SB2025071641 - Multiple vulnerabilities in Oracle Communications Cloud Native Core Console

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2025071641

SB2025071641 - Multiple vulnerabilities in Oracle Communications Cloud Native Core Console

Published: July 16, 2025

Security Bulletin ID SB2025071641
Severity
Low
Patch available
YES
Number of vulnerabilities 2
Exploitation vector Local access
Highest impact Code execution

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 2 secuirty vulnerabilities.


1) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2025-4598)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists in systemd-coredump when handling process crashes. A local user who can force a SUID process to crash can replace it with a non-SUID binary to access the original's privileged process coredump and read sensitive data, such as /etc/shadow content, loaded by the original process.


2) Untrusted search path (CVE-ID: CVE-2025-4802)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to usage of an untrusted LD_LIBRARY_PATH environment variable. A local user can use the LD_LIBRARY_PATH environment variable to point to a malicious binary and execute arbitrary code with escalated privileges.

The vulnerability affects statically linked setuid binaries that call dlopen (including internal dlopen calls after setlocale or calls to NSS functions such as getaddrinfo).


Remediation

Install update from vendor's website.

References