Oracle Critical Patch Update Advisory - April 2014 - Beta Oracle CVRF Oracle Critical Patch Update Advisory CPUApr2014 Final 1.0 1.0 2014-04-15T13:00:00-07:00 Initial Distribution 2014-04-15T13:00:00-07:00 2014-04-15T13:00:00-07:00 This document contains descriptions of Oracle product security vulnerabilities which have had fixes released for all supported versions and platforms for the associated product. Additional information regarding these vulnerabilities including fix distribution information can be found at the Oracle sites referenced in this document. This document is published at: http://www.oracle.com/ocom/groups/public/@otn/documents/webcontent/2188432.xml http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html URL to html version of Advisory Abstergo Industries Abstergo Industries Adam Willard Foreground Security Adi Ivascu Adi Ivascu Amir Sohail Amir Sohail Andrea Micalizzi HP's Zero Day Initiative Andrey Medov Positive Technologies Aniket Singh Aniket Singh Ankit Bharathan Ankit Bharathan Ateeq Khan Ateeq Khan Avik Sarkar Avik Sarkar Ben Khlifa Fahmi Ben Khlifa Fahmi Ben Murphy HP's Zero Day Initiative Christian Galeone Christian Galeone Christopher Meyer Ruhr-University Bochum Deepanker Chawla Deepanker Chawla Gaurav Mishra Gaurav Mishra Gopal Bisht Gopal Bisht Gurjant Singh Sadhra Gurjant Singh Sadhra Ilja van Sprundel ioactive.com James Pearson James Pearson Jerold Camacho Jerold Camacho Jing Wang Jing Wang John Marrett John Marrett Juraj Somorovsky Ruhr-University Bochum Jörg Delker Jörg Delker Ketan Sirigiri Ketan Sirigiri Kevin Stadmeyer for Maarten Van Horenbeeck Google Koutrouss Naddara Kotros Nadara Mazin Ahmed Mazin Ahmed Mikhail Firstov Positive Technologies Mohamed M. Fouad Mohamed M. Fouad Muhammad Talha Khan Muhammad Talha Khan Oliver Gruskovnjak Portcullis Inc Patroklos Argyroudis Census, Inc Rakesh Singh Zero Day Guys Salman Khan Salman Khan Sebastian Neef Internetwache PGP Sergey Bobrov Positive Technologies Shahmeer Baloch Shahmeer Baloch Sherin Panikar Sherin Panikar Simone Memoli Simone Memoli Sky_BlaCk Sky_BlaCk Thamatam Deepak Thamatam Deepak Tibor Jager Ruhr-University Bochum Timo Boettcher RedTeam Pentesting GmbH Timo Warns Timo Warns (DiningPhilosopher) Tomas Hoger Red Hat Tony Trummer Tony Trummer Tor Erling Bjorstad Tor Erling Bjorstad Vitaliy Toropov HP's Zero Day Initiative Yash Kadakia Security Brigade Yuki Chen Trend Micro lokihardt@ASRT HP DVLabs Oracle Database Version 11.1.0.7 Oracle Database Version 11.2.0.3 Oracle Database Version 11.2.0.4 Oracle Database Version 12.1.0.1 Containers for J2EE Version 10.1.3.5 WebCenter Portal Version 11.1.1.7 WebCenter Portal Version 11.1.1.8 COREid Access Version 10.1.4.3 COREid Access Version 11.1.1.3.0 COREid Access Version 11.1.1.5.0 COREid Access Version 11.1.1.7.0 COREid Access Version 11.1.2.0.0 COREid Access Version 11.1.2.1.0 COREid Access Version 11.1.2.2.0 Data Integrator Version 11.1.1.3.0 WebLogic Server Version 10.0.2.0 WebLogic Server Version 10.3.6.0 WebLogic Server Version 12.1.1.0 WebLogic Server Version 12.1.2.0 Event Processing Version 11.1.1.7.0 Access Manager Version 11.1.1.5 OpenSSO Version 3.0-03 OpenSSO Version 8.0 Update 2 Patch 5 Identity Analytics Version Oracle Identity Analytics 11.1.1.5 Identity Analytics Version Sun Role Manager 5.0 Endeca Server Version 2.2.2 Hyperion Common Admin Version 11.1.2.2 Hyperion Common Admin Version 11.1.2.3 Java Version JRockit R27.8.1 Java Version JRockit R28.3.1 Java Version Java SE 5.0u61 Java Version Java SE 6u71 Java Version Java SE 7u51 Java Version Java SE 8 Java Version Java SE Embedded 7u51 Java Version JavaFX 2.2.51 MySQL Server Version 5.5.35 and earlier MySQL Server Version 5.5.36 and earlier MySQL Server Version 5.6.15 and earlier MySQL Server Version 5.6.16 and earlier PeopleSoft Enterprise CS Campus Self Service Version 9.0 PeopleSoft Enterprise HRMS Talent Acquisition Manager Version 9.0 PeopleSoft Enterprise HRMS Talent Acquisition Manager Version 9.1 PeopleSoft Enterprise HRMS Talent Acquisition Manager Version 9.2 PeopleSoft Enterprise PT PeopleTools Version 8.52 PeopleSoft Enterprise PT PeopleTools Version 8.53 Siebel UI Framework Version 8.1.1 Siebel UI Framework Version 8.2.2 Transportation Management Version 5.5.06 Transportation Management Version 6.0 Transportation Management Version 6.1 Transportation Management Version 6.2 Transportation Management Version 6.3 Transportation Management Version 6.3.1 Transportation Management Version 6.3.2 Transportation Management Version 6.3.3 Agile Product Lifecycle Management for Process Version 6.0 Agile Product Lifecycle Management for Process Version 6.1.0 Agile Product Lifecycle Management for Process Version 6.1.0.3 Agile Product Lifecycle Management for Process Version 6.1.1.3 Agile PLM Framework Version 9.3.3 Agile PLM Framework Version 9.3.3.0 Oracle VM VirtualBox Version 4.0.24 Oracle VM VirtualBox Version 4.1.32 Oracle VM VirtualBox Version 4.2.24 Oracle VM VirtualBox Version 4.3.10 Oracle VM VirtualBox Version 4.3.8 Oracle VM VirtualBox Version VirtualBox prior to 3.2.22 Oracle VM VirtualBox Version VirtualBox prior to 4.1.32 Secure Global Desktop Version 4.63 Secure Global Desktop Version 4.71 Secure Global Desktop Version 5.0 Secure Global Desktop Version 5.1 Solaris Operating System Version 10 Solaris Operating System Version 11.1 Solaris Operating System Version 9 iLearning Version 6.0 iLearning Version 6.1 Vulnerability in the Oracle OpenSSO component of Oracle Fusion Middleware (subcomponent: Web Agents). Supported versions that are affected are 3.0-03. Difficult to exploit vulnerability allows successful unauthenticated network attacks via HTTPS. Successful attack of this vulnerability can result in unauthorized read access to a subset of Oracle OpenSSO accessible data. CVSS Base Score 4.3 (Confidentiality impacts). CVSS V2 Vector: (AV:N/AC:M/Au:N/C:P/I:N/A:N). Oracle Vector: (AV:N/AC:M/Au:N/C:P/I:N/A:N). Fix has been released CVE-2013-1620 P-8520V-3.0-03 4.3 AV:N/AC:M/Au:N/C:P/I:N/A:N CPUApr2014 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html P-8520V-3.0-03 Vulnerability in the Oracle Secure Global Desktop (SGD) component of Oracle Virtualization (subcomponent: LibXfont). Supported versions that are affected are 4.63, 4.71, 5.0 and 5.1. Difficult to exploit vulnerability allows successful unauthenticated network attacks via TCP. Successful attack of this vulnerability can result in unauthorized Operating System takeover including arbitrary code execution. CVSS Base Score 9.3 (Confidentiality, Integrity and Availability impacts). CVSS V2 Vector: (AV:N/AC:M/Au:N/C:C/I:C/A:C). Oracle Vector: (AV:N/AC:M/Au:N/C:C/I:C/A:C). Fix has been released CVE-2013-6462 P-8539V-4.63 P-8539V-4.71 P-8539V-5.0 P-8539V-5.1 9.3 AV:N/AC:M/Au:N/C:C/I:C/A:C CPUApr2014 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html P-8539V-4.63 P-8539V-4.71 P-8539V-5.0 P-8539V-5.1 Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: AWT). Supported versions that are affected are Java SE 5.0u61, Java SE 6u71, Java SE 7u51, Java SE 8 and Java SE Embedded 7u51. Easily exploitable vulnerability allows successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability can result in unauthorized read access to a subset of Java SE, Java SE Embedded accessible data. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS Base Score 5.0 (Confidentiality impacts). CVSS V2 Vector: (AV:N/AC:L/Au:N/C:P/I:N/A:N). Oracle Vector: (AV:N/AC:L/Au:N/C:P/I:N/A:N). Fix has been released CVE-2013-6629 P-856V-Java SE 5.0u61 P-856V-Java SE 6u71 P-856V-Java SE 7u51 P-856V-Java SE 8 P-856V-Java SE Embedded 7u51 5.0 AV:N/AC:L/Au:N/C:P/I:N/A:N CPUApr2014 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html P-856V-Java SE 5.0u61 P-856V-Java SE 6u71 P-856V-Java SE 7u51 P-856V-Java SE 8 P-856V-Java SE Embedded 7u51 Vulnerability in the Java SE, JRockit, Java SE Embedded component of Oracle Java SE (subcomponent: AWT). Supported versions that are affected are Java SE 6u71, Java SE 7u51, Java SE 8, JRockit R28.3.1 and Java SE Embedded 7u51. Easily exploitable vulnerability allows successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, JRockit, Java SE Embedded. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS Base Score 5.0 (Availability impacts). CVSS V2 Vector: (AV:N/AC:L/Au:N/C:N/I:N/A:P). Oracle Vector: (AV:N/AC:L/Au:N/C:N/I:N/A:P). Fix has been released CVE-2013-6954 P-856V-Java SE 6u71 P-856V-Java SE 7u51 P-856V-Java SE 8 P-856V-JRockit R28.3.1 P-856V-Java SE Embedded 7u51 5.0 AV:N/AC:L/Au:N/C:N/I:N/A:P CPUApr2014 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html P-856V-Java SE 6u71 P-856V-Java SE 7u51 P-856V-Java SE 8 P-856V-JRockit R28.3.1 P-856V-Java SE Embedded 7u51 Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: XML). Supported versions that are affected are 5.5.35 and earlier and 5.6.15 and earlier. Easily exploitable vulnerability allows successful authenticated network attacks via multiple protocols. Successful attack of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS Base Score 4.0 (Availability impacts). CVSS V2 Vector: (AV:N/AC:L/Au:S/C:N/I:N/A:P). Oracle Vector: (AV:N/AC:L/Au:S/C:N/I:N/A:P+). Fix has been released CVE-2014-0384 P-8478V-5.5.35 and earlier P-8478V-5.6.15 and earlier 4.0 AV:N/AC:L/Au:S/C:N/I:N/A:P CPUApr2014 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html P-8478V-5.5.35 and earlier P-8478V-5.6.15 and earlier Vulnerability in the Oracle Containers for J2EE component of Oracle Fusion Middleware (subcomponent: HTTP Request Handling). The supported version that is affected is 10.1.3.5. Difficult to exploit vulnerability allows successful unauthenticated network attacks via HTTP. Successful attack of this vulnerability can result in unauthorized update, insert or delete access to all Oracle Containers for J2EE accessible data. CVSS Base Score 4.3 (Integrity impacts). CVSS V2 Vector: (AV:N/AC:M/Au:N/C:N/I:P/A:N). Oracle Vector: (AV:N/AC:M/Au:N/C:N/I:P+/A:N). Fix has been released CVE-2014-0413 P-1270V-10.1.3.5 4.3 AV:N/AC:M/Au:N/C:N/I:P/A:N CPUApr2014 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html P-1270V-10.1.3.5 Vulnerability in the Oracle Containers for J2EE component of Oracle Fusion Middleware (subcomponent: HTTP Request Handling). The supported version that is affected is 10.1.3.5. Easily exploitable vulnerability allows successful unauthenticated network attacks via HTTP. Successful attack of this vulnerability can result in unauthorized read access to a subset of Oracle Containers for J2EE accessible data. CVSS Base Score 5.0 (Confidentiality impacts). CVSS V2 Vector: (AV:N/AC:L/Au:N/C:P/I:N/A:N). Oracle Vector: (AV:N/AC:L/Au:N/C:P/I:N/A:N). Fix has been released CVE-2014-0414 P-1270V-10.1.3.5 5.0 AV:N/AC:L/Au:N/C:P/I:N/A:N CPUApr2014 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html P-1270V-10.1.3.5 Vulnerability in the Solaris component of Oracle and Sun Systems Products Suite (subcomponent: SPARC64-X Platform). The supported version that is affected is 10. Easily exploitable vulnerability requiring logon to Operating System. Successful attack of this vulnerability can result in unauthorized update, insert or delete access to some Solaris accessible data as well as read access to a subset of Solaris accessible data and ability to cause a partial denial of service (partial DOS) of Solaris. Note: Applies only when Solaris is running on SPARC64-X platform. CVSS Base Score 4.6 (Confidentiality, Integrity and Availability impacts). CVSS V2 Vector: (AV:L/AC:L/Au:N/C:P/I:P/A:P). Oracle Vector: (AV:L/AC:L/Au:N/C:P/I:P/A:P). Fix has been released CVE-2014-0421 P-10006V-10 4.6 AV:L/AC:L/Au:N/C:P/I:P/A:P CPUApr2014 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html P-10006V-10 Vulnerability in the Oracle Containers for J2EE component of Oracle Fusion Middleware (subcomponent: HTTP Request Handling). The supported version that is affected is 10.1.3.5. Difficult to exploit vulnerability allows successful unauthenticated network attacks via HTTP. Successful attack of this vulnerability can result in unauthorized update, insert or delete access to some Oracle Containers for J2EE accessible data. CVSS Base Score 4.3 (Integrity impacts). CVSS V2 Vector: (AV:N/AC:M/Au:N/C:N/I:P/A:N). Oracle Vector: (AV:N/AC:M/Au:N/C:N/I:P/A:N). Fix has been released CVE-2014-0426 P-1270V-10.1.3.5 4.3 AV:N/AC:M/Au:N/C:N/I:P/A:N CPUApr2014 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html P-1270V-10.1.3.5 Vulnerability in the Java SE, JRockit, Java SE Embedded component of Oracle Java SE (subcomponent: 2D). Supported versions that are affected are Java SE 5.0u61, Java SE 6u71, Java SE 7u51, Java SE 8, JRockit R27.8.1, JRockit R28.3.1 and Java SE Embedded 7u51. Easily exploitable vulnerability allows successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability can result in unauthorized Operating System takeover including arbitrary code execution. