Red Hat Security Advisory

RHSA-2014:0819

Red Hat JBoss BPM Suite 6.0.2 update

Released 2014-06-30 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat JBoss BPMS 6.0

Fixes 3 records

TI-2014-00102 CVE-2014-0107 · GHSA-rc2w-r4jq-7pfx

The TransformerFactory in Apache Xalan-Java before 2.7.2 does not properly restrict…

MEDIUM 48

The TransformerFactory in Apache Xalan-Java before 2.7.2 does not properly restrict access to certain properties when FEATURE_SECURE_PROCESSING is enabled, which allows remote attackers to bypass expected restrictions an…

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.14066 Published 2014-04-15 Partial fix · 2.7.2 CWE-264

TI-2014-00345 CVE-2014-0364 · GHSA-5xpq-f27x-7pw7

The ParseRoster component in the Ignite Realtime Smack XMPP API before 4.0.0-rc1 does not…

LOW 32

The ParseRoster component in the Ignite Realtime Smack XMPP API before 4.0.0-rc1 does not verify the from attribute of a roster-query IQ stanza, which allows remote attackers to spoof IQ responses via a crafted attribute…

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.06242 Published 2014-04-30 Partial fix CWE-345

TI-2014-00344 CVE-2014-0363 · GHSA-444r-2xr3-rxhv

The ServerTrustManager component in the Ignite Realtime Smack XMPP API before 4.0.0-rc1…

LOW 29

The ServerTrustManager component in the Ignite Realtime Smack XMPP API before 4.0.0-rc1 does not verify basicConstraints and nameConstraints in X.509 certificate chains from SSL servers, which allows man-in-the-middle at…

CVSS 2.0MEDIUM 5.8 Network No auth Interaction — EPSS 0.0123 Published 2014-04-30 Partial fix CWE-295