Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.2.4 security update

Fixed packages 2

Vulnerabilities 4

• Medium —
  CVE-2014-0075 Public exploit EPSS 18%

  Integer Overflow or Wraparound in Apache Tomcat

  Integer overflow in the parseChunkHeader function in java/org/apache/coyote/http11/filters/ChunkedInputFilter.java in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4 allows remote attackers to cause a denial of service (resource consumpti…

  org.apache.tomcat:tomcat tomcat7 tomcat6 org.apache.tomcat:tomcat-coyote Ubuntu Maven
  May 31, 2014
• Medium —
  CVE-2014-0096

  Improper Input Validation in Apache Tomcat

  java/org/apache/catalina/servlets/DefaultServlet.java in the default servlet in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4 does not properly restrict XSLT stylesheets, which allows remote attackers to bypass security-manager restrict…

  org.apache.tomcat:tomcat tomcat7 tomcat6 org.apache.tomcat:tomcat-catalina Ubuntu Maven
  May 31, 2014
• Medium —
  CVE-2014-0099

  Improper Neutralization of CRLF Sequences in HTTP Headers in Apache Tomcat

  Integer overflow in java/org/apache/tomcat/util/buf/Ascii.java in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4, when operated behind a reverse proxy, allows remote attackers to conduct HTTP request smuggling attacks via a crafted Conte…

  org.apache.tomcat:tomcat tomcat7 tomcat6 org.apache.tomcat:tomcat-util Ubuntu Maven
  May 31, 2014
• Medium —
  CVE-2014-0119

  Missing XML Validation in Apache Tomcat

  Apache Tomcat before 6.0.40, 7.x before 7.0.54, and 8.x before 8.0.6 does not properly constrain the class loader that accesses the XML parser used with an XSLT stylesheet, which allows remote attackers to (1) read arbitrary files via a crafted web applicatio…

  org.apache.tomcat:tomcat tomcat7 tomcat6 org.apache.tomcat:tomcat-catalina Ubuntu Maven
  May 31, 2014

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1072776
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1088342
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1102030
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1102038
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_0843.json
• report
  https://access.redhat.com/security/cve/CVE-2014-0075
• advisory
  https://www.cve.org/CVERecord?id=CVE-2014-0075
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2014-0075
• report
  https://access.redhat.com/security/cve/CVE-2014-0096
• advisory
  https://www.cve.org/CVERecord?id=CVE-2014-0096
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2014-0096
• report
  https://access.redhat.com/security/cve/CVE-2014-0099
• advisory
  https://www.cve.org/CVERecord?id=CVE-2014-0099
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2014-0099
• report
  https://access.redhat.com/security/cve/CVE-2014-0119
• advisory
  https://www.cve.org/CVERecord?id=CVE-2014-0119
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2014-0119