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS Base Score 10.0 (Confidentiality, Integrity and Availability impacts). CVSS V2 Vector: (AV:N/AC:L/Au:N/C:C/I:C/A:C). Oracle Vector: (AV:N/AC:L/Au:N/C:C/I:C/A:C). Fix has been released CVE-2014-0429 P-856V-Java SE 5.0u61 P-856V-Java SE 6u71 P-856V-Java SE 7u51 P-856V-Java SE 8 P-856V-JRockit R27.8.1 P-856V-JRockit R28.3.1 P-856V-Java SE Embedded 7u51 10.0 AV:N/AC:L/Au:N/C:C/I:C/A:C CPUApr2014 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html P-856V-Java SE 5.0u61 P-856V-Java SE 6u71 P-856V-Java SE 7u51 P-856V-Java SE 8 P-856V-JRockit R27.8.1 P-856V-JRockit R28.3.1 P-856V-Java SE Embedded 7u51 Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Libraries). Supported versions that are affected are Java SE 7u51, Java SE 8 and Java SE Embedded 7u51. Difficult to exploit vulnerability allows successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability can result in unauthorized Operating System takeover including arbitrary code execution. Note: Applies to client deployment of Java only. This vulnerability can be exploited only through sandboxed Java Web Start applications and sandboxed Java applets. CVSS Base Score 9.3 (Confidentiality, Integrity and Availability impacts). CVSS V2 Vector: (AV:N/AC:M/Au:N/C:C/I:C/A:C). Oracle Vector: (AV:N/AC:M/Au:N/C:C/I:C/A:C). Fix has been released CVE-2014-0432 P-856V-Java SE 7u51 P-856V-Java SE 8 P-856V-Java SE Embedded 7u51 9.3 AV:N/AC:M/Au:N/C:C/I:C/A:C CPUApr2014 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html P-856V-Java SE 7u51 P-856V-Java SE 8 P-856V-Java SE Embedded 7u51 Vulnerability in the Solaris component of Oracle and Sun Systems Products Suite (subcomponent: Print Filter Utility). Supported versions that are affected are 9, 10 and 11.1. Easily exploitable vulnerability requiring logon to Operating System. Successful attack of this vulnerability can result in unauthorized update, insert or delete access to some Solaris accessible data as well as read access to a subset of Solaris accessible data and ability to cause a partial denial of service (partial DOS) of Solaris. CVSS Base Score 4.6 (Confidentiality, Integrity and Availability impacts). CVSS V2 Vector: (AV:L/AC:L/Au:N/C:P/I:P/A:P). Oracle Vector: (AV:L/AC:L/Au:N/C:P/I:P/A:P). Fix has been released CVE-2014-0442 P-10006V-9 P-10006V-10 P-10006V-11.1 4.6 AV:L/AC:L/Au:N/C:P/I:P/A:P CPUApr2014 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html P-10006V-9 P-10006V-10 P-10006V-11.1 Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Libraries). Supported versions that are affected are Java SE 5.0u61, Java SE 6u71, Java SE 7u51, Java SE 8 and Java SE Embedded 7u51. Easily exploitable vulnerability allows successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability can result in unauthorized update, insert or delete access to some Java SE, Java SE Embedded accessible data as well as read access to a subset of Java SE, Java SE Embedded accessible data and ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: Applies to client deployment of Java only. This vulnerability can be exploited only through sandboxed Java Web Start applications and sandboxed Java applets. CVSS Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS V2 Vector: (AV:N/AC:L/Au:N/C:P/I:P/A:P). Oracle Vector: (AV:N/AC:L/Au:N/C:P/I:P/A:P). Fix has been released CVE-2014-0446 P-856V-Java SE 5.0u61 P-856V-Java SE 6u71 P-856V-Java SE 7u51 P-856V-Java SE 8 P-856V-Java SE Embedded 7u51 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P CPUApr2014 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html P-856V-Java SE 5.0u61 P-856V-Java SE 6u71 P-856V-Java SE 7u51 P-856V-Java SE 8 P-856V-Java SE Embedded 7u51 Vulnerability in the Solaris component of Oracle and Sun Systems Products Suite (subcomponent: Kernel). Supported versions that are affected are 10 and 11.1. Easily exploitable vulnerability requiring logon to Operating System. Successful attack of this vulnerability can result in unauthorized Operating System hang or frequently repeatable crash (complete DOS). CVSS Base Score 4.9 (Availability impacts). CVSS V2 Vector: (AV:L/AC:L/Au:N/C:N/I:N/A:C). Oracle Vector: (AV:L/AC:L/Au:N/C:N/I:N/A:C). Fix has been released CVE-2014-0447 P-10006V-10 P-10006V-11.1 4.9 AV:L/AC:L/Au:N/C:N/I:N/A:C CPUApr2014 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html P-10006V-10 P-10006V-11.1 Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Deployment). Supported versions that are affected are Java SE 7u51 and Java SE 8. Very difficult to exploit vulnerability allows successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability can result in unauthorized Operating System takeover including arbitrary code execution. Note: Applies to client deployment of Java only. This vulnerability can be exploited only through sandboxed Java Web Start applications and sandboxed Java applets. CVSS Base Score 7.6 (Confidentiality, Integrity and Availability impacts). CVSS V2 Vector: (AV:N/AC:H/Au:N/C:C/I:C/A:C). Oracle Vector: (AV:N/AC:H/Au:N/C:C/I:C/A:C). Fix has been released CVE-2014-0448 P-856V-Java SE 7u51 P-856V-Java SE 8 7.6 AV:N/AC:H/Au:N/C:C/I:C/A:C CPUApr2014 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html P-856V-Java SE 7u51 P-856V-Java SE 8 Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Deployment). Supported versions that are affected are Java SE 6u71, Java SE 7u51, Java SE 8 and Java SE Embedded 7u51. Easily exploitable vulnerability allows successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability can result in unauthorized read access to a subset of Java SE, Java SE Embedded accessible data. Note: Applies to client deployment of Java only. This vulnerability can be exploited only through sandboxed Java Web Start applications and sandboxed Java applets. CVSS Base Score 5.0 (Confidentiality impacts). CVSS V2 Vector: (AV:N/AC:L/Au:N/C:P/I:N/A:N). Oracle Vector: (AV:N/AC:L/Au:N/C:P/I:N/A:N). Fix has been released CVE-2014-0449 P-856V-Java SE 6u71 P-856V-Java SE 7u51 P-856V-Java SE 8 P-856V-Java SE Embedded 7u51 5.0 AV:N/AC:L/Au:N/C:P/I:N/A:N CPUApr2014 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html P-856V-Java SE 6u71 P-856V-Java SE 7u51 P-856V-Java SE 8 P-856V-Java SE Embedded 7u51 Vulnerability in the Oracle WebCenter Portal component of Oracle Fusion Middleware (subcomponent: People Connection). Supported versions that are affected are 11.1.1.7 and 11.1.1.8. Easily exploitable vulnerability allows successful unauthenticated network attacks via HTTP. Successful attack of this vulnerability can result in unauthorized read access to all Oracle WebCenter Portal accessible data. CVSS Base Score 5.0 (Confidentiality impacts). CVSS V2 Vector: (AV:N/AC:L/Au:N/C:P/I:N/A:N). Oracle Vector: (AV:N/AC:L/Au:N/C:P+/I:N/A:N). Fix has been released CVE-2014-0450 P-1696V-11.1.1.7 P-1696V-11.1.1.8 5.0 AV:N/AC:L/Au:N/C:P/I:N/A:N CPUApr2014 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html P-1696V-11.1.1.7 P-1696V-11.1.1.8 Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: AWT). Supported versions that are affected are Java SE 5.0u61, Java SE 6u71, Java SE 7u51, Java SE 8 and Java SE Embedded 7u51. Easily exploitable vulnerability allows successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability can result in unauthorized update, insert or delete access to some Java SE, Java SE Embedded accessible data as well as read access to a subset of Java SE, Java SE Embedded accessible data and ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: Applies to client deployment of Java only. This vulnerability can be exploited only through sandboxed Java Web Start applications and sandboxed Java applets. CVSS Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS V2 Vector: (AV:N/AC:L/Au:N/C:P/I:P/A:P). Oracle Vector: (AV:N/AC:L/Au:N/C:P/I:P/A:P). Fix has been released CVE-2014-0451 P-856V-Java SE 5.0u61 P-856V-Java SE 6u71 P-856V-Java SE 7u51 P-856V-Java SE 8 P-856V-Java SE Embedded 7u51 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P CPUApr2014 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html P-856V-Java SE 5.0u61 P-856V-Java SE 6u71 P-856V-Java SE 7u51 P-856V-Java SE 8 P-856V-Java SE Embedded 7u51 Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: JAX-WS). Supported versions that are affected are Java SE 6u71, Java SE 7u51, Java SE 8 and Java SE Embedded 7u51. Easily exploitable vulnerability allows successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability can result in unauthorized update, insert or delete access to some Java SE, Java SE Embedded accessible data as well as read access to a subset of Java SE, Java SE Embedded accessible data and ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: Applies to client deployment of Java only. This vulnerability can be exploited only through sandboxed Java Web Start applications and sandboxed Java applets. CVSS Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS V2 Vector: (AV:N/AC:L/Au:N/C:P/I:P/A:P). Oracle Vector: (AV:N/AC:L/Au:N/C:P/I:P/A:P). Fix has been released CVE-2014-0452 P-856V-Java SE 6u71 P-856V-Java SE 7u51 P-856V-Java SE 8 P-856V-Java SE Embedded 7u51 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P CPUApr2014 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html P-856V-Java SE 6u71 P-856V-Java SE 7u51 P-856V-Java SE 8 P-856V-Java SE Embedded 7u51 Vulnerability in the Java SE, JRockit, Java SE Embedded component of Oracle Java SE (subcomponent: Security). Supported versions that are affected are Java SE 5.0u61, Java SE 6u71, Java SE 7u51, Java SE 8, JRockit R27.8.1, JRockit R28.3.1 and Java SE Embedded 7u51. Very difficult to exploit vulnerability allows successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability can result in unauthorized update, insert or delete access to some Java SE, JRockit, Java SE Embedded accessible data as well as read access to a subset of Java SE, JRockit, Java SE Embedded accessible data. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS Base Score 4.0 (Confidentiality and Integrity impacts). CVSS V2 Vector: (AV:N/AC:H/Au:N/C:P/I:P/A:N). Oracle Vector: (AV:N/AC:H/Au:N/C:P/I:P/A:N). Fix has been released CVE-2014-0453 P-856V-Java SE 5.0u61 P-856V-Java SE 6u71 P-856V-Java SE 7u51 P-856V-Java SE 8 P-856V-JRockit R27.8.1 P-856V-JRockit R28.3.1 P-856V-Java SE Embedded 7u51 4.0 AV:N/AC:H/Au:N/C:P/I:P/A:N CPUApr2014 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html P-856V-Java SE 5.0u61 P-856V-Java SE 6u71 P-856V-Java SE 7u51 P-856V-Java SE 8 P-856V-JRockit R27.8.1 P-856V-JRockit R28.3.1 P-856V-Java SE Embedded 7u51 Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Security). Supported versions that are affected are Java SE 7u51, Java SE 8 and Java SE Embedded 7u51. Easily exploitable vulnerability allows successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability can result in unauthorized update, insert or delete access to some Java SE, Java SE Embedded accessible data as well as read access to a subset of Java SE, Java SE Embedded accessible data and ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: Applies to client deployment of Java only. This vulnerability can be exploited only through sandboxed Java Web Start applications and sandboxed Java applets. CVSS Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS V2 Vector: (AV:N/AC:L/Au:N/C:P/I:P/A:P). Oracle Vector: (AV:N/AC:L/Au:N/C:P/I:P/A:P). Fix has been released CVE-2014-0454 P-856V-Java SE 7u51 P-856V-Java SE 8 P-856V-Java SE Embedded 7u51 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P CPUApr2014 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html P-856V-Java SE 7u51 P-856V-Java SE 8 P-856V-Java SE Embedded 7u51 Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Libraries). Supported versions that are affected are Java SE 7u51, Java SE 8 and Java SE Embedded 7u51. Difficult to exploit vulnerability allows successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability can result in unauthorized Operating System takeover including arbitrary code execution. Note: Applies to client deployment of Java only. This vulnerability can be exploited only through sandboxed Java Web Start applications and sandboxed Java applets. CVSS Base Score 9.3 (Confidentiality, Integrity and Availability impacts). CVSS V2 Vector: (AV:N/AC:M/Au:N/C:C/I:C/A:C). Oracle Vector: (AV:N/AC:M/Au:N/C:C/I:C/A:C). Fix has been released CVE-2014-0455 P-856V-Java SE 7u51 P-856V-Java SE 8 P-856V-Java SE Embedded 7u51 9.3 AV:N/AC:M/Au:N/C:C/I:C/A:C CPUApr2014 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html P-856V-Java SE 7u51 P-856V-Java SE 8 P-856V-Java SE Embedded 7u51 Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Hotspot). Supported versions that are affected are Java SE 6u71, Java SE 7u51, Java SE 8 and Java SE Embedded 7u51. Easily exploitable vulnerability allows successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability can result in unauthorized Operating System takeover including arbitrary code execution. Note: Applies to client deployment of Java only. This vulnerability can be exploited only through sandboxed Java Web Start applications and sandboxed Java applets. CVSS Base Score 10.0 (Confidentiality, Integrity and Availability impacts). CVSS V2 Vector: (AV:N/AC:L/Au:N/C:C/I:C/A:C). Oracle Vector: (AV:N/AC:L/Au:N/C:C/I:C/A:C). Fix has been released CVE-2014-0456 P-856V-Java SE 6u71 P-856V-Java SE 7u51 P-856V-Java SE 8 P-856V-Java SE Embedded 7u51 10.0 AV:N/AC:L/Au:N/C:C/I:C/A:C CPUApr2014 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html P-856V-Java SE 6u71 P-856V-Java SE 7u51 P-856V-Java SE 8 P-856V-Java SE Embedded 7u51 Vulnerability in the Java SE, JRockit, Java SE Embedded component of Oracle Java SE (subcomponent: Libraries). Supported versions that are affected are Java SE 5.0u61, Java SE 6u71, Java SE 7u51, Java SE 8, JRockit R27.8.1, JRockit R28.3.1 and Java SE Embedded 7u51. Easily exploitable vulnerability allows successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability can result in unauthorized Operating System takeover including arbitrary code execution. Note: Applies to client deployment of Java only. This vulnerability can be exploited only through sandboxed Java Web Start applications and sandboxed Java applets. CVSS Base Score 10.0 (Confidentiality, Integrity and Availability impacts). CVSS V2 Vector: (AV:N/AC:L/Au:N/C:C/I:C/A:C). Oracle Vector: (AV:N/AC:L/Au:N/C:C/I:C/A:C). Fix has been released CVE-2014-0457 P-856V-Java SE 5.0u61 P-856V-Java SE 6u71 P-856V-Java SE 7u51 P-856V-Java SE 8 P-856V-JRockit R27.8.1 P-856V-JRockit R28.3.1 P-856V-Java SE Embedded 7u51 10.0 AV:N/AC:L/Au:N/C:C/I:C/A:C CPUApr2014 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html P-856V-Java SE 5.0u61 P-856V-Java SE 6u71 P-856V-Java SE 7u51 P-856V-Java SE 8 P-856V-JRockit R27.8.1 P-856V-JRockit R28.3.1 P-856V-Java SE Embedded 7u51 Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: JAX-WS). Supported versions that are affected are Java SE 6u71, Java SE 7u51, Java SE 8 and Java SE Embedded 7u51. Easily exploitable vulnerability allows successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability can result in unauthorized update, insert or delete access to some Java SE, Java SE Embedded accessible data as well as read access to a subset of Java SE, Java SE Embedded accessible data and ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: Applies to client deployment of Java only. This vulnerability can be exploited only through sandboxed Java Web Start applications and sandboxed Java applets. CVSS Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS V2 Vector: (AV:N/AC:L/Au:N/C:P/I:P/A:P). Oracle Vector: (AV:N/AC:L/Au:N/C:P/I:P/A:P). Fix has been released CVE-2014-0458 P-856V-Java SE 6u71 P-856V-Java SE 7u51 P-856V-Java SE 8 P-856V-Java SE Embedded 7u51 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P CPUApr2014 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html P-856V-Java SE 6u71 P-856V-Java SE 7u51 P-856V-Java SE 8 P-856V-Java SE Embedded 7u51 Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: 2D). Supported versions that are affected are Java SE 7u51, Java SE 8 and Java SE Embedded 7u51. Difficult to exploit vulnerability allows successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: Applies to client deployment of Java only. This vulnerability can be exploited only through sandboxed Java Web Start applications and sandboxed Java applets. CVSS Base Score 4.3 (Availability impacts). CVSS V2 Vector: (AV:N/AC:M/Au:N/C:N/I:N/A:P). Oracle Vector: (AV:N/AC:M/Au:N/C:N/I:N/A:P). Fix has been released CVE-2014-0459 P-856V-Java SE 7u51 P-856V-Java SE 8 P-856V-Java SE Embedded 7u51 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P CPUApr2014 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html P-856V-Java SE 7u51 P-856V-Java SE 8 P-856V-Java SE Embedded 7u51 Vulnerability in the Java SE, JRockit, Java SE Embedded component of Oracle Java SE (subcomponent: JNDI). Supported versions that are affected are Java SE 5.0u61, Java SE 6u71, Java SE 7u51, Java SE 8, JRockit R27.8.1, JRockit R28.3.1 and Java SE Embedded 7u51. Difficult to exploit vulnerability allows successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability can result in unauthorized update, insert or delete access to some Java SE, JRockit, Java SE Embedded accessible data as well as read access to a subset of Java SE, JRockit, Java SE Embedded accessible data. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS Base Score 5.8 (Confidentiality and Integrity impacts). CVSS V2 Vector: (AV:N/AC:M/Au:N/C:P/I:P/A:N). Oracle Vector: (AV:N/AC:M/Au:N/C:P/I:P/A:N). Fix has been released CVE-2014-0460 P-856V-Java SE 5.0u61 P-856V-Java SE 6u71 P-856V-Java SE 7u51 P-856V-Java SE 8 P-856V-JRockit R27.8.1 P-856V-JRockit R28.3.1 P-856V-Java SE Embedded 7u51 5.8 AV:N/AC:M/Au:N/C:P/I:P/A:N CPUApr2014 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html P-856V-Java SE 5.0u61 P-856V-Java SE 6u71 P-856V-Java SE 7u51 P-856V-Java SE 8 P-856V-JRockit R27.8.1 P-856V-JRockit R28.3.1 P-856V-Java SE Embedded 7u51 Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Libraries). Supported versions that are affected are Java SE 6u71, Java SE 7u51, Java SE 8 and Java SE Embedded 7u51. Difficult to exploit vulnerability allows successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability can result in unauthorized Operating System takeover including arbitrary code execution. Note: Applies to client deployment of Java only. This vulnerability can be exploited only through sandboxed Java Web Start applications and sandboxed Java applets. CVSS Base Score 9.3 (Confidentiality, Integrity and Availability impacts). CVSS V2 Vector: (AV:N/AC:M/Au:N/C:C/I:C/A:C). Oracle Vector: (AV:N/AC:M/Au:N/C:C/I:C/A:C). Fix has been released CVE-2014-0461 P-856V-Java SE 6u71 P-856V-Java SE 7u51 P-856V-Java SE 8 P-856V-Java SE Embedded 7u51 9.3 AV:N/AC:M/Au:N/C:C/I:C/A:C CPUApr2014 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html P-856V-Java SE 6u71 P-856V-Java SE 7u51 P-856V-Java SE 8 P-856V-Java SE Embedded 7u51 Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Scripting). The supported version that is affected is Java SE 8. Difficult to exploit vulnerability allows successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability can result in unauthorized read access to a subset of Java SE accessible data. Note: Applies to client deployment of Java only. This vulnerability can be exploited only through sandboxed Java Web Start applications and sandboxed Java applets. CVSS Base Score 4.3 (Confidentiality impacts). CVSS V2 Vector: (AV:N/AC:M/Au:N/C:P/I:N/A:N). Oracle Vector: (AV:N/AC:M/Au:N/C:P/I:N/A:N). Fix has been released CVE-2014-0463 P-856V-Java SE 8 4.3 AV:N/AC:M/Au:N/C:P/I:N/A:N CPUApr2014 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html P-856V-Java SE 8 Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Scripting). The supported version that is affected is Java SE 8. Difficult to exploit vulnerability allows successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability can result in unauthorized read access to a subset of Java SE accessible data. Note: Applies to client deployment of Java only. This vulnerability can be exploited only through sandboxed Java Web Start applications and sandboxed Java applets. CVSS Base Score 4.3 (Confidentiality impacts). CVSS V2 Vector: (AV:N/AC:M/Au:N/C:P/I:N/A:N). Oracle Vector: (AV:N/AC:M/Au:N/C:P/I:N/A:N). Fix has been released CVE-2014-0464 P-856V-Java SE 8 4.3 AV:N/AC:M/Au:N/C:P/I:N/A:N CPUApr2014 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html P-856V-Java SE 8 Vulnerability in the Oracle OpenSSO component of Oracle Fusion Middleware (subcomponent: Admin Console). The supported version that is affected is 8.0 Update 2 Patch 5. Difficult to exploit vulnerability allows successful authenticated network attacks via HTTP. Successful attack of this vulnerability can result in unauthorized update, insert or delete access to some Oracle OpenSSO accessible data. CVSS Base Score 3.5 (Integrity impacts). CVSS V2 Vector: (AV:N/AC:M/Au:S/C:N/I:P/A:N). Oracle Vector: (AV:N/AC:M/Au:S/C:N/I:P/A:N). Fix has been released CVE-2014-0465 P-8520V-8.0 Update 2 Patch 5 3.5 AV:N/AC:M/Au:S/C:N/I:P/A:N CPUApr2014 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html P-8520V-8.0 Update 2 Patch 5 Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Supported versions that are affected are VirtualBox prior to 3.2.22, 4.0.24, 4.1.32, 4.2.24 and 4.3.8. Difficult to exploit vulnerability requiring logon to Operating System. Successful attack of this vulnerability can result in unauthorized takeover of Oracle VM VirtualBox possibly including arbitrary code execution within the Oracle VM VirtualBox. Note: This fix also addresses CVE-2014-0982 and CVE-2014-0983. CVSS Base Score 4.4 (Confidentiality, Integrity and Availability impacts). CVSS V2 Vector: (AV:L/AC:M/Au:N/C:P/I:P/A:P). Oracle Vector: (AV:L/AC:M/Au:N/C:P+/I:P+/A:P+). Fix has been released CVE-2014-0981 P-8370V-VirtualBox prior to 3.2.22 P-8370V-4.0.24 P-8370V-4.1.32 P-8370V-4.2.24 P-8370V-4.3.8 4.4 AV:L/AC:M/Au:N/C:P/I:P/A:P CPUApr2014 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html P-8370V-VirtualBox prior to 3.2.22 P-8370V-4.0.24 P-8370V-4.1.32 P-8370V-4.2.24 P-8370V-4.3.8 Vulnerability in the Java SE, JRockit, Java SE Embedded component of Oracle Java SE (subcomponent: Libraries). Supported versions that are affected are Java SE 5.0u61, Java SE 6u71, Java SE 7u51, Java SE 8, JRockit R27.8.1, JRockit R28.3.1 and Java SE Embedded 7u51. Very difficult to exploit vulnerability requiring logon to Operating System. Successful attack of this vulnerability can result in unauthorized update, insert or delete access to some Java SE, JRockit, Java SE Embedded accessible data and ability to cause a partial denial of service (partial DOS) of Java SE, JRockit, Java SE Embedded. Note: Applies to the unpack200 tool. CVSS Base Score 2.6 (Integrity and Availability impacts). CVSS V2 Vector: (AV:L/AC:H/Au:N/C:N/I:P/A:P). Oracle Vector: (AV:L/AC:H/Au:N/C:N/I:P/A:P). Fix has been released CVE-2014-1876 P-856V-Java SE 5.0u61 P-856V-Java SE 6u71 P-856V-Java SE 7u51 P-856V-Java SE 8 P-856V-JRockit R27.8.1 P-856V-JRockit R28.3.1 P-856V-Java SE Embedded 7u51 2.6 AV:L/AC:H/Au:N/C:N/I:P/A:P CPUApr2014 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html P-856V-Java SE 5.0u61 P-856V-Java SE 6u71 P-856V-Java SE 7u51 P-856V-Java SE 8 P-856V-JRockit R27.8.1 P-856V-JRockit R28.3.1 P-856V-Java SE Embedded 7u51 Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Hotspot). Supported versions that