- Issued:
- 2016-10-17
- Updated:
- 2016-10-17
RHSA-2016:2068 - Moderate: Red Hat JBoss Enterprise Application Platform 6.4.11 update on RHEL 6
Synopsis
Moderate: Red Hat JBoss Enterprise Application Platform 6.4.11 update on RHEL 6
Type/Severity
Security Advisory Moderate
Topic
Updated packages that provide Red Hat JBoss Enterprise Application Platform 6.4.11, fix several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 6.
Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Description
Red Hat JBoss Enterprise Application Platform 6 is a platform for Java applications based on JBoss Application Server 7.
This release serves as a replacement for Red Hat JBoss Enterprise Application Platform 6.4.10. It includes bug fixes and enhancements. Documentation for these changes will be available shortly from the Red Hat JBoss Enterprise Application Platform 6.4.11 Release Notes, linked to in the References.
All users of Red Hat JBoss Enterprise Application Platform 6.4 on Red Hat Enterprise Linux 6 are advised to upgrade to these updated packages. The JBoss server process must be restarted for the update to take effect.
Security Fix(es):
- A denial of service vulnerability was identified in Commons FileUpload that occurred when the length of the multipart boundary was just below the size of the buffer (4096 bytes) used to read the uploaded file if the boundary was the typical tens of bytes long. (CVE-2016-3092)
Solution
Before applying this update, back up your existing Red Hat JBoss Enterprise Application Platform installation and deployed applications.
For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://access.redhat.com/articles/11258
Affected Products
| Product | Version | Arch |
|---|---|---|
| JBoss Enterprise Application Platform | 6 | x86_64 |
| JBoss Enterprise Application Platform | 6 | ppc64 |
| JBoss Enterprise Application Platform | 6 | i386 |
| JBoss Enterprise Application Platform | 6.4 | x86_64 |
| JBoss Enterprise Application Platform | 6.4 | ppc64 |
| JBoss Enterprise Application Platform | 6.4 | i386 |
Updated Packages
- jboss-as-jsf-7.5.11-1.Final_redhat_1.1.ep6.el6.src.rpm
- jboss-as-modcluster-7.5.11-1.Final_redhat_1.1.ep6.el6.src.rpm
- jboss-as-web-7.5.11-1.Final_redhat_1.1.ep6.el6.noarch.rpm
- jboss-as-logging-7.5.11-1.Final_redhat_1.1.ep6.el6.noarch.rpm
- jboss-as-threads-7.5.11-1.Final_redhat_1.1.ep6.el6.noarch.rpm
- jboss-as-protocol-7.5.11-1.Final_redhat_1.1.ep6.el6.src.rpm
- jboss-as-ee-deployment-7.5.11-1.Final_redhat_1.1.ep6.el6.src.rpm
- jbossas-core-7.5.11-1.Final_redhat_1.1.ep6.el6.noarch.rpm
- jbossas-core-7.5.11-1.Final_redhat_1.1.ep6.el6.src.rpm
- jbossas-modules-eap-7.5.11-2.Final_redhat_1.1.ep6.el6.src.rpm
- jboss-as-system-jmx-7.5.11-1.Final_redhat_1.1.ep6.el6.src.rpm
- jboss-as-platform-mbean-7.5.11-1.Final_redhat_1.1.ep6.el6.src.rpm
- jboss-as-xts-7.5.11-1.Final_redhat_1.1.ep6.el6.noarch.rpm
- jboss-as-domain-http-7.5.11-1.Final_redhat_1.1.ep6.el6.src.rpm
- jboss-as-mail-7.5.11-1.Final_redhat_1.1.ep6.el6.noarch.rpm
