and earlier Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Deployment). Supported versions that are affected are Java SE 7u40 and earlier, Java SE 6u60 and earlier and Java SE Embedded 7u40 and earlier. Easily exploitable vulnerability allows successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability can result in unauthorized update, insert or delete access to some Java SE, Java SE Embedded accessible data. Note: Applies to client deployment of Java only. This vulnerability can be exploited only through sandboxed Java Web Start applications and sandboxed Java applets. CVSS Base Score 5.0 (Integrity impacts). CVSS V2 Vector: (AV:N/AC:L/Au:N/C:N/I:P/A:N). Oracle Vector: (AV:N/AC:L/Au:N/C:N/I:P/A:N). Fix has been released CVE-2013-5831 P-856V-Java SE 7u40 and earlier P-856V-Java SE 6u60 and earlier P-856V-Java SE Embedded 7u40 and earlier 5.0 AV:N/AC:L/Au:N/C:N/I:P/A:N CPUOct2013 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html P-856V-Java SE 7u40 and earlier P-856V-Java SE 6u60 and earlier P-856V-Java SE Embedded 7u40 and earlier Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Deployment). Supported versions that are affected are Java SE 7u40 and earlier, Java SE 6u60 and earlier and Java SE Embedded 7u40 and earlier. Difficult to exploit vulnerability allows successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability can result in unauthorized Operating System takeover including arbitrary code execution. Note: Applies to client deployment of Java only. This vulnerability can be exploited only through sandboxed Java Web Start applications and sandboxed Java applets. CVSS Base Score 9.3 (Confidentiality, Integrity and Availability impacts). CVSS V2 Vector: (AV:N/AC:M/Au:N/C:C/I:C/A:C). Oracle Vector: (AV:N/AC:M/Au:N/C:C/I:C/A:C). Fix has been released CVE-2013-5832 P-856V-Java SE 7u40 and earlier P-856V-Java SE 6u60 and earlier P-856V-Java SE Embedded 7u40 and earlier 9.3 AV:N/AC:M/Au:N/C:C/I:C/A:C CPUOct2013 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html P-856V-Java SE 7u40 and earlier P-856V-Java SE 6u60 and earlier P-856V-Java SE Embedded 7u40 and earlier Vulnerability in the Siebel UI Framework component of Oracle Siebel CRM (subcomponent: Open_UI). Supported versions that are affected are 8.1.1 and 8.2.2. Difficult to exploit vulnerability allows successful unauthenticated network attacks via HTTP. Successful attack of this vulnerability can result in unauthorized update, insert or delete access to some Siebel UI Framework accessible data as well as read access to a subset of Siebel UI Framework accessible data and ability to cause a partial denial of service (partial DOS) of Siebel UI Framework. CVSS Base Score 6.8 (Confidentiality, Integrity and Availability impacts). CVSS V2 Vector: (AV:N/AC:M/Au:N/C:P/I:P/A:P). Oracle Vector: (AV:N/AC:M/Au:N/C:P/I:P/A:P). Fix has been released CVE-2013-5835 P-9011V-8.1.1 P-9011V-8.2.2 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P CPUOct2013 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html P-9011V-8.1.1 P-9011V-8.2.2 Vulnerability in the PeopleSoft Enterprise PeopleTools component of Oracle PeopleSoft Products (subcomponent: Business Interlink). Supported versions that are affected are 8.51, 8.52 and 8.53. Easily exploitable vulnerability allows successful unauthenticated network attacks via HTTP. Successful attack of this vulnerability can result in unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data. CVSS Base Score 5.0 (Confidentiality impacts). CVSS V2 Vector: (AV:N/AC:L/Au:N/C:P/I:N/A:N). Oracle Vector: (AV:N/AC:L/Au:N/C:P/I:N/A:N). Fix has been released CVE-2013-5836 P-5085V-8.51 