Skip to content
OpenAdvisories
Medium RHSA-2015:2660 5 CVEs

Red Hat Security Advisory: Red Hat JBoss Web Server 3.0.2 security update

Published Sep 15, 2024 · Updated Aug 5, 2026

Ecosystem: Red Hat

Fixed packages 36

ReleasePackageFixed in
Red Hat · JBoss Web Server 3 jboss_enterprise_web_server:3.0::el7 apache-commons-collections-eap6 0:3.2.1-18.redhat_7.1.ep6.el7
Red Hat · JBoss Web Server 3 jboss_enterprise_web_server:3.0::el7 apache-commons-collections-tomcat-eap6 0:3.2.1-18.redhat_7.1.ep6.el7
Red Hat · JBoss Web Server 3 jboss_enterprise_web_server:3.0::el7 httpd24 0:2.4.6-59.ep7.el7
Red Hat · JBoss Web Server 3 jboss_enterprise_web_server:3.0::el7 httpd24-debuginfo 0:2.4.6-59.ep7.el7
Red Hat · JBoss Web Server 3 jboss_enterprise_web_server:3.0::el7 httpd24-devel 0:2.4.6-59.ep7.el7
Red Hat · JBoss Web Server 3 jboss_enterprise_web_server:3.0::el7 httpd24-manual 0:2.4.6-59.ep7.el7
Red Hat · JBoss Web Server 3 jboss_enterprise_web_server:3.0::el7 httpd24-tools 0:2.4.6-59.ep7.el7
Red Hat · JBoss Web Server 3 jboss_enterprise_web_server:3.0::el7 mod_bmx 0:0.9.5-7.GA.ep7.el7
Red Hat · JBoss Web Server 3 jboss_enterprise_web_server:3.0::el7 mod_bmx-debuginfo 0:0.9.5-7.GA.ep7.el7
Red Hat · JBoss Web Server 3 jboss_enterprise_web_server:3.0::el7 mod_cluster-native 0:1.3.1-6.Final_redhat_2.ep7.el7
Red Hat · JBoss Web Server 3 jboss_enterprise_web_server:3.0::el7 mod_cluster-native-debuginfo 0:1.3.1-6.Final_redhat_2.ep7.el7
Red Hat · JBoss Web Server 3 jboss_enterprise_web_server:3.0::el7 mod_ldap24 0:2.4.6-59.ep7.el7
Red Hat · JBoss Web Server 3 jboss_enterprise_web_server:3.0::el7 mod_proxy24_html 1:2.4.6-59.ep7.el7
Red Hat · JBoss Web Server 3 jboss_enterprise_web_server:3.0::el7 mod_session24 0:2.4.6-59.ep7.el7
Red Hat · JBoss Web Server 3 jboss_enterprise_web_server:3.0::el7 mod_ssl24 1:2.4.6-59.ep7.el7
Red Hat · JBoss Web Server 3 jboss_enterprise_web_server:3.0::el7 tomcat-vault 0:1.0.8-4.Final_redhat_4.1.ep7.el7
Red Hat · JBoss Web Server 3 jboss_enterprise_web_server:3.0::el7 tomcat7 0:7.0.59-42_patch_01.ep7.el7
Red Hat · JBoss Web Server 3 jboss_enterprise_web_server:3.0::el7 tomcat7-admin-webapps 0:7.0.59-42_patch_01.ep7.el7
Red Hat · JBoss Web Server 3 jboss_enterprise_web_server:3.0::el7 tomcat7-docs-webapp 0:7.0.59-42_patch_01.ep7.el7
Red Hat · JBoss Web Server 3 jboss_enterprise_web_server:3.0::el7 tomcat7-el-2.2-api 0:7.0.59-42_patch_01.ep7.el7
Red Hat · JBoss Web Server 3 jboss_enterprise_web_server:3.0::el7 tomcat7-javadoc 0:7.0.59-42_patch_01.ep7.el7
Red Hat · JBoss Web Server 3 jboss_enterprise_web_server:3.0::el7 tomcat7-jsp-2.2-api 0:7.0.59-42_patch_01.ep7.el7
Red Hat · JBoss Web Server 3 jboss_enterprise_web_server:3.0::el7 tomcat7-lib 0:7.0.59-42_patch_01.ep7.el7
Red Hat · JBoss Web Server 3 jboss_enterprise_web_server:3.0::el7 tomcat7-log4j 0:7.0.59-42_patch_01.ep7.el7
Red Hat · JBoss Web Server 3 jboss_enterprise_web_server:3.0::el7 tomcat7-servlet-3.0-api 0:7.0.59-42_patch_01.ep7.el7
Red Hat · JBoss Web Server 3 jboss_enterprise_web_server:3.0::el7 tomcat7-webapps 0:7.0.59-42_patch_01.ep7.el7
Red Hat · JBoss Web Server 3 jboss_enterprise_web_server:3.0::el7 tomcat8 0:8.0.18-52_patch_01.ep7.el7
Red Hat · JBoss Web Server 3 jboss_enterprise_web_server:3.0::el7 tomcat8-admin-webapps 0:8.0.18-52_patch_01.ep7.el7
Red Hat · JBoss Web Server 3 jboss_enterprise_web_server:3.0::el7 tomcat8-docs-webapp 0:8.0.18-52_patch_01.ep7.el7
Red Hat · JBoss Web Server 3 jboss_enterprise_web_server:3.0::el7 tomcat8-el-2.2-api 0:8.0.18-52_patch_01.ep7.el7
Red Hat · JBoss Web Server 3 jboss_enterprise_web_server:3.0::el7 tomcat8-javadoc 0:8.0.18-52_patch_01.ep7.el7
Red Hat · JBoss Web Server 3 jboss_enterprise_web_server:3.0::el7 tomcat8-jsp-2.3-api 0:8.0.18-52_patch_01.ep7.el7
Red Hat · JBoss Web Server 3 jboss_enterprise_web_server:3.0::el7 tomcat8-lib 0:8.0.18-52_patch_01.ep7.el7
Red Hat · JBoss Web Server 3 jboss_enterprise_web_server:3.0::el7 tomcat8-log4j 0:8.0.18-52_patch_01.ep7.el7
Red Hat · JBoss Web Server 3 jboss_enterprise_web_server:3.0::el7 tomcat8-servlet-3.1-api 0:8.0.18-52_patch_01.ep7.el7
Red Hat · JBoss Web Server 3 jboss_enterprise_web_server:3.0::el7 tomcat8-webapps 0:8.0.18-52_patch_01.ep7.el7