are affected are Java SE 7u51, Java SE 8 and Java SE Embedded 7u51. Difficult to exploit vulnerability allows successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability can result in unauthorized Operating System takeover including arbitrary code execution. Note: Applies to client deployment of Java only. This vulnerability can be exploited only through sandboxed Java Web Start applications and sandboxed Java applets. CVSS Base Score 9.3 (Confidentiality, Integrity and Availability impacts). CVSS V2 Vector: (AV:N/AC:M/Au:N/C:C/I:C/A:C). Oracle Vector: (AV:N/AC:M/Au:N/C:C/I:C/A:C). Fix has been released CVE-2014-2397 P-856V-Java SE 7u51 P-856V-Java SE 8 P-856V-Java SE Embedded 7u51 9.3 AV:N/AC:M/Au:N/C:C/I:C/A:C CPUApr2014 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html P-856V-Java SE 7u51 P-856V-Java SE 8 P-856V-Java SE Embedded 7u51 Vulnerability in the Java SE, JavaFX, JRockit, component of Oracle Java SE (subcomponent: Javadoc). Supported versions that are affected are Java SE 5.0u61, Java SE 6u71, Java SE 7u51, Java SE 8, JavaFX 2.2.51, JRockit R27.8.1 and JRockit R28.3.1. Difficult to exploit vulnerability allows successful authenticated network attacks via HTTP. Successful attack of this vulnerability can result in unauthorized update, insert or delete access to some Java SE, JavaFX, JRockit, accessible data. Note: Applies to sites that run the Javadoc tool as a service and then host the resulting documentation. It is recommended that sites filter HTML where it is not explicitly allowed for javadocs. CVSS Base Score 3.5 (Integrity impacts). CVSS V2 Vector: (AV:N/AC:M/Au:S/C:N/I:P/A:N). Oracle Vector: (AV:N/AC:M/Au:S/C:N/I:P/A:N). Fix has been released CVE-2014-2398 P-856V-Java SE 5.0u61 P-856V-Java SE 6u71 P-856V-Java SE 7u51 P-856V-Java SE 8 P-856V-JavaFX 2.2.51 P-856V-JRockit R27.8.1 P-856V-JRockit R28.3.1 3.5 AV:N/AC:M/Au:S/C:N/I:P/A:N CPUApr2014 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html P-856V-Java SE 5.0u61 P-856V-Java SE 6u71 P-856V-Java SE 7u51 P-856V-Java SE 8 P-856V-JavaFX 2.2.51 P-856V-JRockit R27.8.1 P-856V-JRockit R28.3.1 Vulnerability in the Oracle Endeca Server component of Oracle Fusion Middleware (subcomponent: Oracle Endeca Information Discovery (Formerly Latitude)). The supported version that is affected is 2.2.2. Difficult to exploit vulnerability allows successful unauthenticated network attacks via HTTP. Successful attack of this vulnerability can result in unauthorized update, insert or delete access to some Oracle Endeca Server accessible data. Note: Please refer to <a href="https://support.oracle.com/CSP/main/article?cmd=show&type=NOT&id=1629648.1">My Oracle Support Note 1629648.1</a> for instructions on how to address this issue. CVSS Base Score 4.3 (Integrity impacts). CVSS V2 Vector: (AV:N/AC:M/Au:N/C:N/I:P/A:N). Oracle Vector: (AV:N/AC:M/Au:N/C:N/I:P/A:N). Fix has been released CVE-2014-2399 P-10217V-2.2.2 4.3 AV:N/AC:M/Au:N/C:N/I:P/A:N CPUApr2014 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html P-10217V-2.2.2 Vulnerability in the Oracle Endeca Server component of Oracle Fusion Middleware (subcomponent: Oracle Endeca Information Discovery (Formerly Latitude)). The supported version that is affected is 2.2.2. Difficult to exploit vulnerability allows successful unauthenticated network attacks via HTTP. Successful attack of this vulnerability can result in unauthorized update, insert or delete access to some Oracle Endeca Server accessible data. Note: Please refer to <a href="https://support.oracle.com/CSP/main/article?cmd=show&type=NOT&id=1629648.1">My Oracle Support Note 1629648.1</a> for instructions on how to address this issue. CVSS Base Score 4.3 (Integrity impacts). CVSS V2 Vector: (AV:N/AC:M/Au:N/C:N/I:P/A:N). Oracle Vector: (AV:N/AC:M/Au:N/C:N/I:P/A:N). Fix has been released CVE-2014-2400 P-10217V-2.2.2 4.3 AV:N/AC:M/Au:N/C:N/I:P/A:N CPUApr2014 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html P-10217V-2.2.2 Vulnerability in the Java SE, JavaFX, Java SE Embedded component of Oracle Java SE (subcomponent: 2D). Supported versions that are affected are Java SE 5.0u61, Java SE 6u71, Java SE 7u51, Java SE 8, JavaFX 2.2.51 and Java SE Embedded 7u51. Easily exploitable vulnerability allows successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability can result in unauthorized read access to a subset of Java SE, JavaFX, Java SE Embedded accessible data. Note: Applies to client deployment of Java only. This vulnerability can be exploited only through sandboxed Java Web Start applications and sandboxed Java applets. CVSS Base Score 5.0 (Confidentiality impacts). CVSS V2 Vector: (AV:N/AC:L/Au:N/C:P/I:N/A:N). Oracle Vector: (AV:N/AC:L/Au:N/C:P/I:N/A:N). Fix has been released CVE-2014-2401 P-856V-Java SE 5.0u61 P-856V-Java SE 6u71 P-856V-Java SE 7u51 P-856V-Java SE 8 P-856V-JavaFX 2.2.51 P-856V-Java SE Embedded 7u51 5.0 AV:N/AC:L/Au:N/C:P/I:N/A:N CPUApr2014 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html P-856V-Java SE 5.0u61 P-856V-Java SE 6u71 P-856V-Java SE 7u51 P-856V-Java SE 8 P-856V-JavaFX 2.2.51 P-856V-Java SE Embedded 7u51 Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Libraries). Supported versions that are affected are Java SE 7u51, Java SE 8 and Java SE Embedded 7u51. Easily exploitable vulnerability allows successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability can result in unauthorized update, insert or delete access to some Java SE, Java SE Embedded accessible data as well as read access to a subset of Java SE, Java SE Embedded accessible data and ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: Applies to client deployment of Java only. This vulnerability can be exploited only through sandboxed Java Web Start applications and sandboxed Java applets. CVSS Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS V2 Vector: (AV:N/AC:L/Au:N/C:P/I:P/A:P). Oracle Vector: (AV:N/AC:L/Au:N/C:P/I:P/A:P). Fix has been released CVE-2014-2402 P-856V-Java SE 7u51 P-856V-Java SE 8 P-856V-Java SE Embedded 7u51 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P CPUApr2014 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html P-856V-Java SE 7u51 P-856V-Java SE 8 P-856V-Java SE Embedded 7u51 Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: JAXP). Supported versions that are affected are Java SE 6u71, Java SE 7u51, Java SE 8 and Java SE Embedded 7u51. Easily exploitable vulnerability allows successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability can result in unauthorized read access to a subset of Java SE, Java SE Embedded accessible data. Note: Applies to client deployment of Java only. This vulnerability can be exploited only through sandboxed Java Web Start applications and sandboxed Java applets. CVSS Base Score 5.0 (Confidentiality impacts). CVSS V2 Vector: (AV:N/AC:L/Au:N/C:P/I:N/A:N). Oracle Vector: (AV:N/AC:L/Au:N/C:P/I:N/A:N). Fix has been released CVE-2014-2403 P-856V-Java SE 6u71 P-856V-Java SE 7u51 P-856V-Java SE 8 P-856V-Java SE Embedded 7u51 5.0 AV:N/AC:L/Au:N/C:P/I:N/A:N CPUApr2014 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html P-856V-Java SE 6u71 P-856V-Java SE 7u51 P-856V-Java SE 8 P-856V-Java SE Embedded 7u51 Vulnerability in the Oracle Access Manager component of Oracle Fusion Middleware (subcomponent: WebGate). Supported versions that are affected are 10.1.4.3, 11.1.1.3.0, 11.1.1.5.0, 11.1.1.7.0, 11.1.2.0.0, 11.1.2.1.0 and 11.1.2.2.0. Easily exploitable vulnerability allows successful authenticated network attacks via HTTP. Successful attack of this vulnerability can result in unauthorized read access to a subset of Oracle Access Manager accessible data. Note: Please refer to <a href="https://support.oracle.com/CSP/main/article?cmd=show&type=NOT&id=1643382.1">My Oracle Support Note 1643382.1</a> for instructions on how to address this issue. CVSS Base Score 4.0 (Confidentiality impacts). CVSS V2 Vector: (AV:N/AC:L/Au:S/C:P/I:N/A:N). Oracle Vector: (AV:N/AC:L/Au:S/C:P/I:N/A:N). Fix has been released CVE-2014-2404 P-1773V-10.1.4.3 P-1773V-11.1.1.3.0 P-1773V-11.1.1.5.0 P-1773V-11.1.1.7.0 P-1773V-11.1.2.0.0 P-1773V-11.1.2.1.0 P-1773V-11.1.2.2.0 4.0 AV:N/AC:L/Au:S/C:P/I:N/A:N CPUApr2014 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html P-1773V-10.1.4.3 P-1773V-11.1.1.3.0 P-1773V-11.1.1.5.0 P-1773V-11.1.1.7.0 P-1773V-11.1.2.0.0 P-1773V-11.1.2.1.0 P-1773V-11.1.2.2.0 Vulnerability in the Core RDBMS component of Oracle Database Server. This vulnerability requires Create Session, Advisor, Select Any Dictionary privileges for a successful attack. Supported versions that are affected are 11.1.0.7, 11.2.0.3, 11.2.0.4 and 12.1.0.1. Difficult to exploit vulnerability allows successful authenticated network attacks via Oracle Net. Successful attack of this vulnerability can result in unauthorized Operating System takeover including arbitrary code execution. Note: The CVSS Base Score is 8.5 only for Windows. For Linux, Unix and other platforms, the CVSS Base Score is 6.0, and the impacts for Confidentiality, Integrity and Availability are Partial+. CVSS Base Score 8.5 (Confidentiality, Integrity and Availability impacts). CVSS V2 Vector: (AV:N/AC:M/Au:S/C:C/I:C/A:C). Oracle Vector: (AV:N/AC:M/Au:S/C:C/I:C/A:C). Fix has been released CVE-2014-2406 P-5V-11.1.0.7 P-5V-11.2.0.3 P-5V-11.2.0.4 P-5V-12.1.0.1 8.5 AV:N/AC:M/Au:S/C:C/I:C/A:C CPUApr2014 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html P-5V-11.1.0.7 P-5V-11.2.0.3 P-5V-11.2.0.4 P-5V-12.1.0.1 Vulnerability in the Oracle Data Integrator component of Oracle Fusion Middleware (subcomponent: Data Quality). The supported version that is affected is 11.1.1.3.0. Difficult to exploit vulnerability allows successful unauthenticated network attacks via HTTP. Successful attack of this vulnerability can result in unauthorized update, insert or delete access to some Oracle Data Integrator accessible data as well as read access to a subset of Oracle Data Integrator accessible data and ability to cause a partial denial of service (partial DOS) of Oracle Data Integrator. CVSS Base Score 6.8 (Confidentiality, Integrity and Availability impacts). CVSS V2 Vector: (AV:N/AC:M/Au:N/C:P/I:P/A:P). Oracle Vector: (AV:N/AC:M/Au:N/C:P/I:P/A:P). Fix has been released CVE-2014-2407 P-2196V-11.1.1.3.0 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P CPUApr2014 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html P-2196V-11.1.1.3.0 Vulnerability in the Core RDBMS component of Oracle Database Server. This vulnerability requires Create Session, Grant Any Object Privilege privileges for a successful attack. Supported versions that are affected are 11.1.0.7, 11.2.0.3, 11.2.0.4 and 12.1.0.1. Very difficult to exploit vulnerability allows successful authenticated network attacks via Oracle Net. Successful attack of this vulnerability can result in unauthorized write access to any arbitrary Operating System location as well as read access to any arbitrary Operating System location. CVSS Base Score 6.6 (Confidentiality and Integrity impacts). CVSS V2 Vector: (AV:N/AC:H/Au:S/C:C/I:C/A:N). Oracle Vector: (AV:N/AC:H/Au:S/C:C/I:C/A:N). Fix has been released CVE-2014-2408 P-5V-11.1.0.7 P-5V-11.2.0.3 P-5V-11.2.0.4 P-5V-12.1.0.1 6.6 AV:N/AC:H/Au:S/C:C/I:C/A:N CPUApr2014 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html P-5V-11.1.0.7 P-5V-11.2.0.3 P-5V-11.2.0.4 P-5V-12.1.0.1 Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Deployment). Supported versions that are affected are Java SE 6u71, Java SE 7u51, Java SE 8 and Java SE Embedded 7u51. Easily exploitable vulnerability allows successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability can result in unauthorized update, insert or delete access to some Java SE, Java SE Embedded accessible data as well as read access to a subset of Java SE, Java SE Embedded accessible data. Note: Applies to client deployment of Java only. This vulnerability can be exploited only through sandboxed Java Web Start applications and sandboxed Java applets. CVSS Base Score 6.4 (Confidentiality and Integrity impacts). CVSS V2 Vector: (AV:N/AC:L/Au:N/C:P/I:P/A:N). Oracle Vector: (AV:N/AC:L/Au:N/C:P/I:P/A:N). Fix has been released CVE-2014-2409 P-856V-Java SE 6u71 