A buffer overflow vulnerability was found in the SYS_CONTEXT procedure in Oracle Database Server allowing a valid database user to execute arbitrary code.
The vulnerability can be exploited by any valid database user able to execute SQL commands via SQL Plus. The buffer overflow can then be exploited by calling the SYS_CONTEXT() function. As with all buffer overflows the cause for the vulnerability is either no bounds checking or a degenerate case leading to an overwrite of the buffer due to a programming error when performing bounds checking.