Vulnerabilities 5

  • Medium 4.3
    CVE-2015-5174 EPSS 13%

    Improper Limitation of a Pathname to a Restricted Directory in Apache Tomcat

    Directory traversal vulnerability in RequestUtil.java in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.65, and 8.x before 8.0.27 allows remote authenticated users to bypass intended SecurityManager restrictions and list a parent directory via a /.. (slash d…

    org.apache.tomcat:tomcat tomcat7 tomcat6 Ubuntu Maven
  • Unscored —
    CVE-2013-5704 EPSS 58%

    The mod_headers module in the Apache HTTP Server 2.2.22 allows remote attackers to bypass "RequestHeader unset" directi…

    apache2 apache2 Debian Ubuntu
  • High —
    CVE-2014-0230 EPSS 20%

    Uncontrolled Resource Consumption in Apache Tomcat

    Apache Tomcat 6.x before 6.0.44, 7.x before 7.0.55, and 8.x before 8.0.9 does not properly handle cases where an HTTP response occurs before finishing the reading of an entire request body, which allows remote attackers to cause a denial of service (thread co…

    org.apache.tomcat:tomcat tomcat7 tomcat6 Ubuntu Maven
  • Unscored —
    CVE-2014-3581 EPSS 13%

    The cache_merge_headers_out function in modules/cache/cache_util.c in the mod_cache module in the Apache HTTP Server be…

    apache2 apache2 Debian Ubuntu
  • Unscored —
    CVE-2015-3183 EPSS 74%

    The chunked transfer coding implementation in the Apache HTTP Server before 2.4.14 does not properly parse chunk header…

    apache2 apache2 Debian Ubuntu

References

  • article
    https://access.redhat.com/security/updates/classification/#moderate
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1082903
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1191200
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1243887
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1263884
  • article
    https://issues.redhat.com/browse/JWS-219
  • article
    https://issues.redhat.com/browse/JWS-220
  • article
    https://issues.redhat.com/browse/JWS-229
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2015/rhsa-2015_2660.json
  • report
    https://access.redhat.com/security/cve/CVE-2013-5704
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2013-5704
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2013-5704
  • report
    https://access.redhat.com/security/cve/CVE-2014-0230
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2014-0230
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2014-0230
  • article
    http://tomcat.apache.org/security-6.html#Fixed_in_Apache_Tomcat_6.0.44
  • article
    http://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.55
  • article
    http://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.0.9
  • report
    https://access.redhat.com/security/cve/CVE-2014-3581
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1149709
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2014-3581
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2014-3581
  • report
    https://access.redhat.com/security/cve/CVE-2015-3183
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2015-3183
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2015-3183
  • report
    https://access.redhat.com/security/cve/CVE-2015-5174
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1265698
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2015-5174
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2015-5174
  • article
    http://seclists.org/bugtraq/2016/Feb/149