Red Hat Security Advisory

RHSA-2015:0216

Red Hat JBoss Enterprise Application Platform 6.3.3 update

Released 2015-02-11 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat JBoss Enterprise Application Platform 6.3 for RHEL 5 Server antlr-eap6-2.7.7-18.redhat_4.1.ep6.el5, apache-cxf-2.7.14-1.redhat_1.1.ep6.el5, glassfish-jsf-eap6-2.1.28-6.redhat_7.1.ep6.el5 +47

Fixes 5 records

TI-2014-06512 CVE-2014-7839 · GHSA-pc54-pchm-xcw6

DocumentProvider in RESTEasy 2.3.7 and 3.0.9 does not configure the (1)…

LOW 32

DocumentProvider in RESTEasy 2.3.7 and 3.0.9 does not configure the (1) external-general-entities or (2) external-parameter-entities features, which allows remote attackers to conduct XML external entity (XXE) attacks vi…

CVSS 2.0MEDIUM 6.4 Network No auth Interaction — EPSS 0.01955 Published 2014-11-25 Partial fix · 3.0.11.Final CWE-20

TI-2014-06737 CVE-2014-8122 · GHSA-338v-3958-8v8r

Race condition in JBoss Weld before 2.2.8 and 3.x before 3.0.0 Alpha3 allows remote…

LOW 24

Race condition in JBoss Weld before 2.2.8 and 3.x before 3.0.0 Alpha3 allows remote attackers to obtain information from a previous conversation via vectors related to a stale thread state.

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.02051 Published 2015-02-13 Partial fix · 2.2.8 CWE-362

TI-2014-06526 CVE-2014-7853 · GHSA-7cr6-g5pc-g6g4

The JBoss Application Server (WildFly) JacORB subsystem in Red Hat JBoss Enterprise…

LOW 21

The JBoss Application Server (WildFly) JacORB subsystem in Red Hat JBoss Enterprise Application Platform (EAP) before 6.3.3 does not properly assign socket-binding-ref sensitivity classification to the security-domain at…

CVSS 2.0MEDIUM 4.0 Network Low privileges Interaction — EPSS 0.0124 Published 2015-02-13 Partial fix CWE-200

TI-2014-06522 CVE-2014-7849 · GHSA-5938-95q9-6rh3

The Role Based Access Control (RBAC) implementation in JBoss Enterprise Application…

LOW 21

The Role Based Access Control (RBAC) implementation in JBoss Enterprise Application Platform (EAP) 6.2.0 through 6.3.2 does not properly verify authorization conditions, which allows remote authenticated users to add, mo…

CVSS 2.0MEDIUM 4.0 Network Low privileges Interaction — EPSS 0.0126 Published 2015-02-13 Partial fix CWE-264

TI-2014-06500 CVE-2014-7827 · GHSA-hgx6-q6mp-88m2

The org.jboss.security.plugins.mapping.JBossMappingManager implementation in JBoss…

LOW 20

The org.jboss.security.plugins.mapping.JBossMappingManager implementation in JBoss Security in Red Hat JBoss Enterprise Application Platform (EAP) before 6.3.3 uses the default security domain when a security domain is u…

CVSS 2.0LOW 3.5 Network Low privileges Interaction — EPSS 0.01739 Published 2015-02-13 Partial fix CWE-264