Impatto Sistemico

Alto (66.66)

Sintesi

Oracle ha rilasciato il Critical Patch Update di agosto che mira a correggere numerose vulnerabilità su più prodotti, di cui 145 con gravità “critica” e 520 con gravità “alta”.

Tipologia

• Authentication Bypass
• Denial of Service
• Privilege Escalation
• Arbitrary Code Execution

Prodotti e/o versioni affette

Oracle

• Database Server
• Autonomous Health Framework
• Essbase
• Application Testing Suite
• Commerce Guided Search / Commerce Experience Manager
• Commerce Platform
• Communications Unified Inventory Management
• Payments
• Workflow
• Call Center Technology
• Customers Online
• Flow Manufacturing
• General Ledger
• Payroll
• Product Hub
• Purchasing
• Risk Management
• Sales for Handhelds
• Sales Foundation
• Scripting
• Teleservice
• U.S. Federal Financials
• Work in Process
• Yard Management
• Customer Care
• Trading Community
• Bills of Material
• Warehouse Management
• Advanced Inbound Telephony
• Email Center
• HCM Common Architecture
• MES for Process Manufacturing
• Partner Management
• Applications Platform Engineering
• Internet Procurement Connector
• iRecruitment
• Labor Distribution
• Payables
• Process Manufacturing Systems
• Project Planning and Control
• Sales
• HRMS (US)
• Public Sector Human Resources
• Financials Common Modules
• Marketing
• Marketing Encyclopedia System
• Enterprise Asset Management
• Service Fulfillment Manager
• Transportation Execution
• Applications DBA
• iSetup
• iSupplier Portal
• Operations Intelligence
• Order Management
• SDP Number Portability
• Service Contracts
• Telecommunications Billing Integrator
• Cost Management
• HRMS (Netherlands)
• Proposals
• Complex Maintenance, Repair and Overhaul
• E-Business Tax
• Financials for Asia/Pacific
• Financials for EMEA
• Landed Cost Management
• Loans
• Enterprise Manager Base Platform
• Enterprise Manager for Systems Infrastructure
• Financial Services Enterprise Case Management
• Hospitality Simphony
• Internet Directory
• Helidon
• Identity Manager
• Identity Manager Connector
• Managed File Transfer
• Reports Developer
• WebCenter Enterprise Capture
• WebCenter Portal
• WebCenter Sites
• WebLogic Server
• Access Manager
• Web Services Manager
• WebCenter Content
• Service Delivery Platform
• SOA Suite
• Virtual Directory
• Unified Directory
• Outside In Technology
• BI Publisher
• Business Intelligence Enterprise Edition
• Hospitality OPERA 5 Property Services
• Hyperion Data Relationship Management
• Hyperion Financial Management
• Hyperion Calculation Manager
• Hyperion Financial Reporting
• Hyperion Infrastructure Technology
• Hyperion Profitability and Cost Management
• Java SE
• JD Edwards EnterpriseOne Tools
• JD Edwards EnterpriseOne Orchestrator
• JD Edwards EnterpriseOne US Payroll
• MySQL Cluster
• PeopleSoft Enterprise PeopleTools
• PeopleSoft Enterprise CC Common Application Objects
• PeopleSoft Enterprise FIN Common Objects
• PeopleSoft Enterprise FIN Lease Administration
• PeopleSoft Enterprise FIN Common Objects Brazil
• Siebel CRM Cloud Applications
• Siebel CRM Integration
• Siebel CRM Administration
• Siebel Apps – Self Service
• Siebel Apps – Marketing
• Siebel CRM Deployment
• Siebel CRM End User
• Siebel Artificial Intelligence
• Agile PLM
• Agile PLM MCAD Connector
• Demand Planning
• Agile Engineering Data Management
• Product Lifecycle Analytics
• VM VirtualBox

Azioni di mitigazione

In linea con le dichiarazioni del vendor, si consiglia di aggiornare i prodotti all’ultima versione disponibile.

Per approfondimenti sui prodotti interessati e sulle modalità di intervento si consiglia di fare riferimento al bollettino di sicurezza disponibile nella sezione Riferimenti.

Di seguito sono riportate le sole CVE relative alle vulnerabilità con gravità “critica” e “alta”: