Red Hat JBoss Fuse Service Works is the next-generation ESB and business process automation infrastructure.<br>Security Fix(es):<br><li> It was found that JGroups did not require necessary headers for encrypt and auth protocols from new nodes joining the cluster. An attacker could use this flaw to bypass security restrictions, and use this vulnerability to send and receive messages within the cluster, leading to information disclosure, message spoofing, or further possible attacks. (CVE-2016-2141)</li> This issue was discovered by Dennis Reed (Red Hat).

Apache POI is a library providing Java API for working with OOXML documentfiles.It was found that Apache POI would resolve entities in OOXML documents.A remote attacker able to supply OOXML documents that are parsed by ApachePOI could use this flaw to read files accessible to the user running theapplication server, and potentially perform more advanced XML ExternalEntity (XXE) attacks. (CVE-2014-3529)It was found that Apache POI would expand an unlimited number of entitiesin OOXML documents. A remote attacker able to supply OOXML documents thatare parsed by Apache POI could use this flaw to trigger a denial of serviceattack via excessive CPU and memory consumption. (CVE-2014-3574)All users of Red Hat JBoss Fuse Service Works 6.0.0 as provided from theRed Hat Customer Portal are advised to apply this security update.

XStream is a simple library to serialize and de-serialize objects to andfrom XML.It was found that XStream could deserialize arbitrary user-supplied XMLcontent, representing objects of any type. A remote attacker able to passXML to XStream could use this flaw to perform a variety of attacks,including remote code execution in the context of the server running theXStream application. (CVE-2013-7285)All users of Red Hat JBoss Fuse Service Works 6.0.0 as provided from theRed Hat Customer Portal are advised to apply this update.