DJ-CERT - Centre gouvernementale de veille, d'alertes et de réponses aux attaques informatiques

BULLETIN D'ALERTES

Object	Multiples vulnérabilités dans plusieurs produits d'Oracle
Réference	1314
Date de Publication	2025-01-22
Sévérité	Critique

IMPACT :

Exécution de code arbitraire à distance.
Accès à des informations confidentielles.
Déni de service

SYSTÉME AFFECTÉ :

Enterprise Manager for MySQL Database, version 13.5.2.0.0
JD Edwards EnterpriseOne Orchestrator, versions antérieures à 9.2.9.2
JD Edwards EnterpriseOne Tools, versions antérieures à 9.2.9.2
MySQL Cluster, versions 7.6.32 et antérieures, 8.0.40 et antérieures, 8.4.3 et antérieures, 9.1.0 et antérieures
MySQL Connectors, versions 9.1.0 et antérieures
MySQL Enterprise Backup, versions 8.0.40 et antérieures, 8.4.3 et antérieures, 9.1.0 et antérieures
MySQL Enterprise Firewall, versions 8.0.40 et antérieures, 8.4.3 et antérieures, 9.1.0 et antérieures
MySQL Server, versions 8.0.40 et antérieures, 8.4.3 et antérieures, 9.0.1 et antérieures, 9.1.0 et antérieures
MySQL Shell, versions 8.0.40 et antérieures, 8.4.3 et antérieures, 9.1.0 et antérieures
Oracle Agile Engineering Data Management, version 6.2.1
Oracle Agile PLM Framework, version 9.3.6
Oracle Analytics Desktop, versions antérieures à 8.1.0
Oracle Application Express, versions 23.2, 24.1
Oracle Application Testing Suite, version 13.3.0.1
Oracle Banking Corporate Lending Process Management, versions 14.4.0.0.0-14.7.0.0.0
Oracle Banking Liquidity Management, version 14.7.5.0.0
Oracle Banking Origination, versions 14.5.0.0.0-14.7.0.0.0
Oracle BI Publisher, versions 7.0.0.0.0, 7.6.0.0.0
Oracle Big Data Spatial and Graph, version 3.7
Oracle Blockchain Platform, versions 21.1.2, 24.1.3
Oracle Business Activity Monitoring, version 12.2.1.4.0
Oracle Business Intelligence Enterprise Edition, versions 7.0.0.0.0, 7.6.0.0.0, 12.2.1.4.0
Oracle Business Process Management Suite, version 12.2.1.4.0
Oracle Coherence, versions 12.2.1.4.0, 14.1.1.0.0
Oracle Commerce Guided Search, version 11.3.2
Oracle Communications Billing and Revenue Management, versions 12.0.0.4-12.0.0.8, 15.0.0.0-15.0.0.1
Oracle Communications BRM - Elastic Charging Engine, versions 12.0.0.4-12.0.0.8, 15.0.0.0, 15.0.1.0
Oracle Communications Cloud Native Core Automated Test Suite, version 24.2.0
Oracle Communications Cloud Native Core Binding Support Function, versions 24.2.0, 24.2.1
Oracle Communications Cloud Native Core Certificate Management, version 24.2.1
Oracle Communications Cloud Native Core Console, version 24.2.1
Oracle Communications Cloud Native Core DBTier, version 24.3.0
Oracle Communications Cloud Native Core Network Function Cloud Native Environment, versions 24.2.0, 24.3.0
Oracle Communications Cloud Native Core Network Repository Function, version 24.2.2
Oracle Communications Cloud Native Core Policy, versions 24.2.0-24.2.2
Oracle Communications Cloud Native Core Security Edge Protection Proxy, versions 23.4.0, 24.2.0, 24.2.1, 24.2.2
