Red Hat Security Advisory

RHSA-2015:2660

Red Hat JBoss Web Server 3.0.2 security update

Released 2015-12-16 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat JBoss Web Server 3.0 for RHEL 7 apache-commons-collections-eap6-3.2.1-18.redhat_7.1.ep6.el7, apache-commons-collections-tomcat-eap6-3.2.1-18.redhat_7.1.ep6.el7, httpd24-2.4.6-59.ep7.el7 +30

Fixes 5 records

TI-2015-02814 CVE-2015-3183 · GHSA-892q-vvcr-v6j5

The chunked transfer coding implementation in the Apache HTTP Server before 2.4.14 does…

MEDIUM 61

The chunked transfer coding implementation in the Apache HTTP Server before 2.4.14 does not properly parse chunk headers, which allows remote attackers to conduct HTTP request smuggling attacks via a crafted request, rel…

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.74387 Published 2015-07-20 Partial fix CWE-17

TI-2014-00223 CVE-2014-0230 · GHSA-pxcx-cxq8-4mmw

Apache Tomcat 6.x before 6.0.44, 7.x before 7.0.55, and 8.x before 8.0.9 does not…

MEDIUM 59

Apache Tomcat 6.x before 6.0.44, 7.x before 7.0.55, and 8.x before 8.0.9 does not properly handle cases where an HTTP response occurs before finishing the reading of an entire request body, which allows remote attackers…

CVSS 2.0HIGH 7.8 Network No auth Interaction — EPSS 0.20183 Published 2015-06-07 Partial fix · 6.0.44, 7.0.55 +1 CWE-399

TI-2013-04858 CVE-2013-5704 · GHSA-gwg2-5774-jpjm

The mod_headers module in the Apache HTTP Server 2.2.22 allows remote attackers to bypass…

MEDIUM 57

The mod_headers module in the Apache HTTP Server 2.2.22 allows remote attackers to bypass "RequestHeader unset" directives by placing a header in the trailer portion of data sent with chunked transfer coding.

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.57992 Published 2014-04-15 Partial fix

TI-2014-02905 CVE-2014-3581 · GHSA-fp3c-hq6w-q3rf

The cache_merge_headers_out function in modules/cache/cache_util.c in the mod_cache…

LOW 38

The cache_merge_headers_out function in modules/cache/cache_util.c in the mod_cache module in the Apache HTTP Server before 2.4.11 allows remote attackers to cause a denial of service (NULL pointer dereference and applic…

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.13451 Published 2014-10-10 Fixed CWE-476

TI-2015-04342 CVE-2015-5174 · GHSA-6qr6-x7jm-x2q6

Directory traversal vulnerability in RequestUtil.java in Apache Tomcat 6.x before 6.0.45…

LOW 34

Directory traversal vulnerability in RequestUtil.java in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.65, and 8.x before 8.0.27 allows remote authenticated users to bypass intended SecurityManager restrictions and lis…

CVSS 3.0MEDIUM 4.3 Network Low privileges No interaction EPSS 0.12555 Published 2016-02-25 Partial fix · 8.0.27, 7.0.65 +1 CWE-22