Oracle Releases January 2025 Patch to Address 318 Flaws Across Major Products
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2016-1000027 | Pivotal Spring Framework through 5.3.16 suffers from a potential remote code execution (RCE) issue if used for Java deserialization of untrusted data | 9.8 | 33% | PoC ×2 | |
| CVE-2020-2883 | Unauthenticated RCE in Oracle WebLogic Server via T3/IIOP | 9.8 | 95% | KEV | KEV |
| CVE-2023-29824 | A use-after-free issue was discovered in Py_FindObjects() function in SciPy versions prior to 1.8.0 | 9.8 | 1% | PoC ×2 | |
| CVE-2023-3961 | A path traversal vulnerability was identified in Samba when processing client pipe names connecting to Unix domain sockets within a private directory | 9.8 | 3% | PoC | |
| CVE-2023-46604 | Unauthenticated RCE in Apache ActiveMQ via OpenWire Deserialization | 9.8 | 100% | KEVRansomwarePoC | KEV |
| CVE-2024-21287 | Incorrect Authorization Flaw in Oracle Agile PLM 9.3.6 Under Active Exploitation | 7.5 | 2% | KEV | KEV |
| CVE-2024-23807 | The Apache Xerces C++ XML parser on versions 3.0.0 before 3.2.5 contains a use-after-free error triggered during the scanning of external DTDs | 9.8 | 1% | PoC | |
| CVE-2024-37371 | In MIT Kerberos 5 (aka krb5) before 1.21.3, an attacker can cause invalid memory reads during GSS message token handling by sending message tokens with invalid… | 9.1 | 2% | ||
| CVE-2024-45492 | An issue was discovered in libexpat before 2.6.3 | 9.8 | 1% | ||
| CVE-2024-56337 | Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Apache Tomcat | 9.8 | 9% | ||
| CVE-2025-21524 | Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component | 9.8 | <1% | ||
| CVE-2025-21535 | Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component | 9.8 | <1% | ||
| CVE-2025-21556 | Vulnerability in the Oracle Agile PLM Framework product of Oracle Supply Chain (component | 9.9 | <1% |
From the original article
2 min read at thehackernews.com
Ravie Lakshmanan Jan 22, 2025 Vulnerability / Enterprise Security Oracle is urging customers to apply its January 2025 Critical Patch Update (CPU) to address 318 new security vulnerabilities spanning its products and services. The most severe of the flaws is a bug in the Oracle Agile Product Lifecycle Management (PLM) Framework (CVE-2025-21556, CVSS score: 9.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.