Yes and no
EXECUTE permission only grants User A the ability to call (execute) the package. It has nothing to do with the permissions of the underlying objects.
What permissions User A needs depends on the value for the
AUTHID line of the compiled package (and if CBAC is in effect).
These Packages are those whose authorization line is
AUTHID DEFINER (default)
The code only has the privileges of the Definer (user B)
User A does not need the underlying privileges.
These are packages/procedures/functions whose authorization line is
The code only has the privileges of the Invoker (user A).
User A will need underlying permissions.
CBAC === Code Based Access Control
CBAC is usually used in conjunction with Invoker's Rights code to enhance security.
Oracle 12c introduced the ability to grant a role to a package.
Under CBAC, the user has (temporarily) the privileges that were granted to the package through a role.
The code only has the privileges of the granted Role.
User A does not need the underlying privileges if and only if the appropriate privileges have been granted to the package being called.
This allows the developer to (temporarily) grant only the neccesary permissions needed to run the code to the user calling the code.
You can read more about CBAC here
This applies to Packages and standalone Functions and standalone Procedures