Red Hat Security Advisory

RHSA-2014:0834

Red Hat JBoss Web Server 2.0.1 tomcat6 security and bug fix update

Released 2014-07-03 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat JBoss Enterprise Web Server 2 for RHEL 5 Server tomcat6-6.0.37-20_patch_04.ep6.el5, tomcat6-admin-webapps-6.0.37-20_patch_04.ep6.el5, tomcat6-docs-webapp-6.0.37-20_patch_04.ep6.el5 +7
Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server tomcat6-6.0.37-29_patch_05.ep6.el6, tomcat6-admin-webapps-6.0.37-29_patch_05.ep6.el6, tomcat6-docs-webapp-6.0.37-29_patch_05.ep6.el6 +7

Fixes 3 records

TI-2014-00070 CVE-2014-0075 · GHSA-475f-74wp-pqv5

Integer overflow in the parseChunkHeader function in…

MEDIUM 46

Integer overflow in the parseChunkHeader function in java/org/apache/coyote/http11/filters/ChunkedInputFilter.java in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4 allows remote attackers to cause…

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.17577 Published 2014-05-31 Partial fix · 6.0.40, 7.0.53 +1 CWE-189

TI-2014-00094 CVE-2014-0099 · GHSA-xh5x-j8jf-pcpx

Integer overflow in java/org/apache/tomcat/util/buf/Ascii.java in Apache Tomcat before…

LOW 37

Integer overflow in java/org/apache/tomcat/util/buf/Ascii.java in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4, when operated behind a reverse proxy, allows remote attackers to conduct HTTP reques…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.08838 Published 2014-05-31 Partial fix · 6.0.40, 7.0.54 +1 CWE-189

TI-2014-00091 CVE-2014-0096 · GHSA-qprx-q2r7-3rx6

java/org/apache/catalina/servlets/DefaultServlet.java in the default servlet in Apache…

LOW 36

java/org/apache/catalina/servlets/DefaultServlet.java in the default servlet in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4 does not properly restrict XSLT stylesheets, which allows remote attack…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.06905 Published 2014-05-31 Partial fix · 6.0.40, 7.0.54 +1 CWE-264