CVE-2007-3854
Multiple unspecified vulnerabilities in Oracle Database 9.0.1.5+, 9.2.0.7, and 10.1.0.5 allow remote authenticated users to have unknown impact via (1) SYS.DBMS_PRVTAQIS in the Advanced Queuing component (DB02) and (2) MDSYS.MD in the Spatial component…
Does this matter?
Lower severity and a low EPSS score (2.53%). Track it; it rarely justifies an emergency change on its own.
Description
Multiple unspecified vulnerabilities in Oracle Database 9.0.1.5+, 9.2.0.7, and 10.1.0.5 allow remote authenticated users to have unknown impact via (1) SYS.DBMS_PRVTAQIS in the Advanced Queuing component (DB02) and (2) MDSYS.MD in the Spatial component (DB12). NOTE: Oracle has not disputed reliable researcher claims that DB02 is for SQL injection and DB12 is for a buffer overflow.
- CVSS 2.0
- 5.5 MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:N
- EPSS
- 2.53% probability · 85th percentile
- Public exploits
- None in Exploit-DB
- CISA KEV
- Not listed
- Affected
- oracle/apex · oracle/application server · oracle/collaboration suite · oracle/database server · oracle/e-business suite · oracle/peoplesoft enterprise customer relationship management · oracle/peoplesoft enterprise human capital management · oracle/peoplesoft enterprise peopletools · oracle/secure enterprise search
- Source
- cve@mitre.org
EPSS 2.5% since 26 October 2026; no change recorded yet. Points are recorded when the score first appears and whenever it moves by a percentage point or more.
References
- http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c00727143
- http://secunia.com/advisories/26114Patch, Vendor Advisory
- http://secunia.com/advisories/26166Vendor Advisory
- http://www.integrigy.com/security-resources/analysis/Integrigy_Oracle_CPU_July_2007_Analysis.pdf
- http://www.oracle.com/technetwork/topics/security/cpujul2007-087014.html
- http://www.red-database-security.com/advisory/oracle_cpu_jul_2007.html
- http://www.red-database-security.com/advisory/oracle_sql_injection_dbms_prvtaqis.html
- http://www.securitytracker.com/id?1018415
- http://www.us-cert.gov/cas/techalerts/TA07-200A.htmlUS Government Resource
- http://www.vupen.com/english/advisories/2007/2562Vendor Advisory
- http://www.vupen.com/english/advisories/2007/2635Vendor Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/35490
- https://exchange.xforce.ibmcloud.com/vulnerabilities/35497
- http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c00727143
- http://secunia.com/advisories/26114Patch, Vendor Advisory
- http://secunia.com/advisories/26166Vendor Advisory
- http://www.integrigy.com/security-resources/analysis/Integrigy_Oracle_CPU_July_2007_Analysis.pdf
- http://www.oracle.com/technetwork/topics/security/cpujul2007-087014.html
- http://www.red-database-security.com/advisory/oracle_cpu_jul_2007.html
- http://www.red-database-security.com/advisory/oracle_sql_injection_dbms_prvtaqis.html
- http://www.securitytracker.com/id?1018415
- http://www.us-cert.gov/cas/techalerts/TA07-200A.htmlUS Government Resource
- http://www.vupen.com/english/advisories/2007/2562Vendor Advisory
- http://www.vupen.com/english/advisories/2007/2635Vendor Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/35490
- https://exchange.xforce.ibmcloud.com/vulnerabilities/35497
Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.