Skip to content
OpenAdvisories
Unscored RHSA-2013:1012 5 CVEs

Red Hat Security Advisory: Red Hat JBoss Web Server 2.0.1 update

Published Sep 15, 2024 · Updated Aug 5, 2026

Ecosystem: Red Hat

Fixed packages 45

ReleasePackageFixed in
Red Hat · JBoss Web Server 2 jboss_enterprise_web_server:2::el6 apache-commons-daemon-eap6 1:1.0.15-4.redhat_1.ep6.el6
Red Hat · JBoss Web Server 2 jboss_enterprise_web_server:2::el6 apache-commons-daemon-jsvc-eap6 1:1.0.15-1.redhat_1.ep6.el6
Red Hat · JBoss Web Server 2 jboss_enterprise_web_server:2::el6 apache-commons-daemon-jsvc-eap6-debuginfo 1:1.0.15-1.redhat_1.ep6.el6
Red Hat · JBoss Web Server 2 jboss_enterprise_web_server:2::el6 apache-commons-pool-eap6 0:1.6-6.redhat_4.ep6.el6
Red Hat · JBoss Web Server 2 jboss_enterprise_web_server:2::el6 apache-commons-pool-tomcat-eap6 0:1.6-6.redhat_4.ep6.el6
Red Hat · JBoss Web Server 2 jboss_enterprise_web_server:2::el6 dom4j 0:1.6.1-19.redhat_5.ep6.el6
Red Hat · JBoss Web Server 2 jboss_enterprise_web_server:2::el6 ecj3 1:3.7.2-6.redhat_1.ep6.el6
Red Hat · JBoss Web Server 2 jboss_enterprise_web_server:2::el6 httpd 0:2.2.22-23.ep6.el6
Red Hat · JBoss Web Server 2 jboss_enterprise_web_server:2::el6 httpd-debuginfo 0:2.2.22-23.ep6.el6
Red Hat · JBoss Web Server 2 jboss_enterprise_web_server:2::el6 httpd-devel 0:2.2.22-23.ep6.el6
Red Hat · JBoss Web Server 2 jboss_enterprise_web_server:2::el6 httpd-manual 0:2.2.22-23.ep6.el6
Red Hat · JBoss Web Server 2 jboss_enterprise_web_server:2::el6 httpd-tools 0:2.2.22-23.ep6.el6
Red Hat · JBoss Web Server 2 jboss_enterprise_web_server:2::el6 mod_cluster 0:1.2.4-1.Final_redhat_1.ep6.el6
Red Hat · JBoss Web Server 2 jboss_enterprise_web_server:2::el6 mod_cluster-demo 0:1.2.4-1.Final_redhat_1.ep6.el6
Red Hat · JBoss Web Server 2 jboss_enterprise_web_server:2::el6 mod_cluster-native 0:1.2.4-1.Final.redhat_1.ep6.el6
Red Hat · JBoss Web Server 2 jboss_enterprise_web_server:2::el6 mod_cluster-native-debuginfo 0:1.2.4-1.Final.redhat_1.ep6.el6
Red Hat · JBoss Web Server 2 jboss_enterprise_web_server:2::el6 mod_cluster-tomcat6 0:1.2.4-1.Final_redhat_1.ep6.el6
Red Hat · JBoss Web Server 2 jboss_enterprise_web_server:2::el6 mod_cluster-tomcat7 0:1.2.4-1.Final_redhat_1.ep6.el6
Red Hat · JBoss Web Server 2 jboss_enterprise_web_server:2::el6 mod_jk 0:1.2.37-2.redhat_1.ep6.el6
Red Hat · JBoss Web Server 2 jboss_enterprise_web_server:2::el6 mod_jk-ap22 0:1.2.37-2.redhat_1.ep6.el6
Red Hat · JBoss Web Server 2 jboss_enterprise_web_server:2::el6 mod_jk-debuginfo 0:1.2.37-2.redhat_1.ep6.el6
Red Hat · JBoss Web Server 2 jboss_enterprise_web_server:2::el6 mod_jk-manual 0:1.2.37-2.redhat_1.ep6.el6
Red Hat · JBoss Web Server 2 jboss_enterprise_web_server:2::el6 mod_ssl 1:2.2.22-23.ep6.el6
Red Hat · JBoss Web Server 2 jboss_enterprise_web_server:2::el6 tomcat-native 0:1.1.27-4.redhat_1.ep6.el6
Red Hat · JBoss Web Server 2 jboss_enterprise_web_server:2::el6 tomcat-native-debuginfo 0:1.1.27-4.redhat_1.ep6.el6
Red Hat · JBoss Web Server 2 jboss_enterprise_web_server:2::el6 tomcat6 0:6.0.37-10_patch_01.ep6.el6
Red Hat · JBoss Web Server 2 jboss_enterprise_web_server:2::el6 tomcat6-admin-webapps 0:6.0.37-10_patch_01.ep6.el6
Red Hat · JBoss Web Server 2 jboss_enterprise_web_server:2::el6 tomcat6-docs-webapp 0:6.0.37-10_patch_01.ep6.el6
Red Hat · JBoss Web Server 2 jboss_enterprise_web_server:2::el6 tomcat6-el-1.0-api 0:6.0.37-10_patch_01.ep6.el6
Red Hat · JBoss Web Server 2 jboss_enterprise_web_server:2::el6 tomcat6-javadoc 0:6.0.37-10_patch_01.ep6.el6
Red Hat · JBoss Web Server 2 jboss_enterprise_web_server:2::el6 tomcat6-jsp-2.1-api 0:6.0.37-10_patch_01.ep6.el6
Red Hat · JBoss Web Server 2 jboss_enterprise_web_server:2::el6 tomcat6-lib 0:6.0.37-10_patch_01.ep6.el6
Red Hat · JBoss Web Server 2 jboss_enterprise_web_server:2::el6 tomcat6-log4j 0:6.0.37-10_patch_01.ep6.el6
Red Hat · JBoss Web Server 2 jboss_enterprise_web_server:2::el6 tomcat6-servlet-2.5-api 0:6.0.37-10_patch_01.ep6.el6
Red Hat · JBoss Web Server 2 jboss_enterprise_web_server:2::el6 tomcat6-webapps 0:6.0.37-10_patch_01.ep6.el6
Red Hat · JBoss Web Server 2 jboss_enterprise_web_server:2::el6 tomcat7 0:7.0.40-5_patch_01.ep6.el6
Red Hat · JBoss Web Server 2 jboss_enterprise_web_server:2::el6 tomcat7-admin-webapps 0:7.0.40-5_patch_01.ep6.el6
Red Hat · JBoss Web Server 2 jboss_enterprise_web_server:2::el6 tomcat7-docs-webapp 0:7.0.40-5_patch_01.ep6.el6
Red Hat · JBoss Web Server 2 jboss_enterprise_web_server:2::el6 tomcat7-el-1.0-api 0:7.0.40-5_patch_01.ep6.el6
Red Hat · JBoss Web Server 2 jboss_enterprise_web_server:2::el6 tomcat7-javadoc 0:7.0.40-5_patch_01.ep6.el6
Red Hat · JBoss Web Server 2 jboss_enterprise_web_server:2::el6 tomcat7-jsp-2.2-api 0:7.0.40-5_patch_01.ep6.el6
Red Hat · JBoss Web Server 2 jboss_enterprise_web_server:2::el6 tomcat7-lib 0:7.0.40-5_patch_01.ep6.el6
Red Hat · JBoss Web Server 2 jboss_enterprise_web_server:2::el6 tomcat7-log4j 0:7.0.40-5_patch_01.ep6.el6
Red Hat · JBoss Web Server 2 jboss_enterprise_web_server:2::el6 tomcat7-servlet-3.0-api 0:7.0.40-5_patch_01.ep6.el6
Red Hat · JBoss Web Server 2 jboss_enterprise_web_server:2::el6 tomcat7-webapps 0:7.0.40-5_patch_01.ep6.el6

