Skip to content
OpenAdvisories
Medium RHSA-2008:0524 37 CVEs

Red Hat Security Advisory: Red Hat Network Satellite Server security update

Published Sep 15, 2024 · Updated Jun 29, 2026

Ecosystem: Red Hat

Fixed packages 24

ReleasePackageFixed in
Red Hat · Network Satellite 4 network_satellite:4.2::el3 jabberd 0:2.0s10-3.37.rhn
Red Hat · Network Satellite 4 network_satellite:4.2::el3 java-1.4.2-ibm 0:1.4.2.10-1jpp.2.el3
Red Hat · Network Satellite 4 network_satellite:4.2::el3 java-1.4.2-ibm-devel 0:1.4.2.10-1jpp.2.el3
Red Hat · Network Satellite 4 network_satellite:4.2::el3 jfreechart 0:0.9.20-3.rhn
Red Hat · Network Satellite 4 network_satellite:4.2::el3 openmotif21 0:2.1.30-9.RHEL3.8
Red Hat · Network Satellite 4 network_satellite:4.2::el3 openmotif21-debuginfo 0:2.1.30-9.RHEL3.8
Red Hat · Network Satellite 4 network_satellite:4.2::el3 perl-Crypt-CBC 0:2.24-1.el3
Red Hat · Network Satellite 4 network_satellite:4.2::el3 rhn-apache 0:1.3.27-36.rhn.rhel3
Red Hat · Network Satellite 4 network_satellite:4.2::el3 rhn-modjk-ap13 0:1.2.23-2rhn.rhel3
Red Hat · Network Satellite 4 network_satellite:4.2::el3 rhn-modperl 0:1.29-16.rhel3
Red Hat · Network Satellite 4 network_satellite:4.2::el3 rhn-modssl 0:2.8.12-8.rhn.10.rhel3
Red Hat · Network Satellite 4 network_satellite:4.2::el3 tomcat5 0:5.0.30-0jpp_10rh
Red Hat · Network Satellite 4 network_satellite:4.2::el4 jabberd 0:2.0s10-3.38.rhn
Red Hat · Network Satellite 4 network_satellite:4.2::el4 java-1.4.2-ibm 0:1.4.2.10-1jpp.2.el4
Red Hat · Network Satellite 4 network_satellite:4.2::el4 java-1.4.2-ibm-devel 0:1.4.2.10-1jpp.2.el4
Red Hat · Network Satellite 4 network_satellite:4.2::el4 jfreechart 0:0.9.20-3.rhn
Red Hat · Network Satellite 4 network_satellite:4.2::el4 openmotif21 0:2.1.30-11.RHEL4.6
Red Hat · Network Satellite 4 network_satellite:4.2::el4 openmotif21-debuginfo 0:2.1.30-11.RHEL4.6
Red Hat · Network Satellite 4 network_satellite:4.2::el4 perl-Crypt-CBC 0:2.24-1.el4
Red Hat · Network Satellite 4 network_satellite:4.2::el4 rhn-apache 0:1.3.27-36.rhn.rhel4
Red Hat · Network Satellite 4 network_satellite:4.2::el4 rhn-modjk-ap13 0:1.2.23-2rhn.rhel4
Red Hat · Network Satellite 4 network_satellite:4.2::el4 rhn-modperl 0:1.29-16.rhel4
Red Hat · Network Satellite 4 network_satellite:4.2::el4 rhn-modssl 0:2.8.12-8.rhn.10.rhel4
Red Hat · Network Satellite 4 network_satellite:4.2::el4 tomcat5 0:5.0.30-0jpp_10rh

Vulnerabilities 37

  • Medium 6.1
    CVE-2007-4465 EPSS 26%

    Cross-site scripting (XSS) vulnerability in mod_autoindex.c in the Apache HTTP Server before 2.2.6, when the charset on…

    apache2 Debian
  • Unscored —
    CVE-2004-0687

    Multiple stack-based buffer overflows in (1) xpmParseColors in parse.c, (2) ParseAndPutPixels in create.c, and (3) Pars…

