Red Hat Security Advisory: activemq security update

Fixed packages 2

Vulnerabilities 4

• Medium —
  CVE-2013-2035

  Improper Control of Generation of Code in HawtJNI

  Race condition in hawtjni-runtime/src/main/java/org/fusesource/hawtjni/runtime/Library.java in HawtJNI before 1.8, when a custom library path is not specified, allows local users to execute arbitrary Java code by overwriting a temporary JAR file with a predic…

  thingsboard-tb-node hawtjni org.fusesource.hawtjni:hawtjni-runtime hawtjni Debian Ubuntu Wolfi Maven
  Aug 28, 2013
• Medium —
  CVE-2013-4152 EPSS 26%

  Cross-Site Request Forgery in Spring Framework

  The Spring OXM wrapper in Spring Framework before 3.2.4 and 4.0.0.M1, when using the JAXB marshaller, does not disable entity resolution, which allows context-dependent attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via…

  libspring-java org.springframework:spring-oxm Debian Maven
  Jan 23, 2014
• Medium —
  CVE-2013-4330

  Improper Control of Generation of Code in Apache Camel

  Apache Camel before 2.9.7, 2.10.0 before 2.10.7, 2.11.0 before 2.11.2, and 2.12.0 allows remote attackers to execute arbitrary simple language expressions by including "$simple{}" in a CamelFileName message header to a (1) FILE or (2) FTP producer.

  org.apache.camel:camel-core Maven
  Oct 4, 2013
• High —
  CVE-2014-0003

  Apache Camel's XSLT component allows remote attackers to execute arbitrary Java methods

  The XSLT component in Apache Camel 2.11.x before 2.11.4, 2.12.x before 2.12.3, and possibly earlier versions allows remote attackers to execute arbitrary Java methods via a crafted message.

  org.apache.camel:camel-core Maven
  Mar 20, 2014

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=958618
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1000186
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1011726
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1049692
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_0245.json
• report
  https://access.redhat.com/security/cve/CVE-2013-2035
• advisory
  https://www.cve.org/CVERecord?id=CVE-2013-2035
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2013-2035
• report
  https://access.redhat.com/security/cve/CVE-2013-4152
• advisory
  https://www.cve.org/CVERecord?id=CVE-2013-4152
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2013-4152
• article
  http://www.gopivotal.com/security/cve-2013-4152
• article
  https://github.com/SpringSource/spring-framework/pull/317
• article
  https://jira.springsource.org/browse/SPR-10806
• report
  https://access.redhat.com/security/cve/CVE-2013-4330
• advisory
  https://www.cve.org/CVERecord?id=CVE-2013-4330
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2013-4330
• report
  https://access.redhat.com/security/cve/CVE-2014-0003
• advisory
  https://www.cve.org/CVERecord?id=CVE-2014-0003
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2014-0003
• article
  http://camel.apache.org/security-advisories.data/CVE-2014-0003.txt.asc