P-5085V-8.52 P-5085V-8.53 5.0 AV:N/AC:L/Au:N/C:P/I:N/A:N CPUOct2013 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html P-5085V-8.51 P-5085V-8.52 P-5085V-8.53 Vulnerability in the Oracle Health Sciences InForm component of Oracle Industry Applications (subcomponent: Cognos). Supported versions that are affected are 4.6 SP0, 4.6 SP0a-c, 4.6 SP1, 4.6 SP1a-c, 4.6 SP2, 4.6 SP2a-c, 5.0 SP0, 5.0 SP0a, 5.0 SP1, 5.0 SP1a-b, 5.0.3 and 5.0.4. Very difficult to exploit vulnerability allows successful authenticated network attacks via None. Successful attack of this vulnerability can result in unauthorized read access to all Oracle Health Sciences InForm accessible data. CVSS Base Score 2.1 (Confidentiality impacts). CVSS V2 Vector: (AV:N/AC:H/Au:S/C:P/I:N/A:N). Oracle Vector: (AV:N/AC:H/Au:S/C:P+/I:N/A:N). Fix has been released CVE-2013-5837 P-9132V-4.6 SP0 P-9132V-4.6 SP0a-c P-9132V-4.6 SP1 P-9132V-4.6 SP1a-c P-9132V-4.6 SP2 P-9132V-4.6 SP2a-c P-9132V-5.0 SP0 P-9132V-5.0 SP0a P-9132V-5.0 SP1 P-9132V-5.0 SP1a-b P-9132V-5.0.3 P-9132V-5.0.4 2.1 AV:N/AC:H/Au:S/C:P/I:N/A:N CPUOct2013 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html P-9132V-4.6 SP0 P-9132V-4.6 SP0a-c P-9132V-4.6 SP1 P-9132V-4.6 SP1a-c P-9132V-4.6 SP2 P-9132V-4.6 SP2a-c P-9132V-5.0 SP0 P-9132V-5.0 SP0a P-9132V-5.0 SP1 P-9132V-5.0 SP1a-b P-9132V-5.0.3 P-9132V-5.0.4 Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Libraries). Supported versions that are affected are Java SE 7u25 and earlier and Java SE Embedded 7u25 and earlier. Difficult to exploit vulnerability allows successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability can result in unauthorized Operating System takeover including arbitrary code execution. Note: Applies to client deployment of Java only. This vulnerability can be exploited only through sandboxed Java Web Start applications and sandboxed Java applets. CVSS Base Score 9.3 (Confidentiality, Integrity and Availability impacts). CVSS V2 Vector: (AV:N/AC:M/Au:N/C:C/I:C/A:C). Oracle Vector: (AV:N/AC:M/Au:N/C:C/I:C/A:C). Fix has been released CVE-2013-5838 P-856V-Java SE 7u25 and earlier P-856V-Java SE Embedded 7u25 and earlier 9.3 AV:N/AC:M/Au:N/C:C/I:C/A:C CPUOct2013 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html P-856V-Java SE 7u25 and earlier P-856V-Java SE Embedded 7u25 and earlier Vulnerability in the Solaris component of Oracle and Sun Systems Products Suite (subcomponent: Oracle Java Web Console). The supported version that is affected is 10. Difficult to exploit vulnerability allows successful unauthenticated network attacks via HTTP. Successful attack of this vulnerability can result in unauthorized update, insert or delete access to some Solaris accessible data. CVSS Base Score 4.3 (Integrity impacts). CVSS V2 Vector: (AV:N/AC:M/Au:N/C:N/I:P/A:N). Oracle Vector: (AV:N/AC:M/Au:N/C:N/I:P/A:N). Fix has been released CVE-2013-5839 P-10006V-10 4.3 AV:N/AC:M/Au:N/C:N/I:P/A:N CPUOct2013 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html P-10006V-10 Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Libraries). Supported versions that are affected are Java SE 7u40 and earlier, Java SE 6u60 and earlier, Java SE 5.0u51 and earlier and Java SE Embedded 7u40 and earlier. Easily exploitable vulnerability allows successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability can result in unauthorized read access to a subset of Java SE, Java SE Embedded accessible data. Note: Applies to client deployment of Java only. This vulnerability can be exploited only through sandboxed Java Web Start applications and sandboxed Java applets. CVSS Base Score 5.0 (Confidentiality impacts). CVSS V2 Vector: (AV:N/AC:L/Au:N/C:P/I:N/A:N). Oracle Vector: (AV:N/AC:L/Au:N/C:P/I:N/A:N). Fix has been released CVE-2013-5840 P-856V-Java SE 7u40 and earlier P-856V-Java SE 6u60 and earlier P-856V-Java SE 5.0u51 and earlier P-856V-Java SE Embedded 7u40 and earlier 5.0 AV:N/AC:L/Au:N/C:P/I:N/A:N CPUOct2013 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html P-856V-Java SE 7u40 and earlier P-856V-Java SE 6u60 and earlier P-856V-Java SE 5.0u51 and earlier P-856V-Java SE Embedded 7u40 and earlier Vulnerability in the PeopleSoft Enterprise PeopleTools component of Oracle PeopleSoft Products (subcomponent: Portal). Supported versions that are affected are 8.51, 8.52 and 8.53. Easily exploitable vulnerability allows successful unauthenticated network attacks via HTTP. Successful attack of this vulnerability can result in unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data. CVSS Base Score 5.0 (Confidentiality impacts). CVSS V2 Vector: (AV:N/AC:L/Au:N/C:P/I:N/A:N). Oracle Vector: (AV:N/AC:L/Au:N/C:P/I:N/A:N). Fix has been released CVE-2013-5841 P-5085V-8.51 P-5085V-8.52 P-5085V-8.53 5.0 AV:N/AC:L/Au:N/C:P/I:N/A:N CPUOct2013 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html P-5085V-8.51 P-5085V-8.52 P-5085V-8.53 Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Libraries). Supported versions that are affected are Java SE 7u40 and earlier, Java SE 6u60 and earlier, Java SE 5.0u51 and earlier and Java SE Embedded 7u40 and earlier. Easily exploitable vulnerability allows successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability can result in unauthorized Operating System takeover including arbitrary code execution. Note: Applies to client deployment of Java only. This vulnerability can be exploited only through sandboxed Java Web Start applications and sandboxed Java applets. CVSS Base Score 10.0 (Confidentiality, Integrity and Availability impacts). CVSS V2 Vector: (AV:N/AC:L/Au:N/C:C/I:C/A:C). Oracle Vector: (AV:N/AC:L/Au:N/C:C/I:C/A:C). Fix has been released CVE-2013-5842 P-856V-Java SE 7u40 and earlier P-856V-Java SE 6u60 and earlier P-856V-Java SE 5.0u51 and earlier P-856V-Java SE Embedded 7u40 and earlier 10.0 AV:N/AC:L/Au:N/C:C/I:C/A:C CPUOct2013 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html P-856V-Java SE 7u40 and earlier P-856V-Java SE 6u60 and earlier P-856V-Java SE 5.0u51 and earlier P-856V-Java SE Embedded 7u40 and earlier Vulnerability in the Java SE, JavaFX, Java SE Embedded component of Oracle Java SE (subcomponent: 2D). Supported versions that are affected are Java SE 7u40 and earlier, Java SE 6u60 and earlier, Java SE 5.0u51 and earlier, JavaFX 2.2.40 and earlier and Java SE Embedded 7u40 and earlier. Easily exploitable vulnerability allows successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability can result in unauthorized Operating System takeover including arbitrary code execution. Note: Applies to client deployment of Java only. This vulnerability can be exploited only through sandboxed Java Web Start applications and sandboxed Java applets. CVSS Base Score 10.0 (Confidentiality, Integrity and Availability impacts). CVSS V2 Vector: (AV:N/AC:L/Au:N/C:C/I:C/A:C). Oracle Vector: (AV:N/AC:L/Au:N/C:C/I:C/A:C). Fix has been released CVE-2013-5843 P-856V-Java SE 7u40 and earlier P-856V-Java SE 6u60 and earlier P-856V-Java SE 5.0u51 and earlier P-856V-JavaFX 2.2.40 and earlier P-856V-Java SE Embedded 7u40 and earlier 10.0 AV:N/AC:L/Au:N/C:C/I:C/A:C CPUOct2013 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html P-856V-Java SE 7u40 and earlier P-856V-Java SE 6u60 and earlier P-856V-Java SE 5.0u51 and earlier P-856V-JavaFX 2.2.40 and earlier P-856V-Java SE