jabberd14 1.6.1.1 and earlier does not properly detect recursion during entity expansion, which allows remote attackers to cause a denial of service (memory and CPU consumption) via a crafted XML document containing a large number of nested entity references, a similar issue to CVE-2003-1564.

This release corrects several security vulnerabilities in variouscomponents shipped as part of the Red Hat Network Satellite Server 4.2. Ina typical operating environment, these components are not exposed to usersof Satellite Server in a vulnerable manner. These security updates willreduce risk in unique Satellite Server environments.Multiple flaws were fixed in the Apache HTTPD server. These flaws couldresult in a cross-site scripting, denial-of-service, or informationdisclosure attacks. (CVE-2004-0885, CVE-2006-5752, CVE-2006-7197,CVE-2007-1860, CVE-2007-3304, CVE-2007-4465, CVE-2007-5000, CVE-2007-6388)A denial-of-service flaw was fixed in modperl. (CVE-2007-1349)A denial-of-service flaw was fixed in the jabberd server. (CVE-2006-1329)Multiple cross-site scripting flaws were fixed in the image map feature inthe JFreeChart package. (CVE-2007-6306)Multiple flaws were fixed in the IBM Java 1.4.2 Runtime. (CVE-2007-0243,CVE-2007-2435, CVE-2007-2788, CVE-2007-2789)Multiple flaws were fixed in the OpenMotif package. (CVE-2004-0687,CVE-2004-0688, CVE-2004-0914, CVE-2005-3964, CVE-2005-0605)A flaw which could result in weak encryption was fixed in theperl-Crypt-CBC package. (CVE-2006-0898)Multiple flaws were fixed in the Tomcat package. (CVE-2008-0128,CVE-2007-5461, CVE-2007-3385, CVE-2007-3382, CVE-2007-1358, CVE-2007-1355,CVE-2007-2450, CVE-2007-2449, CVE-2007-0450, CVE-2006-7196, CVE-2006-7195,CVE-2006-3835, CVE-2006-0254, CVE-2005-2090, CVE-2005-4838, CVE-2005-3510)Users of Red Hat Network Satellite Server 4.2 are advised to upgrade to4.2.3, which resolves these issues.

During an internal security review, a cross-site scripting flaw was foundthat affected the Red Hat Network channel search feature. (CVE-2007-5961)This release also corrects several security vulnerabilities in variouscomponents shipped as part of the Red Hat Network Satellite Server. In atypical operating environment, these components are not exposed to users ofSatellite Server in a vulnerable manner. These security updates will reducerisk in unique Satellite Server environments.Multiple flaws were fixed in the Apache HTTPD server. These flaws couldresult in a cross-site scripting, denial-of-service, or informationdisclosure attacks. (CVE-2004-0885, CVE-2006-5752, CVE-2006-7197,CVE-2007-1860, CVE-2007-3304, CVE-2007-4465, CVE-2007-5000, CVE-2007-6388)A denial-of-service flaw was fixed in modperl. (CVE-2007-1349)A denial-of-service flaw was fixed in the jabberd server. (CVE-2006-1329)Multiple cross-site scripting flaws were fixed in the image map feature inthe JFreeChart package. (CVE-2007-6306)Multiple flaws were fixed in the IBM Java 1.4.2 Runtime. (CVE-2007-0243,CVE-2007-2435, CVE-2007-2788, CVE-2007-2789)Two arbitrary code execution flaws were fixed in the OpenMotif package.(CVE-2005-3964, CVE-2005-0605)A flaw which could result in weak encryption was fixed in theperl-Crypt-CBC package. (CVE-2006-0898)Multiple flaws were fixed in the Tomcat package. (CVE-2008-0128,CVE-2007-5461, CVE-2007-3385, CVE-2007-3382, CVE-2007-1358, CVE-2007-1355,CVE-2007-2450, CVE-2007-2449, CVE-2007-0450, CVE-2006-7196, CVE-2006-7195,CVE-2006-3835, CVE-2006-0254, CVE-2005-2090, CVE-2005-4838, CVE-2005-3510)Users of Red Hat Network Satellite Server 5.0 are advised to upgrade to5.0.2, which resolves these issues.