P-856V-Java SE 7u51 P-856V-Java SE 8 P-856V-Java SE Embedded 7u51 6.4 AV:N/AC:L/Au:N/C:P/I:P/A:N CPUApr2014 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html P-856V-Java SE 6u71 P-856V-Java SE 7u51 P-856V-Java SE 8 P-856V-Java SE Embedded 7u51 Vulnerability in the Java SE component of Oracle Java SE (subcomponent: JavaFX). The supported version that is affected is Java SE 8. Difficult to exploit vulnerability allows successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability can result in unauthorized Operating System takeover including arbitrary code execution. Note: Applies to client deployment of Java only. This vulnerability can be exploited only through sandboxed Java Web Start applications and sandboxed Java applets. CVSS Base Score 9.3 (Confidentiality, Integrity and Availability impacts). CVSS V2 Vector: (AV:N/AC:M/Au:N/C:C/I:C/A:C). Oracle Vector: (AV:N/AC:M/Au:N/C:C/I:C/A:C). Fix has been released CVE-2014-2410 P-856V-Java SE 8 9.3 AV:N/AC:M/Au:N/C:C/I:C/A:C CPUApr2014 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html P-856V-Java SE 8 Vulnerability in the Oracle Identity Analytics component of Oracle Fusion Middleware (subcomponent: Security). Supported versions that are affected are Oracle Identity Analytics 11.1.1.5 and Sun Role Manager 5.0. Easily exploitable vulnerability allows successful authenticated network attacks via HTTP. Successful attack of this vulnerability can result in unauthorized update, insert or delete access to all Oracle Identity Analytics accessible data as well as read access to a subset of Oracle Identity Analytics accessible data and ability to cause a partial denial of service (partial DOS) of Oracle Identity Analytics. CVSS Base Score 6.5 (Confidentiality, Integrity and Availability impacts). CVSS V2 Vector: (AV:N/AC:L/Au:S/C:P/I:P/A:P). Oracle Vector: (AV:N/AC:L/Au:S/C:P/I:P+/A:P). Fix has been released CVE-2014-2411 P-8522V-Oracle Identity Analytics 11.1.1.5 P-8522V-Sun Role Manager 5.0 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P CPUApr2014 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html P-8522V-Oracle Identity Analytics 11.1.1.5 P-8522V-Sun Role Manager 5.0 Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: AWT). Supported versions that are affected are Java SE 5.0u61, Java SE 6u71, Java SE 7u51, Java SE 8 and Java SE Embedded 7u51. Easily exploitable vulnerability allows successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability can result in unauthorized update, insert or delete access to some Java SE, Java SE Embedded accessible data as well as read access to a subset of Java SE, Java SE Embedded accessible data and ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: Applies to client deployment of Java only. This vulnerability can be exploited only through sandboxed Java Web Start applications and sandboxed Java applets. CVSS Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS V2 Vector: (AV:N/AC:L/Au:N/C:P/I:P/A:P). Oracle Vector: (AV:N/AC:L/Au:N/C:P/I:P/A:P). Fix has been released CVE-2014-2412 P-856V-Java SE 5.0u61 P-856V-Java SE 6u71 P-856V-Java SE 7u51 P-856V-Java SE 8 P-856V-Java SE Embedded 7u51 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P CPUApr2014 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html P-856V-Java SE 5.0u61 P-856V-Java SE 6u71 P-856V-Java SE 7u51 P-856V-Java SE 8 P-856V-Java SE Embedded 7u51 Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Libraries). Supported versions that are affected are Java SE 7u51, Java SE 8 and Java SE Embedded 7u51. Difficult to exploit vulnerability allows successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability can result in unauthorized update, insert or delete access to some Java SE, Java SE Embedded accessible data. Note: Applies to client deployment of Java only. This vulnerability can be exploited only through sandboxed Java Web Start applications and sandboxed Java applets. CVSS Base Score 4.3 (Integrity impacts). CVSS V2 Vector: (AV:N/AC:M/Au:N/C:N/I:P/A:N). Oracle Vector: (AV:N/AC:M/Au:N/C:N/I:P/A:N). Fix has been released CVE-2014-2413 P-856V-Java SE 7u51 P-856V-Java SE 8 P-856V-Java SE Embedded 7u51 4.3 AV:N/AC:M/Au:N/C:N/I:P/A:N CPUApr2014 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html P-856V-Java SE 7u51 P-856V-Java SE 8 P-856V-Java SE Embedded 7u51 Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: JAXB). Supported versions that are affected are Java SE 6u71, Java SE 7u51, Java SE 8 and Java SE Embedded 7u51. Easily exploitable vulnerability allows successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability can result in unauthorized update, insert or delete access to some Java SE, Java SE Embedded accessible data as well as read access to a subset of Java SE, Java SE Embedded accessible data and ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: Applies to client deployment of Java only. This vulnerability can be exploited only through sandboxed Java Web Start applications and sandboxed Java applets. CVSS Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS V2 Vector: (AV:N/AC:L/Au:N/C:P/I:P/A:P). Oracle Vector: (AV:N/AC:L/Au:N/C:P/I:P/A:P). Fix has been released CVE-2014-2414 P-856V-Java SE 6u71 P-856V-Java SE 7u51 P-856V-Java SE 8 P-856V-Java SE Embedded 7u51 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P CPUApr2014 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html P-856V-Java SE 6u71 P-856V-Java SE 7u51 P-856V-Java SE 8 P-856V-Java SE Embedded 7u51 Vulnerability in the Oracle Data Integrator component of Oracle Fusion Middleware (subcomponent: Data Quality). The supported version that is affected is 11.1.1.3.0. Easily exploitable vulnerability allows successful unauthenticated network attacks via HTTP. Successful attack of this vulnerability can result in unauthorized update, insert or delete access to some Oracle Data Integrator accessible data as well as read access to a subset of Oracle Data Integrator accessible data and ability to cause a partial denial of service (partial DOS) of Oracle Data Integrator. CVSS Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS V2 Vector: (AV:N/AC:L/Au:N/C:P/I:P/A:P). Oracle Vector: (AV:N/AC:L/Au:N/C:P/I:P/A:P). Fix has been released CVE-2014-2415 P-2196V-11.1.1.3.0 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P CPUApr2014 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html P-2196V-11.1.1.3.0 Vulnerability in the Oracle Data Integrator component of Oracle Fusion Middleware (subcomponent: Data Quality). The supported version that is affected is 11.1.1.3.0. Easily exploitable vulnerability allows successful unauthenticated network attacks via HTTP. Successful attack of this vulnerability can result in unauthorized update, insert or delete access to some Oracle Data Integrator accessible data as well as read access to a subset of Oracle Data Integrator accessible data and ability to cause a partial denial of service (partial DOS) of Oracle Data Integrator. CVSS Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS V2 Vector: (AV:N/AC:L/Au:N/C:P/I:P/A:P). Oracle Vector: (AV:N/AC:L/Au:N/C:P/I:P/A:P). Fix has been released CVE-2014-2416 P-2196V-11.1.1.3.0 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P CPUApr2014 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html P-2196V-11.1.1.3.0 Vulnerability in the Oracle Data Integrator component of Oracle Fusion Middleware (subcomponent: Data Quality). The supported version that is affected is 11.1.1.3.0. Easily exploitable vulnerability allows successful unauthenticated network attacks via HTTP. Successful attack of this vulnerability can result in unauthorized update, insert or delete access to some Oracle Data Integrator accessible data as well as read access to a subset of Oracle Data Integrator accessible data and ability to cause a partial denial of service (partial DOS) of Oracle Data Integrator. CVSS Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS V2 Vector: (AV:N/AC:L/Au:N/C:P/I:P/A:P). Oracle Vector: (AV:N/AC:L/Au:N/C:P/I:P/A:P). Fix has been released CVE-2014-2417 P-2196V-11.1.1.3.0 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P CPUApr2014 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html P-2196V-11.1.1.3.0 Vulnerability in the Oracle Data Integrator component of Oracle Fusion Middleware (subcomponent: Data Quality). The supported version that is affected is 11.1.1.3.0. Easily exploitable vulnerability allows successful unauthenticated network attacks via HTTP. Successful attack of this vulnerability can result in unauthorized update, insert or delete access to some Oracle Data Integrator accessible data as well as read access to a subset of Oracle Data Integrator accessible data and ability to cause a partial denial of service (partial DOS) of Oracle Data Integrator. CVSS Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS V2 Vector: (AV:N/AC:L/Au:N/C:P/I:P/A:P). Oracle Vector: (AV:N/AC:L/Au:N/C:P/I:P/A:P). Fix has been released CVE-2014-2418 P-2196V-11.1.1.3.0 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P CPUApr2014 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html P-2196V-11.1.1.3.0 Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Partition). Supported versions that are affected are 5.5.35 and earlier and 5.6.15 and earlier. Easily exploitable vulnerability allows successful authenticated network attacks via multiple protocols. Successful attack of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS Base Score 4.0 (Availability impacts). CVSS V2 Vector: (AV:N/AC:L/Au:S/C:N/I:N/A:P). Oracle Vector: (AV:N/AC:L/Au:S/C:N/I:N/A:P+). Fix has been released CVE-2014-2419 P-8478V-5.5.35 and earlier P-8478V-5.6.15 and earlier 4.0 AV:N/AC:L/Au:S/C:N/I:N/A:P CPUApr2014 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html P-8478V-5.5.35 and earlier P-8478V-5.6.15 and earlier Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Deployment). Supported versions that are affected are Java SE 6u71, Java SE 7u51, Java SE 8 and Java SE Embedded 7u51. Very difficult to exploit vulnerability allows successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability can result in unauthorized update, insert or delete access to some Java SE, Java SE Embedded accessible data. Note: Applies to client deployment of Java only. This vulnerability can be exploited only through sandboxed Java Web Start applications and sandboxed Java applets. CVSS Base Score 2.6 (Integrity impacts). CVSS V2 Vector: (AV:N/AC:H/Au:N/C:N/I:P/A:N). Oracle Vector: (AV:N/AC:H/Au:N/C:N/I:P/A:N). Fix has been released CVE-2014-2420 P-856V-Java SE 6u71 P-856V-Java SE 7u51 P-856V-Java SE 8 P-856V-Java SE Embedded 7u51 2.6 AV:N/AC:H/Au:N/C:N/I:P/A:N CPUApr2014 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html P-856V-Java SE 6u71 P-856V-Java SE 7u51 P-856V-Java SE 8 P-856V-Java SE Embedded 7u51 Vulnerability in the Java SE, JavaFX, Java SE Embedded component of Oracle Java SE (subcomponent: 2D). Supported versions that are affected are Java SE 5.0u61, Java SE 6u71, Java SE 7u51, Java SE 8, JavaFX 2.2.51 and Java SE Embedded 7u51. Easily exploitable vulnerability allows successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability can result in unauthorized Operating System takeover including arbitrary code execution. Note: Applies to client deployment of Java only. This vulnerability can be exploited only through sandboxed Java Web Start applications and sandboxed Java applets. CVSS Base Score 10.0 (Confidentiality, Integrity and Availability impacts). CVSS V2 Vector: (AV:N/AC:L/Au:N/C:C/I:C/A:C). Oracle Vector: (AV:N/AC:L/Au:N/C:C/I:C/A:C). Fix has been released CVE-2014-2421 P-856V-Java SE 5.0u61 P-856V-Java SE 6u71 P-856V-Java SE 7u51 P-856V-Java SE 8 P-856V-JavaFX 2.2.51 P-856V-Java SE Embedded 7u51 10.0 AV:N/AC:L/Au:N/C:C/I:C/A:C CPUApr2014 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html P-856V-Java SE 5.0u61 P-856V-Java SE 6u71 P-856V-Java SE 7u51 P-856V-Java SE 8 P-856V-JavaFX 2.2.51 P-856V-Java SE Embedded 7u51 Vulnerability in the Java SE, JavaFX component of Oracle Java SE (subcomponent: JavaFX). Supported versions that are affected are Java SE 7u51, Java SE 8 and JavaFX 2.2.51. Difficult to exploit vulnerability