RHSA-2012:1594HighCVSS 6.5

Red Hat Security Advisory: JBoss Enterprise Application Platform 6.0.1 update

Published
December 18, 2012
Last Modified
November 7, 2026

🔗 CVE IDs covered (10)

CVE-2008-0455 →CVE-2012-0883 →CVE-2012-2378 →CVE-2012-2379 →CVE-2012-2672 →CVE-2012-2687 →CVE-2012-3428 →CVE-2012-3451 →CVE-2012-4549 →CVE-2012-4550 →

📋 Description

CVE-2008-0455 — httpd: mod_negotiation XSS via untrusted file names in directories with MultiViews enabled CVE-2012-0883 — httpd: insecure handling of LD_LIBRARY_PATH in envvars CVE-2012-2378 — apache-cxf: Certain child policies of WS-SecurityPolicy 1.1 SupportingToken policy not applied on the client side CVE-2012-2379 — apache-cxf: Apache CXF does not verify that elements were signed / encrypted by a particular Supporting Token CVE-2012-2672 — Mojarra: deployed web applications can read FacesContext from other applications under certain conditions CVE-2012-2687 — httpd: mod_negotiation XSS via untrusted file names in directories with MultiViews enabled CVE-2012-3428 — JBoss: Datasource connection manager returns valid connection for wrong credentials when using security-domains CVE-2012-3451 — apache-cxf: SOAPAction spoofing on document literal web services CVE-2012-4549 — JBoss Enterprise Application Platform: org.jboss.as.ejb3: JBoss Enterprise Application Platform: Access restriction bypass via improper EJB method authorization CVE-2012-4550 — JBoss Enterprise Application Platform: JBoss EAP: JBEAP: JBoss Enterprise Application Platform: Unauthorized EJB access via authorization module bypass

🎯 Affected products1

  • Red Hat JBoss Enterprise Application Platform 6.0

✅ Remediation

Users of JBoss Enterprise Application Platform 6.0.0 as provided from the Red Hat Customer Portal are advised to upgrade to JBoss Enterprise Application Platform 6.0.1. The References section of this erratum contains a download link (you must log in to download the update). Before applying this update, back up your existing JBoss Enterprise Application Platform installation and deployed applications. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

🔗 References (14)