Red Hat Security Advisory: Red Hat JBoss Core Services Apache HTTP Server 2.4.23 Release on RHEL 7

Fixed packages 37

Vulnerabilities 6

• Unscored —
  CVE-2016-2108 EPSS 78%

  The ASN.1 implementation in OpenSSL before 1.0.1o and 1.0.2 before 1.0.2c allows remote attackers to execute arbitrary …

  openssl openssl Debian Ubuntu
  May 5, 2016
• Unscored —
  CVE-2016-2177 EPSS 45%

  OpenSSL through 1.0.2h incorrectly uses pointer arithmetic for heap-buffer boundary checks, which might allow remote at…

  openssl openssl openssl Debian Ubuntu Alpine
  Jun 20, 2016
• Unscored —
  CVE-2016-2178

  The dsa_sign_setup function in crypto/dsa/dsa_ossl.c in OpenSSL through 1.0.2h does not properly ensure the use of cons…

  openssl openssl openssl Debian Ubuntu Alpine
  Jun 20, 2016
• Unscored —
  CVE-2016-4459

  Stack-based buffer overflow in native/mod_manager/node.c in mod_cluster 1.2.9.

  Apr 12, 2017
• Unscored —
  CVE-2016-6808 EPSS 23%

  Buffer overflow in Apache Tomcat Connectors (mod_jk) before 1.2.42.

  Apr 12, 2017
• Unscored —
  CVE-2016-8612

  Apache HTTP Server mod_cluster before version httpd 2.4.23 is vulnerable to an Improper Input Validation in the protoco…

  Red Hat mod_cluster
  Mar 9, 2018

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1331402
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1341583
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1341705
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1343400
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1382352
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1387605
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_0194.json
• report
  https://access.redhat.com/security/cve/CVE-2016-2108
• advisory
  https://www.cve.org/CVERecord?id=CVE-2016-2108
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2016-2108
• article
  https://openssl.org/news/secadv/20160503.txt
• report
  https://access.redhat.com/security/cve/CVE-2016-2177
• advisory
  https://www.cve.org/CVERecord?id=CVE-2016-2177
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2016-2177
• article
  https://www.openssl.org/news/secadv/20160922.txt
• report
  https://access.redhat.com/security/cve/CVE-2016-2178
• advisory
  https://www.cve.org/CVERecord?id=CVE-2016-2178
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2016-2178
• article
  http://eprint.iacr.org/2016/594
• report
  https://access.redhat.com/security/cve/CVE-2016-4459
• advisory
  https://www.cve.org/CVERecord?id=CVE-2016-4459
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2016-4459
• report
  https://access.redhat.com/security/cve/CVE-2016-6808
• advisory
  https://www.cve.org/CVERecord?id=CVE-2016-6808
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2016-6808
• article
  https://tomcat.apache.org/security-jk.html#Fixed_in_Apache_Tomcat_JK_Connector_1.2.42
• report
  https://access.redhat.com/security/cve/CVE-2016-8612
• advisory
  https://www.cve.org/CVERecord?id=CVE-2016-8612
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2016-8612