The package DBMS_SQLTUNE_INTERNAL contains SQL injection vulnerabilities. in I_SET_TUNING_PARAMETER and SELECT_SQLSET. Oracle fixed this by using bind variables in their dynamic SQL statements.
You can download this advisory from the following link: https://packetstormsecurity.com/files/download/51384/Oracle-SYS.DBMS_SQLTUNE_INTERNAL.txt
Source: https://packetstormsecurity.com/files/51384/Oracle-SYS.DBMS_SQLTUNE_INTERNAL.txt.html