Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.4.6 update on RHEL 6

Fixed packages 94

Vulnerabilities 1

• High —
  CVE-2015-0254 EPSS 12%

  XXE in Apache Standard Taglibs

  Apache Standard Taglibs before 1.2.3 allows remote attackers to execute arbitrary code or conduct external XML entity (XXE) attacks via a crafted XSLT extension in a (1) <x:parse> or (2) <x:transform> JSTL XML tag.

  org.apache.taglibs:taglibs-standard-impl jakarta-taglibs-standard org.apache.taglibs:taglibs-standard Ubuntu Maven
  Mar 9, 2015

References

• article
  https://access.redhat.com/security/updates/classification/#important
• article
  https://access.redhat.com/documentation/en-US/JBoss_Enterprise_Application_Platform/6.4/index.html
• article
  https://access.redhat.com/solutions/1584363
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1198606
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1275692
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1286738
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1286836
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1289295
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1289298
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1289304
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1289624
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1289748
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1290033
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1290059
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1290812
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1290817
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1298276
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_0122.json
• report
  https://access.redhat.com/security/cve/CVE-2015-0254
• advisory
  https://www.cve.org/CVERecord?id=CVE-2015-0254
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2015-0254