Embedded 7u40 and earlier Vulnerability in the Java SE, JavaFX component of Oracle Java SE (subcomponent: JavaFX). Supported versions that are affected are Java SE 7u40 and earlier and JavaFX 2.2.40 and earlier. Difficult to exploit vulnerability allows successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability can result in unauthorized Operating System takeover including arbitrary code execution. Note: Applies to client deployment of Java only. This vulnerability can be exploited only through sandboxed Java Web Start applications and sandboxed Java applets. CVSS Base Score 9.3 (Confidentiality, Integrity and Availability impacts). CVSS V2 Vector: (AV:N/AC:M/Au:N/C:C/I:C/A:C). Oracle Vector: (AV:N/AC:M/Au:N/C:C/I:C/A:C). Fix has been released CVE-2013-5844 P-856V-Java SE 7u40 and earlier P-856V-JavaFX 2.2.40 and earlier 9.3 AV:N/AC:M/Au:N/C:C/I:C/A:C CPUOct2013 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html P-856V-Java SE 7u40 and earlier P-856V-JavaFX 2.2.40 and earlier Vulnerability in the Oracle iLearning component of Oracle iLearning (subcomponent: Learner Administration). Supported versions that are affected are 5.2.1 and 6.0. Difficult to exploit vulnerability allows successful unauthenticated network attacks via HTTP. Successful attack of this vulnerability can result in unauthorized update, insert or delete access to some Oracle iLearning accessible data. CVSS Base Score 4.3 (Integrity impacts). CVSS V2 Vector: (AV:N/AC:M/Au:N/C:N/I:P/A:N). Oracle Vector: (AV:N/AC:M/Au:N/C:N/I:P/A:N). Fix has been released CVE-2013-5845 P-902V-5.2.1 P-902V-6.0 4.3 AV:N/AC:M/Au:N/C:N/I:P/A:N CPUOct2013 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html P-902V-5.2.1 P-902V-6.0 Vulnerability in the Java SE, JavaFX component of Oracle Java SE (subcomponent: JavaFX). Supported versions that are affected are Java SE 7u40 and earlier and JavaFX 2.2.40 and earlier. Difficult to exploit vulnerability allows successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability can result in unauthorized Operating System takeover including arbitrary code execution. Note: Applies to client deployment of Java only. This vulnerability can be exploited only through sandboxed Java Web Start applications and sandboxed Java applets. CVSS Base Score 9.3 (Confidentiality, Integrity and Availability impacts). CVSS V2 Vector: (AV:N/AC:M/Au:N/C:C/I:C/A:C). Oracle Vector: (AV:N/AC:M/Au:N/C:C/I:C/A:C). Fix has been released CVE-2013-5846 P-856V-Java SE 7u40 and earlier P-856V-JavaFX 2.2.40 and earlier 9.3 AV:N/AC:M/Au:N/C:C/I:C/A:C CPUOct2013 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html P-856V-Java SE 7u40 and earlier P-856V-JavaFX 2.2.40 and earlier Vulnerability in the PeopleSoft Enterprise HRMS eCompensation component of Oracle PeopleSoft Products (subcomponent: eCompensation). Supported versions that are affected are 9.1 and 9.2. Easily exploitable vulnerability allows successful authenticated network attacks via HTTP. Successful attack of this vulnerability can result in unauthorized read access to a subset of PeopleSoft Enterprise HRMS eCompensation accessible data. CVSS Base Score 4.0 (Confidentiality impacts). CVSS V2 Vector: (AV:N/AC:L/Au:S/C:P/I:N/A:N). Oracle Vector: (AV:N/AC:L/Au:S/C:P/I:N/A:N). Fix has been released CVE-2013-5847 P-5046V-9.1 P-5046V-9.2 4.0 AV:N/AC:L/Au:S/C:P/I:N/A:N CPUOct2013 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html P-5046V-9.1 P-5046V-9.2 Vulnerability in the Java SE, JavaFX component of Oracle Java SE (subcomponent: Deployment). Supported versions that are affected are Java SE 7u40 and earlier, Java SE 6u60 and earlier and JavaFX 2.2.40 and