  • Unscored —
    CVE-2004-0688

    Multiple integer overflows in (1) the xpmParseColors function in parse.c, (2) XpmCreateImageFromXpmImage, (3) CreateXIm…

  • Unscored —
    CVE-2004-0885 EPSS 15%

    The mod_ssl module in Apache 2.0.35 through 2.0.52, when using the "SSLCipherSuite" directive in directory or location …

    apache2 Debian
  • Unscored —
    CVE-2004-0914

    Multiple vulnerabilities in libXpm for 6.8.1 and earlier, as used in XFree86 and other packages, include (1) multiple i…

  • Unscored —
    CVE-2005-0605

    scan.c for LibXPM may allow attackers to execute arbitrary code via a negative bitmap_unit value that leads to a buffer…

  • Medium —
    CVE-2005-2090 EPSS 26%

    Tomcat Vulnerable to Web Cache Poisoning

    Jakarta Tomcat 5.0.19 (Coyote/1.1) and Tomcat 4.1.24 (Coyote/1.0) allows remote attackers to poison the web cache, bypass web application firewall protection, and conduct XSS attacks via an HTTP request with both a "Transfer-Encoding: chunked" header and a Co…

    org.apache.tomcat:tomcat Maven
  • High —
    CVE-2005-3510

    Apache Tomcat Vulnerable to Denial of Service (DoS) via Simultaneous Requests

    Apache Tomcat 5.5.0 to 5.5.11 allows remote attackers to cause a denial of service (CPU consumption) via a large number of simultaneous requests to list a web directory that has a large number of files.

    org.apache.tomcat:tomcat Maven
  • Unscored —
    CVE-2005-3964

    Multiple buffer overflows in libUil (libUil.so) in OpenMotif 2.2.3, and possibly other versions, allows attackers to ex…

  • Unscored —
    CVE-2005-4838

    Multiple cross-site scripting (XSS) vulnerabilities in the example web applications for Jakarta Tomcat 5.5.6 and earlie…

  • Medium —
    CVE-2006-0254 Public exploit EPSS 32%

    Apache Geronimo console 1.0 vulnerable to cross-site scripting

    Multiple cross-site scripting (XSS) vulnerabilities in Apache Geronimo 1.0 allow remote attackers to inject arbitrary web script or HTML via the (1) time parameter to cal2.jsp and (2) any invalid parameter, which causes an XSS when the log file is viewed by t…

    geronimo:geronimo-console-standard Maven
  • Unscored —
    CVE-2006-0898

    Crypt::CBC Perl module 2.16 and earlier, when running in RandomIV mode, uses an initialization vector (IV) of 8 bytes, …

    libcrypt-cbc-perl Debian
  • Unscored —
    CVE-2006-1329

    The SASL negotiation in Jabber Studio jabberd before 2.0s11 allows remote attackers to cause a denial of service ("c2s …

    jabberd2 Debian
  • Medium —
    CVE-2006-3835 Public exploit EPSS 48%

    Apache Tomcat Reveals Directories

    Apache Tomcat 5 before 5.5.17 allows remote attackers to list directories via a semicolon (;) preceding a filename with a mapped extension, as demonstrated by URLs ending with /;index.jsp and /;help.do.

    org.apache.tomcat:tomcat Maven
  • Unscored —
    CVE-2006-5752 EPSS 28%

    Cross-site scripting (XSS) vulnerability in mod_status.c in the mod_status module in Apache HTTP Server (httpd), when E…

    apache2 Debian
  • Medium —
    CVE-2006-7195

    Apache Tomcat XSS Vulnerability

    Cross-site scripting (XSS) vulnerability in implicit-objects.jsp in Apache Tomcat 5.0.0 through 5.0.30 and 5.5.0 through 5.5.17 allows remote attackers to inject arbitrary web script or HTML via certain header values.

    org.apache.tomcat:tomcat Maven
  • Medium —
    CVE-2006-7196 Public exploit EPSS 72%

