A number of high-risk vulnerabilities in Oracle's database products were announced today by Next Generation Security Software [NGSS] in what is likely the first news in Oracle Corp.'s new quarterly patching schedule. Surrey, U.K.-based NGSS said all versions of the Oracle Database 10g and Oracle 9i Database Server are vulnerable to the flaws, which include a buffer overflow vulnerability and PL/SQL injection vulnerabilities that allow low-privileged users to gain DBA privileges. The latter flaws can be exploited via the Web through the Oracle Application Server, NGSS said. Oracle has released a patch set [18/01/2005] to address these vulnerabilities. NGSS said...