CVE-2014-3464

WS: Incomplete fix for CVE-2013-2133

The EJB invocation handler implementation in Red Hat JBossWS, as used in JBoss Enterprise Application Platform (EAP) 6.2.0 and 6.3.0, does not properly enforce the method level restrictions for outbound messages, which allows remote authenticated users to access otherwise restricted JAX-WS handlers by leveraging permissions to the EJB class. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-2133.

CVSS 2.0 · 5.5 Medium EPSS 1.1% KEV · Not listed

Vendors

Redhat

Products

Jboss Enterprise Application Platform

CVE-2014-3472

Security: Invalid EJB caller role check implementation

The isCallerInRole function in SimpleSecurityManager in JBoss Application Server (AS) 7, as used in Red Hat JBoss Enterprise Application Platform (JBEAP) 6.3.0, does not properly check caller roles, which allows remote authenticated users to bypass access restrictions via unspecified vectors.

CVSS 2.0 · 4.9 Medium EPSS 1.7% KEV · Not listed

Vendors

Redhat

Products

Jboss Bpms Jboss Brms Jboss Enterprise Application Platform and 2 more

CVE-2016-2106

openssl: EVP_EncryptUpdate overflow

Integer overflow in the EVP_EncryptUpdate function in crypto/evp/evp_enc.c in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h allows remote attackers to cause a denial of service (heap memory corruption) via a large amount of data.

CVSS 3.0 · 7.5 High EPSS 27.3% KEV · Not listed

Vendors

Openssl Redhat

Products

Openssl Enterprise Linux Enterprise Linux Desktop and 10 more

CVE-2014-3481

JAX-RS: Information disclosure via XML eXternal Entity (XXE)

org.jboss.as.jaxrs.deployment.JaxrsIntegrationProcessor in Red Hat JBoss Enterprise Application Platform (JEAP) before 6.2.4 enables entity expansion, which allows remote attackers to read arbitrary files via unspecified vectors, related to an XML External Entity (XXE) issue.

CVSS 2.0 · 5.0 Medium EPSS 3.0% KEV · Not listed

Vendors

Redhat

Products

Jboss Data Grid Jboss Data Virtualization Jboss Enterprise Application Platform and 3 more

CVE-2014-3490

RESTEasy: XXE via parameter entities

RESTEasy 2.3.1 before 2.3.8.SP2 and 3.x before 3.0.9, as used in Red Hat JBoss Enterprise Application Platform (EAP) 6.3.0, does not disable external entities when the resteasy.document.expand.entity.references parameter is set to false, which allows remote attackers to read arbitrary files and have other unspecified impact via unspecified vectors, related to an XML External Entity (XXE) issue. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-0818.

CVSS 2.0 · 7.5 High EPSS 4.6% KEV · Not listed

Vendors

Redhat

Products

Enterprise Linux Jboss Bpms Jboss Brms and 8 more

CVE-2014-3505

openssl: DTLS packet processing double free

Double free vulnerability in d1_both.c in the DTLS implementation in OpenSSL 0.9.8 before 0.9.8zb, 1.0.0 before 1.0.0n, and 1.0.1 before 1.0.1i allows remote attackers to cause a denial of service (application crash) via crafted DTLS packets that trigger an error condition.

CVSS 2.0 · 5.0 Medium EPSS 46.1% KEV · Not listed

Vendors

Openssl Redhat

Products

Openssl Enterprise Linux Jboss Enterprise Application Platform and 2 more

CVE-2014-3506

openssl: DTLS memory exhaustion

d1_both.c in the DTLS implementation in OpenSSL 0.9.8 before 0.9.8zb, 1.0.0 before 1.0.0n, and 1.0.1 before 1.0.1i allows remote attackers to cause a denial of service (memory consumption) via crafted DTLS handshake messages that trigger memory allocations corresponding to large length values.

