RHSA-2008:0158: Moderate: JBoss Enterprise Application Platform security update
First published: Mon Mar 24 2008(Updated: )
JBEAP is a middleware platform for Java 2 Platform, Enterprise Edition<br>(J2EE) applications.<br>This release of JBEAP for Red Hat Enterprise Linux 4 contains the JBoss<br>Application Server and JBoss Seam. This release serves as a replacement to<br>JBEAP 4.2.0.GA.<br>The updated packages address the following security vulnerabilities:<br><li> the JFreeChart component was vulnerable to multiple cross-site scripting </li> (XSS) vulnerabilities. An attacker could misuse the image map feature to<br>inject arbitrary web script or HTML via several attributes of the chart<br>area. (CVE-2007-6306)<br><li> a vulnerability caused by exposing static java methods was located within </li> the HSQLDB component. This could be utilized by an attacker to execute<br>arbitrary static java methods. (CVE-2007-4575)<br><li> the setOrder method in the org.jboss.seam.framework.Query class did not </li> properly validate user-supplied parameters. This vulnerability allowed<br>remote attackers to inject and execute arbitrary EJBQL commands via the<br>order parameter. (CVE-2007-6433)<br>All users are advised to upgrade to this release of JBEAP, which addresses<br>these vulnerabilities.
| Affected Software | Affected Version | How to fix |
|---|---|---|
| JBoss Enterprise Application Platform |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=299801
- https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=421081
- https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=426206
- http://www.redhat.com/docs/manuals/jboss/jboss-eap-4.2.0.cp02/readme.html
- https://rhstack.108.redhat.com/docs/Red_Hat_Application_Stack_V.1.2_Release_Notes.html
- http://www.redhat.com/security/updates/classification/#moderate
- https://access.redhat.com/errata/RHSA-2008:0158 (Advisory)
Frequently Asked Questions
What is the severity of RHSA-2008:0158?
The severity of RHSA-2008:0158 is classified as moderate.
How do I fix RHSA-2008:0158?
To fix RHSA-2008:0158, you should update to the latest version of JBEAP provided by Red Hat.
What vulnerabilities does RHSA-2008:0158 address?
RHSA-2008:0158 addresses various flaws in the JBoss Application Server and JBoss Seam.
Is RHSA-2008:0158 applicable to my system?
RHSA-2008:0158 is applicable to systems running Red Hat Enterprise Linux 4 with JBEAP 4.2.0.GA.
Will applying the fix for RHSA-2008:0158 disrupt my applications?
Applying the fix for RHSA-2008:0158 may require application restarts, so timing the update is important.
- agent/severity
- agent/type
- agent/event
- agent/first-publish-date
- agent/last-modified-date
- collector/redhat-errata
- source/Red Hat
- anchor-id/RHSA-2008:0158
- agent/trending
- agent/weakness
- agent/references
- agent/title
- agent/remedy
- agent/description
- agent/source
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/red hat
- canonical/jboss enterprise application platform