Red Hat Security Advisory

RHSA-2011:0897

JBoss Enterprise Web Server 1.0.2 update

Released 2011-06-22 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat JBoss Enterprise Web Server 1 for RHEL 5 Server ant-1.7.1-13.jdk6.ep5.el5, ant-antlr-1.7.1-13.jdk6.ep5.el5, ant-apache-bcel-1.7.1-13.jdk6.ep5.el5 +47
Red Hat JBoss Enterprise Web Server 1 for RHEL 6 Server ant-1.7.1-14.ep5.el6, ant-antlr-1.7.1-14.ep5.el6, ant-apache-bcel-1.7.1-14.ep5.el6 +47
Red Hat JBoss Web Server 1.0 for RHEL 4 AS ant-1.7.1-13.jdk6.ep5.el4, antlr-2.7.7-7.ep5.el4, bcel-5.2-8.1.ep5.el4 +47
Red Hat JBoss Web Server 1.0 for RHEL 4 ES ant-1.7.1-13.jdk6.ep5.el4, antlr-2.7.7-7.ep5.el4, bcel-5.2-8.1.ep5.el4 +47

Fixes 8 records

TI-2010-03927 CVE-2010-4172 · GHSA-c78g-qwpw-2jgv

Multiple cross-site scripting (XSS) vulnerabilities in the Manager application in Apache…

MEDIUM 48

Multiple cross-site scripting (XSS) vulnerabilities in the Manager application in Apache Tomcat 6.0.12 through 6.0.29 and 7.0.0 through 7.0.4 allow remote attackers to inject arbitrary web script or HTML via the (1) orde…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.42009 Published 2010-11-26 Fixed in 7.0.5 CWE-79

TI-2010-01113 CVE-2010-1157 · GHSA-w6q7-ww2x-7gm3

Apache Tomcat 5.5.0 through 5.5.29 and 6.0.0 through 6.0.26 might allow remote attackers…

MEDIUM 45

Apache Tomcat 5.5.0 through 5.5.29 and 6.0.0 through 6.0.26 might allow remote attackers to discover the server's hostname or IP address by sending a request for a resource that requires (1) BASIC or (2) DIGEST authentic…

CVSS 2.0LOW 2.6 Network No auth Interaction — EPSS 0.52507 Published 2010-04-23 Partial fix · 5.5.30, 6.0.28 CWE-200

TI-2011-00350 CVE-2011-0419 · GHSA-hx32-x2cq-h45v

Stack consumption vulnerability in the fnmatch implementation in apr_fnmatch.c in the…

MEDIUM 44

Stack consumption vulnerability in the fnmatch implementation in apr_fnmatch.c in the Apache Portable Runtime (APR) library before 1.4.3 and the Apache HTTP Server before 2.2.18, and in fnmatch.c in libc in NetBSD 5.1, O…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.30406 Published 2011-05-16 Fixed CWE-770

TI-2010-01567 CVE-2010-1623 · GHSA-2cc8-vf33-qm9m

Memory leak in the apr_brigade_split_line function in buckets/apr_brigade.c in the Apache…

MEDIUM 42

Memory leak in the apr_brigade_split_line function in buckets/apr_brigade.c in the Apache Portable Runtime Utility library (aka APR-util) before 1.3.10, as used in the mod_reqtimeout module in the Apache HTTP Server and…

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.2033 Published 2010-10-04 Fixed CWE-119

TI-2010-01406 CVE-2010-1452 · GHSA-gmw3-8mp2-pvvf

The (1) mod_cache and (2) mod_dav modules in the Apache HTTP Server 2.2.x before 2.2.16…

MEDIUM 42

The (1) mod_cache and (2) mod_dav modules in the Apache HTTP Server 2.2.x before 2.2.16 allow remote attackers to cause a denial of service (process crash) via a request that lacks a path.

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.21425 Published 2010-07-28 Partial fix

TI-2012-03897 CVE-2012-4557 · GHSA-9p9q-h6h7-37g9

The mod_proxy_ajp module in the Apache HTTP Server 2.2.12 through 2.2.21 places a worker…

MEDIUM 40

The mod_proxy_ajp module in the Apache HTTP Server 2.2.12 through 2.2.21 places a worker node into an error state upon detection of a long request-processing time, which allows remote attackers to cause a denial of servi…

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.1747 Published 2012-11-30 Fixed CWE-399

TI-2011-00013 CVE-2011-0013 · GHSA-3p86-xgrq-m6p6

Multiple cross-site scripting (XSS) vulnerabilities in the HTML Manager Interface in…

LOW 32

Multiple cross-site scripting (XSS) vulnerabilities in the HTML Manager Interface in Apache Tomcat 5.5 before 5.5.32, 6.0 before 6.0.30, and 7.0 before 7.0.6 allow remote attackers to inject arbitrary web script or HTML,…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.10009 Published 2011-02-18 Fixed in 5.5.32, 6.0.30 +1 CWE-79

TI-2010-03542 CVE-2010-3718 · GHSA-fj6c-prgj-gr3r

Apache Tomcat 7.0.0 through 7.0.3, 6.0.x, and 5.5.x, when running within a…

LOW 10

Apache Tomcat 7.0.0 through 7.0.3, 6.0.x, and 5.5.x, when running within a SecurityManager, does not make the ServletContext attribute read-only, which allows local web applications to read or write files outside of the…

CVSS 2.0LOW 1.2 Local No auth Interaction — EPSS 0.013 Published 2011-02-10 Fixed in 7.0.4, 6.0.30 +1 CWE-22