Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.4.16 natives update

Fixed packages 12

Vulnerabilities 4

• Unscored —
  CVE-2016-2177 EPSS 45%

  OpenSSL through 1.0.2h incorrectly uses pointer arithmetic for heap-buffer boundary checks, which might allow remote at…

  openssl openssl openssl Debian Ubuntu Alpine
  Jun 20, 2016
• Unscored —
  CVE-2016-2178

  The dsa_sign_setup function in crypto/dsa/dsa_ossl.c in OpenSSL through 1.0.2h does not properly ensure the use of cons…

  openssl openssl openssl Debian Ubuntu Alpine
  Jun 20, 2016
• Unscored —
  CVE-2016-6304 EPSS 63%

  Multiple memory leaks in t1_lib.c in OpenSSL before 1.0.1u, 1.0.2 before 1.0.2i, and 1.1.0 before 1.1.0a allow remote a…

  openssl openssl openssl Debian Ubuntu Alpine
  Sep 26, 2016
• Unscored —
  CVE-2016-8610 Public exploit EPSS 40%

  A denial of service flaw was found in OpenSSL 0.9.8, 1.0.1, 1.0.2 through 1.0.2h, and 1.1.0 in the way the TLS/SSL prot…

  OpenSSL OpenSSL openssl openssl Debian Ubuntu
  Nov 13, 2017

References

• article
  https://access.redhat.com/security/updates/classification/#important
• article
  https://access.redhat.com/articles/2688611
• article
  https://access.redhat.com/solutions/222023
• article
  https://access.redhat.com/documentation/en/red-hat-jboss-enterprise-application-platform/
• article
  https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=appplatform&downloadType=securityPatches&version=6.4
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1341705
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1343400
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1377600
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1384743
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_1658.json
• report
  https://access.redhat.com/security/cve/CVE-2016-2177
• advisory
  https://www.cve.org/CVERecord?id=CVE-2016-2177
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2016-2177
• article
  https://www.openssl.org/news/secadv/20160922.txt
• report
  https://access.redhat.com/security/cve/CVE-2016-2178
• advisory
  https://www.cve.org/CVERecord?id=CVE-2016-2178
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2016-2178
• article
  http://eprint.iacr.org/2016/594
• report
  https://access.redhat.com/security/cve/CVE-2016-6304
• advisory
  https://www.cve.org/CVERecord?id=CVE-2016-6304
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2016-6304
• report
  https://access.redhat.com/security/cve/CVE-2016-8610
• advisory
  https://www.cve.org/CVERecord?id=CVE-2016-8610
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2016-8610
• article
  http://security.360.cn/cve/CVE-2016-8610