Red Hat Security Advisory

RHSA-2014:0452

Fuse ESB Enterprise/Fuse MQ Enterprise 7.1.0 update

Released 2014-04-30 · Red Hat rating Important · View on Red Hat →

Fixed in

Fuse ESB Enterprise 7.1.0
Fuse MQ Enterprise 7.1.0
Fuse Management Console 7.1.0

Fixes 5 records

TI-2013-05951 CVE-2013-7285 · GHSA-f554-x222-wgf7

Xstream API versions up to 1.4.6 and version 1.4.10, if the security framework has not…

CRITICAL 90

Xstream API versions up to 1.4.6 and version 1.4.10, if the security framework has not been initialized, may allow a remote attacker to run arbitrary shell commands by manipulating the processed input stream when unmarsh…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.84362 Published 2019-05-15 Partial fix · 1.4.7, 1.4.11 CWE-78

TI-2014-00048 CVE-2014-0050 · GHSA-xx68-jfcg-xmmf

MultipartStream.java in Apache Commons FileUpload before 1.3.1, as used in Apache Tomcat…

HIGH 80

MultipartStream.java in Apache Commons FileUpload before 1.3.1, as used in Apache Tomcat, JBoss Web, and other products, allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a craf…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.83334 Published 2014-03-28 Partial fix · 1.3.1, 8.0.3 +1 CWE-835

TI-2014-00002 CVE-2014-0002 · GHSA-2fw5-rvf2-jq56

The XSLT component in Apache Camel before 2.11.4 and 2.12.x before 2.12.3 allows remote…

MEDIUM 55

The XSLT component in Apache Camel before 2.11.4 and 2.12.x before 2.12.3 allows remote attackers to read arbitrary files and possibly have other unspecified impact via an XML document containing an external entity decla…

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.27389 Published 2014-03-20 Partial fix · 2.11.4, 2.12.3 CWE-264

TI-2014-00003 CVE-2014-0003 · GHSA-h6rp-8v4j-hwph

The XSLT component in Apache Camel 2.11.x before 2.11.4, 2.12.x before 2.12.3, and…

MEDIUM 43

The XSLT component in Apache Camel 2.11.x before 2.11.4, 2.12.x before 2.12.3, and possibly earlier versions allows remote attackers to execute arbitrary Java methods via a crafted message.

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.07492 Published 2014-03-20 Fixed in 2.11.4, 2.12.3 CWE-264

TI-2013-05393 CVE-2013-6440 · GHSA-v723-58jv-2qc4

The (1) BasicParserPool, (2) StaticBasicParserPool, (3) XML Decrypter, and (4) SAML…

LOW 28

The (1) BasicParserPool, (2) StaticBasicParserPool, (3) XML Decrypter, and (4) SAML Decrypter in Shibboleth OpenSAML-Java before 2.6.1 set the expandEntityReferences property to true, which allows remote attackers to con…

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.02752 Published 2014-02-14 Partial fix · 2.6.1 CWE-200