Skip to content
OpenAdvisories
High RHSA-2018:2742 4 CVEs

Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.4.21 security update

Published Sep 29, 2024 · Updated Aug 5, 2026

Ecosystem: Red Hat

Fixed packages 89

ReleasePackageFixed in
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 codehaus-jackson 0:1.9.9-14.redhat_7.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 codehaus-jackson-core-asl 0:1.9.9-14.redhat_7.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 codehaus-jackson-jaxrs 0:1.9.9-14.redhat_7.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 codehaus-jackson-mapper-asl 0:1.9.9-14.redhat_7.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 codehaus-jackson-xc 0:1.9.9-14.redhat_7.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 guava-libraries 0:13.0.1-5.redhat_3.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 hibernate4-validator 0:4.3.4-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 hornetq 0:2.3.25-27.SP28_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 ironjacamar-common-api-eap6 0:1.0.42-2.Final_redhat_2.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 ironjacamar-common-impl-eap6 0:1.0.42-2.Final_redhat_2.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 ironjacamar-common-spi-eap6 0:1.0.42-2.Final_redhat_2.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 ironjacamar-core-api-eap6 0:1.0.42-2.Final_redhat_2.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 ironjacamar-core-impl-eap6 0:1.0.42-2.Final_redhat_2.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 ironjacamar-deployers-common-eap6 0:1.0.42-2.Final_redhat_2.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 ironjacamar-eap6 0:1.0.42-2.Final_redhat_2.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 ironjacamar-jdbc-eap6 0:1.0.42-2.Final_redhat_2.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 ironjacamar-spec-api-eap6 0:1.0.42-2.Final_redhat_2.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 ironjacamar-validator-eap6 0:1.0.42-2.Final_redhat_2.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jboss-as-appclient 0:7.5.21-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jboss-as-cli 0:7.5.21-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jboss-as-client-all 0:7.5.21-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jboss-as-clustering 0:7.5.21-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jboss-as-cmp 0:7.5.21-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jboss-as-configadmin 0:7.5.21-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jboss-as-connector 0:7.5.21-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jboss-as-controller 0:7.5.21-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jboss-as-controller-client 0:7.5.21-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jboss-as-core-security 0:7.5.21-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jboss-as-deployment-repository 0:7.5.21-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jboss-as-deployment-scanner 0:7.5.21-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jboss-as-domain-http 0:7.5.21-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jboss-as-domain-management 0:7.5.21-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jboss-as-ee 0:7.5.21-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jboss-as-ee-deployment 0:7.5.21-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jboss-as-ejb3 0:7.5.21-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jboss-as-embedded 0:7.5.21-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jboss-as-host-controller 0:7.5.21-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jboss-as-jacorb 0:7.5.21-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jboss-as-jaxr 0:7.5.21-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jboss-as-jaxrs 0:7.5.21-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jboss-as-jdr 0:7.5.21-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jboss-as-jmx 0:7.5.21-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jboss-as-jpa 0:7.5.21-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jboss-as-jsf 0:7.5.21-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jboss-as-jsr77 0:7.5.21-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jboss-as-logging 0:7.5.21-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jboss-as-mail 0:7.5.21-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jboss-as-management-client-content 0:7.5.21-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jboss-as-messaging 0:7.5.21-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jboss-as-modcluster 0:7.5.21-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jboss-as-naming 0:7.5.21-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jboss-as-network 0:7.5.21-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jboss-as-osgi 0:7.5.21-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jboss-as-osgi-configadmin 0:7.5.21-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jboss-as-osgi-service 0:7.5.21-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jboss-as-picketlink 0:7.5.21-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jboss-as-platform-mbean 0:7.5.21-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jboss-as-pojo 0:7.5.21-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jboss-as-process-controller 0:7.5.21-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jboss-as-protocol 0:7.5.21-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jboss-as-remoting 0:7.5.21-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jboss-as-sar 0:7.5.21-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jboss-as-security 0:7.5.21-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jboss-as-server 0:7.5.21-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jboss-as-system-jmx 0:7.5.21-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jboss-as-threads 0:7.5.21-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jboss-as-transactions 0:7.5.21-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jboss-as-version 0:7.5.21-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jboss-as-web 0:7.5.21-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jboss-as-webservices 0:7.5.21-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jboss-as-weld 0:7.5.21-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jboss-as-xts 0:7.5.21-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jboss-ejb-client 0:1.0.41-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jboss-modules 0:1.3.11-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jboss-vfs2 0:3.2.13-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jboss-xnio-base 0:3.0.17-1.GA_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jbossas-appclient 0:7.5.21-2.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jbossas-bundles 0:7.5.21-2.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jbossas-core 0:7.5.21-2.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jbossas-domain 0:7.5.21-2.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jbossas-javadocs 0:7.5.21-2.Final_redhat_1.2.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jbossas-modules-eap 0:7.5.21-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jbossas-product-eap 0:7.5.21-2.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jbossas-standalone 0:7.5.21-2.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jbossas-welcome-content-eap 0:7.5.21-2.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jbossweb 0:7.5.29-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 picketlink-bindings 0:2.5.4-23.SP18_redhat_2.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 picketlink-federation 0:2.5.4-21.SP18_redhat_2.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 xerces-j2-eap6 0:2.9.1-19.redhat_8.1.ep6.el5

