Skip to content
OpenAdvisories
Unscored RHSA-2014:0254 4 CVEs

Red Hat Security Advisory: activemq security update

Published Sep 29, 2024 · Updated Aug 5, 2026

Ecosystem: Red Hat

Fixed packages 2

ReleasePackageFixed in
Red Hat · OpenShift 1 openshift:1.2::el6 activemq 0:5.9.0-4.redhat.610328.el6op
Red Hat · OpenShift 1 openshift:1.2::el6 activemq-client 0:5.9.0-4.redhat.610328.el6op

Vulnerabilities 4

  • Medium —
    CVE-2013-2035

    Improper Control of Generation of Code in HawtJNI

    Race condition in hawtjni-runtime/src/main/java/org/fusesource/hawtjni/runtime/Library.java in HawtJNI before 1.8, when a custom library path is not specified, allows local users to execute arbitrary Java code by overwriting a temporary JAR file with a predic…

    thingsboard-tb-node hawtjni org.fusesource.hawtjni:hawtjni-runtime hawtjni Debian Ubuntu Wolfi Maven
  • Medium —
    CVE-2013-4152 EPSS 26%

    Cross-Site Request Forgery in Spring Framework

    The Spring OXM wrapper in Spring Framework before 3.2.4 and 4.0.0.M1, when using the JAXB marshaller, does not disable entity resolution, which allows context-dependent attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via…

    libspring-java org.springframework:spring-oxm Debian Maven
  • Medium —
    CVE-2013-4330

    Improper Control of Generation of Code in Apache Camel

    Apache Camel before 2.9.7, 2.10.0 before 2.10.7, 2.11.0 before 2.11.2, and 2.12.0 allows remote attackers to execute arbitrary simple language expressions by including "$simple{}" in a CamelFileName message header to a (1) FILE or (2) FTP producer.

    org.apache.camel:camel-core Maven
  • High —
    CVE-2014-0003

    Apache Camel's XSLT component allows remote attackers to execute arbitrary Java methods

    The XSLT component in Apache Camel 2.11.x before 2.11.4, 2.12.x before 2.12.3, and possibly earlier versions allows remote attackers to execute arbitrary Java methods via a crafted message.

    org.apache.camel:camel-core Maven

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=958618
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1000186
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1011726
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1049692
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_0254.json
  • report
    https://access.redhat.com/security/cve/CVE-2013-2035
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2013-2035
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2013-2035
  • report
    https://access.redhat.com/security/cve/CVE-2013-4152
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2013-4152
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2013-4152
  • article
    http://www.gopivotal.com/security/cve-2013-4152
  • article
    https://github.com/SpringSource/spring-framework/pull/317
  • article
    https://jira.springsource.org/browse/SPR-10806
  • report
    https://access.redhat.com/security/cve/CVE-2013-4330
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2013-4330
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2013-4330
  • report
    https://access.redhat.com/security/cve/CVE-2014-0003
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2014-0003
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2014-0003
  • article
    http://camel.apache.org/security-advisories.data/CVE-2014-0003.txt.asc