Red Hat Security Advisory: Red Hat JBoss Web Server 2.0.1 tomcat7 security update

Fixed packages 20

Vulnerabilities 3

• Medium —
  CVE-2014-0075 Public exploit EPSS 18%

  Integer Overflow or Wraparound in Apache Tomcat

  Integer overflow in the parseChunkHeader function in java/org/apache/coyote/http11/filters/ChunkedInputFilter.java in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4 allows remote attackers to cause a denial of service (resource consumpti…

  org.apache.tomcat:tomcat tomcat7 tomcat6 org.apache.tomcat:tomcat-coyote Ubuntu Maven
  May 31, 2014
• Medium —
  CVE-2014-0096

  Improper Input Validation in Apache Tomcat

  java/org/apache/catalina/servlets/DefaultServlet.java in the default servlet in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4 does not properly restrict XSLT stylesheets, which allows remote attackers to bypass security-manager restrict…

  org.apache.tomcat:tomcat tomcat7 tomcat6 org.apache.tomcat:tomcat-catalina Ubuntu Maven
  May 31, 2014
• Medium —
  CVE-2014-0099

  Improper Neutralization of CRLF Sequences in HTTP Headers in Apache Tomcat

  Integer overflow in java/org/apache/tomcat/util/buf/Ascii.java in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4, when operated behind a reverse proxy, allows remote attackers to conduct HTTP request smuggling attacks via a crafted Conte…

  org.apache.tomcat:tomcat tomcat7 tomcat6 org.apache.tomcat:tomcat-util Ubuntu Maven
  May 31, 2014

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1072776
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1088342
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1102030
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_0835.json
• report
  https://access.redhat.com/security/cve/CVE-2014-0075
• advisory
  https://www.cve.org/CVERecord?id=CVE-2014-0075
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2014-0075
• report
  https://access.redhat.com/security/cve/CVE-2014-0096
• advisory
  https://www.cve.org/CVERecord?id=CVE-2014-0096
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2014-0096
• report
  https://access.redhat.com/security/cve/CVE-2014-0099
• advisory
  https://www.cve.org/CVERecord?id=CVE-2014-0099
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2014-0099