RHSA-2016:1087MediumCVSS 8.8

Red Hat Security Advisory: Red Hat JBoss Web Server 3.0.3 update

Published
May 17, 2016
Last Modified
October 14, 2026

🔗 CVE IDs covered (6)

CVE-2015-5346 →CVE-2015-5351 →CVE-2016-0706 →CVE-2016-0714 →CVE-2016-0763 →CVE-2015-5345 →

📋 Description

CVE-2015-5345 — tomcat: directory disclosure CVE-2015-5346 — tomcat: Session fixation CVE-2015-5351 — tomcat: CSRF token leak CVE-2016-0706 — tomcat: security manager bypass via StatusManagerServlet CVE-2016-0714 — tomcat: Security Manager bypass via persistence mechanisms CVE-2016-0763 — tomcat: security manager bypass via setGlobalContext()

🎯 Affected products46

  • Red Hat JBoss Web Server 3.0 for RHEL 6
  • httpd24-0:2.4.6-61.ep7.el6.i686 as a component of Red Hat JBoss Web Server 3.0 for RHEL 6
  • httpd24-0:2.4.6-61.ep7.el6.src as a component of Red Hat JBoss Web Server 3.0 for RHEL 6
  • httpd24-0:2.4.6-61.ep7.el6.x86_64 as a component of Red Hat JBoss Web Server 3.0 for RHEL 6
  • httpd24-debuginfo-0:2.4.6-61.ep7.el6.i686 as a component of Red Hat JBoss Web Server 3.0 for RHEL 6
  • httpd24-debuginfo-0:2.4.6-61.ep7.el6.x86_64 as a component of Red Hat JBoss Web Server 3.0 for RHEL 6
  • httpd24-devel-0:2.4.6-61.ep7.el6.i686 as a component of Red Hat JBoss Web Server 3.0 for RHEL 6
  • httpd24-devel-0:2.4.6-61.ep7.el6.x86_64 as a component of Red Hat JBoss Web Server 3.0 for RHEL 6
  • httpd24-manual-0:2.4.6-61.ep7.el6.noarch as a component of Red Hat JBoss Web Server 3.0 for RHEL 6
  • httpd24-tools-0:2.4.6-61.ep7.el6.i686 as a component of Red Hat JBoss Web Server 3.0 for RHEL 6
  • httpd24-tools-0:2.4.6-61.ep7.el6.x86_64 as a component of Red Hat JBoss Web Server 3.0 for RHEL 6
  • mod_ldap24-0:2.4.6-61.ep7.el6.i686 as a component of Red Hat JBoss Web Server 3.0 for RHEL 6
  • mod_ldap24-0:2.4.6-61.ep7.el6.x86_64 as a component of Red Hat JBoss Web Server 3.0 for RHEL 6
  • mod_proxy24_html-1:2.4.6-61.ep7.el6.i686 as a component of Red Hat JBoss Web Server 3.0 for RHEL 6
  • mod_proxy24_html-1:2.4.6-61.ep7.el6.x86_64 as a component of Red Hat JBoss Web Server 3.0 for RHEL 6
  • mod_security-jws3-0:2.8.0-7.GA.ep7.el6.i686 as a component of Red Hat JBoss Web Server 3.0 for RHEL 6
  • mod_security-jws3-0:2.8.0-7.GA.ep7.el6.src as a component of Red Hat JBoss Web Server 3.0 for RHEL 6
  • mod_security-jws3-0:2.8.0-7.GA.ep7.el6.x86_64 as a component of Red Hat JBoss Web Server 3.0 for RHEL 6
  • mod_security-jws3-debuginfo-0:2.8.0-7.GA.ep7.el6.i686 as a component of Red Hat JBoss Web Server 3.0 for RHEL 6
  • mod_security-jws3-debuginfo-0:2.8.0-7.GA.ep7.el6.x86_64 as a component of Red Hat JBoss Web Server 3.0 for RHEL 6
  • mod_session24-0:2.4.6-61.ep7.el6.i686 as a component of Red Hat JBoss Web Server 3.0 for RHEL 6
  • mod_session24-0:2.4.6-61.ep7.el6.x86_64 as a component of Red Hat JBoss Web Server 3.0 for RHEL 6
  • mod_ssl24-1:2.4.6-61.ep7.el6.i686 as a component of Red Hat JBoss Web Server 3.0 for RHEL 6
  • mod_ssl24-1:2.4.6-61.ep7.el6.x86_64 as a component of Red Hat JBoss Web Server 3.0 for RHEL 6
  • tomcat7-0:7.0.59-50_patch_01.ep7.el6.noarch as a component of Red Hat JBoss Web Server 3.0 for RHEL 6
  • tomcat7-0:7.0.59-50_patch_01.ep7.el6.src as a component of Red Hat JBoss Web Server 3.0 for RHEL 6
  • tomcat7-admin-webapps-0:7.0.59-50_patch_01.ep7.el6.noarch as a component of Red Hat JBoss Web Server 3.0 for RHEL 6
  • tomcat7-docs-webapp-0:7.0.59-50_patch_01.ep7.el6.noarch as a component of Red Hat JBoss Web Server 3.0 for RHEL 6
  • tomcat7-el-2.2-api-0:7.0.59-50_patch_01.ep7.el6.noarch as a component of Red Hat JBoss Web Server 3.0 for RHEL 6
  • tomcat7-javadoc-0:7.0.59-50_patch_01.ep7.el6.noarch as a component of Red Hat JBoss Web Server 3.0 for RHEL 6
  • +16 more not shown

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing the updated packages, the httpd daemon will be restarted automatically.

🔗 References (19)