- jboss-as-osgi-7.5.11-1.Final_redhat_1.1.ep6.el6.src.rpm
- jbossas-product-eap-7.5.11-1.Final_redhat_1.1.ep6.el6.src.rpm
- jboss-as-clustering-7.5.11-1.Final_redhat_1.1.ep6.el6.noarch.rpm
- jboss-as-security-7.5.11-1.Final_redhat_1.1.ep6.el6.noarch.rpm
- jboss-as-server-7.5.11-1.Final_redhat_1.1.ep6.el6.noarch.rpm
- jboss-as-version-7.5.11-1.Final_redhat_1.1.ep6.el6.src.rpm
- jboss-as-clustering-7.5.11-1.Final_redhat_1.1.ep6.el6.src.rpm
- jboss-as-embedded-7.5.11-1.Final_redhat_1.1.ep6.el6.noarch.rpm
- jboss-as-controller-7.5.11-1.Final_redhat_1.1.ep6.el6.noarch.rpm
- jboss-as-configadmin-7.5.11-1.Final_redhat_1.1.ep6.el6.src.rpm
- jboss-as-cli-7.5.11-1.Final_redhat_1.1.ep6.el6.src.rpm
- jboss-as-transactions-7.5.11-1.Final_redhat_1.1.ep6.el6.src.rpm
- jboss-as-weld-7.5.11-1.Final_redhat_1.1.ep6.el6.src.rpm
- jboss-as-ee-7.5.11-1.Final_redhat_1.1.ep6.el6.src.rpm
- jbossas-welcome-content-eap-7.5.11-1.Final_redhat_1.1.ep6.el6.src.rpm
- jboss-as-network-7.5.11-1.Final_redhat_1.1.ep6.el6.noarch.rpm
- jbossas-javadocs-7.5.11-1.Final_redhat_1.1.ep6.el6.src.rpm
- jboss-as-core-security-7.5.11-1.Final_redhat_1.1.ep6.el6.src.rpm
- jbossas-bundles-7.5.11-1.Final_redhat_1.1.ep6.el6.noarch.rpm
- jboss-as-deployment-repository-7.5.11-1.Final_redhat_1.1.ep6.el6.noarch.rpm
- jbossas-standalone-7.5.11-1.Final_redhat_1.1.ep6.el6.noarch.rpm
- jboss-as-process-controller-7.5.11-1.Final_redhat_1.1.ep6.el6.noarch.rpm
- jboss-as-host-controller-7.5.11-1.Final_redhat_1.1.ep6.el6.src.rpm
- jboss-as-management-client-content-7.5.11-1.Final_redhat_1.1.ep6.el6.noarch.rpm
- jbossas-modules-eap-7.5.11-2.Final_redhat_1.1.ep6.el6.noarch.rpm
- jboss-as-osgi-service-7.5.11-1.Final_redhat_1.1.ep6.el6.src.rpm
- jboss-as-pojo-7.5.11-1.Final_redhat_1.1.ep6.el6.src.rpm
- picketlink-federation-2.5.4-13.SP11_redhat_1.1.ep6.el6.src.rpm
- jboss-as-osgi-service-7.5.11-1.Final_redhat_1.1.ep6.el6.noarch.rpm
- jboss-as-jaxr-7.5.11-1.Final_redhat_1.1.ep6.el6.noarch.rpm
- jboss-as-protocol-7.5.11-1.Final_redhat_1.1.ep6.el6.noarch.rpm
- jbossts-4.17.35-1.Final_redhat_1.1.ep6.el6.noarch.rpm
- jbossas-domain-7.5.11-1.Final_redhat_1.1.ep6.el6.noarch.rpm
- jboss-as-connector-7.5.11-1.Final_redhat_1.1.ep6.el6.src.rpm
- jboss-as-controller-client-7.5.11-1.Final_redhat_1.1.ep6.el6.src.rpm
- jboss-as-weld-7.5.11-1.Final_redhat_1.1.ep6.el6.noarch.rpm
- jboss-as-domain-management-7.5.11-1.Final_redhat_1.1.ep6.el6.src.rpm
- jboss-as-ejb3-7.5.11-1.Final_redhat_1.1.ep6.el6.noarch.rpm
- jboss-as-appclient-7.5.11-1.Final_redhat_1.1.ep6.el6.src.rpm
- jboss-as-remoting-7.5.11-1.Final_redhat_1.1.ep6.el6.noarch.rpm
- jboss-as-ejb3-7.5.11-1.Final_redhat_1.1.ep6.el6.src.rpm
- jboss-as-jpa-7.5.11-1.Final_redhat_1.1.ep6.el6.src.rpm
- jboss-as-ee-deployment-7.5.11-1.Final_redhat_1.1.ep6.el6.noarch.rpm
- jboss-as-jaxrs-7.5.11-1.Final_redhat_1.1.ep6.el6.src.rpm
- jboss-as-jaxr-7.5.11-1.Final_redhat_1.1.ep6.el6.src.rpm
- jbossas-standalone-7.5.11-1.Final_redhat_1.1.ep6.el6.src.rpm
- jboss-as-ee-7.5.11-1.Final_redhat_1.1.ep6.el6.noarch.rpm