CVSS 2.0 · 5.0 Medium EPSS 46.1% KEV · Not listed

Vendors

Openssl Redhat

Products

Openssl Enterprise Linux Jboss Enterprise Application Platform and 2 more

CVE-2014-3508

openssl: information leak in pretty printing functions

The OBJ_obj2txt function in crypto/objects/obj_dat.c in OpenSSL 0.9.8 before 0.9.8zb, 1.0.0 before 1.0.0n, and 1.0.1 before 1.0.1i, when pretty printing is used, does not ensure the presence of '\0' characters, which allows context-dependent attackers to obtain sensitive information from process stack memory by reading output from X509_name_oneline, X509_name_print_ex, and unspecified other functions.

CVSS 2.0 · 4.3 Medium EPSS 24.5% KEV · Not listed

Vendors

Openssl Redhat

Products

Openssl Enterprise Linux Jboss Enterprise Application Platform and 2 more

CVE-2014-3510

openssl: DTLS anonymous (EC)DH denial of service

The ssl3_send_client_key_exchange function in s3_clnt.c in OpenSSL 0.9.8 before 0.9.8zb, 1.0.0 before 1.0.0n, and 1.0.1 before 1.0.1i allows remote DTLS servers to cause a denial of service (NULL pointer dereference and client application crash) via a crafted handshake message in conjunction with a (1) anonymous DH or (2) anonymous ECDH ciphersuite.

CVSS 2.0 · 4.3 Medium EPSS 18.4% KEV · Not listed

Vendors

Openssl Redhat

Products

Openssl Enterprise Linux Jboss Enterprise Application Platform and 2 more

CVE-2014-3518

5: Remote code execution via unauthenticated JMX/RMI connector

jmx-remoting.sar in JBoss Remoting, as used in Red Hat JBoss Enterprise Application Platform (JEAP) 5.2.0, Red Hat JBoss BRMS 5.3.1, Red Hat JBoss Portal Platform 5.2.2, and Red Hat JBoss SOA Platform 5.3.1, does not properly implement the JSR 160 specification, which allows remote attackers to execute arbitrary code via unspecified vectors.

CVSS 2.0 · 6.8 Medium EPSS 2.6% KEV · Not listed

Vendors

Redhat

Products

Jboss Enterprise Application Platform Jboss Enterprise Brms Platform Jboss Enterprise Portal Platform and 1 more

CVE-2014-3530

PicketLink: XXE via insecure DocumentBuilderFactory usage

The org.picketlink.common.util.DocumentUtil.getDocumentBuilderFactory method in PicketLink, as used in Red Hat JBoss Enterprise Application Platform (JBEAP) 5.2.0 and 6.2.4, expands entity references, which allows remote attackers to read arbitrary code and possibly have other unspecified impact via unspecified vectors, related to an XML External Entity (XXE) issue.

CVSS 2.0 · 7.5 High EPSS 3.9% KEV · Not listed

Vendors

Redhat

Products

Jboss Bpms Jboss Brms Jboss Data Grid and 7 more

CVE-2014-3558

Validator: JSM bypass via ReflectionHelper

ReflectionHelper (org.hibernate.validator.util.ReflectionHelper) in Hibernate Validator 4.1.0 before 4.2.1, 4.3.x before 4.3.2, and 5.x before 5.1.2 allows attackers to bypass Java Security Manager (JSM) restrictions and execute restricted reflection calls via a crafted application.

CVSS 2.0 · 5.0 Medium EPSS 2.9% KEV · Not listed

Vendors

Redhat

Products

Hibernate Validator Jboss Bpms Jboss Brms and 3 more

CVE-2014-3570

openssl: Bignum squaring may produce incorrect results

The BN_sqr implementation in OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k does not properly calculate the square of a BIGNUM value, which might make it easier for remote attackers to defeat cryptographic protection mechanisms via unspecified vectors, related to crypto/bn/asm/mips.pl, crypto/bn/asm/x86_64-gcc.c, and crypto/bn/bn_asm.c.

