Multiple vulnerabilities have been reported in Oracle Database, which can be exploited by malicious users to conduct SQL injection attacks and compromise a vulnerable system and by malicious people to conduct spoofing, HTTP response splitting, and cross-site scripting and request forgery attacks and manipulate certain data.

1) Some errors exists in the Enterprise Manager Grid Control component.

For more information:
SA51884

2) The vulnerability is caused due to an error in the GeoRaster API within the Spatial component and can be exploited to cause a stack-based buffer overflow.

Successful exploitation of this vulnerability requires "Create Session" privileges.

The vulnerabilities are reported in versions 10.2.0.3, 10.2.0.4, 10.2.0.5, 11.1.0.7, 11.2.0.2, and 11.2.0.3.

Solution
Apply patch (please see the vendor's advisory for details).
Further details available to Secunia VIM customers

Provided and/or discovered by
Martin Rakhmanov, Application Security Inc.

Changelog
Further details available to Secunia VIM customers

Original Advisory
Oracle:
http://www.oracle.com/technetwork/topics/security/cpujan2013-1515902.html#AppendixDB

TeamSHATTER:
http://www.teamshatter.com/topics/general/team-shatter-exclusive/advisory-oracle-database-georaster-api-overflow/

Other references
Further details available to Secunia VIM customers

Deep Links
Links available to Secunia VIM customers