Red Hat Security Advisory

RHSA-2014:0172

Red Hat JBoss Enterprise Application Platform 6.2.1 update

Released 2014-02-13 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat JBoss Enterprise Application Platform 6.2

Fixes 3 records

TI-2013-03964 CVE-2013-4517 · GHSA-4p4w-6h54-g885

Apache Santuario XML Security for Java before 1.5.6, when applying Transforms, allows…

LOW 31

Apache Santuario XML Security for Java before 1.5.6, when applying Transforms, allows remote attackers to cause a denial of service (memory consumption) via crafted Document Type Definitions (DTDs), related to signatures…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.08863 Published 2014-01-11 Partial fix · 1.5.6 CWE-399

TI-2013-05393 CVE-2013-6440 · GHSA-v723-58jv-2qc4

The (1) BasicParserPool, (2) StaticBasicParserPool, (3) XML Decrypter, and (4) SAML…

LOW 28

The (1) BasicParserPool, (2) StaticBasicParserPool, (3) XML Decrypter, and (4) SAML Decrypter in Shibboleth OpenSAML-Java before 2.6.1 set the expandEntityReferences property to true, which allows remote attackers to con…

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.02752 Published 2014-02-14 Partial fix · 2.6.1 CWE-200

TI-2014-00018 CVE-2014-0018 · GHSA-mxv4-hqqr-c5rm

Red Hat JBoss Enterprise Application Platform (JBEAP) 6.2.0 and JBoss WildFly Application…

LOW 10

Red Hat JBoss Enterprise Application Platform (JBEAP) 6.2.0 and JBoss WildFly Application Server, when run under a security manager, do not properly restrict access to the Modular Service Container (MSC) service registry…

CVSS 2.0LOW 1.9 Local No auth Interaction — EPSS 0.00354 Published 2014-02-14 Fixed CWE-264