----------------------------------------------------------------------


  Secunia CSI
+ Microsoft SCCM
-----------------------
= Extensive Patch Management

http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/


----------------------------------------------------------------------

TITLE:
Oracle E-Business Suite Multiple Vulnerabilities

SECUNIA ADVISORY ID:
SA39441

VERIFY ADVISORY:
http://secunia.com/advisories/39441/

DESCRIPTION:
Multiple vulnerabilities have been reported in Oracle E-Business
Suite, which can be exploited by malicious users to manipulate
certain data and by malicious people to disclose potentially
sensitive information or manipulate certain data.

1) An error in the Oracle Application Object Library component can be
exploited to disclose or manipulate certain data.

2) An error in the Oracle iStore component can be exploited to
disclose or manipulate certain data.

3) An error in the Oracle HRMS (Self Service) component can be
exploited to disclose certain information.

4) An error in the Oracle Agile Engineering Data Management component
can be exploited to disclose certain information.

5) An error in the Oracle Application Object Library component can be
exploited to manipulate certain data.

6) An error in the Oracle Transportation Management component can be
exploited to disclose certain information.

7) An error in the E-Business Intelligence component can be exploited
by authenticated users to manipulate certain data.

8) An error in the Oracle Workflow Cartridge component can be
exploited by authenticated users to manipulate certain data.

The vulnerabilities are reported in the following products and
versions:
* Oracle E-Business Suite Release 12, versions 12.0.4, 12.0.5,
12.0.6, 12.1.1, and 12.1.2
* Oracle E-Business Suite Release 11i, versions 11.5.10 and 11.5.10.2

SOLUTION:
Apply patches (please see the vendor's advisory for details).

PROVIDED AND/OR DISCOVERED BY:
It is currently unclear who reported these vulnerabilities as the
Oracle Critical Patch Update for April 2010 only provides a bundled
list of credits. This section will be updated when/if the original
reporter provides more information.

ORIGINAL ADVISORY:
Oracle:
http://www.oracle.com/technology/deploy/security/critical-patch-updates/cpuapr2010.html

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
private users keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/advisories/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/advisories/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------