    Cross-site scripting in Apache Tomcat

    Cross-site scripting (XSS) vulnerability in the calendar application example in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0 through 4.1.31, 5.0.0 through 5.0.30, and 5.5.0 through 5.5.15 allows remote attackers to inject arbitrary web script or HTML via the time…

    org.apache.tomcat:tomcat Maven
  • High —
    CVE-2006-7197

    Apache Tomcat Buffer Over-Read

    The AJP connector in Apache Tomcat 5.5.15 uses an incorrect length for chunks, which can cause a buffer over-read in the ajp_process_callback in mod_jk, which allows remote attackers to read portions of sensitive memory.

    org.apache.tomcat:tomcat Maven
  • Unscored —
    CVE-2007-0243 Public exploit EPSS 12%

    Buffer overflow in Sun JDK and Java Runtime Environment (JRE) 5.0 Update 9 and earlier, SDK and JRE 1.4.2_12 and earlie…

  • Medium —
    CVE-2007-0450 Public exploit EPSS 91%

    Apache Tomcat Directory Traversal

    Directory traversal vulnerability in Apache HTTP Server and Tomcat 5.x before 5.5.22 and 6.x before 6.0.10, when using certain proxy modules (mod_proxy, mod_rewrite, mod_jk), allows remote attackers to read arbitrary files via a .. (dot dot) sequence with com…

    org.apache.tomcat:tomcat apache2 Wolfi Maven
  • Unscored —
    CVE-2007-1349 EPSS 10%

    PerlRun.pm in Apache mod_perl before 1.30, and RegistryCooker.pm in mod_perl 2.x, does not properly escape PATH_INFO be…

    libapache2-mod-perl2 Debian
  • Medium —
    CVE-2007-1355 Public exploit EPSS 58%

    Apache Tomcat Vulnerable to Cross-Site Scripting

    Multiple cross-site scripting (XSS) vulnerabilities in the appdev/sample/web/hello.jsp example application in Tomcat 4.0.0 through 4.0.6, 4.1.0 through 4.1.36, 5.0.0 through 5.0.30, 5.5.0 through 5.5.23, and 6.0.0 through 6.0.10 allow remote attackers to inje…

    org.apache.tomcat:jsp-api org.apache.tomcat:servlet-api Maven
  • Low —
    CVE-2007-1358 EPSS 20%

    Apache Tomcat XSS In Accept-Language Headers

    Cross-site scripting (XSS) vulnerability in certain applications using Apache Tomcat 4.0.0 through 4.0.6 and 4.1.0 through 4.1.34 allows remote attackers to inject arbitrary web script or HTML via crafted "Accept-Language headers that do not conform to RFC 26…

    org.apache.tomcat:tomcat Maven
  • Unscored —
    CVE-2007-1860 EPSS 13%

    mod_jk in Apache Tomcat JK Web Server Connector 1.2.x before 1.2.23 decodes request URLs within the Apache HTTP Server …

    libapache-mod-jk Debian
  • Unscored —
    CVE-2007-2435

    Sun Java Web Start in JDK and JRE 5.0 Update 10 and earlier, and Java Web Start in SDK and JRE 1.4.2_13 and earlier, al…

  • Medium —
    CVE-2007-2449 Public exploit Scanner template EPSS 77%

    Apache Tomcat XSS Vulnerabilities in Examples Web Application

    Multiple cross-site scripting (XSS) vulnerabilities in certain JSP files in the examples web application in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0 through 4.1.36, 5.0.0 through 5.0.30, 5.5.0 through 5.5.24, and 6.0.0 through 6.0.13 allow remote attackers to…

    org.apache.tomcat:tomcat Maven
  • Low —
    CVE-2007-2450

    Apache Tomcat vulnerable to Cross-site Scripting

    Multiple cross-site scripting (XSS) vulnerabilities in the (1) Manager and (2) Host Manager web applications in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0 through 4.1.36, 5.0.0 through 5.0.30, 5.5.0 through 5.5.24, and 6.0.0 through 6.0.13 allow remote authenti…

    org.apache.tomcat:tomcat Maven
  • Unscored —
    CVE-2007-2788 Public exploit EPSS 18%

    Integer overflow in the embedded ICC profile image parser in Sun Java Development Kit (JDK) before 1.5.0_11-b03 and 1.6…