earlier. Easily exploitable vulnerability allows successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability can result in unauthorized update, insert or delete access to some Java SE, JavaFX accessible data. Note: Applies to client deployment of Java only. This vulnerability can be exploited only through sandboxed Java Web Start applications and sandboxed Java applets. CVSS Base Score 5.0 (Integrity impacts). CVSS V2 Vector: (AV:N/AC:L/Au:N/C:N/I:P/A:N). Oracle Vector: (AV:N/AC:L/Au:N/C:N/I:P/A:N). Fix has been released CVE-2013-5848 P-856V-Java SE 7u40 and earlier P-856V-Java SE 6u60 and earlier P-856V-JavaFX 2.2.40 and earlier 5.0 AV:N/AC:L/Au:N/C:N/I:P/A:N CPUOct2013 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html P-856V-Java SE 7u40 and earlier P-856V-Java SE 6u60 and earlier P-856V-JavaFX 2.2.40 and earlier Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: AWT). Supported versions that are affected are Java SE 7u40 and earlier, Java SE 6u60 and earlier, Java SE 5.0u51 and earlier and Java SE Embedded 7u40 and earlier. Difficult to exploit vulnerability allows successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability can result in unauthorized read access to a subset of Java SE, Java SE Embedded accessible data. Note: Applies to client deployment of Java only. This vulnerability can be exploited only through sandboxed Java Web Start applications and sandboxed Java applets. CVSS Base Score 4.3 (Confidentiality impacts). CVSS V2 Vector: (AV:N/AC:M/Au:N/C:P/I:N/A:N). Oracle Vector: (AV:N/AC:M/Au:N/C:P/I:N/A:N). Fix has been released CVE-2013-5849 P-856V-Java SE 7u40 and earlier P-856V-Java SE 6u60 and earlier P-856V-Java SE 5.0u51 and earlier P-856V-Java SE Embedded 7u40 and earlier 4.3 AV:N/AC:M/Au:N/C:P/I:N/A:N CPUOct2013 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html P-856V-Java SE 7u40 and earlier P-856V-Java SE 6u60 and earlier P-856V-Java SE 5.0u51 and earlier P-856V-Java SE Embedded 7u40 and earlier Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Libraries). Supported versions that are affected are Java SE 7u40 and earlier, Java SE 6u60 and earlier, Java SE 5.0u51 and earlier and Java SE Embedded 7u40 and earlier. Difficult to exploit vulnerability allows successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability can result in unauthorized Operating System takeover including arbitrary code execution. Note: Applies to client deployment of Java only. This vulnerability can be exploited only through sandboxed Java Web Start applications and sandboxed Java applets. CVSS Base Score 9.3 (Confidentiality, Integrity and Availability impacts). CVSS V2 Vector: (AV:N/AC:M/Au:N/C:C/I:C/A:C). Oracle Vector: (AV:N/AC:M/Au:N/C:C/I:C/A:C). Fix has been released CVE-2013-5850 P-856V-Java SE 7u40 and earlier P-856V-Java SE 6u60 and earlier P-856V-Java SE 5.0u51 and earlier P-856V-Java SE Embedded 7u40 and earlier 9.3 AV:N/AC:M/Au:N/C:C/I:C/A:C CPUOct2013 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html P-856V-Java SE 7u40 and earlier P-856V-Java SE 6u60 and earlier P-856V-Java SE 5.0u51 and earlier P-856V-Java SE Embedded 7u40 and earlier Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: JAXP). Supported versions that are affected are Java SE 7u40 and earlier and Java SE Embedded 7u40 and earlier. Easily exploitable vulnerability allows successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability can result in unauthorized read access to a subset of Java SE, Java SE Embedded accessible data. Note: Applies to client deployment of Java only. This vulnerability can be exploited only through sandboxed Java Web Start applications and sandboxed