CVSS 3.0 · 3.7 Low EPSS 21.9% KEV · Not listed

Vendors

Openssl Redhat

Products

Openssl Enterprise Linux Jboss Enterprise Application Platform and 1 more

CVE-2014-3577

CXF: SSL hostname verification bypass, incomplete CVE-2012-6153 fix

org.apache.http.conn.ssl.AbstractVerifier in Apache HttpComponents HttpClient before 4.3.5 and HttpAsyncClient before 4.0.2 does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a "CN=" string in a field in the distinguished name (DN) of a certificate, as demonstrated by the "foo,CN=www.apache.org" string in the O field.

CVSS 3.0 · 4.8 Medium EPSS 9.2% KEV · Not listed

Vendors

Apache Redhat

Products

Httpasyncclient Httpclient Enterprise Linux and 15 more

CVE-2014-3586

CLI: Insecure default permissions on history file

The default configuration for the Command Line Interface in Red Hat Enterprise Application Platform before 6.4.0 and WildFly (formerly JBoss Application Server) uses weak permissions for .jboss-cli-history, which allows local users to obtain sensitive information via unspecified vectors.

CVSS 2.0 · 2.1 Low EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Jboss Enterprise Application Platform Jboss Enterprise Portal Platform

CVE-2014-3623

CXF: Improper security semantics enforcement of SAML SubjectConfirmation methods

Apache WSS4J before 1.6.17 and 2.x before 2.0.2, as used in Apache CXF 2.7.x before 2.7.13 and 3.0.x before 3.0.2, when using TransportBinding, does not properly enforce the SAML SubjectConfirmation method security semantics, which allows remote attackers to conduct spoofing attacks via unspecified vectors.

CVSS 2.0 · 5.0 Medium EPSS 9.2% KEV · Not listed

Vendors

Apache Redhat

Products

Cxf Wss4j Jboss Amq and 5 more

CVE-2014-7827

Security: Wrong security context loaded when using SAML2 STS Login Module

The org.jboss.security.plugins.mapping.JBossMappingManager implementation in JBoss Security in Red Hat JBoss Enterprise Application Platform (EAP) before 6.3.3 uses the default security domain when a security domain is undefined, which allows remote authenticated users to bypass intended access restrictions by leveraging credentials on the default domain for a role that is also on the application domain.

CVSS 2.0 · 3.5 Low EPSS 1.7% KEV · Not listed

Vendors

Redhat

Products

Jboss Bpms Jboss Brms Jboss Enterprise Application Platform

CVE-2014-7839

RESTeasy: External entities expanded by DocumentProvider

DocumentProvider in RESTEasy 2.3.7 and 3.0.9 does not configure the (1) external-general-entities or (2) external-parameter-entities features, which allows remote attackers to conduct XML external entity (XXE) attacks via unspecified vectors.

CVSS 2.0 · 6.4 Medium EPSS 2.0% KEV · Not listed

Vendors

Redhat

Products

Jboss Bpms Jboss Brms Jboss Data Grid and 4 more

CVE-2014-7849

Management: Limited RBAC authorization bypass

The Role Based Access Control (RBAC) implementation in JBoss Enterprise Application Platform (EAP) 6.2.0 through 6.3.2 does not properly verify authorization conditions, which allows remote authenticated users to add, modify, and undefine otherwise restricted attributes by leveraging the Maintainer role.

CVSS 2.0 · 4.0 Medium EPSS 1.3% KEV · Not listed

Vendors

Redhat

Products

Jboss Enterprise Application Platform Jboss Operations Network

CVE-2014-7853

Subsystem: Information disclosure via incorrect sensitivity classification of attribute

The JBoss Application Server (WildFly) JacORB subsystem in Red Hat JBoss Enterprise Application Platform (EAP) before 6.3.3 does not properly assign socket-binding-ref sensitivity classification to the security-domain attribute, which allows remote authenticated users to obtain sensitive information by leveraging access to the security-domain attribute.

CVSS 2.0 · 4.0 Medium EPSS 1.2% KEV · Not listed

Vendors

Redhat

Products

Jboss Enterprise Application Platform Jboss Operations Network