Oracle Communications Cloud Native Core Service Communication Proxy, versions 24.2.0, 24.3.0
Oracle Communications Cloud Native Core Unified Data Repository, versions 23.4.4, 24.1.1, 24.2.2, 24.2.3, 24.3.0
Oracle Communications Converged Application Server, versions 8.0, 8.1
Oracle Communications Convergence, versions 3.0.2.0.0, 3.0.3.0.0, 3.0.3.3.0
Oracle Communications Diameter Signaling Router, versions 8.2.3.0.0, 8.6.0.4.0, 9.0, 9.0.0.0.0-9.0.2.0.0
Oracle Communications EAGLE Element Management System, version 47.0.0.0.0
Oracle Communications Messaging Server, version 8.1.0.26
Oracle Communications Network Analytics Data Director, versions 24.1.0, 24.2.0
Oracle Communications Offline Mediation Controller, versions 12.0.0.8, 15.0.0.0, 15.0.1.0
Oracle Communications Operations Monitor, versions 5.1, 5.2
Oracle Communications Order and Service Management, versions 7.4.0, 7.4.1, 7.5.0
Oracle Communications Policy Management, version 15.0.0.0.0
Oracle Communications Service Catalog and Design, versions 8.0.0.3, 8.1.0.1
Oracle Communications Session Border Controller, versions 9.2.0, 9.3.0
Oracle Communications Unified Assurance, versions 6.0.0-6.0.5
Oracle Communications Unified Inventory Management, versions 7.4.1, 7.4.2, 7.5.1, 7.6.0
Oracle Communications User Data Repository, versions 12.11, 14.0, 15.0
Oracle Database Server, versions 19.1, 19.3-19.25, 21.3-21.16, 23.4-23.6
Oracle Documaker, versions 12.7.1, 12.7.2, 13.0.0
Oracle E-Business Suite, versions 12.2.3-12.2.14
Oracle Enterprise Communications Broker, versions 4.1.0, 4.2.0
Oracle Enterprise Manager Base Platform, version 13.5.0.0
Oracle Enterprise Session Border Controller, versions 9.2.0, 9.3.0
Oracle Essbase, version 21.7
Oracle Financial Services Analytical Applications Infrastructure, versions 8.0.7.8, 8.0.8.6, 8.1.2.5
Oracle Financial Services Behavior Detection Platform, versions 8.0.8.1, 8.1.2.7, 8.1.2.8
Oracle Financial Services Compliance Studio, versions 8.1.2.5, 8.1.2.6
Oracle Financial Services Enterprise Case Management, versions 8.0.8.2, 8.1.2.7, 8.1.2.8
Oracle Financial Services Model Management and Governance, versions 8.1.2.6, 8.1.2.7, 8.1.3.0
Oracle Financial Services Regulatory Reporting, versions 8.1.2.7, 8.1.2.8
Oracle Financial Services Revenue Management and Billing, versions 2.9.0.0.0-7.0.0.0.0
Oracle Financial Services Trade-Based Anti Money Laundering Enterprise Edition, version 8.0.8
Oracle Fusion Middleware MapViewer, version 12.2.1.4.0
Oracle GoldenGate, versions 19.1.0.0.0-19.25.0.0.241015, 21.3-21.16, 23.4-23.6
Oracle GoldenGate Big Data and Application Adapters, versions 19.1.0.0.0-19.1.0.0.18, 21.3.0.0.0-21.16.0.0.0, 23.4-23.6
Oracle GoldenGate Studio, version 12.2.0.4.0
Oracle GoldenGate Veridata, versions 12.2.1.4.0-12.2.1.4.240430
Oracle GraalVM Enterprise Edition, versions 20.3.16, 21.3.12
Oracle GraalVM for JDK, versions 17.0.13, 21.0.5, 23.0.1