  • Unscored —
    CVE-2007-2789

    The BMP image parser in Sun Java Development Kit (JDK) before 1.5.0_11-b03 and 1.6.x before 1.6.0_01-b06, and Sun Java …

  • Unscored —
    CVE-2007-3304

    Apache httpd 1.3.37, 2.0.59, and 2.2.4 with the Prefork MPM module, allows local users to cause a denial of service by …

    apache2 Debian
  • Medium —
    CVE-2007-3382 Public exploit EPSS 37%

    Apache Tomcat treats single quotes as delimiters in cookies

    Apache Tomcat 6.0.0 to 6.0.13, 5.5.0 to 5.5.24, 5.0.0 to 5.0.30, 4.1.0 to 4.1.36, and 3.3 to 3.3.2 treats single quotes ("'") as delimiters in cookies, which might cause sensitive information such as session IDs to be leaked and allow remote attackers to cond…

    org.apache.tomcat:tomcat Maven
  • Medium —
    CVE-2007-3385 EPSS 17%

    Apache Tomcat Mishandles Character Sequence in Cookies

    Apache Tomcat 6.0.0 to 6.0.13, 5.5.0 to 5.5.24, 5.0.0 to 5.0.30, 4.1.0 to 4.1.36, and 3.3 to 3.3.2 does not properly handle the \" character sequence in a cookie value, which might cause sensitive information such as session IDs to be leaked to remote attacke…

    org.apache.tomcat:tomcat Maven
  • Unscored —
    CVE-2007-5000 EPSS 47%

    Cross-site scripting (XSS) vulnerability in the (1) mod_imap module in the Apache HTTP Server 1.3.0 through 1.3.39 and …

    apache2 Debian
  • Low —
    CVE-2007-5461 Public exploit EPSS 40%

    Apache Tomcat Path Traversal Vulnerability

    Absolute path traversal vulnerability in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0, 5.0.0, 5.5.0 through 5.5.25, and 6.0.0 through 6.0.14, under certain configurations, allows remote authenticated users to read arbitrary files via a WebDAV write request that s…

    org.apache.tomcat:tomcat Maven
  • Unscored —
    CVE-2007-6306

    Multiple cross-site scripting (XSS) vulnerabilities in the image map feature in JFreeChart 1.0.8 allow remote attackers…

    libjfreechart-java Debian
  • Unscored —
    CVE-2007-6388 EPSS 76%

    Cross-site scripting (XSS) vulnerability in mod_status in the Apache HTTP Server 2.2.0 through 2.2.6, 2.0.35 through 2.…

    apache2 Debian
  • Unscored —
    CVE-2008-0128 Public exploit EPSS 20%

    The SingleSignOn Valve (org.apache.catalina.authenticator.SingleSignOn) in Apache Tomcat before 5.5.21 does not set the…

References

  • article
    https://access.redhat.com/security/updates/classification/#low
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=449337
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2008/rhsa-2008_0524.json
  • report
    https://access.redhat.com/security/cve/CVE-2004-0687
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=430513
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2004-0687
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2004-0687
  • report
    https://access.redhat.com/security/cve/CVE-2004-0688
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=430515
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2004-0688
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2004-0688
  • report
    https://access.redhat.com/security/cve/CVE-2004-0885
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=430637
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2004-0885
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2004-0885
  • report
    https://access.redhat.com/security/cve/CVE-2004-0914
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=430516
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2004-0914
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2004-0914
  • report
    https://access.redhat.com/security/cve/CVE-2005-0605
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=430520
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2005-0605
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2005-0605
  • report
    https://access.redhat.com/security/cve/CVE-2005-2090
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=237079
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2005-2090
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2005-2090
  • report
    https://access.redhat.com/security/cve/CVE-2005-3510
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=237085
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2005-3510
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2005-3510
  • report
    https://access.redhat.com/security/cve/CVE-2005-3964
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=430519
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2005-3964
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2005-3964
  • report
    https://access.redhat.com/security/cve/CVE-2005-4838
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=238401
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2005-4838
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2005-4838