Red Hat Security Advisory

RHSA-2014:1088

Red Hat JBoss Web Server 2.1.0 update

Released 2014-08-21 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat JBoss Enterprise Web Server 2 for RHEL 5 Server antlr-eap6-2.7.7-17.redhat_4.1.ep6.el5, apache-commons-collections-eap6-3.2.1-15.redhat_3.1.ep6.el5, apache-commons-collections-tomcat-eap6-3.2.1-15.redhat_3.1.ep6.el5 +47

Fixes 6 records

TI-2014-00219 CVE-2014-0226 · GHSA-9c3m-phm4-whxx

Race condition in the mod_status module in the Apache HTTP Server before 2.4.10 allows…

HIGH 72

Race condition in the mod_status module in the Apache HTTP Server before 2.4.10 allows remote attackers to cause a denial of service (heap-based buffer overflow), or possibly obtain sensitive credential information or ex…

CVSS 2.0MEDIUM 6.8 Network No auth Interaction — EPSS 0.85808 Published 2014-07-20 Partial fix CWE-362

TI-2014-00220 CVE-2014-0227 · GHSA-42j3-498q-m6vp

java/org/apache/coyote/http11/filters/ChunkedInputFilter.java in Apache Tomcat 6.x before…

MEDIUM 54

java/org/apache/coyote/http11/filters/ChunkedInputFilter.java in Apache Tomcat 6.x before 6.0.42, 7.x before 7.0.55, and 8.x before 8.0.9 does not properly handle attempts to continue reading data after an error has occu…

CVSS 2.0MEDIUM 6.4 Network No auth Interaction — EPSS 0.21045 Published 2015-02-16 Partial fix · 6.0.42, 7.0.55 +1 CWE-19

TI-2014-00224 CVE-2014-0231 · GHSA-3h3q-q3h4-xhww

The mod_cgid module in the Apache HTTP Server before 2.4.10 does not have a timeout…

MEDIUM 52

The mod_cgid module in the Apache HTTP Server before 2.4.10 does not have a timeout mechanism, which allows remote attackers to cause a denial of service (process hang) via a request to a CGI script that does not read fr…

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.4472 Published 2014-07-20 Partial fix CWE-399

TI-2014-00112 CVE-2014-0118 · GHSA-m8vg-h7wr-m54w

The deflate_in_filter function in mod_deflate.c in the mod_deflate module in the Apache…

MEDIUM 47

The deflate_in_filter function in mod_deflate.c in the mod_deflate module in the Apache HTTP Server before 2.4.10, when request body decompression is enabled, allows remote attackers to cause a denial of service (resourc…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.37295 Published 2014-07-20 Partial fix CWE-400

TI-2014-00113 CVE-2014-0119 · GHSA-prc3-7f44-w48j

Apache Tomcat before 6.0.40, 7.x before 7.0.54, and 8.x before 8.0.6 does not properly…

LOW 36

Apache Tomcat before 6.0.40, 7.x before 7.0.54, and 8.x before 8.0.6 does not properly constrain the class loader that accesses the XML parser used with an XSLT stylesheet, which allows remote attackers to (1) read arbit…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.07616 Published 2014-05-31 Partial fix · 6.0.40, 7.0.54 +1 CWE-264

TI-2013-04033 CVE-2013-4590 · GHSA-87w9-x2c3-hrjj

Apache Tomcat before 6.0.39, 7.x before 7.0.50, and 8.x before 8.0.0-RC10 allows…

LOW 32

Apache Tomcat before 6.0.39, 7.x before 7.0.50, and 8.x before 8.0.0-RC10 allows attackers to obtain "Tomcat internals" information by leveraging the presence of an untrusted web application with a context.xml, web.xml,…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.09487 Published 2014-02-26 Partial fix · 6.0.39, 7.0.50 +1 CWE-200