RHSA-2015:0849HighCVSS 6.3

Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.4.0 update

Published
April 16, 2015
Last Modified
November 7, 2026

🔗 CVE IDs covered (8)

CVE-2014-3570 →CVE-2014-3586 →CVE-2014-8111 →CVE-2015-0204 →CVE-2015-0226 →CVE-2015-0227 →CVE-2015-0277 →CVE-2015-6254 →

📋 Description

CVE-2014-3570 — openssl: Bignum squaring may produce incorrect results CVE-2014-3586 — CLI: Insecure default permissions on history file CVE-2014-8111 — mod_jk: information leak due to incorrect JkMount/JkUnmount directives processing CVE-2015-0204 — openssl: only allow ephemeral RSA keys in export ciphersuites (FREAK) CVE-2015-0226 — wss4j: Apache WSS4J is vulnerable to Bleichenbacher's attack (incomplete fix for CVE-2011-2487) CVE-2015-0227 — wss4j: Apache WSS4J doesn't correctly enforce the requireSignedEncryptedDataElements property CVE-2015-0277 — PicketLink: SP does not take Audience condition of a SAML assertion into account CVE-2015-6254 — PicketLink: Lack of validation for the Destination attribute in a Response element in a SAML assertion

🎯 Affected products1

  • Red Hat JBoss Enterprise Application Platform 6.4

✅ Remediation

The References section of this erratum contains a download link (you must log in to download the update). Before applying this update, back up your existing Red Hat JBoss Enterprise Application Platform installation and deployed applications.

🔗 References (12)