CVE-2004-1363: Oracle Application Server

Critical severity, CVSS 9.8. EPSS: 9.1% chance of exploitation in the next 30 days.

Buffer overflow in extproc in Oracle 10g allows remote attackers to execute arbitrary code via environment variables in the library name, which are expanded after the length check is performed.

Affected products

• Oracle Application Server: any version; version 9.0.2 only; version 9.0.2.0.0 only; version 9.0.2.0.1 only; version 9.0.2.1 only; version 9.0.2.2 only; …
• Oracle Collaboration Suite: affected versions not specified
• Oracle Database Server: version 8.1.7.4 only; version 9.0.1.4 only; version 9.0.1.5 only; version 9.0.4 only; version 9.2.0.4 only; version 9.2.0.5 only; …
• Oracle E-Business Suite: version 11.5.1 only; version 11.5.2 only; version 11.5.3 only; version 11.5.4 only; version 11.5.5 only; version 11.5.6 only; …
• Oracle Enterprise Manager: version 9 only; version 9.0.1 only
• Oracle Enterprise Manager Database Control: version 10.1.2 only
• Oracle Enterprise Manager Grid Control: version 10.1.0.2 only

Published 2004-08-04. Last modified 2026-06-16.