allows successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability can result in unauthorized update, insert or delete access to some Java SE, JavaFX accessible data as well as read access to a subset of Java SE, JavaFX accessible data and ability to cause a partial denial of service (partial DOS) of Java SE, JavaFX. Note: Applies to client deployment of Java only. This vulnerability can be exploited only through sandboxed Java Web Start applications and sandboxed Java applets. CVSS Base Score 6.8 (Confidentiality, Integrity and Availability impacts). CVSS V2 Vector: (AV:N/AC:M/Au:N/C:P/I:P/A:P). Oracle Vector: (AV:N/AC:M/Au:N/C:P/I:P/A:P). Fix has been released CVE-2014-2422 P-856V-Java SE 7u51 P-856V-Java SE 8 P-856V-JavaFX 2.2.51 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P CPUApr2014 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html P-856V-Java SE 7u51 P-856V-Java SE 8 P-856V-JavaFX 2.2.51 Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: JAX-WS). Supported versions that are affected are Java SE 6u71, Java SE 7u51, Java SE 8 and Java SE Embedded 7u51. Easily exploitable vulnerability allows successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability can result in unauthorized update, insert or delete access to some Java SE, Java SE Embedded accessible data as well as read access to a subset of Java SE, Java SE Embedded accessible data and ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: Applies to client deployment of Java only. This vulnerability can be exploited only through sandboxed Java Web Start applications and sandboxed Java applets. CVSS Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS V2 Vector: (AV:N/AC:L/Au:N/C:P/I:P/A:P). Oracle Vector: (AV:N/AC:L/Au:N/C:P/I:P/A:P). Fix has been released CVE-2014-2423 P-856V-Java SE 6u71 P-856V-Java SE 7u51 P-856V-Java SE 8 P-856V-Java SE Embedded 7u51 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P CPUApr2014 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html P-856V-Java SE 6u71 P-856V-Java SE 7u51 P-856V-Java SE 8 P-856V-Java SE Embedded 7u51 Vulnerability in the Oracle Event Processing component of Oracle Fusion Middleware (subcomponent: CEP system). The supported version that is affected is 11.1.1.7.0. Easily exploitable vulnerability allows successful authenticated network attacks via HTTP. Successful attack of this vulnerability can result in unauthorized update, insert or delete access to some Oracle Event Processing accessible data. CVSS Base Score 4.0 (Integrity impacts). CVSS V2 Vector: (AV:N/AC:L/Au:S/C:N/I:P/A:N). Oracle Vector: (AV:N/AC:L/Au:S/C:N/I:P/A:N). Fix has been released CVE-2014-2424 P-5370V-11.1.1.7.0 4.0 AV:N/AC:L/Au:S/C:N/I:P/A:N CPUApr2014 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html P-5370V-11.1.1.7.0 Vulnerability in the Oracle OpenSSO component of Oracle Fusion Middleware (subcomponent: Other). The supported version that is affected is 8.0 Update 2 Patch 5. Easily exploitable vulnerability allows successful authenticated network attacks via HTTP. Successful attack of this vulnerability can result in unauthorized read access to all Oracle OpenSSO accessible data. CVSS Base Score 4.0 (Confidentiality impacts). CVSS V2 Vector: (AV:N/AC:L/Au:S/C:P/I:N/A:N). Oracle Vector: (AV:N/AC:L/Au:S/C:P+/I:N/A:N). Fix has been released CVE-2014-2425 P-8520V-8.0 Update 2 Patch 5 4.0 AV:N/AC:L/Au:S/C:P/I:N/A:N CPUApr2014 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html P-8520V-8.0 Update 2 Patch 5 Vulnerability in the Oracle OpenSSO component of Oracle Fusion Middleware (subcomponent: Admin Console). The supported version that is affected is 8.0 Update 2 Patch 5. Difficult to exploit vulnerability allows successful authenticated network attacks via HTTP. Successful attack of this vulnerability can result in unauthorized update, insert or delete access to some Oracle OpenSSO accessible data and ability to cause a partial denial of service (partial DOS) of Oracle OpenSSO. CVSS Base Score 4.9 (Integrity and Availability impacts). CVSS V2 Vector: (AV:N/AC:M/Au:S/C:N/I:P/A:P). Oracle Vector: (AV:N/AC:M/Au:S/C:N/I:P/A:P). Fix has been released CVE-2014-2426 P-8520V-8.0 Update 2 Patch 5 4.9 AV:N/AC:M/Au:S/C:N/I:P/A:P CPUApr2014 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html P-8520V-8.0 Update 2 Patch 5 Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Sound). Supported versions that are affected are Java SE 5.0u61, Java SE 6u71, Java SE 7u51, Java SE 8 and Java SE Embedded 7u51. Easily exploitable vulnerability allows successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability can result in unauthorized update, insert or delete access to some Java SE, Java SE Embedded accessible data as well as read access to a subset of Java SE, Java SE Embedded accessible data and ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: Applies to client deployment of Java only. This vulnerability can be exploited only through sandboxed Java Web Start applications and sandboxed Java applets. CVSS Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS V2 Vector: (AV:N/AC:L/Au:N/C:P/I:P/A:P). Oracle Vector: (AV:N/AC:L/Au:N/C:P/I:P/A:P). Fix has been released CVE-2014-2427 P-856V-Java SE 5.0u61 P-856V-Java SE 6u71 P-856V-Java SE 7u51 P-856V-Java SE 8 P-856V-Java SE Embedded 7u51 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P CPUApr2014 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html P-856V-Java SE 5.0u61 P-856V-Java SE 6u71 P-856V-Java SE 7u51 P-856V-Java SE 8 P-856V-Java SE Embedded 7u51 Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Deployment). Supported versions that are affected are Java SE 6u71, Java SE 7u51, Java SE 8 and Java SE Embedded 7u51. Very difficult to exploit vulnerability allows successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability can result in unauthorized Operating System takeover including arbitrary code execution. Note: Applies to client deployment of Java only. This vulnerability can be exploited only through sandboxed Java Web Start applications and sandboxed Java applets. CVSS Base Score 7.6 (Confidentiality, Integrity and Availability impacts). CVSS V2 Vector: (AV:N/AC:H/Au:N/C:C/I:C/A:C). Oracle Vector: (AV:N/AC:H/Au:N/C:C/I:C/A:C). Fix has been released CVE-2014-2428 P-856V-Java SE 6u71 P-856V-Java SE 7u51 P-856V-Java SE 8 P-856V-Java SE Embedded 7u51 7.6 AV:N/AC:H/Au:N/C:C/I:C/A:C CPUApr2014 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html P-856V-Java SE 6u71 P-856V-Java SE 7u51 P-856V-Java SE 8 P-856V-Java SE Embedded 7u51 Vulnerability in the PeopleSoft Enterprise CS Campus Self Service component of Oracle PeopleSoft Products (subcomponent: Campus Mobile). The supported version that is affected is 9.0. Easily exploitable vulnerability allows successful authenticated network attacks via HTTP. Successful attack of this vulnerability can result in unauthorized read access to a subset of PeopleSoft Enterprise CS Campus Self Service accessible data. CVSS Base Score 4.0 (Confidentiality impacts). CVSS V2 Vector: (AV:N/AC:L/Au:S/C:P/I:N/A:N). Oracle Vector: (AV:N/AC:L/Au:S/C:P/I:N/A:N). Fix has been released CVE-2014-2429 P-4903V-9.0 4.0 AV:N/AC:L/Au:S/C:P/I:N/A:N CPUApr2014 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html P-4903V-9.0 Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Performance Schema). Supported versions that are affected are 5.5.36 and earlier and 5.6.16 and earlier. Difficult to exploit vulnerability allows successful authenticated network attacks via multiple protocols. Successful attack of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Server. CVSS Base Score 3.5 (Availability impacts). CVSS V2 Vector: (AV:N/AC:M/Au:S/C:N/I:N/A:P). Oracle Vector: (AV:N/AC:M/Au:S/C:N/I:N/A:P). Fix has been released CVE-2014-2430 P-8478V-5.5.36 and earlier P-8478V-5.6.16 and earlier 3.5 AV:N/AC:M/Au:S/C:N/I:N/A:P CPUApr2014 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html P-8478V-5.5.36 and earlier P-8478V-5.6.16 and earlier Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Options). Supported versions that are affected are 5.5.36 and earlier and 5.6.16 and earlier. Very difficult to exploit vulnerability allows successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS Base Score 2.6 (Availability impacts). CVSS V2 Vector: (AV:N/AC:H/Au:N/C:N/I:N/A:P). Oracle Vector: (AV:N/AC:H/Au:N/C:N/I:N/A:P+). Fix has been released CVE-2014-2431 P-8478V-5.5.36 and earlier P-8478V-5.6.16 and earlier 2.6 AV:N/AC:H/Au:N/C:N/I:N/A:P CPUApr2014 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html P-8478V-5.5.36 and earlier P-8478V-5.6.16 and earlier Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Federated). Supported versions that are affected are 5.5.35 and earlier and 5.6.15 and earlier. Difficult to exploit vulnerability allows successful network attacks via multiple protocols, requiring multiple authentications. Successful attack of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS Base Score 2.8 (Availability impacts). CVSS V2 Vector: (AV:N/AC:M/Au:M/C:N/I:N/A:P). Oracle Vector: (AV:N/AC:M/Au:M/C:N/I:N/A:P+). Fix has been released CVE-2014-2432 P-8478V-5.5.35 and earlier P-8478V-5.6.15 and earlier 2.8 AV:N/AC:M/Au:M/C:N/I:N/A:P CPUApr2014 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html P-8478V-5.5.35 and earlier P-8478V-5.6.15 and earlier Vulnerability in the PeopleSoft Enterprise PT PeopleTools component of Oracle PeopleSoft Products (subcomponent: Integration Broker). The supported version that is affected is 8.53. Easily exploitable vulnerability allows successful unauthenticated network attacks via HTTP. Successful attack of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of PeopleSoft Enterprise PT PeopleTools. CVSS Base Score 5.0 (Availability impacts). CVSS V2 Vector: (AV:N/AC:L/Au:N/C:N/I:N/A:P). Oracle Vector: (AV:N/AC:L/Au:N/C:N/I:N/A:P). Fix has been released CVE-2014-2433 P-5085V-8.53 5.0 AV:N/AC:L/Au:N/C:N/I:N/A:P CPUApr2014 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html P-5085V-8.53 Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: DML). Supported versions that are affected are 5.6.15 and earlier. Easily exploitable vulnerability allows successful authenticated network attacks via multiple protocols. Successful attack of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS Base Score 4.0 (Availability impacts). CVSS V2 Vector: (AV:N/AC:L/Au:S/C:N/I:N/A:P). Oracle Vector: (AV:N/AC:L/Au:S/C:N/I:N/A:P+). Fix has been released CVE-2014-2434 P-8478V-5.6.15 and earlier 4.0 AV:N/AC:L/Au:S/C:N/I:N/A:P CPUApr2014 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html P-8478V-5.6.15 and earlier Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: InnoDB). Supported versions that are affected are 5.6.16 and earlier. Easily exploitable vulnerability allows successful authenticated network attacks via multiple protocols. Successful attack of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS Base Score 4.0 (Availability impacts). CVSS V2 Vector: (AV:N/AC:L/Au:S/C:N/I:N/A:P). Oracle Vector: (AV:N/AC:L/Au:S/C:N/I:N/A:P+). Fix has been released CVE-2014-2435 P-8478V-5.6.16 and earlier 4.0 AV:N/AC:L/Au:S/C:N/I:N/A:P CPUApr2014 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html P-8478V-5.6.16 and earlier Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: RBR). Supported versions that are affected are 5.5.36 and earlier and 5.6.16 and earlier. Difficult to exploit vulnerability allows successful authenticated network attacks via multiple protocols. Successful attack of this vulnerability can result in unauthorized takeover of MySQL Server possibly including arbitrary code execution within the MySQL Server. CVSS Base Score 6.0 (Confidentiality, Integrity and Availability impacts). CVSS V2 Vector: (AV:N/AC:M/Au:S/C:P/I:P/A:P). Oracle Vector: (AV:N/AC:M/Au:S/C:P+/I:P+/A:P+). Fix has been released CVE-2014-2436 P-8478V-5.5.36 and earlier P-8478V-5.6.16 and earlier 6.0 AV:N/AC:M/Au:S/C:P/I:P/A:P CPUApr2014 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html P-8478V-5.5.36 and earlier P-8478V-5.6.16 and earlier Vulnerability in the PeopleSoft Enterprise PT PeopleTools component of Oracle PeopleSoft Products (subcomponent: Integration Broker). Supported versions that are affected are 8.52 and 8.53. Easily exploitable vulnerability allows successful unauthenticated network attacks via HTTP. Successful attack of this vulnerability can result in unauthorized read access to a subset of PeopleSoft Enterprise PT PeopleTools accessible data. CVSS Base Score 5.0 (Confidentiality impacts). CVSS V2 Vector: (AV:N/AC:L/Au:N/C:P/I:N/A:N). Oracle Vector: (AV:N/AC:L/Au:N/C:P/I:N/A:N). Fix has been released CVE-2014-2437 P-5085V-8.52 P-5085V-8.53 5.0 AV:N/AC:L/Au:N/C:P/I:N/A:N CPUApr2014 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html P-5085V-8.52 P-5085V-8.53 Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Replication). Supported versions that are affected are 5.5.35 and earlier and 5.6.15 and earlier. Difficult to exploit vulnerability allows successful authenticated network attacks via multiple protocols. Successful attack of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS Base Score 3.5 (Availability impacts). CVSS V2 Vector: (AV:N/AC:M/Au:S/C:N/I:N/A:P). Oracle Vector: (AV:N/AC:M/Au:S/C:N/I:N/A:P+). Fix has been released CVE-2014-2438 P-8478V-5.5.35 and earlier P-8478V-5.6.15 and earlier 3.5 AV:N/AC:M/Au:S/C:N/I:N/A:P CPUApr2014 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html P-8478V-5.5.35 and earlier P-8478V-5.6.15 and earlier Vulnerability in the Oracle Secure Global Desktop (SGD) component of Oracle Virtualization (subcomponent: Workspace Web Application). Supported versions that are affected are 5.0 and 5.1. Easily exploitable vulnerability allows successful unauthenticated network attacks via HTTP. Successful attack of this vulnerability can result in unauthorized update, insert or delete access to some Oracle Secure Global Desktop (SGD) accessible data as well as read access to a subset of Oracle Secure Global Desktop (SGD) accessible data. CVSS Base Score 6.4 (Confidentiality and Integrity impacts). CVSS V2 Vector: (AV:N/AC:L/Au:N/C:P/I:P/A:N). Oracle Vector: (AV:N/AC:L/Au:N/C:P/I:P/A:N). Fix has been released CVE-2014-2439 P-8539V-5.0 P-8539V-5.1 6.4 AV:N/AC:L/Au:N/C:P/I:P/A:N CPUApr2014 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html P-8539V-5.0 P-8539V-5.1 Vulnerability in the MySQL Client component of Oracle MySQL (subcomponent: Client). Supported versions that are affected are 5.5.36 and earlier and 5.6.16 and earlier. Very difficult to exploit vulnerability allows successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability can result in unauthorized update, insert or delete access to some MySQL Client accessible data as well as read access to a subset of MySQL Client accessible data and ability to cause a partial denial of service (partial DOS) of MySQL Client. CVSS Base Score 5.1 (Confidentiality, Integrity and Availability impacts). CVSS V2 Vector: (AV:N/AC:H/Au:N/C:P/I:P/A:P). Oracle Vector: (AV:N/AC:H/Au:N/C:P/I:P/A:P). Fix has been released CVE-2014-2440 P-8478V-5.5.36 and earlier P-8478V-5.6.16 and earlier 5.1 AV:N/AC:H/Au:N/C:P/I:P/A:P CPUApr2014 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html P-8478V-5.5.36 and earlier P-8478V-5.6.16 and earlier Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Graphics driver(WDDM) for Windows guests). Supported versions that are affected are VirtualBox prior to 4.1.32, 4.2.24 and 4.3.10. Difficult to exploit vulnerability requiring logon to Operating System. Successful attack of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox as well as update, insert or delete access to some Oracle VM VirtualBox accessible data and read access to a subset of Oracle VM VirtualBox accessible data. CVSS Base Score 4.4 (Confidentiality, Integrity and Availability impacts). CVSS V2 Vector: (AV:L/AC:M/Au:N/C:P/I:P/A:P). Oracle Vector: (AV:L/AC:M/Au:N/C:P/I:P/A:P+). Fix has been released CVE-2014-2441 P-8370V-VirtualBox prior to 4.1.32 P-8370V-4.2.24 P-8370V-4.3.10 4.4 AV:L/AC:M/Au:N/C:P/I:P/A:P CPUApr2014 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html P-8370V-VirtualBox prior to 4.1.32 P-8370V-4.2.24 P-8370V-4.3.10 Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: MyISAM). Supported versions that are affected are 5.6.15 and earlier. Easily exploitable vulnerability allows successful authenticated network attacks via multiple protocols. Successful attack of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS Base Score 4.0 (Availability impacts). CVSS V2 Vector: (AV:N/AC:L/Au:S/C:N/I:N/A:P). Oracle Vector: (AV:N/AC:L/Au:S/C:N/I:N/A:P+). Fix has been released CVE-2014-2442 P-8478V-5.6.15 and earlier 4.0 AV:N/AC:L/Au:S/C:N/I:N/A:P CPUApr2014 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html P-8478V-5.6.15 and earlier Vulnerability in the PeopleSoft Enterprise PT PeopleTools component of Oracle PeopleSoft Products (subcomponent: PIA Core Technology). Supported versions that are affected are 8.52 and 8.53. Difficult to exploit vulnerability allows successful unauthenticated network attacks via HTTP. Successful attack of this vulnerability can result in unauthorized update, insert or delete access to some PeopleSoft Enterprise PT PeopleTools accessible data. CVSS Base Score 4.3 (Integrity impacts). CVSS V2 Vector: (AV:N/AC:M/Au:N/C:N/I:P/A:N). Oracle Vector: (AV:N/AC:M/Au:N/C:N/I:P/A:N). Fix has been released CVE-2014-2443 P-5085V-8.52 P-5085V-8.53 4.3 AV:N/AC:M/Au:N/C:N/I:P/A:N CPUApr2014 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html P-5085V-8.52 P-5085V-8.53 Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: InnoDB). Supported versions that are affected are 5.6.15 and earlier. Easily exploitable vulnerability allows successful authenticated network attacks via multiple protocols. Successful attack of this vulnerability can result in unauthorized takeover of MySQL Server possibly including arbitrary code execution within the MySQL Server. CVSS Base Score 6.5 (Confidentiality, Integrity and Availability impacts). CVSS V2 Vector: (AV:N/AC:L/Au:S/C:P/I:P/A:P). Oracle Vector: (AV:N/AC:L/Au:S/C:P+/I:P+/A:P+). Fix has been released CVE-2014-2444 P-8478V-5.6.15 and earlier 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P CPUApr2014 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html P-8478V-5.6.15 and earlier Vulnerability in the Oracle Agile PLM Framework component of Oracle Supply Chain Products Suite (subcomponent: Security). The supported version that is affected is 9.3.3. Difficult to exploit vulnerability allows successful authenticated network attacks via HTTP. Successful attack of this vulnerability can result in unauthorized update, insert or delete access to all Oracle Agile PLM Framework accessible data. CVSS Base Score 3.5 (Integrity impacts). CVSS V2 Vector: (AV:N/AC:M/Au:S/C:N/I:P/A:N). Oracle Vector: (AV:N/AC:M/Au:S/C:N/I:P+/A:N). Fix has been released CVE-2014-2445 P-4461V-9.3.3 3.5 AV:N/AC:M/Au:S/C:N/I:P/A:N CPUApr2014 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html P-4461V-9.3.3 Vulnerability in the PeopleSoft Enterprise PT PeopleTools component of Oracle PeopleSoft Products (subcomponent: QAS). Supported versions that are affected are 8.52 and 8.53. Easily exploitable vulnerability allows successful authenticated network attacks via HTTP. Successful attack of this vulnerability can result in unauthorized read access to a subset of PeopleSoft Enterprise PT PeopleTools accessible data. CVSS Base Score 4.0 (Confidentiality impacts). CVSS V2 Vector: (AV:N/AC:L/Au:S/C:P/I:N/A:N). Oracle Vector: (AV:N/AC:L/Au:S/C:P/I:N/A:N). Fix has been released CVE-2014-2446 P-5085V-8.52 P-5085V-8.53 4.0 AV:N/AC:L/Au:S/C:P/I:N/A:N CPUApr2014 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html P-5085V-8.52 P-5085V-8.53 Vulnerability in the PeopleSoft Enterprise PT PeopleTools component of Oracle PeopleSoft Products (subcomponent: Integration Broker). Supported versions that are affected are 8.52 and 8.53. Easily exploitable vulnerability allows successful unauthenticated network attacks via HTTP. Successful attack of this vulnerability can result in unauthorized read access to a subset of PeopleSoft Enterprise PT PeopleTools accessible data. CVSS Base Score 5.0 (Confidentiality impacts). CVSS V2 Vector: (AV:N/AC:L/Au:N/C:P/I:N/A:N). Oracle Vector: (AV:N/AC:L/Au:N/C:P/I:N/A:N). Fix has been released CVE-2014-2447 P-5085V-8.52 P-5085V-8.53 5.0 AV:N/AC:L/Au:N/C:P/I:N/A:N CPUApr2014 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html P-5085V-8.52 P-5085V-8.53 Vulnerability in the PeopleSoft Enterprise PT PeopleTools component of Oracle PeopleSoft Products (subcomponent: Install and Packaging). Supported versions that are affected are 8.52 and 8.53. Easily exploitable vulnerability allows successful unauthenticated network attacks via HTTP. Successful attack of this vulnerability can result in unauthorized read access to a subset of PeopleSoft Enterprise PT PeopleTools accessible data. CVSS Base Score 5.0 (Confidentiality impacts). CVSS V2 Vector: (AV:N/AC:L/Au:N/C:P/I:N/A:N). Oracle Vector: (AV:N/AC:L/Au:N/C:P/I:N/A:N). Fix has been released CVE-2014-2448 P-5085V-8.52 P-5085V-8.53 5.0 AV:N/AC:L/Au:N/C:P/I:N/A:N CPUApr2014 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html P-5085V-8.52 P-5085V-8.53 Vulnerability in the PeopleSoft Enterprise HRMS Talent Acquisition Manager component of Oracle PeopleSoft Products (subcomponent: Security). Supported versions that are affected are 9.0, 9.1 and 9.2. Easily exploitable vulnerability allows successful authenticated network attacks via HTTP. Successful attack of this vulnerability can result in unauthorized read access to a subset of PeopleSoft Enterprise HRMS Talent Acquisition Manager accessible data. CVSS Base Score 4.0 (Confidentiality impacts). CVSS V2 Vector: (AV:N/AC:L/Au:S/C:P/I:N/A:N). Oracle Vector: (AV:N/AC:L/Au:S/C:P/I:N/A:N). Fix has been released CVE-2014-2449 P-5078V-9.0 P-5078V-9.1 P-5078V-9.2 4.0 AV:N/AC:L/Au:S/C:P/I:N/A:N CPUApr2014 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html P-5078V-9.0 P-5078V-9.1 P-5078V-9.2 Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Optimizer). Supported versions that are affected are 5.6.15 and earlier. Easily exploitable vulnerability allows successful authenticated network attacks via multiple protocols. Successful attack of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS Base Score 4.0 (Availability impacts). CVSS V2 Vector: (AV:N/AC:L/Au:S/C:N/I:N/A:P). Oracle Vector: (AV:N/AC:L/Au:S/C:N/I:N/A:P+). Fix has been released CVE-2014-2450 P-8478V-5.6.15 and earlier 4.0 AV:N/AC:L/Au:S/C:N/I:N/A:P CPUApr2014 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html P-8478V-5.6.15 and earlier Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Privileges). Supported versions that are affected are 5.6.15 and earlier. Difficult to exploit vulnerability allows successful authenticated network attacks via multiple protocols. Successful attack of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Server. CVSS Base Score 3.5 (Availability impacts). CVSS V2 Vector: (AV:N/AC:M/Au:S/C:N/I:N/A:P). Oracle Vector: (AV:N/AC:M/Au:S/C:N/I:N/A:P). Fix has been released CVE-2014-2451 P-8478V-5.6.15 and earlier 3.5 AV:N/AC:M/Au:S/C:N/I:N/A:P CPUApr2014 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html P-8478V-5.6.15 and earlier Vulnerability in the Oracle Access Manager component of Oracle Fusion Middleware (subcomponent: Webserver Plugin). The supported version that is affected is 11.1.1.5. Easily exploitable vulnerability allows successful authenticated network attacks via HTTP. Successful attack of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Access Manager. CVSS Base Score 4.0 (Availability impacts). CVSS V2 Vector: (AV:N/AC:L/Au:S/C:N/I:N/A:P). Oracle Vector: (AV:N/AC:L/Au:S/C:N/I:N/A:P+). Fix has been released CVE-2014-2452 P-5565V-11.1.1.5 4.0 AV:N/AC:L/Au:S/C:N/I:N/A:P CPUApr2014 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html P-5565V-11.1.1.5 Vulnerability in the Hyperion Common Admin component of Oracle Hyperion (subcomponent: User Interface). Supported versions that are affected are 11.1.2.2 and 11.1.2.3. Difficult to exploit vulnerability allows successful unauthenticated network attacks via HTTP. Successful attack of this