JFreeChart v1.5.4 was discovered to be vulnerable to ArrayIndexOutOfBounds via the component /chart/plot/CompassPlot.java. NOTE: this is disputed by multiple third parties who believe there was not reasonable evidence to determine the existence of a vulnerability. The submission may have been based on a tool that is not sufficiently robust for vulnerability identification.

This release corrects several security vulnerabilities in variouscomponents shipped as part of the Red Hat Network Satellite Server 4.2. Ina typical operating environment, these components are not exposed to usersof Satellite Server in a vulnerable manner. These security updates willreduce risk in unique Satellite Server environments.Multiple flaws were fixed in the Apache HTTPD server. These flaws couldresult in a cross-site scripting, denial-of-service, or informationdisclosure attacks. (CVE-2004-0885, CVE-2006-5752, CVE-2006-7197,CVE-2007-1860, CVE-2007-3304, CVE-2007-4465, CVE-2007-5000, CVE-2007-6388)A denial-of-service flaw was fixed in modperl. (CVE-2007-1349)A denial-of-service flaw was fixed in the jabberd server. (CVE-2006-1329)Multiple cross-site scripting flaws were fixed in the image map feature inthe JFreeChart package. (CVE-2007-6306)Multiple flaws were fixed in the IBM Java 1.4.2 Runtime. (CVE-2007-0243,CVE-2007-2435, CVE-2007-2788, CVE-2007-2789)Multiple flaws were fixed in the OpenMotif package. (CVE-2004-0687,CVE-2004-0688, CVE-2004-0914, CVE-2005-3964, CVE-2005-0605)A flaw which could result in weak encryption was fixed in theperl-Crypt-CBC package. (CVE-2006-0898)Multiple flaws were fixed in the Tomcat package. (CVE-2008-0128,CVE-2007-5461, CVE-2007-3385, CVE-2007-3382, CVE-2007-1358, CVE-2007-1355,CVE-2007-2450, CVE-2007-2449, CVE-2007-0450, CVE-2006-7196, CVE-2006-7195,CVE-2006-3835, CVE-2006-0254, CVE-2005-2090, CVE-2005-4838, CVE-2005-3510)Users of Red Hat Network Satellite Server 4.2 are advised to upgrade to4.2.3, which resolves these issues.