CVE-2007-3854

Severity: medium (CVSS 5.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2007-07-18 · updated 2026-06-16

Description

Multiple unspecified vulnerabilities in Oracle Database 9.0.1.5+, 9.2.0.7, and 10.1.0.5 allow remote authenticated users to have unknown impact via (1) SYS.DBMS_PRVTAQIS in the Advanced Queuing component (DB02) and (2) MDSYS.MD in the Spatial component (DB12). NOTE: Oracle has not disputed reliable researcher claims that DB02 is for SQL injection and DB12 is for a buffer overflow.

Affected products

Oracle Corporation Oracle APEX: 1.5.0, 1.6.1, 2.0, 2.2
Oracle Application Server: 1.0.2.2-r2, 9.0.4.3, 10.1.2.0.1, 10.1.2.0.2, 10.1.2.1.0, 10.1.2.2.0 (+4)
Oracle Collaboration Suite: 10.1.2
Oracle Database: 9.0.1.5, 9.2.0.7-r2, 9.2.0.8-r2, 9.2.0.8dv-r2, 10.1.0.5, 10.2.0.2-r2 (+1)
Oracle E-Business Suite: 11.5.8, 11.5.9, 11.5.10, 11.5.10.2, 12.0.0, 12.0.1
Oracle Peoplesoft Enterprise Customer Relationship Management: 8.9, 9.0
Oracle Peoplesoft Enterprise Human Capital Management: 8.9, 9.0
Oracle Corporation PeopleSoft Enterprise PT PeopleTools: 8.22, 8.47, 8.48, 8.49
Oracle Secure Enterprise Search: 10.1.6, 10.1.8

References

Get alerted when CVE-2007-3854 or the next vulnerability affects your stack