Skip to content
OpenAdvisories
Medium RHSA-2008:0825 2 CVEs

Red Hat Security Advisory: JBoss Enterprise Application Platform 4.2.0.CP03 security update

Published Sep 15, 2024 · Updated Nov 22, 2025

Ecosystem: Red Hat

Fixed packages 15

ReleasePackageFixed in
Red Hat · JBoss EAP 4 jboss_enterprise_application_platform:4.2.0::el4 glassfish-javamail 0:1.4.0-0jpp.ep1.9.el4
Red Hat · JBoss EAP 4 jboss_enterprise_application_platform:4.2.0::el4 hibernate3 1:3.2.4-1.SP1_CP03.0jpp.ep1.1.el4
Red Hat · JBoss EAP 4 jboss_enterprise_application_platform:4.2.0::el4 hibernate3-annotations 0:3.2.1-1.patch02.1jpp.ep1.3.el4
Red Hat · JBoss EAP 4 jboss_enterprise_application_platform:4.2.0::el4 hibernate3-annotations-javadoc 0:3.2.1-1.patch02.1jpp.ep1.3.el4
Red Hat · JBoss EAP 4 jboss_enterprise_application_platform:4.2.0::el4 hibernate3-javadoc 1:3.2.4-1.SP1_CP03.0jpp.ep1.1.el4
Red Hat · JBoss EAP 4 jboss_enterprise_application_platform:4.2.0::el4 jboss-cache 0:1.4.1-4.SP9.1jpp.ep1.1.el4
Red Hat · JBoss EAP 4 jboss_enterprise_application_platform:4.2.0::el4 jboss-remoting 0:2.2.2-3.SP7.0jpp.ep1.3.el4
Red Hat · JBoss EAP 4 jboss_enterprise_application_platform:4.2.0::el4 jboss-seam 0:1.2.1-1.ep1.7.el4
Red Hat · JBoss EAP 4 jboss_enterprise_application_platform:4.2.0::el4 jboss-seam-docs 0:1.2.1-1.ep1.7.el4
Red Hat · JBoss EAP 4 jboss_enterprise_application_platform:4.2.0::el4 jbossas 0:4.2.0-3.GA_CP03.ep1.9.el4
Red Hat · JBoss EAP 4 jboss_enterprise_application_platform:4.2.0::el4 jbossts 1:4.2.3-1.SP5_CP01.1jpp.ep1.1.el4
Red Hat · JBoss EAP 4 jboss_enterprise_application_platform:4.2.0::el4 jcommon 0:1.0.12-1jpp.ep1.3.el4
Red Hat · JBoss EAP 4 jboss_enterprise_application_platform:4.2.0::el4 jfreechart 0:1.0.9-1jpp.ep1.3.el4
Red Hat · JBoss EAP 4 jboss_enterprise_application_platform:4.2.0::el4 rh-eap-docs 0:4.2.0-3.GA_CP03.ep1.5.el4
Red Hat · JBoss EAP 4 jboss_enterprise_application_platform:4.2.0::el4 rh-eap-docs-examples 0:4.2.0-3.GA_CP03.ep1.5.el4

Vulnerabilities 2

  • Medium 5.3
    CVE-2008-1285

    Cross-site scripting (XSS) vulnerability in Sun Java Server Faces (JSF)

    Cross-site scripting (XSS) vulnerability in Sun Java Server Faces (JSF) 1.2 before 1.2_08 allows remote attackers to inject arbitrary web script or HTML via unknown vectors.

    com.sun.faces:jsf-api Maven
  • Unscored —
    CVE-2008-3273 Public exploit EPSS 47%

    JBoss Enterprise Application Platform (aka JBossEAP or EAP) before 4.2.0.CP03, and 4.3.0 before 4.3.0.CP01, allows remo…

References

  • article
    https://access.redhat.com/security/updates/classification/#moderate
  • article
    http://www.redhat.com/docs/en-US/JBoss_Enterprise_Application_Platform/4.2.0.cp03/html-single/readme/index.html
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=437082
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=457757
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2008/rhsa-2008_0825.json
  • report
    https://access.redhat.com/security/cve/CVE-2008-1285
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2008-1285
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2008-1285
  • report
    https://access.redhat.com/security/cve/CVE-2008-3273
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2008-3273
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2008-3273