Red Hat Security Advisory: JBoss Enterprise Web Server 1.0.2 update

Fixed packages 338

Vulnerabilities 8

• Medium —
  CVE-2010-1157 Public exploit EPSS 53%

  Exposure of Sensitive Information to an Unauthorized Actor in Apache Tomcat

  Apache Tomcat 5.5.0 through 5.5.29 and 6.0.0 through 6.0.26 might allow remote attackers to discover the server's hostname or IP address by sending a request for a resource that requires (1) BASIC or (2) DIGEST authentication, and then reading the realm field…

  org.apache.tomcat:tomcat Maven
  Apr 23, 2010
• Unscored —
  CVE-2010-1452 EPSS 21%

  The (1) mod_cache and (2) mod_dav modules in the Apache HTTP Server 2.2.x before 2.2.16 allow remote attackers to cause…

  apache2 Debian
  Jul 28, 2010
• Unscored —
  CVE-2010-1623 EPSS 20%

  Memory leak in the apr_brigade_split_line function in buckets/apr_brigade.c in the Apache Portable Runtime Utility libr…

  apache2 apr-util Debian
  Oct 4, 2010
• Low —
  CVE-2010-3718

  Improper Limitation of a Pathname to a Restricted Directory in Apache Tomcat

  Apache Tomcat 7.0.0 through 7.0.3, 6.0.x, and 5.5.x, when running within a SecurityManager, does not make the ServletContext attribute read-only, which allows local web applications to read or write files outside of the intended working directory, as demonstr…

  org.apache.tomcat:tomcat Maven
  Feb 10, 2011
• Medium —
  CVE-2010-4172 Public exploit EPSS 42%

  Improper Neutralization of Input During Web Page Generation in Apache Tomcat

  Multiple cross-site scripting (XSS) vulnerabilities in the Manager application in Apache Tomcat 6.0.12 through 6.0.29 and 7.0.0 through 7.0.4 allow remote attackers to inject arbitrary web script or HTML via the (1) orderBy or (2) sort parameter to sessionsLi…

  org.apache.tomcat:tomcat Maven
  Nov 26, 2010
• Medium —
  CVE-2011-0013 EPSS 10%

  Improper Neutralization of Input During Web Page Generation in Apache Tomcat

  Multiple cross-site scripting (XSS) vulnerabilities in the HTML Manager Interface in Apache Tomcat 5.5 before 5.5.32, 6.0 before 6.0.30, and 7.0 before 7.0.6 allow remote attackers to inject arbitrary web script or HTML, as demonstrated via the display-name t…

  org.apache.tomcat:tomcat Maven
  Feb 18, 2011
• Unscored —
  CVE-2011-0419 Public exploit EPSS 30%

  Stack consumption vulnerability in the fnmatch implementation in apr_fnmatch.c in the Apache Portable Runtime (APR) lib…

  apr Debian
  May 16, 2011
• Unscored —
  CVE-2012-4557 EPSS 17%

  The mod_proxy_ajp module in the Apache HTTP Server 2.2.12 through 2.2.21 places a worker node into an error state upon …

  apache2 Debian
  Nov 30, 2012

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• article
  http://docs.redhat.com/docs/en-US/JBoss_Enterprise_Web_Server/1.0/html-single/Release_Notes_1.0.2/index.html
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=585331
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=618189
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=640281
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=656246
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=675786
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=675792
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=677655
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=677657
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=677659
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=703390
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2011/rhsa-2011_0897.json
• report
  https://access.redhat.com/security/cve/CVE-2010-1157
• advisory
  https://www.cve.org/CVERecord?id=CVE-2010-1157
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2010-1157
• report
  https://access.redhat.com/security/cve/CVE-2010-1452
• advisory
  https://www.cve.org/CVERecord?id=CVE-2010-1452
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2010-1452
• report
  https://access.redhat.com/security/cve/CVE-2010-1623
• advisory
  https://www.cve.org/CVERecord?id=CVE-2010-1623
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2010-1623
• report
  https://access.redhat.com/security/cve/CVE-2010-3718
• advisory
  https://www.cve.org/CVERecord?id=CVE-2010-3718
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2010-3718
• report
  https://access.redhat.com/security/cve/CVE-2010-4172
• advisory
  https://www.cve.org/CVERecord?id=CVE-2010-4172
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2010-4172
• report
  https://access.redhat.com/security/cve/CVE-2011-0013
• advisory
  https://www.cve.org/CVERecord?id=CVE-2011-0013
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2011-0013
• report
  https://access.redhat.com/security/cve/CVE-2011-0419
• advisory
  https://www.cve.org/CVERecord?id=CVE-2011-0419
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2011-0419
• report
  https://access.redhat.com/security/cve/CVE-2012-4557
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=871685
• advisory
  https://www.cve.org/CVERecord?id=CVE-2012-4557
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2012-4557