Unspecified vulnerability in the Oracle Outside In Technology component in Oracle Fusion Middleware 8.5.0, 8.5.1, and 8.5.2 allows local users to affect availability via unknown vectors related to Outside In Filters, a different vulnerability than CVE-2015-4808, CVE-2015-6013, CVE-2015-6015, and CVE-2016-0432. NOTE: the previous information is from the January 2016 CPU. Oracle has not commented on third-party claims that this issue is a stack-based buffer overflow in Oracle Outside In 8.5.2 and earlier, which allows remote attackers to execute arbitrary code via a crafted DOC file.

The remote Microsoft Exchange Server is missing a security update. It is, therefore, affected by multiple vulnerabilities :

  - Multiple remote code execution vulnerabilities exist in     the Oracle Outside In libraries. An unauthenticated,     remote attacker can exploit these, via a specially     crafted email, to execute arbitrary code.
    (CVE-2015-6014, CVE-2016-3575, CVE-2016-3581,     CVE-2016-3582, CVE-2016-3583, CVE-2016-3591,     CVE-2016-3592, CVE-2016-3593, CVE-2016-3594,     CVE-2016-3595, CVE-2016-3596)

  - An unspecified information disclosure vulnerability     exists in the Oracle Outside In libraries that allows an     attacker to disclose sensitive information.
    (CVE-2016-3574)

  - Multiple denial of service vulnerabilities exists in the     Oracle Outside In libraries. (CVE-2016-3576,     CVE-2016-3577, CVE-2016-3578, CVE-2016-3579,     CVE-2016-3580, CVE-2016-3590)

  - An information disclosure vulnerability exists due to     improper parsing of certain unstructured file formats.
    An unauthenticated, remote attacker can exploit this,     via a crafted email using 'send as' rights, to disclose     confidential user information. (CVE-2016-0138)

  - An open redirect vulnerability exists due to improper     handling of open redirect requests. An unauthenticated,     remote attacker can exploit this, by convincing a user     to click a specially crafted URL, to redirect the user     to a malicious website that spoofs a legitimate one.
    (CVE-2016-3378)

  - An elevation of privilege vulnerability exists due to     improper handling of meeting invitation requests. An     unauthenticated, remote attacker can exploit this, via a     specially crafted Outlook meeting invitation request,     to gain elevated privileges. (CVE-2016-3379)

The remote Microsoft Exchange Server is missing a security update. It is, therefore, affected by multiple vulnerabilities :

  - Multiple stack buffer overflow conditions exist in the     Oracle Outside In subcomponent due to improper     validation of user-supplied input. An unauthenticated,     remote attacker can exploit these, via a crafted file,     to cause a denial of service condition or the execution     of arbitrary code. (CVE-2015-6013, CVE-2015-6014,     CVE-2015-6015)

  - An email filter bypass flaw exists in the parsing of     HTML messages. An unauthenticated, remote attacker can     exploit this, via specially crafted URLs in OWA messages,     to identify, fingerprint, and track a user online if the     user views email using Outlook Web Access.
    (CVE-2016-0028)

ID	Name	Product	Family	Type	Severity
93467	MS16-108: Security Update for Microsoft Exchange Server (3185883)	Nessus	Windows : Microsoft Bulletins	Local	high
91612	MS16-079: Security Update for Microsoft Exchange Server (3160339)	Nessus	Windows : Microsoft Bulletins	Local	critical

Detections

Analytics

CVE-2015-6014

high

Tenable Plugins

high

critical