CVE-2023-34364: progress datadirect odbc oracle wire protoco…

csirt@kutim:~/threat-intel/cve/CVE-2023-34364

CVSS 9.8 · Critical EPSS 1,6%

Kerentanan Out-of-bounds Write pada progress datadirect odbc oracle wire protocol driver. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

A buffer overflow was discovered in Progress DataDirect Connect for ODBC before 08.02.2770 for Oracle. An overly large value for certain options of a connection string may overrun the buffer allocated to process the string value. This allows an attacker to execute code of their choice on an affected host by copying carefully selected data that will be executed as code.

Rincian

Terbit di NVD: 9 Juni 2023
Terakhir diubah: 17 Juni 2026
Status NVD: Modified
CVSS 3.1: 9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-787: Out-of-bounds Write
EPSS (30 hari): 1,6% peluang dieksploitasi; lebih tinggi dari 75,0% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
progress	datadirect odbc oracle wire protocol driver	Semua versi sebelum 08.02.2770

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://community.progress.com/s/article/Security-vulnerabilities-in-DataDirect-ODBC-Oracle-Wire-Protocol-driv... advisory vendor
https://progress.com product

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.