Red Hat Security Advisory

RHSA-2014:1020

Red Hat JBoss Enterprise Application Platform 6.3.0 update

Released 2014-08-06 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat JBoss Enterprise Application Platform 6 for RHEL 6 Server apache-commons-beanutils-eap6-1.8.3-7.redhat_6.1.ep6.el6, apache-commons-cli-eap6-1.2-6.redhat_4.1.ep6.el6, apache-commons-codec-eap6-1.4-16.redhat_3.1.ep6.el6 +47

Fixes 7 records

TI-2014-00219 CVE-2014-0226 · GHSA-9c3m-phm4-whxx

Race condition in the mod_status module in the Apache HTTP Server before 2.4.10 allows…

HIGH 72

Race condition in the mod_status module in the Apache HTTP Server before 2.4.10 allows remote attackers to cause a denial of service (heap-based buffer overflow), or possibly obtain sensitive credential information or ex…

CVSS 2.0MEDIUM 6.8 Network No auth Interaction — EPSS 0.85808 Published 2014-07-20 Partial fix CWE-362

TI-2014-00220 CVE-2014-0227 · GHSA-42j3-498q-m6vp

java/org/apache/coyote/http11/filters/ChunkedInputFilter.java in Apache Tomcat 6.x before…

MEDIUM 54

java/org/apache/coyote/http11/filters/ChunkedInputFilter.java in Apache Tomcat 6.x before 6.0.42, 7.x before 7.0.55, and 8.x before 8.0.9 does not properly handle attempts to continue reading data after an error has occu…

CVSS 2.0MEDIUM 6.4 Network No auth Interaction — EPSS 0.21045 Published 2015-02-16 Partial fix · 6.0.42, 7.0.55 +1 CWE-19

TI-2014-00224 CVE-2014-0231 · GHSA-3h3q-q3h4-xhww

The mod_cgid module in the Apache HTTP Server before 2.4.10 does not have a timeout…

MEDIUM 52

The mod_cgid module in the Apache HTTP Server before 2.4.10 does not have a timeout mechanism, which allows remote attackers to cause a denial of service (process hang) via a request to a CGI script that does not read fr…

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.4472 Published 2014-07-20 Partial fix CWE-399

TI-2014-00112 CVE-2014-0118 · GHSA-m8vg-h7wr-m54w

The deflate_in_filter function in mod_deflate.c in the mod_deflate module in the Apache…

MEDIUM 47

The deflate_in_filter function in mod_deflate.c in the mod_deflate module in the Apache HTTP Server before 2.4.10, when request body decompression is enabled, allows remote attackers to cause a denial of service (resourc…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.37295 Published 2014-07-20 Partial fix CWE-400

TI-2014-00187 CVE-2014-0193 · GHSA-7vpq-g998-qpv7

WebSocket08FrameDecoder in Netty 3.6.x before 3.6.9, 3.7.x before 3.7.1, 3.8.x before…

LOW 30

WebSocket08FrameDecoder in Netty 3.6.x before 3.6.9, 3.7.x before 3.7.1, 3.8.x before 3.8.2, 3.9.x before 3.9.1, and 4.0.x before 4.0.19 allows remote attackers to cause a denial of service (memory consumption) via a Tex…

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.04326 Published 2014-05-06 Partial fix · 3.6.9.Final, 3.7.1.Final +3 CWE-399

TI-2014-02791 CVE-2014-3464 · GHSA-jm2h-vv8x-8cv3

The EJB invocation handler implementation in Red Hat JBossWS, as used in JBoss Enterprise…

LOW 27

The EJB invocation handler implementation in Red Hat JBossWS, as used in JBoss Enterprise Application Platform (EAP) 6.2.0 and 6.3.0, does not properly enforce the method level restrictions for outbound messages, which a…

CVSS 2.0MEDIUM 5.5 Network Low privileges Interaction — EPSS 0.01087 Published 2014-08-19 Fixed CWE-264

TI-2014-02799 CVE-2014-3472 · GHSA-x926-v8v9-j4mp

The isCallerInRole function in SimpleSecurityManager in JBoss Application Server (AS) 7…

LOW 26

The isCallerInRole function in SimpleSecurityManager in JBoss Application Server (AS) 7, as used in Red Hat JBoss Enterprise Application Platform (JBEAP) 6.3.0, does not properly check caller roles, which allows remote a…

CVSS 2.0MEDIUM 4.9 Network Low privileges Interaction — EPSS 0.01681 Published 2014-08-19 Fixed CWE-264