CVE-2007-3854
Published Jul 18, 2007 · Updated Nov 3, 2026
Original summary
Normalized public record · Updated Nov 3, 2026
Multiple unspecified vulnerabilities in Oracle Database 9.0.1.5+, 9.2.0.7, and 10.1.0.5 allow remote authenticated users to have unknown impact via (1) SYS.DBMS_PRVTAQIS in the Advanced Queuing component (DB02) and (2) MDSYS.MD in the Spatial component (DB12). NOTE: Oracle has not disputed reliable researcher claims that DB02 is for SQL injection and DB12 is for a buffer overflow.
Publisher and source text is retained separately from QFinch interpretation.
QFinch assessment
Multiple unspecified vulnerabilities in Oracle Database 9.0.1.5+, 9.2.0.7, and 10.1.0.5 allow remote authenticated users to have unknown impact via (1) SYS.DBMS_PRVTAQIS in the Advanced Queuing component (DB02) and (2) MDSYS.MD in the Spatial component (DB12). NOTE: Oracle has not disputed reliable researcher claims that DB02 is for SQL injection and DB12 is for a buffer overflow.
Evidence: public source recordsAffected products
| Affected package, product or range | Fix status |
|---|---|
| Consult the referenced vendor advisory for affected versions. | Consult source advisory |
Matching a version is only one part of assessing exposure. QFinch has not assessed your environment on this public page.
Remediation
Apply the vendor-supported fixed release or mitigation, then verify the affected component is no longer reachable.
- Confirm the affected product and reachable code path exist in your environment.
- Apply the vendor-supported patch or mitigation from the primary advisory.
- Rescan the exact deployed revision and retain verification evidence.
Evidence coverage
- SSVC priority
- LOW
- Confidence
- Not available
- Aliases
- None reported
Scores appear only when corresponding evidence exists. Missing data is never interpreted as zero risk.
Sources and record history
- SSRT061201 ↗
- 26114 ↗
- www.red-database-security.com ↗
- 26166 ↗
- www.oracle.com ↗
- TA07-200A ↗
- ADV-2007-2562 ↗
- ADV-2007-2635 ↗
- oracle-prvtaqis-sql-injection(35497) ↗
- oracle-cpu-july2007(35490) ↗
- www.integrigy.com ↗
- 1018415 ↗
Record history
Published Jul 18, 2007 · Last refreshed Nov 3, 2026