Java applets. CVSS Base Score 5.0 (Confidentiality impacts). CVSS V2 Vector: (AV:N/AC:L/Au:N/C:P/I:N/A:N). Oracle Vector: (AV:N/AC:L/Au:N/C:P/I:N/A:N). Fix has been released CVE-2013-5851 P-856V-Java SE 7u40 and earlier P-856V-Java SE Embedded 7u40 and earlier 5.0 AV:N/AC:L/Au:N/C:P/I:N/A:N CPUOct2013 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html P-856V-Java SE 7u40 and earlier P-856V-Java SE Embedded 7u40 and earlier Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Deployment). Supported versions that are affected are Java SE 7u40 and earlier, Java SE 6u60 and earlier and Java SE Embedded 7u40 and earlier. Very difficult to exploit vulnerability allows successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability can result in unauthorized Operating System takeover including arbitrary code execution. Note: Applies to installation process on client deployment of Java. CVSS Base Score 7.6 (Confidentiality, Integrity and Availability impacts). CVSS V2 Vector: (AV:N/AC:H/Au:N/C:C/I:C/A:C). Oracle Vector: (AV:N/AC:H/Au:N/C:C/I:C/A:C). Fix has been released CVE-2013-5852 P-856V-Java SE 7u40 and earlier P-856V-Java SE 6u60 and earlier P-856V-Java SE Embedded 7u40 and earlier 7.6 AV:N/AC:H/Au:N/C:C/I:C/A:C CPUOct2013 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html P-856V-Java SE 7u40 and earlier P-856V-Java SE 6u60 and earlier P-856V-Java SE Embedded 7u40 and earlier Vulnerability in the Java SE, JavaFX component of Oracle Java SE (subcomponent: JavaFX). Supported versions that are affected are Java SE 7u40 and earlier and JavaFX 2.2.40 and earlier. Very difficult to exploit vulnerability allows successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability can result in unauthorized read access to a subset of Java SE, JavaFX accessible data. Note: Applies to client deployment of Java only. This vulnerability can be exploited only through sandboxed Java Web Start applications and sandboxed Java applets. CVSS Base Score 2.6 (Confidentiality impacts). CVSS V2 Vector: (AV:N/AC:H/Au:N/C:P/I:N/A:N). Oracle Vector: (AV:N/AC:H/Au:N/C:P/I:N/A:N). Fix has been released CVE-2013-5854 P-856V-Java SE 7u40 and earlier P-856V-JavaFX 2.2.40 and earlier 2.6 AV:N/AC:H/Au:N/C:P/I:N/A:N CPUOct2013 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html P-856V-Java SE 7u40 and earlier P-856V-JavaFX 2.2.40 and earlier Vulnerability in the Oracle Health Sciences InForm component of Oracle Industry Applications (subcomponent: Web). Supported versions that are affected are 4.5 SP3, 4.5 SP3a-k, 4.6 SP0, 4.6 SP0a-c, 4.6 SP1, 4.6 SP1a-c, 4.6 SP2, 4.6 SP2a-c, 5.0 SP0, 5.0 SP0a, 5.0 SP1, 5.0 SP1a-b, 5.5 SP0, 5.5 SP0b, 5.5.1 and 6.0.0. Very difficult to exploit vulnerability allows successful authenticated network attacks via HTTP. Successful attack of this vulnerability can result in unauthorized update, insert or delete access to some Oracle Health Sciences InForm accessible data as well as read access to a subset of Oracle Health Sciences InForm accessible data. CVSS Base Score 3.6 (Confidentiality and Integrity impacts). CVSS V2 Vector: (AV:N/AC:H/Au:S/C:P/I:P/A:N). Oracle Vector: (AV:N/AC:H/Au:S/C:P/I:P/A:N). Fix has been released CVE-2013-5856 P-9132V-4.5 SP3 P-9132V-4.5 SP3a-k P-9132V-4.6 SP0 P-9132V-4.6 SP0a-c P-9132V-4.6 SP1 P-9132V-4.6 SP1a-c P-9132V-4.6 SP2 P-9132V-4.6 SP2a-c P-9132V-5.0 SP0 P-9132V-5.0 SP0a P-9132V-5.0 SP1 P-9132V-5.0 SP1a-b P-9132V-5.5 SP0 P-9132V-5.5 SP0b P-9132V-5.5.1 P-9132V-6.0.0 3.6 AV:N/AC:H/Au:S/C:P/I:P/A:N CPUOct2013 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html P-9132V-4.5 SP3 P-9132V-4.5 SP3a-k P-9132V-4.6 SP0 P-9132V-4.6 SP0a-c P-9132V-4.6 SP1 