Red Hat Security Advisory

RHSA-2016:1840

eap7-jboss-ec2-eap security, bug fix, and enhancement update

Released 2016-09-08 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 6 Server eap7-jboss-ec2-eap-7.0.2-2.GA_redhat_1.ep7.el6, eap7-jboss-ec2-eap-samples-7.0.2-2.GA_redhat_1.ep7.el6
Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 7 Server eap7-jboss-ec2-eap-7.0.2-2.GA_redhat_1.ep7.el7, eap7-jboss-ec2-eap-samples-7.0.2-2.GA_redhat_1.ep7.el7

Fixes 3 records

TI-2015-00223 CVE-2015-0254 · GHSA-6x4w-8w53-xrvv

Apache Standard Taglibs before 1.2.3 allows remote attackers to execute arbitrary code or…

MEDIUM 55

Apache Standard Taglibs before 1.2.3 allows remote attackers to execute arbitrary code or conduct external XML entity (XXE) attacks via a crafted XSLT extension in a (1) <x:parse> or (2) <x:transform> JSTL XML tag.

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.1204 Published 2015-03-09 Partial fix · 1.2.3 CWE-611

TI-2016-04684 CVE-2016-5406 · GHSA-5rw6-f2f7-548c

The domain controller in Red Hat JBoss Enterprise Application Platform (EAP) 7.x before…

MEDIUM 43

The domain controller in Red Hat JBoss Enterprise Application Platform (EAP) 7.x before 7.0.2 allows remote authenticated users to gain privileges by leveraging failure to propagate administrative RBAC configuration to a…

CVSS 3.0HIGH 8.8 Network Low privileges No interaction EPSS 0.029 Published 2016-09-26 Fixed CWE-264

TI-2016-04313 CVE-2016-4993 · GHSA-qcqr-hcjq-whfq

CRLF injection vulnerability in the Undertow web server in WildFly 10.0.0, as used in Red…

LOW 32

CRLF injection vulnerability in the Undertow web server in WildFly 10.0.0, as used in Red Hat JBoss Enterprise Application Platform (EAP) 7.x before 7.0.2, allows remote attackers to inject arbitrary HTTP headers and con…

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.02548 Published 2016-09-26 Fixed in 11.0.0.Final CWE-113