RHSA-2015:2542Critical

Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.4.5 jboss-ec2-eap update

Published
December 2, 2015
Last Modified
November 7, 2026

🔗 CVE IDs covered (2)

CVE-2015-5304 →CVE-2015-7501 →

📋 Description

CVE-2015-5304 — EAP: missing authorization check for Monitor/Deployer/Auditor role when shutting down server CVE-2015-7501 — apache-commons-collections: InvokerTransformer code execution during deserialisation

🎯 Affected products4

  • Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 Server
  • jboss-ec2-eap-0:7.5.5-3.Final_redhat_3.ep6.el6.noarch as a component of Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 Server
  • jboss-ec2-eap-0:7.5.5-3.Final_redhat_3.ep6.el6.src as a component of Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 Server
  • jboss-ec2-eap-samples-0:7.5.5-3.Final_redhat_3.ep6.el6.noarch as a component of Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 Server

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. Also, make sure to back up any modified configuration files, deployments, and all user data. After applying the update, restart the instance of Red Hat JBoss Enterprise Application Platform for the changes to take effect. This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/articles/11258

🔗 References (6)