Vulnerabilities 5

  • Unscored —
    CVE-2012-3499 EPSS 23%

    Multiple cross-site scripting (XSS) vulnerabilities in the Apache HTTP Server 2.2.x before 2.2.24-dev and 2.4.x before …

    apache2 Debian
  • Medium —
    CVE-2012-3544 EPSS 11%

    Apache Tomcat Vulnerable to Denial of Service (DoS) via Improper Handling of chunk extensions

    Apache Tomcat 6.x before 6.0.37 and 7.x before 7.0.30 does not properly handle chunk extensions in chunked transfer coding, which allows remote attackers to cause a denial of service by streaming data.

    org.apache.tomcat:tomcat Maven
  • Unscored —
    CVE-2012-4558 EPSS 23%

    Multiple cross-site scripting (XSS) vulnerabilities in the balancer_handler function in the manager interface in mod_pr…

    apache2 Debian
  • Medium —
    CVE-2013-2067 EPSS 10%

    Improper Authentication in Apache Tomcat

    java/org/apache/catalina/authenticator/FormAuthenticator.java in the form authentication feature in Apache Tomcat 6.0.21 through 6.0.36 and 7.x before 7.0.33 does not properly handle the relationships between authentication requirements and sessions, which al…

    org.apache.tomcat:tomcat Maven
  • Low —
    CVE-2013-2071

    Exposure of Sensitive Information to an Unauthorized Actor in Apache Tomcat

    java/org/apache/catalina/core/AsyncContextImpl.java in Apache Tomcat 7.x before 7.0.40 does not properly handle the throwing of a RuntimeException in an AsyncListener in an application, which allows context-dependent attackers to obtain sensitive request info…

    org.apache.tomcat:tomcat Maven

References

  • article
    https://access.redhat.com/security/updates/classification/#moderate
  • article
    https://access.redhat.com/site/documentation/
  • article
    https://access.redhat.com/site/documentation/en-US/JBoss_Enterprise_Web_Server/2/html-single/Installation_Guide/index.html
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=915883
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=915884
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=961779
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=961783
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=961803
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2013/rhsa-2013_1012.json
  • report
    https://access.redhat.com/security/cve/CVE-2012-3499
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2012-3499
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2012-3499
  • report
    https://access.redhat.com/security/cve/CVE-2012-3544
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2012-3544
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2012-3544
  • report
    https://access.redhat.com/security/cve/CVE-2012-4558
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2012-4558
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2012-4558
  • report
    https://access.redhat.com/security/cve/CVE-2013-2067
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2013-2067
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2013-2067
  • report
    https://access.redhat.com/security/cve/CVE-2013-2071
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2013-2071
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2013-2071