Unspecified vulnerability in the Core RDBMS component in Oracle Database 10.1.0.5 has unknown impact and remote authenticated attack…

Description

Unspecified vulnerability in the Core RDBMS component in Oracle Database 10.1.0.5 has unknown impact and remote authenticated attack vectors related to sys.dbms_sqltune, aka Vuln# DB10. NOTE: as of 20061023, Oracle has not disputed reports from reliable third parties that DB10 is for SQL injection in DROP_SQLSET, DELETE_SQLSET, SELECT_SQLSET, and I_SET_TUNING_PARAMETER. NOTE: some of these vectors might be in DBMS_SQLTUNE_INTERNAL.

Scores

EPSS (exploitation in 30 days)

3.0% · top 12% of all CVEs (5 Nov 2026)

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 9.0.

Weakness

• n/a

Affected products

• n/a

  • affected n/a

References (12)

• http://www.red-database-security.com/advisory/oracle_cpu_oct_2006.html (opens in a new tab)x_refsource_MISCx_transferred
• 20588 (opens in a new tab)vdb-entryx_refsource_BIDx_transferred
• HPSBMA02133 (opens in a new tab)vendor-advisoryx_refsource_HPx_transferred
• http://www.oracle.com/technetwork/topics/security/cpuoct2006-095368.html (opens in a new tab)x_refsource_CONFIRMx_transferred
• http://www.databasesecurity.com/oracle/OracleOct2006-CPU-Analysis.pdf (opens in a new tab)x_refsource_MISCx_transferred
• 20061018 Analysis of the Oracle October 2006 Critical Patch Update (opens in a new tab)mailing-listx_refsource_BUGTRAQx_transferred
• http://www.red-database-security.com/advisory/oracle_sql_injection_dbms_sqltune_internal.html (opens in a new tab)x_refsource_MISCx_transferred
• ADV-2006-4065 (opens in a new tab)vdb-entryx_refsource_VUPENx_transferred
• 20061023 SQL Injection in package SYS.DBMS_SQLTUNE_INTERNAL (opens in a new tab)mailing-listx_refsource_BUGTRAQx_transferred
• 22396 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• 1017077 (opens in a new tab)vdb-entryx_refsource_SECTRACKx_transferred
• TA06-291A (opens in a new tab)third-party-advisoryx_refsource_CERTx_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2006-5338](https://trackcve.app/badge/CVE-2006-5338.svg)](https://trackcve.app/cve/CVE-2006-5338)

Record last updated 7 Aug 2024, 19:48 UTC.