Oracle Graph Server and Client, versions 23.4.4, 24.4.0
Oracle Hospitality OPERA 5, versions 5.6.19.20, 5.6.25.8, 5.6.26.6, 5.6.27.1
Oracle HTTP Server, version 12.2.1.4.0
Oracle Hyperion Data Relationship Management, version 11.2.19.0.0
Oracle Identity Manager, version 12.2.1.4.0
Oracle Java SE, versions 8u431, 8u431-perf, 11.0.25, 17.0.13, 21.0.5, 23.0.1
Oracle Life Sciences Argus Safety, version 8.2.3
Oracle Life Sciences Empirica Signal, versions antérieures à 9.2.3
Oracle Managed File Transfer, version 12.2.1.4.0
Oracle Middleware Common Libraries and Tools, version 12.2.1.4.0
Oracle Outside In Technology, version 8.5.7
Oracle Policy Automation, versions 12.2.18-12.2.36
Oracle REST Data Services, versions 23.3.0.289.1830, 23.3.1.305.1055, 23.4.0.346.1619, 23.4.1.38.1857, 24.1.0.108.942, 24.1.1.120.1228, 24.1.2.163.1158, 24.2.0, 24.2.0.169.2208, 24.2.1.180.1634, 24.2.2.187.1943, 24.3.0
Oracle Retail Financial Integration, versions 14.1.3.2, 15.0.3.1, 16.0.3.0, 19.0.1.0
Oracle Retail Integration Bus, versions 14.1.3.2, 15.0.3.1, 16.0.3.0, 19.0.1.0
Oracle SD-WAN Edge, versions 9.1.1.0-9.1.1.9
Oracle Secure Backup, versions 18.1.0.1.0, 18.1.0.2.0, 19.1.0.0.0
Oracle Security Service, version 12.2.1.4.0
Oracle Solaris, version 11
Oracle TimesTen In-Memory Database, versions 18.1, 22.1
Oracle Utilities Application Framework, versions 4.3.0.3.0-4.3.0.6.0, 4.4.0.0.0, 4.4.0.2.0, 4.4.0.3.0, 4.5.0.0.0, 4.5.0.1.1, 4.5.0.1.3, 24.1.0.0.0-24.3.0.0.0
Oracle Utilities Network Management System, versions 2.5.0.1.14, 2.5.0.1.15, 2.5.0.2.9, 2.6.0.1.5, 2.6.0.1.7
Oracle Utilities Testing Accelerator, versions 6.0.0.1.0-6.0.0.3.0, 7.0.0.0.0-7.0.0.1.0
Oracle VM VirtualBox, versions antérieures à 7.0.24, antérieures à 7.1.6
Oracle WebCenter Portal, version 12.2.1.4.0
Oracle WebLogic Server, versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0
PeopleSoft Enterprise CC Common Application Objects, version 9.2
PeopleSoft Enterprise FIN Cash Management, version 9.2
PeopleSoft Enterprise FIN eSettlements, version 9.2
PeopleSoft Enterprise PeopleTools, versions 8.60, 8.61
PeopleSoft Enterprise SCM Purchasing, version 9.2
Primavera Gateway, versions 20.12.0-20.12.15, 21.12.0-21.12.13
Primavera P6 Enterprise Project Portfolio Management, versions 20.12.1.0-20.12.21.5, 21.12.1.0-21.12.20.0, 22.12.1.0-22.12.16.0, 23.12.1.0-23.12.10.0
Primavera Unifier, versions 20.12.0-20.12.16, 21.12.0-21.12.17, 22.12.0-22.12.15, 23.12.0-23.12.12, 24.12.0
Siebel Applications, versions 24.11 et versions antérieures

DÉSCRIPTION :

Oracle a publié une mise à jour trimestrielle contenant des correctifs de sécurité pour remédier à plusieurs vulnérabilités affectant des dizaines de produits mentionnés dans ce bulletin.Certaines de ces vulnérabilités, jugées critiques, pourraient permettre à un attaquant distant non authentifié d'exécuter du code arbitraire, d'accéder à des données sensibles ou de provoquer un déni de service.