Oracle Spatial And Graph vulnerabilities

3 CVEs affecting Oracle Spatial And Graph, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2021-45943, published 2022-01-01.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2020-9488, published 2020-04-27. Low severity, CVSS 3.7. EPSS: 8.2% chance of exploitation in the next 30 days. Improper validation of certificate with host mismatch in Apache Log4j SMTP appender. This could allow an SMTPS connection to be intercepted by a man-in-the-middle attack which could leak any log…
CVE-2019-17545, published 2019-10-14. Critical severity, CVSS 9.8. EPSS: 2.6% chance of exploitation in the next 30 days. GDAL through 3.0.1 has a poolDestroy double free in OGRExpatRealloc in ogr/ogr_expat.cpp when the 10MB threshold is exceeded.
CVE-2021-45943, published 2022-01-01. Medium severity, CVSS 5.5. EPSS: 1.5% chance of exploitation in the next 30 days. GDAL 3.3.0 through 3.4.0 has a heap-based buffer overflow in PCIDSK::CPCIDSKFile::ReadFromFile (called from PCIDSK::CPCIDSKSegment::ReadFromFile and…