P-9132V-4.6 SP1a-c P-9132V-4.6 SP2 P-9132V-4.6 SP2a-c P-9132V-5.0 SP0 P-9132V-5.0 SP0a P-9132V-5.0 SP1 P-9132V-5.0 SP1a-b P-9132V-5.5 SP0 P-9132V-5.5 SP0b P-9132V-5.5.1 P-9132V-6.0.0 Vulnerability in the Oracle Health Sciences InForm component of Oracle Industry Applications (subcomponent: Web). Supported versions that are affected are 4.5 SP3, 4.5 SP3a-k, 4.6 SP0, 4.6 SP0a-c, 4.6 SP1, 4.6 SP1a-c, 4.6 SP2, 4.6 SP2a-c, 5.0 SP0, 5.0 SP0a, 5.0 SP1 and 5.0 SP1a-b. Very difficult to exploit vulnerability allows successful authenticated network attacks via HTTP. Successful attack of this vulnerability can result in unauthorized update, insert or delete access to some Oracle Health Sciences InForm accessible data as well as read access to a subset of Oracle Health Sciences InForm accessible data. CVSS Base Score 3.6 (Confidentiality and Integrity impacts). CVSS V2 Vector: (AV:N/AC:H/Au:S/C:P/I:P/A:N). Oracle Vector: (AV:N/AC:H/Au:S/C:P/I:P/A:N). Fix has been released CVE-2013-5857 P-9132V-4.5 SP3 P-9132V-4.5 SP3a-k P-9132V-4.6 SP0 P-9132V-4.6 SP0a-c P-9132V-4.6 SP1 P-9132V-4.6 SP1a-c P-9132V-4.6 SP2 P-9132V-4.6 SP2a-c P-9132V-5.0 SP0 P-9132V-5.0 SP0a P-9132V-5.0 SP1 P-9132V-5.0 SP1a-b 3.6 AV:N/AC:H/Au:S/C:P/I:P/A:N CPUOct2013 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html P-9132V-4.5 SP3 P-9132V-4.5 SP3a-k P-9132V-4.6 SP0 P-9132V-4.6 SP0a-c P-9132V-4.6 SP1 P-9132V-4.6 SP1a-c P-9132V-4.6 SP2 P-9132V-4.6 SP2a-c P-9132V-5.0 SP0 P-9132V-5.0 SP0a P-9132V-5.0 SP1 P-9132V-5.0 SP1a-b Vulnerability in the Instantis EnterpriseTrack component of Oracle Primavera Products Suite (subcomponent: Instantis EnterpriseTrack). Supported versions that are affected are 8.0.6 and 8.5. Easily exploitable vulnerability allows successful unauthenticated network attacks via HTTP. Successful attack of this vulnerability can result in unauthorized read access to a subset of Instantis EnterpriseTrack accessible data. CVSS Base Score 5.0 (Confidentiality impacts). CVSS V2 Vector: (AV:N/AC:L/Au:N/C:P/I:N/A:N). Oracle Vector: (AV:N/AC:L/Au:N/C:P/I:N/A:N). Fix has been released CVE-2013-5859 P-10563V-8.0.6 P-10563V-8.5 5.0 AV:N/AC:L/Au:N/C:P/I:N/A:N CPUOct2013 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html P-10563V-8.0.6 P-10563V-8.5 Vulnerability in the Solaris component of Oracle and Sun Systems Products Suite (subcomponent: Kernel/KSSL). The supported version that is affected is 11.1. Difficult to exploit vulnerability allows successful unauthenticated network attacks via SSL. Successful attack of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Solaris. CVSS Base Score 4.3 (Availability impacts). CVSS V2 Vector: (AV:N/AC:M/Au:N/C:N/I:N/A:P). Oracle Vector: (AV:N/AC:M/Au:N/C:N/I:N/A:P). Fix has been released CVE-2013-5861 P-10006V-11.1 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P CPUOct2013 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html P-10006V-11.1 Vulnerability in the Solaris component of Oracle and Sun Systems Products Suite (subcomponent: CPU performance counters (CPC) drivers). Supported versions that are affected are 10 and 11.1. Easily exploitable vulnerability requiring logon to Operating System. Successful attack of this vulnerability can result in unauthorized Operating System hang or frequently repeatable crash (complete DOS). CVSS Base Score 4.9 (Availability impacts). CVSS V2 Vector: (AV:L/AC:L/Au:N/C:N/I:N/A:C). Oracle Vector: (AV:L/AC:L/Au:N/C:N/I:N/A:C). Fix has been released CVE-2013-5862 P-10006V-10 P-10006V-11.1 4.9 AV:L/AC:L/Au:N/C:N/I:N/A:C CPUOct2013 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html P-10006V-10 P-10006V-11.1 Vulnerability in the Solaris component of