RHSA-2008:0261: Moderate: Red Hat Network Satellite Server security update

During an internal security review, a cross-site scripting flaw was foundthat affected the Red Hat Network channel search feature. (CVE-2007-5961)This release also corrects several security vulnerabilities in variouscomponents shipped as part of the Red Hat Network Satellite Server. In atypical operating environment, these components are not exposed to users ofSatellite Server in a vulnerable manner. These security updates will reducerisk in unique Satellite Server environments.Multiple flaws were fixed in the Apache HTTPD server. These flaws couldresult in a cross-site scripting, denial-of-service, or informationdisclosure attacks. (CVE-2004-0885, CVE-2006-5752, CVE-2006-7197,CVE-2007-1860, CVE-2007-3304, CVE-2007-4465, CVE-2007-5000, CVE-2007-6388)A denial-of-service flaw was fixed in modperl. (CVE-2007-1349)A denial-of-service flaw was fixed in the jabberd server. (CVE-2006-1329)Multiple cross-site scripting flaws were fixed in the image map feature inthe JFreeChart package. (CVE-2007-6306)Multiple flaws were fixed in the IBM Java 1.4.2 Runtime. (CVE-2007-0243,CVE-2007-2435, CVE-2007-2788, CVE-2007-2789)Two arbitrary code execution flaws were fixed in the OpenMotif package.(CVE-2005-3964, CVE-2005-0605)A flaw which could result in weak encryption was fixed in theperl-Crypt-CBC package. (CVE-2006-0898)Multiple flaws were fixed in the Tomcat package. (CVE-2008-0128,CVE-2007-5461, CVE-2007-3385, CVE-2007-3382, CVE-2007-1358, CVE-2007-1355,CVE-2007-2450, CVE-2007-2449, CVE-2007-0450, CVE-2006-7196, CVE-2006-7195,CVE-2006-3835, CVE-2006-0254, CVE-2005-2090, CVE-2005-4838, CVE-2005-3510)Users of Red Hat Network Satellite Server 5.0 are advised to upgrade to5.0.2, which resolves these issues.