Vulnerabilities 4

  • High 7.5
    CVE-2018-1336 EPSS 20%

    In Apache Tomcat there is an improper handing of overflow in the UTF-8 decoder

    An improper handing of overflow in the UTF-8 decoder with supplementary characters can lead to an infinite loop in the decoder causing a Denial of Service. Versions Affected: Apache Tomcat 9.0.0.M9 to 9.0.7, 8.5.0 to 8.5.30, 8.0.0.RC1 to 8.0.51, and 7.0.28 to…

    Apache Software Foundation Apache Tomcat tomcat8 tomcat7 Ubuntu Maven
  • High 7.0
    CVE-2017-7536

    Privilege Escalation in Hibernate Validator

    In Hibernate Validator 5.2.x before 5.2.5 final, 5.3.x, and 5.4.x, it was found that when the security manager's reflective permissions, which allows it to access the private members of the class, are granted to Hibernate Validator, a potential privilege esca…

    Red Hat hibernate-validator libhibernate-validator-java org.hibernate:hibernate-validator Debian Maven
  • Medium 6.5
    CVE-2017-2582

    keycloak-core discloses system properties

    It was found that while parsing the SAML messages the StaxParserUtil class of keycloak before 2.5.1 replaces special strings for obtaining attribute values with system property. This could allow an attacker to determine values of system properties at the atta…

    Red Hat keycloak org.keycloak:keycloak-core Maven
  • Medium 5.9
    CVE-2018-10237

    Denial of Service in Google Guava

    Unbounded memory allocation in Google Guava 11.0 through 24.x before 24.1.1 allows remote attackers to conduct denial of service attacks against servers that depend on this library and deserialize attacker-provided data, because the AtomicDoubleArray class (w…

    druid guava-libraries com.google.guava:guava guava-libraries Debian Ubuntu Wolfi Maven

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • article
    https://access.redhat.com/documentation/en-US/JBoss_Enterprise_Application_Platform/6.4/index.html
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1261190
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1410481
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1465573
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1570200
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1573391
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1578830
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1580440
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1594389
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1602226
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1606334
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1607591
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1610355
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1610742
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1611770
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1614448
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1615347
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1615380
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2018/rhsa-2018_2742.json
  • report
    https://access.redhat.com/security/cve/CVE-2017-2582
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2017-2582
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2017-2582
  • report
    https://access.redhat.com/security/cve/CVE-2017-7536
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2017-7536
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2017-7536
  • report
    https://access.redhat.com/security/cve/CVE-2018-1336
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2018-1336
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2018-1336
  • report
    https://access.redhat.com/security/cve/CVE-2018-10237
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2018-10237
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2018-10237
  • article
    https://github.com/google/guava/wiki/CVE-2018-10237
  • article
    https://groups.google.com/forum/#!topic/guava-announce/xqWALw4W1vs/discussion