CVE Feed

    Dashboard / CVE / CVE-2006-0272

    CVE-2006-0272

    Unspecified vulnerability in the XML Database component of Oracle Database server 9.2.0.7 and 10.1.0.4 has unspecified impact and attack vectors, as identified by Oracle Vuln# DB29. NOTE: based on mutual credits by the relevant sources, it is highly likely that this issue is a buffer overflow in the (a) DBMS_XMLSCHEMA and (b) DBMS_XMLSCHEMA_INT packages, as exploitable via long arguments to (1) XDB.DBMS_XMLSCHEMA.GENERATESCHEMA or (2) XDB.DBMS_XMLSCHEMA.GENERATESCHEMAS.

    Published:Jan 18, 2006
    Last Modified:Apr 16, 2026
    EPS:Jan 18, 2006
    EPSS Score:0.28125
    CVSS Score:9

    Affected Products

    Vendor
    Oracle
    Product
    Oracle10g
    Vendor
    Oracle
    Product
    Oracle9i

    Exploits

    No exploit reference

    Common Weakness Enumeration

    No CWE recorded yet

    Common Attack Pattern Enumeration and Classification (CAPEC)

    No CAPEC recorded yet

    Related CVEs

    CVE-2007-3856 (CVSS 6.5) — Unspecified vulnerability in the Oracle Data Mining component for Oracle Database 10g Release 2 10.2.0.2 and 1…
    CVE-2006-6703 (CVSS 6.8) — Multiple cross-site scripting (XSS) vulnerabilities in Oracle Portal 9i and 10g allow remote attackers to inje…
    CVE-2006-1705 (CVSS 2.1) — Oracle Database 9.2.0.0 to 10.2.0.3 allows local users with "SELECT" privileges for a base table to insert, up…
    CVE-2006-0586 (CVSS 7.5) — Multiple SQL injection vulnerabilities in Oracle 10g Release 1 before CPU Jan 2006 allow remote attackers to e…
    CVE-2006-0552 (CVSS 7.5) — Unspecified vulnerability in the Net Listener component of Oracle Database server 8.1.7.4, 9.0.1.5, 9.0.1.5 FI…
    CVE-2006-0262 (CVSS 10) — Unspecified vulnerability in the Net Foundation Layer component of Oracle Database server 8.1.7.4, 9.0.1.5, 9.…
    CVE-2006-0271 (CVSS 10) — Unspecified vulnerability in the Upgrade & Downgrade component of Oracle Database server 8.1.7.4, 9.0.1.5, 9.2…
    CVE-2006-0269 (CVSS 5.5) — Unspecified vulnerability in the Streams Capture component of Oracle Database server 10.1.0.5 and 10.2.0.1 has…
    CVE-2005-4832 (CVSS 7.5) — SQL injection vulnerability in the Oracle Database Server 10g allows remote authenticated users to execute arb…
    CVE-2005-3641 (CVSS 7.5) — Oracle Databases running on Windows XP with Simple File Sharing enabled, allows remote attackers to bypass aut…

    References

    http://archives.neohapsis.com/archives/fulldisclosure/2006-01/0893.html
    http://secunia.com/advisories/18493
    http://secunia.com/advisories/18608
    http://securitytracker.com/id?1015499
    http://www.argeniss.com/research/ARGENISS-ADV-010601.txt
    http://www.integrigy.com/info/IntegrigySecurityAnalysis-CPU0106.pdf
    http://www.kb.cert.org/vuls/id/545804
    http://www.kb.cert.org/vuls/id/891644
    http://www.oracle.com/technetwork/topics/security/cpujan2006-082403.html
    http://www.red-database-security.com/advisory/oracle_cpu_jan_2006.html
    http://www.securityfocus.com/bid/16287
    http://www.us-cert.gov/cas/techalerts/TA06-018A.html
    http://www.vupen.com/english/advisories/2006/0243
    http://www.vupen.com/english/advisories/2006/0323
    https://exchange.xforce.ibmcloud.com/vulnerabilities/24321
    https://exchange.xforce.ibmcloud.com/vulnerabilities/24376
    http://archives.neohapsis.com/archives/fulldisclosure/2006-01/0893.html
    http://secunia.com/advisories/18493
    http://secunia.com/advisories/18608
    http://securitytracker.com/id?1015499
    http://www.argeniss.com/research/ARGENISS-ADV-010601.txt
    http://www.integrigy.com/info/IntegrigySecurityAnalysis-CPU0106.pdf
    http://www.kb.cert.org/vuls/id/545804
    http://www.kb.cert.org/vuls/id/891644
    http://www.oracle.com/technetwork/topics/security/cpujan2006-082403.html
    http://www.red-database-security.com/advisory/oracle_cpu_jan_2006.html
    http://www.securityfocus.com/bid/16287
    http://www.us-cert.gov/cas/techalerts/TA06-018A.html
    http://www.vupen.com/english/advisories/2006/0243
    http://www.vupen.com/english/advisories/2006/0323
    https://exchange.xforce.ibmcloud.com/vulnerabilities/24321
    https://exchange.xforce.ibmcloud.com/vulnerabilities/24376

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High