Red Hat Security Advisory

RHSA-2013:1012

Red Hat JBoss Web Server 2.0.1 update

Released 2013-07-03 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server apache-commons-daemon-eap6-1:1.0.15-4.redhat_1.ep6.el6, apache-commons-daemon-jsvc-eap6-1:1.0.15-1.redhat_1.ep6.el6, apache-commons-daemon-jsvc-eap6-1:1.0.15-1.redhat_1.ep6.el6.i386 +47

Fixes 5 records

TI-2013-01838 CVE-2013-2067 · GHSA-6m48-jxwx-76q7

java/org/apache/catalina/authenticator/FormAuthenticator.java in the form authentication…

MEDIUM 43

java/org/apache/catalina/authenticator/FormAuthenticator.java in the form authentication feature in Apache Tomcat 6.0.21 through 6.0.36 and 7.x before 7.0.33 does not properly handle the relationships between authenticat…

CVSS 2.0MEDIUM 6.8 Network No auth Interaction — EPSS 0.10407 Published 2013-06-01 Partial fix · 6.0.37, 7.0.33 CWE-287

TI-2012-03070 CVE-2012-3544 · GHSA-qfxv-3ppc-7qg5

Apache Tomcat 6.x before 6.0.37 and 7.x before 7.0.30 does not properly handle chunk…

MEDIUM 42

Apache Tomcat 6.x before 6.0.37 and 7.x before 7.0.30 does not properly handle chunk extensions in chunked transfer coding, which allows remote attackers to cause a denial of service by streaming data.

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.11001 Published 2013-06-01 Partial fix · 6.0.37, 7.0.30 CWE-20

TI-2012-03898 CVE-2012-4558 · GHSA-gvpv-mmxx-g3g2

Multiple cross-site scripting (XSS) vulnerabilities in the balancer_handler function in…

MEDIUM 40

Multiple cross-site scripting (XSS) vulnerabilities in the balancer_handler function in the manager interface in mod_proxy_balancer.c in the mod_proxy_balancer module in the Apache HTTP Server 2.2.x before 2.2.24-dev and…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.22913 Published 2013-02-26 Partial fix CWE-79

TI-2012-03027 CVE-2012-3499 · GHSA-88g5-5jg8-6vw5

Multiple cross-site scripting (XSS) vulnerabilities in the Apache HTTP Server 2.2.x…

MEDIUM 40

Multiple cross-site scripting (XSS) vulnerabilities in the Apache HTTP Server 2.2.x before 2.2.24-dev and 2.4.x before 2.4.4 allow remote attackers to inject arbitrary web script or HTML via vectors involving hostnames a…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.22913 Published 2013-02-26 Partial fix CWE-79

TI-2013-01842 CVE-2013-2071 · GHSA-3p5r-7cw3-2m67

java/org/apache/catalina/core/AsyncContextImpl.java in Apache Tomcat 7.x before 7.0.40…

LOW 23

java/org/apache/catalina/core/AsyncContextImpl.java in Apache Tomcat 7.x before 7.0.40 does not properly handle the throwing of a RuntimeException in an AsyncListener in an application, which allows context-dependent att…

CVSS 2.0LOW 2.6 Network No auth Interaction — EPSS 0.06501 Published 2013-06-01 Fixed in 7.0.40 CWE-200