CVE-2004-1363

Buffer overflow in extproc in Oracle 10g allows remote attackers to execute arbitrary code via environment variables in the library name, which are expanded after the length check is performed.

• CWE-131

• http://marc.info/?l=bugtraq&m=110382345829397&w=2Mailing List
• http://sunsolve.sun.com/search/document.do?assetkey=1-26-101782-1Broken Link
• http://www.kb.cert.org/vuls/id/316206Third Party Advisory, US Government Resource
• http://www.ngssoftware.com/advisories/oracle23122004.txtBroken Link, Patch, Vendor Advisory
• http://www.oracle.com/technology/deploy/security/pdf/2004alert68.pdfBroken Link, Patch, Vendor Advisory
• http://www.securityfocus.com/bid/10871Broken Link, Patch, Third Party Advisory, VDB Entry
• http://www.us-cert.gov/cas/techalerts/TA04-245A.htmlBroken Link, Patch, Third Party Advisory, US Government Resource
• https://exchange.xforce.ibmcloud.com/vulnerabilities/18659Third Party Advisory, VDB Entry
• http://marc.info/?l=bugtraq&m=110382345829397&w=2Mailing List
• http://sunsolve.sun.com/search/document.do?assetkey=1-26-101782-1Broken Link
• http://www.kb.cert.org/vuls/id/316206Third Party Advisory, US Government Resource
• http://www.ngssoftware.com/advisories/oracle23122004.txtBroken Link, Patch, Vendor Advisory
• http://www.oracle.com/technology/deploy/security/pdf/2004alert68.pdfBroken Link, Patch, Vendor Advisory
• http://www.securityfocus.com/bid/10871Broken Link, Patch, Third Party Advisory, VDB Entry
• http://www.us-cert.gov/cas/techalerts/TA04-245A.htmlBroken Link, Patch, Third Party Advisory, US Government Resource
• https://exchange.xforce.ibmcloud.com/vulnerabilities/18659Third Party Advisory, VDB Entry

Published

Aug 4, 2004

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2004-1357The Secure Shell (SSH) Daemon (SSHD) in Sun Solaris 9 does n…
• CVE-2004-1358The patches (1) 114332-08 and (2) 114929-06 for Sun Solaris …
• CVE-2004-1359Multiple buffer overflows in uucp for Sun Solaris 2.6, 7, 8,…
• CVE-2004-1360Unknown vulnerability in conv_fix in Sun Solaris 7 through 9…
• CVE-2004-1361Integer underflow in winhlp32.exe in Windows NT, Windows 200…
• CVE-2004-1362The PL/SQL module for the Oracle HTTP Server in Oracle Appli…
• CVE-2004-1364Directory traversal vulnerability in extproc in Oracle 9i an…
• CVE-2004-1365Extproc in Oracle 9i and 10g does not require authentication…
• CVE-2004-1366Oracle 10g Database Server stores the password for the SYSMA…
• CVE-2004-1367Oracle 10g Database Server, when installed with a password t…
• CVE-2004-1368ISQL*Plus in Oracle 10g Application Server allows remote att…
• CVE-2004-1369The TNS Listener in Oracle 10g allows remote attackers to ca…