WaratekVRT Sign in

Oracle Critical Patch Update October 2012

Released October 2012 · Oracle's advisory ↗ · ← Critical Patch Update, July 2012 · Java SE Critical Patch Update, October 2012 →

107 CVEs in this release, one square each

Protected by Waratek, exploitedProtected by Waratek, exploitedMitigation candidate, exploitedMitigation candidateMitigation candidateMitigation candidateMitigation candidateNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicable
Share this chart Oracle Critical Patch Update October 2012, one square per CVE: 68 Java CVEs, 2 protected by Waratek, 3 exploited, 39 other CVEs in this release.

Download the image

By status

2Protected by Waratek5Mitigation candidate61No exploit published5Outside Waratek scope34Not applicable 3Exploited, marked by the ring

No exploit published. For 61 of them, Oracle's security advisory is the source of public detail.

Protected by Waratek. Waratek RASP can block exploitation of these on systems that have not applied the patch yet.

Reset
More filters
Columns
Including CVEs outside Waratek scope✕
Overview 107 matches · 68 in Waratek scope · 2 protected · 3 exploited · 2 CISA KEV · 9 public PoC · 2 EPSS ≥ 0.5
107matches 68in Waratek scope63.6% 2protected1.9% 3exploited2.8% 2CISA KEV1.9% 9public PoC8.4% 2EPSS ≥ 0.51.9%
Protected by Waratek 2 1.9% Rule in development 0 0.0% Mitigation candidate 5 4.7% No exploit published 61 57.0% Outside Waratek scope 5 4.7% Not applicable 34 31.8% Withdrawn CVE 0 0.0%
Critical 1 0.9% High 8 7.5% Medium 61 57.0% Low 37 34.6% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 2 1.9% partly blocked 0 0.0% not blocked 104 97.2% not established 1 0.9% unrecorded 0 0.0%
Exploited 3 2.8% Working exploit published 7 6.5% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 97 90.7%
split by peak 103 / month
Not applicable: 34Outside Waratek scope: 5No exploit published: 61Mitigation candidate: 5Protected by Waratek: 2 Low: 37Medium: 61High: 8Critical: 1 not established: 1not blocked: 104blocked by ARMR today: 2 No public exploit: 97Working exploit published: 7Exploited: 3
Sep 111 Not applicable1 Medium1 not blocked1 No public exploit1 Oct 110 Nov 110 Dec 110 Jan 120 Feb 120 Mar 120 Apr 120 May 120 Jun 121 Not applicable1 High1 not blocked1 Working exploit published1 Jul 120 Aug 121 Outside Waratek scope1 Medium1 not blocked1 No public exploit1 Sep 121 Outside Waratek scope1 Medium1 not blocked1 Working exploit published1 Oct 12103 Protected by Waratek2 Mitigation candidate5 No exploit published61 Outside Waratek scope3 Not applicable32 Critical1 High7 Medium58 Low37 blocked by ARMR today2 not blocked100 not established1 Exploited3 Working exploit published5 No public exploit95
Oct 11Dec 11Feb 12Apr 12Jun 12Aug 12Oct 12
107 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed. ‹ prev page 2 of 2 next ›
CVE Severity Published▾ Status Exploitation Description
CVE-2012-0090 Low 2012-10-16 No exploit published No public exploit Unspecified vulnerability in the Oracle Imaging and Process Management component in Oracle Fusion Middleware 10.1.3.6.0 allows remote authenticated users to affect integrity via unknown vectors related to Web, a different vulnerability than CVE-2012-0092.
CVE-2012-0086 Low 2012-10-16 No exploit published No public exploit Unspecified vulnerability in the Oracle Imaging and Process Management component in Oracle Fusion Middleware 10.1.3.6.0 allows remote authenticated users to affect confidentiality via unknown vectors related to Web, a different vulnerability than CVE-2012-0095 and CVE-2012-0108.
CVE-2012-0071 Medium 2012-10-16 No exploit published No public exploit Unspecified vulnerability in the Oracle Imaging and Process Management component in Oracle Fusion Middleware 10.1.3.6.0 allows remote attackers to affect integrity via unknown vectors related to Web, a different vulnerability than CVE-2012-0093.
CVE-2012-3137 Medium 2012-09-21 Outside Waratek scope Working exploit published The authentication protocol in Oracle Database Server 10.2.0.3, 10.2.0.4, 10.2.0.5, 11.1.0.7, 11.2.0.2, and 11.2.0.3 allows remote attackers to obtain the session key and salt for arbitrary users, which leaks information about the cryptographic hash and makes it easier to conduct brute force password guessing attacks, aka "stealth password cracking vulnerability."
CVE-2012-3132 Medium 2012-08-10 Outside Waratek scope No public exploit SQL injection vulnerability in Oracle Database Server 10.2.0.3, 10.2.0.4, 10.2.0.5, 11.1.0.7, 11.2.0.2, and 11.2.0.3 allows remote authenticated users to execute arbitrary SQL commands via vectors involving CREATE INDEX with a CTXSYS.CONTEXT INDEXTYPE and DBMS_STATS.GATHER_TABLE_STATS.
CVE-2012-0217 High 2012-06-12 Not applicable Working exploit published The x86-64 kernel system-call functionality in Xen 4.1.2 and earlier, as used in Citrix XenServer 6.0.2 and earlier and other products; Oracle Solaris 11 and earlier; illumos before r13724; Joyent SmartOS before 20120614T184600Z; FreeBSD before 9.0-RELEASE-p3; NetBSD 6.0 Beta and earlier; Microsoft Windows Server 2008 R2 and R2 SP1 and Windows 7 Gold and SP1; and possibly other operating systems, when running on an Intel processor, incorrectly uses the sysret path in cases where a certain address is not a canonical address, which allows local users to gain privileges via a crafted application. NOTE: because this issue is due to incorrect use of the Intel specification, it should have been split into separate identifiers; however, there was some value in preserving the original mapping of the multi-codebase coordinated-disclosure effort to a single identifier.
CVE-2011-1411 Medium 2011-09-02 Not applicable No public exploit Shibboleth OpenSAML library 2.4.x before 2.4.3 and 2.5.x before 2.5.1, and IdP before 2.3.2, allows remote attackers to forge messages and bypass authentication via an "XML Signature wrapping attack."
‹ prev page 2 of 2 next ›