RHSA-2014:0819: Important: Red Hat JBoss BPM Suite 6.0.2 update

Red Hat JBoss BPM Suite is a business rules and processes management systemfor the management, storage, creation, modification, and deployment ofJBoss rules and BPMN2-compliant business processes.This release of Red Hat JBoss BPM Suite 6.0.2 serves as a replacement forRed Hat JBoss BPM Suite 6.0.1, and includes bug fixes and enhancements.Refer to the Red Hat JBoss BPM Suite 6.0.2 Release Notes for informationon the most significant of these changes. The Release Notes will beavailable shortly athttps://access.redhat.com/site/documentation/en-US/RedHatJBossBPMSuite/ The following security issues are fixed with this release:It was found that the secure processing feature of Xalan-Java hadinsufficient restrictions defined for certain properties and features. Aremote attacker able to provide Extensible Stylesheet LanguageTransformations (XSLT) content to be processed by an application usingXalan-Java could use this flaw to bypass the intended constraints of thesecure processing feature. Depending on the components available in theclasspath, this could lead to arbitrary remote code execution in thecontext of the application server running the application that usesXalan-Java. (CVE-2014-0107)It was found that the ServerTrustManager in the Smack XMPP API did notverify basicConstraints and nameConstraints in X.509 certificate chains. Aman-in-the-middle attacker could use this flaw to spoof servers and obtainsensitive information. (CVE-2014-0363)It was found that the ParseRoster component in the Smack XMPP API did notverify the From attribute of a roster-query IQ stanza. A remote attackercould use this flaw to spoof IQ responses. (CVE-2014-0364)All users of Red Hat JBoss BPM Suite 6.0.1 as provided from the Red HatCustomer Portal are advised to upgrade to Red Hat JBoss BPM Suite 6.0.2.