Description
Cross-site scripting (XSS) vulnerability in Sun Java Server Faces (JSF) 1.2 before 1.2_08 allows remote attackers to inject arbitrary web script or HTML via unknown vectors.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat JBoss EAP 4 | asm | 1.5.3-1jpp.ep1.2.el5 | RHSA-2008:0828 |
| Red Hat JBoss EAP 4 | cglib | 2.1.3-2jpp.ep1.6.el5 | RHSA-2008:0828 |
| Red Hat JBoss EAP 4 | concurrent | 1.3.4-8jpp.ep1.6.el5.1 | RHSA-2008:0828 |
| Red Hat JBoss EAP 4 | glassfish-javamail | 1.4.0-0jpp.ep1.9.el4 | RHSA-2008:0826, RHSA-2008:0825 |
| Red Hat JBoss EAP 4 | glassfish-jsf | 1.2_08-0jpp.ep1.2.el5 | RHSA-2008:0828 |
| Red Hat JBoss EAP 4 | hibernate3 +1 | 1:3.2.4-1.SP1_CP03.0jpp.ep1.1.el4 | RHSA-2008:0828, RHSA-2008:0827, RHSA-2008:0826 |
| Red Hat JBoss EAP 4 | hibernate3-annotations +1 | 3.2.1-1.patch02.1jpp.ep1.3.el4 | RHSA-2008:0828, RHSA-2008:0827, RHSA-2008:0826 |
| Red Hat JBoss EAP 4 | hibernate3-entitymanager +1 | 3.2.1-1jpp.ep1.7.el5 | RHSA-2008:0828 |
| Red Hat JBoss EAP 4 | jboss-aop | 1.5.5-1.CP01.0jpp.ep1.1.el4 | RHSA-2008:0828, RHSA-2008:0826 |
| Red Hat JBoss EAP 4 | jboss-cache | 1.4.1-4.SP9.1jpp.ep1.1.el4 | RHSA-2008:0828, RHSA-2008:0827, RHSA-2008:0826 |
| Red Hat JBoss EAP 4 | jboss-messaging | 1.4.0-1.SP3_CP02.0jpp.ep1.6.el4 | RHSA-2008:0828, RHSA-2008:0826 |
| Red Hat JBoss EAP 4 | jboss-remoting | 2.2.2-3.SP7.0jpp.ep1.3.el4 | RHSA-2008:0828, RHSA-2008:0827, RHSA-2008:0826 |
| Red Hat JBoss EAP 4 | jboss-seam +1 | 1.2.1-1.ep1.6.el5 | RHSA-2008:0828, RHSA-2008:0827, RHSA-2008:0826 |
| Red Hat JBoss EAP 4 | jbossas | 4.2.0-3.GA_CP03.ep1.9.el4 | RHSA-2008:0828, RHSA-2008:0827, RHSA-2008:0826 |
| Red Hat JBoss EAP 4 | jbossts | 1:4.2.3-1.SP5_CP01.1jpp.ep1.1.el4 | RHSA-2008:0828, RHSA-2008:0827, RHSA-2008:0826 |
| Red Hat JBoss EAP 4 | jbossws | 2.0.1-2.SP2_CP01.0jpp.ep1.2.el4 | RHSA-2008:0828, RHSA-2008:0826 |
| Red Hat JBoss EAP 4 | jbossxb | 1.0.0-2.SP1.0jpp.ep1.2.el5.1 | RHSA-2008:0828 |
| Red Hat JBoss EAP 4 | jcommon | 1.0.12-1jpp.ep1.3.el4 | RHSA-2008:0828, RHSA-2008:0827, RHSA-2008:0826 |
| Red Hat JBoss EAP 4 | jfreechart | 1.0.9-1jpp.ep1.3.el4 | RHSA-2008:0828, RHSA-2008:0827, RHSA-2008:0826 |
| Red Hat JBoss EAP 4 | jgroups | 1:2.4.2-1.GA_CP01.0jpp.ep1.1.el4 | RHSA-2008:0828, RHSA-2008:0826 |
| Red Hat JBoss EAP 4 | rh-eap-docs +1 | 4.2.0-3.GA_CP03.ep1.5.el4 | RHSA-2008:0828, RHSA-2008:0827, RHSA-2008:0826 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | com.sun.faces:jsf-api | < 1.2.08 | 1.2.08 | GHSA-vv6j-5x58-q2c3 |
Advisories 4
- RHSA-2008:0828 Red Hat Security Advisory: JBoss Enterprise Application Platform 4.3.0CP01 security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
- RHSA-2008:0827 Red Hat Security Advisory: JBoss Enterprise Application Platform 4.2.0.CP03 security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
- RHSA-2008:0826 Red Hat Security Advisory: JBoss Enterprise Application Platform 4.3.0.CP01 security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
- RHSA-2008:0825 Red Hat Security Advisory: JBoss Enterprise Application Platform 4.2.0.CP03 security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
References
- RHSA-2008:0828 vendor-advisory
- RHSA-2008:0826 vendor-advisory
- 233561 vendor-advisory
- sun-jsf-routines-xss(41081) vdb-entry
- https://jira.jboss.org/jira/browse/JBPAPP-682
- https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=437082
- http://www.redhat.com/docs/en-US/JBoss_Enterprise_Application_Platform/4.2.0.cp03/html-single/readme/index.html
- ADV-2008-0808 vdb-entry
- http://www.redhat.com/docs/en-US/JBoss_Enterprise_Application_Platform/4.3.0.cp01/html-single/readme/
- 28192 vdb-entry
- RHSA-2008:0827 vendor-advisory
- 29327 third-party-advisory
- RHSA-2008:0825 vendor-advisory
- 1020628 vdb-entry