Oracle Tekelec Platform Distribution vulnerabilities

15 CVEs affecting Oracle Tekelec Platform Distribution, 1 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2021-30640, published 2021-07-12.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2021-3156: Sudo Heap-Based Buffer Overflow Vulnerability, published 2021-01-26. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2022-04-06. EPSS: 100% chance of exploitation in the next 30 days. Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege escalation to root via "sudoedit -s" and a command-line argument that ends…
CVE-2021-25215, published 2021-04-29. High severity, CVSS 7.5. EPSS: 11.4% chance of exploitation in the next 30 days. In BIND 9.0.0 -> 9.11.29, 9.12.0 -> 9.16.13, and versions BIND 9.9.3-S1 -> 9.11.29-S1 and 9.16.8-S1 -> 9.16.13-S1 of BIND Supported Preview Edition, as well as release versions 9.17.0 -> 9.17.11 of…
CVE-2020-10543, published 2020-06-05. High severity, CVSS 8.2. EPSS: 11.3% chance of exploitation in the next 30 days. Perl before 5.30.3 on 32-bit platforms allows a heap-based buffer overflow because nested regular expression quantifiers have an integer overflow.
CVE-2016-5018, published 2017-08-10. Critical severity, CVSS 9.1. EPSS: 10.3% chance of exploitation in the next 30 days. In Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 a malicious web application was able to bypass a configured SecurityManager via a…
CVE-2021-30640, published 2021-07-12. Medium severity, CVSS 6.5. EPSS: 9.9% chance of exploitation in the next 30 days. A vulnerability in the JNDI Realm of Apache Tomcat allows an attacker to authenticate using variations of a valid user name and/or to bypass some of the protection provided by the LockOut Realm. This…
CVE-2016-6796, published 2017-08-11. High severity, CVSS 7.5. EPSS: 8.3% chance of exploitation in the next 30 days. A malicious web application running on Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 was able to bypass a configured SecurityManager via…
CVE-2016-6797, published 2017-08-10. High severity, CVSS 7.5. EPSS: 8.1% chance of exploitation in the next 30 days. The ResourceLinkFactory implementation in Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 did not limit web application access to global…
CVE-2016-0762, published 2017-08-10. Medium severity, CVSS 5.9. EPSS: 8% chance of exploitation in the next 30 days. The Realm implementations in Apache Tomcat versions 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 did not process the supplied password if the…
CVE-2016-6794, published 2017-08-10. Medium severity, CVSS 5.3. EPSS: 7.2% chance of exploitation in the next 30 days. When a SecurityManager is configured, a web application's ability to read system properties should be controlled by the SecurityManager. In Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4,…
CVE-2020-12723, published 2020-06-05. High severity, CVSS 7.5. EPSS: 6% chance of exploitation in the next 30 days. regcomp.c in Perl before 5.30.3 allows a buffer overflow via a crafted regular expression because of recursive S_study_chunk calls.

Latest

CVE-2021-20265, published 2021-03-10. Medium severity, CVSS 5.5. EPSS: 0.3% chance of exploitation in the next 30 days. A flaw was found in the way memory resources were freed in the unix_stream_recvmsg function in the Linux kernel when a signal was pending. This flaw allows an unprivileged local user to crash the…
CVE-2021-27365, published 2021-03-07. High severity, CVSS 7.8. EPSS: 2.1% chance of exploitation in the next 30 days. An issue was discovered in the Linux kernel through 5.11.3. Certain iSCSI data structures do not have appropriate length constraints or checks, and can exceed the PAGE_SIZE value. An unprivileged…
CVE-2021-27364, published 2021-03-07. High severity, CVSS 7.1. EPSS: 1% chance of exploitation in the next 30 days. An issue was discovered in the Linux kernel through 5.11.3. drivers/scsi/scsi_transport_iscsi.c is adversely affected by the ability of an unprivileged user to craft Netlink messages.
CVE-2020-29661, published 2020-12-09. High severity, CVSS 7.8. EPSS: 1.1% chance of exploitation in the next 30 days. A locking issue was discovered in the tty subsystem of the Linux kernel through 5.9.13. drivers/tty/tty_jobctrl.c allows a use-after-free attack against TIOCSPGRP, aka CID-54ffccbf053b.
CVE-2020-10878, published 2020-06-05. High severity, CVSS 8.6. EPSS: 4.9% chance of exploitation in the next 30 days. Perl before 5.30.3 has an integer overflow related to mishandling of a "PL_regkind[OP(n)] == NOTHING" situation. A crafted regular expression could lead to malformed bytecode with a possibility of…