PT-2020-3870 · Oracle · Oracle Solaris

Published 2020-07-15 · Updated 2020-07-17 · CVE-2020-14537

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:H/UI:R/S:C/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions: Oracle Solaris version 11

Description: The issue is related to errors in resource release in the Packaging Scripts component of Oracle Solaris. Exploitation of this issue can allow an attacker to cause a denial of service. The vulnerability can be easily exploited by a high-privileged attacker with logon to the infrastructure where Oracle Solaris executes, requiring human interaction from a person other than the attacker. Successful attacks can result in the unauthorized ability to cause a hang or frequently repeatable crash of Oracle Solaris.

Recommendations: For Oracle Solaris version 11, there is no information about a newer version that contains a fix for this vulnerability.

Improper Resource Release

Weakness Enumeration

CWE-404

Related Identifiers

BDU:2020-04262

CVE-2020-14537

Affected Products

Oracle Solaris

References · 5

• https://osv.dev/vulnerability/CVE-2020-14537 · Vendor Advisory
• https://oracle.com/security-alerts/cpujul2020.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-14537 · Security Note
• https://bdu.fstec.ru/vul/2020-04262 · Security Note
• https://cybersecurity-help.cz/vdb/SB2020071544 · Note