Oracle and Sun Systems Products Suite (subcomponent: IPS repository daemon). The supported version that is affected is 11.1. Difficult to exploit vulnerability allows successful unauthenticated network attacks via HTTP. Successful attack of this vulnerability can result in unauthorized update, insert or delete access to some Solaris accessible data. CVSS Base Score 4.3 (Integrity impacts). CVSS V2 Vector: (AV:N/AC:M/Au:N/C:N/I:P/A:N). Oracle Vector: (AV:N/AC:M/Au:N/C:N/I:P/A:N). Fix has been released CVE-2013-5863 P-10006V-11.1 4.3 AV:N/AC:M/Au:N/C:N/I:P/A:N CPUOct2013 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html P-10006V-11.1 Vulnerability in the Solaris component of Oracle and Sun Systems Products Suite (subcomponent: USB hub driver). Supported versions that are affected are 10 and 11.1. Easily exploitable vulnerability requiring logon to Operating System. Successful attack of this vulnerability can result in unauthorized Operating System hang or frequently repeatable crash (complete DOS). CVSS Base Score 4.9 (Availability impacts). CVSS V2 Vector: (AV:L/AC:L/Au:N/C:N/I:N/A:C). Oracle Vector: (AV:L/AC:L/Au:N/C:N/I:N/A:C). Fix has been released CVE-2013-5864 P-10006V-10 P-10006V-11.1 4.9 AV:L/AC:L/Au:N/C:N/I:N/A:C CPUOct2013 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html P-10006V-10 P-10006V-11.1 Vulnerability in the Solaris component of Oracle and Sun Systems Products Suite (subcomponent: Utility/User administration). The supported version that is affected is 11.1. Easily exploitable vulnerability requiring logon to Operating System plus additional login/authentication to component or subcomponent. Successful attack of this vulnerability can escalate attacker privileges resulting in unauthorized ability to cause a partial denial of service (partial DOS) of Solaris. CVSS Base Score 1.7 (Availability impacts). CVSS V2 Vector: (AV:L/AC:L/Au:S/C:N/I:N/A:P). Oracle Vector: (AV:L/AC:L/Au:S/C:N/I:N/A:P). Fix has been released CVE-2013-5865 P-10006V-11.1 1.7 AV:L/AC:L/Au:S/C:N/I:N/A:P CPUOct2013 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html P-10006V-11.1 Vulnerability in the Solaris component of Oracle and Sun Systems Products Suite (subcomponent: Kernel). The supported version that is affected is 11.1. Very difficult to exploit vulnerability requiring logon to Operating System. Successful attack of this vulnerability can result in unauthorized Operating System hang or frequently repeatable crash (complete DOS) as well as update, insert or delete access to some Solaris accessible data and read access to a subset of Solaris accessible data. CVSS Base Score 5.2 (Confidentiality, Integrity and Availability impacts). CVSS V2 Vector: (AV:L/AC:H/Au:N/C:P/I:P/A:C). Oracle Vector: (AV:L/AC:H/Au:N/C:P/I:P/A:C). Fix has been released CVE-2013-5866 P-10006V-11.1 5.2 AV:L/AC:H/Au:N/C:P/I:P/A:C CPUOct2013 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html P-10006V-11.1 Vulnerability in the Siebel Core - Server Infrastructure component of Oracle Siebel CRM (subcomponent: SISNAPI & Network Infrastructu). Supported versions that are affected are 8.1.1 and 8.2.2. Easily exploitable vulnerability allows successful unauthenticated network attacks via HTTP. Successful attack of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Siebel Core - Server Infrastructure. CVSS Base Score 5.0 (Availability impacts). CVSS V2 Vector: (AV:N/AC:L/Au:N/C:N/I:N/A:P). Oracle Vector: (AV:N/AC:L/Au:N/C:N/I:N/A:P). Fix has been released CVE-2013-5867 P-9004V-8.1.1 P-9004V-8.2.2 5.0 AV:N/AC:L/Au:N/C:N/I:N/A:P CPUOct2013 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html P-9004V-8.1.1 P-9004V-8.2.2