Description
JBoss Web, as used in Red Hat JBoss Communications Platform before 5.1.3, Enterprise Web Platform before 5.1.2, Enterprise Application Platform before 5.1.2, and other products, allows remote attackers to cause a denial of service (infinite loop) via vectors related to a crafted UTF-8 and a "surrogate pair character" that is "at the boundary of an internal buffer."
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat JBoss Web Platform 5 | jbossweb +4 | 2.1.12-3_patch_03.2.ep5.el5 | RHSA-2012:0076 |
| Red Hat JBoss EAP 5 | jbossweb +4 | 2.1.12-3_patch_03.2.ep5.el4 | RHSA-2012:0074 |
Advisories 2
- RHSA-2012:0076 Red Hat Security Advisory: jbossweb security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2012:0074 Red Hat Security Advisory: jbossweb security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
References
- 51829 vdb-entry
- RHSA-2012:0325 vendor-advisory
- RHSA-2012:0078 vendor-advisory
- RHSA-2012:0075 vendor-advisory
- RHSA-2012:0074 vendor-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=767871
- 78775 vdb-entry
- RHSA-2012:0076 vendor-advisory
- RHSA-2012:0077 vendor-advisory