vulnerability can result in unauthorized update, insert or delete access to some Hyperion Common Admin accessible data. CVSS Base Score 4.3 (Integrity impacts). CVSS V2 Vector: (AV:N/AC:M/Au:N/C:N/I:P/A:N). Oracle Vector: (AV:N/AC:M/Au:N/C:N/I:P/A:N). Fix has been released CVE-2014-2453 P-4367V-11.1.2.2 P-4367V-11.1.2.3 4.3 AV:N/AC:M/Au:N/C:N/I:P/A:N CPUApr2014 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html P-4367V-11.1.2.2 P-4367V-11.1.2.3 Vulnerability in the Hyperion Common Admin component of Oracle Hyperion (subcomponent: User Interface). Supported versions that are affected are 11.1.2.2 and 11.1.2.3. Difficult to exploit vulnerability allows successful unauthenticated network attacks via HTTP. Successful attack of this vulnerability can result in unauthorized read access to a subset of Hyperion Common Admin accessible data. CVSS Base Score 4.3 (Confidentiality impacts). CVSS V2 Vector: (AV:N/AC:M/Au:N/C:P/I:N/A:N). Oracle Vector: (AV:N/AC:M/Au:N/C:P/I:N/A:N). Fix has been released CVE-2014-2454 P-4367V-11.1.2.2 P-4367V-11.1.2.3 4.3 AV:N/AC:M/Au:N/C:P/I:N/A:N CPUApr2014 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html P-4367V-11.1.2.2 P-4367V-11.1.2.3 Vulnerability in the Hyperion Common Admin component of Oracle Hyperion (subcomponent: User Interface). Supported versions that are affected are 11.1.2.2 and 11.1.2.3. Difficult to exploit vulnerability allows successful authenticated network attacks via HTTP. Successful attack of this vulnerability can result in unauthorized takeover of Hyperion Common Admin possibly including arbitrary code execution within the Hyperion Common Admin. CVSS Base Score 6.0 (Confidentiality, Integrity and Availability impacts). CVSS V2 Vector: (AV:N/AC:M/Au:S/C:P/I:P/A:P). Oracle Vector: (AV:N/AC:M/Au:S/C:P+/I:P+/A:P+). Fix has been released CVE-2014-2455 P-4367V-11.1.2.2 P-4367V-11.1.2.3 6.0 AV:N/AC:M/Au:S/C:P/I:P/A:P CPUApr2014 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html P-4367V-11.1.2.2 P-4367V-11.1.2.3 Vulnerability in the Oracle Agile Product Lifecycle component of Oracle Supply Chain Products Suite (subcomponent: Install). Supported versions that are affected are 6.0 and 6.1.0. Difficult to exploit vulnerability allows successful unauthenticated network attacks via HTTP. Successful attack of this vulnerability can result in unauthorized update, insert or delete access to some Oracle Agile Product Lifecycle accessible data. CVSS Base Score 4.3 (Integrity impacts). CVSS V2 Vector: (AV:N/AC:M/Au:N/C:N/I:P/A:N). Oracle Vector: (AV:N/AC:M/Au:N/C:N/I:P/A:N). Fix has been released CVE-2014-2457 P-4445V-6.0 P-4445V-6.1.0 4.3 AV:N/AC:M/Au:N/C:N/I:P/A:N CPUApr2014 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html P-4445V-6.0 P-4445V-6.1.0 Vulnerability in the Oracle Agile Product Lifecycle component of Oracle Supply Chain Products Suite (subcomponent: Install). Supported versions that are affected are 6.1.0.3 and 6.1.1.3. Difficult to exploit vulnerability allows successful unauthenticated network attacks via HTTP. Successful attack of this vulnerability can result in unauthorized update, insert or delete access to some Oracle Agile Product Lifecycle accessible data. CVSS Base Score 4.3 (Integrity impacts). CVSS V2 Vector: (AV:N/AC:M/Au:N/C:N/I:P/A:N). Oracle Vector: (AV:N/AC:M/Au:N/C:N/I:P/A:N). Fix has been released CVE-2014-2458 P-4445V-6.1.0.3 P-4445V-6.1.1.3 4.3 AV:N/AC:M/Au:N/C:N/I:P/A:N CPUApr2014 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html P-4445V-6.1.0.3 P-4445V-6.1.1.3 Vulnerability in the Oracle Transportation Management component of Oracle Supply Chain Products Suite (subcomponent: Security). Supported versions that are affected are 6.3.2 and 6.3.3. Very difficult to exploit vulnerability requiring logon to Operating System. Successful attack of this vulnerability can result in unauthorized takeover of Oracle Transportation Management possibly including arbitrary code execution within the Oracle Transportation Management. CVSS Base Score 3.7 (Confidentiality, Integrity and Availability impacts). CVSS V2 Vector: (AV:L/AC:H/Au:N/C:P/I:P/A:P). Oracle Vector: (AV:L/AC:H/Au:N/C:P+/I:P+/A:P+). Fix has been released CVE-2014-2459 P-1991V-6.3.2 P-1991V-6.3.3 3.7 AV:L/AC:H/Au:N/C:P/I:P/A:P CPUApr2014 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html P-1991V-6.3.2 P-1991V-6.3.3 Vulnerability in the Oracle Transportation Management component of Oracle Supply Chain Products Suite (subcomponent: CSV Management). Supported versions that are affected are 5.5.06, 6.0, 6.1, 6.2, 6.3, 6.3.1, 6.3.2 and 6.3.3. Easily exploitable vulnerability allows successful authenticated network attacks via HTTP. Successful attack of this vulnerability can result in unauthorized read access to a subset of Oracle Transportation Management accessible data. CVSS Base Score 4.0 (Confidentiality impacts). CVSS V2 Vector: (AV:N/AC:L/Au:S/C:P/I:N/A:N). Oracle Vector: (AV:N/AC:L/Au:S/C:P/I:N/A:N). Fix has been released CVE-2014-2460 P-1991V-5.5.06 P-1991V-6.0 P-1991V-6.1 P-1991V-6.2 P-1991V-6.3 P-1991V-6.3.1 P-1991V-6.3.2 P-1991V-6.3.3 4.0 AV:N/AC:L/Au:S/C:P/I:N/A:N CPUApr2014 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html P-1991V-5.5.06 P-1991V-6.0 P-1991V-6.1 P-1991V-6.2 P-1991V-6.3 P-1991V-6.3.1 P-1991V-6.3.2 P-1991V-6.3.3 Vulnerability in the Oracle Transportation Management component of Oracle Supply Chain Products Suite (subcomponent: Security). Supported versions that are affected are 5.5.06, 6.0, 6.1, 6.2, 6.3, 6.3.1, 6.3.2 and 6.3.3. Easily exploitable vulnerability allows successful unauthenticated network attacks via HTTP. Successful attack of this vulnerability can result in unauthorized read access to a subset of Oracle Transportation Management accessible data. CVSS Base Score 5.0 (Confidentiality impacts). CVSS V2 Vector: (AV:N/AC:L/Au:N/C:P/I:N/A:N). Oracle Vector: (AV:N/AC:L/Au:N/C:P/I:N/A:N). Fix has been released CVE-2014-2461 P-1991V-5.5.06 P-1991V-6.0 P-1991V-6.1 P-1991V-6.2 P-1991V-6.3 P-1991V-6.3.1 P-1991V-6.3.2 P-1991V-6.3.3 5.0 AV:N/AC:L/Au:N/C:P/I:N/A:N CPUApr2014 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html P-1991V-5.5.06 P-1991V-6.0 P-1991V-6.1 P-1991V-6.2 P-1991V-6.3 P-1991V-6.3.1 P-1991V-6.3.2 P-1991V-6.3.3 Vulnerability in the Oracle Secure Global Desktop (SGD) component of Oracle Virtualization (subcomponent: Workspace Web Application). Supported versions that are affected are 4.63, 4.71, 5.0 and 5.1. Difficult to exploit vulnerability allows successful unauthenticated network attacks via HTTP. Successful attack of this vulnerability can result in unauthorized update, insert or delete access to some Oracle Secure Global Desktop (SGD) accessible data. CVSS Base Score 4.3 (Integrity impacts). CVSS V2 Vector: (AV:N/AC:M/Au:N/C:N/I:P/A:N). Oracle Vector: (AV:N/AC:M/Au:N/C:N/I:P/A:N). Fix has been released CVE-2014-2463 P-8539V-4.63 P-8539V-4.71 P-8539V-5.0 P-8539V-5.1 4.3 AV:N/AC:M/Au:N/C:N/I:P/A:N CPUApr2014 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html P-8539V-4.63 P-8539V-4.71 P-8539V-5.0 P-8539V-5.1 Vulnerability in the Oracle Agile PLM Framework component of Oracle Supply Chain Products Suite (subcomponent: Security). The supported version that is affected is 9.3.3.0. Difficult to exploit vulnerability allows successful authenticated network attacks via HTTP. Successful attack of this vulnerability can result in unauthorized read access to a subset of Oracle Agile PLM Framework accessible data. CVSS Base Score 3.5 (Confidentiality impacts). CVSS V2 Vector: (AV:N/AC:M/Au:S/C:P/I:N/A:N). Oracle Vector: (AV:N/AC:M/Au:S/C:P/I:N/A:N). Fix has been released CVE-2014-2464 P-4461V-9.3.3.0 3.5 AV:N/AC:M/Au:S/C:P/I:N/A:N CPUApr2014 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html P-4461V-9.3.3.0 Vulnerability in the Oracle Agile PLM Framework component of Oracle Supply Chain Products Suite (subcomponent: Security). The supported version that is affected is 9.3.3. Difficult to exploit vulnerability allows successful unauthenticated network attacks via HTTP. Successful attack of this vulnerability can result in unauthorized update, insert or delete access to some Oracle Agile PLM Framework accessible data. CVSS Base Score 4.3 (Integrity impacts). CVSS V2 Vector: (AV:N/AC:M/Au:N/C:N/I:P/A:N). Oracle Vector: (AV:N/AC:M/Au:N/C:N/I:P/A:N). Fix has been released CVE-2014-2465 P-4461V-9.3.3 4.3 AV:N/AC:M/Au:N/C:N/I:P/A:N CPUApr2014 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html P-4461V-9.3.3 Vulnerability in the Oracle Agile PLM Framework component of Oracle Supply Chain Products Suite (subcomponent: Security). The supported version that is affected is 9.3.3. Very difficult to exploit vulnerability allows successful authenticated network attacks via HTTP. Successful attack of this vulnerability can result in unauthorized read access to a subset of Oracle Agile PLM Framework accessible data. CVSS Base Score 2.1 (Confidentiality impacts). CVSS V2 Vector: (AV:N/AC:H/Au:S/C:P/I:N/A:N). Oracle Vector: (AV:N/AC:H/Au:S/C:P/I:N/A:N). Fix has been released CVE-2014-2466 P-4461V-9.3.3 2.1 AV:N/AC:H/Au:S/C:P/I:N/A:N CPUApr2014 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html P-4461V-9.3.3 Vulnerability in the Oracle Agile PLM Framework component of Oracle Supply Chain Products Suite (subcomponent: Security). The supported version that is affected is 9.3.3. Difficult to exploit vulnerability allows successful authenticated network attacks via HTTP. Successful attack of this vulnerability can result in unauthorized update, insert or delete access to some Oracle Agile PLM Framework accessible data. CVSS Base Score 3.5 (Integrity impacts). CVSS V2 Vector: (AV:N/AC:M/Au:S/C:N/I:P/A:N). Oracle Vector: (AV:N/AC:M/Au:S/C:N/I:P/A:N). Fix has been released CVE-2014-2467 P-4461V-9.3.3 3.5 AV:N/AC:M/Au:S/C:N/I:P/A:N CPUApr2014 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html P-4461V-9.3.3 Vulnerability in the Siebel UI Framework component of Oracle Siebel CRM (subcomponent: Open_UI.). Supported versions that are affected are 8.1.1 and 8.2.2. Difficult to exploit vulnerability allows successful unauthenticated network attacks via HTTP. Successful attack of this vulnerability can result in unauthorized update, insert or delete access to some Siebel UI Framework accessible data. CVSS Base Score 4.3 (Integrity impacts). CVSS V2 Vector: (AV:N/AC:M/Au:N/C:N/I:P/A:N). Oracle Vector: (AV:N/AC:M/Au:N/C:N/I:P/A:N). Fix has been released CVE-2014-2468 P-9011V-8.1.1 P-9011V-8.2.2 4.3 AV:N/AC:M/Au:N/C:N/I:P/A:N CPUApr2014 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html P-9011V-8.1.1 P-9011V-8.2.2 Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Security). Supported versions that are affected are 10.0.2.0, 10.3.6.0, 12.1.1.0 and 12.1.2.0. Easily exploitable vulnerability allows successful unauthenticated network attacks via T3. Successful attack of this vulnerability can result in unauthorized takeover of Oracle WebLogic Server possibly including arbitrary code execution within the Oracle WebLogic Server. CVSS Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS V2 Vector: (AV:N/AC:L/Au:N/C:P/I:P/A:P). Oracle Vector: (AV:N/AC:L/Au:N/C:P+/I:P+/A:P+). Fix has been released CVE-2014-2470 P-5242V-10.0.2.0 P-5242V-10.3.6.0 P-5242V-12.1.1.0 P-5242V-12.1.2.0 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P CPUApr2014 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html P-5242V-10.0.2.0 P-5242V-10.3.6.0 P-5242V-12.1.1.0 P-5242V-12.1.2.0 Vulnerability in the Oracle iLearning component of Oracle iLearning (subcomponent: Learner Pages). Supported versions that are affected are 6.0 and 6.1. Difficult to exploit vulnerability allows successful unauthenticated network attacks via HTTP. Successful attack of this vulnerability can result in unauthorized update, insert or delete access to some Oracle iLearning accessible data. CVSS Base Score 4.3 (Integrity impacts). CVSS V2 Vector: (AV:N/AC:M/Au:N/C:N/I:P/A:N). Oracle Vector: (AV:N/AC:M/Au:N/C:N/I:P/A:N). Fix has been released CVE-2014-2471 P-902V-6.0 P-902V-6.1 4.3 AV:N/AC:M/Au:N/C:N/I:P/A:N CPUApr2014 Oracle customers with valid support contracts http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html P-902V-6.0 P-902V-6.1