{"id":"CVE-2014-6567","description":"Unspecified vulnerability in the Core RDBMS component in Oracle Database Server 11.1.0.7, 11.2.0.3, 11.2.0.4, 12.1.0.1, and 12.1.0.2 allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors.  NOTE: the previous information is from the January 2015 CPU. Oracle has not commented on the researcher's claim that this is a stack-based buffer overflow in DBMS_AW.EXECUTE, which allows code execution via a long Current Directory Alias (CDA) command.","cvssScore":9,"cvssVersion":"2.0","cvssVector":"AV:N/AC:L/Au:S/C:C/I:C/A:C","cvssMetrics":[{"version":"2.0","score":9,"vector":"AV:N/AC:L/Au:S/C:C/I:C/A:C","source":"nvd@nist.gov","sourceName":"NVD","type":"Primary"}],"resolved":"OUT-OF-SCOPE","published":"2015-01-21","lastModified":"2026-06-17","affectedProducts":[{"vendor":"oracle","product":"database server","version":"11.1.0.7"},{"vendor":"oracle","product":"database server","version":"11.2.0.3"},{"vendor":"oracle","product":"database server","version":"11.2.0.4"},{"vendor":"oracle","product":"database server","version":"12.1.0.1"},{"vendor":"oracle","product":"database server","version":"12.1.0.2"}],"totalAffectedProducts":1,"references":[{"url":"http://www.databaseforensics.com/Oracle_Jan2015_CPU.pdf","source":"secalert_us@oracle.com","tags":["Patch"]},{"url":"http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html","source":"secalert_us@oracle.com","tags":["Patch","Vendor Advisory"]},{"url":"http://www.securityfocus.com/bid/72134","source":"secalert_us@oracle.com"},{"url":"http://www.securitytracker.com/id/1031572","source":"secalert_us@oracle.com"}],"reasoning":{"decidingSource":"h2-out-of-scope-with-cpe","decidingReason":"Manual classification marked OUT-OF-SCOPE but CVE matches known CPE products","verdicts":[{"rule":"rejected","stage":"identity","outcome":"no-match"},{"rule":"armr-patch-file","stage":"scope","outcome":"no-match"},{"rule":"armr-secure-rule-file","stage":"scope","outcome":"no-match"},{"rule":"manual-classification","stage":"scope","outcome":"no-match"},{"rule":"h2-history","stage":"scope","outcome":"matched","status":"OUT-OF-SCOPE","detail":"Found in legacy manual classifications","decisive":true}]},"oracleAdvisories":[{"advisory":"Oracle Critical Patch Update January 2015","releaseType":"CPU","quarter":"2015-Q1","url":"https://www.oracle.com/security-alerts/cpujan2015.html","products":[{"product":"Oracle Database Server","component":"Core RDBMS","affectedVersions":"11.1.0.7, 11.2.0.3, 11.2.0.4, 12.1.0.1, 12.1.0.2"}]}],"assessment":{"record":{"state":"active"},"protection":{"level":"none"},"action":{"state":"not-needed","type":"none"},"review":{"state":"human","basis":"manual-review"}},"h2Comments":"## Manual Classification Context\n\n\n**Labels:** CREATE SESSION, SEE NOTE 1, ORACLE NET\n\n**Products:** CORE RDBMS, ORACLE DATABASE SERVER","signals":{"hasPOC":false,"pocCount":0},"kev":{"inKEV":false},"epss":{"available":true,"score":0.04618,"percentile":0.91179},"ssvc":{"available":false}}