- apache-cxf-2.7.18-4.SP3_redhat_1.1.ep6.el6.src.rpm
- jboss-as-messaging-7.5.11-1.Final_redhat_1.1.ep6.el6.noarch.rpm
- jboss-as-osgi-configadmin-7.5.11-1.Final_redhat_1.1.ep6.el6.src.rpm
- jboss-as-process-controller-7.5.11-1.Final_redhat_1.1.ep6.el6.src.rpm
- jboss-as-jdr-7.5.11-1.Final_redhat_1.1.ep6.el6.src.rpm
- jboss-as-version-7.5.11-1.Final_redhat_1.1.ep6.el6.noarch.rpm
- jboss-as-client-all-7.5.11-1.Final_redhat_1.1.ep6.el6.src.rpm
- jboss-as-webservices-7.5.11-1.Final_redhat_1.1.ep6.el6.src.rpm
- jboss-as-host-controller-7.5.11-1.Final_redhat_1.1.ep6.el6.noarch.rpm
- jboss-as-cmp-7.5.11-1.Final_redhat_1.1.ep6.el6.src.rpm
- jboss-as-logging-7.5.11-1.Final_redhat_1.1.ep6.el6.src.rpm
- jboss-remote-naming-1.0.13-1.Final_redhat_1.1.ep6.el6.noarch.rpm
- jboss-as-network-7.5.11-1.Final_redhat_1.1.ep6.el6.src.rpm
- jboss-as-jsf-7.5.11-1.Final_redhat_1.1.ep6.el6.noarch.rpm
- picketlink-federation-2.5.4-13.SP11_redhat_1.1.ep6.el6.noarch.rpm
- jboss-as-osgi-7.5.11-1.Final_redhat_1.1.ep6.el6.noarch.rpm
- jboss-as-osgi-configadmin-7.5.11-1.Final_redhat_1.1.ep6.el6.noarch.rpm
- jboss-as-jmx-7.5.11-1.Final_redhat_1.1.ep6.el6.noarch.rpm
- jbossweb-7.5.19-1.Final_redhat_1.1.ep6.el6.src.rpm
- jboss-as-remoting-7.5.11-1.Final_redhat_1.1.ep6.el6.src.rpm
- jbossas-welcome-content-eap-7.5.11-1.Final_redhat_1.1.ep6.el6.noarch.rpm
- hornetq-2.3.25-16.SP14_redhat_1.1.ep6.el6.noarch.rpm
- jboss-as-configadmin-7.5.11-1.Final_redhat_1.1.ep6.el6.noarch.rpm
- jboss-as-embedded-7.5.11-1.Final_redhat_1.1.ep6.el6.src.rpm
- jboss-as-deployment-scanner-7.5.11-1.Final_redhat_1.1.ep6.el6.noarch.rpm
- jboss-as-jsr77-7.5.11-1.Final_redhat_1.1.ep6.el6.noarch.rpm
- jboss-as-sar-7.5.11-1.Final_redhat_1.1.ep6.el6.src.rpm
- jboss-as-transactions-7.5.11-1.Final_redhat_1.1.ep6.el6.noarch.rpm
- jboss-as-deployment-scanner-7.5.11-1.Final_redhat_1.1.ep6.el6.src.rpm
- jboss-as-cli-7.5.11-1.Final_redhat_1.1.ep6.el6.noarch.rpm
- jboss-as-management-client-content-7.5.11-1.Final_redhat_1.1.ep6.el6.src.rpm
- jboss-as-mail-7.5.11-1.Final_redhat_1.1.ep6.el6.src.rpm
- jbossas-javadocs-7.5.11-1.Final_redhat_1.1.ep6.el6.noarch.rpm
- jbossas-domain-7.5.11-1.Final_redhat_1.1.ep6.el6.src.rpm
- jbossweb-7.5.19-1.Final_redhat_1.1.ep6.el6.noarch.rpm
- picketlink-bindings-2.5.4-13.SP11_redhat_1.1.ep6.el6.noarch.rpm
- jboss-as-cmp-7.5.11-1.Final_redhat_1.1.ep6.el6.noarch.rpm
- jbossas-appclient-7.5.11-1.Final_redhat_1.1.ep6.el6.noarch.rpm
- jboss-as-domain-management-7.5.11-1.Final_redhat_1.1.ep6.el6.noarch.rpm
- jboss-as-system-jmx-7.5.11-1.Final_redhat_1.1.ep6.el6.noarch.rpm
- jboss-as-jmx-7.5.11-1.Final_redhat_1.1.ep6.el6.src.rpm
- jboss-as-pojo-7.5.11-1.Final_redhat_1.1.ep6.el6.noarch.rpm
- jboss-as-jsr77-7.5.11-1.Final_redhat_1.1.ep6.el6.src.rpm
- jboss-as-modcluster-7.5.11-1.Final_redhat_1.1.ep6.el6.noarch.rpm
- jboss-as-xts-7.5.11-1.Final_redhat_1.1.ep6.el6.src.rpm
- jboss-as-naming-7.5.11-1.Final_redhat_1.1.ep6.el6.src.rpm
- jboss-as-picketlink-7.5.11-1.Final_redhat_1.1.ep6.el6.noarch.rpm
- jboss-as-appclient-7.5.11-1.Final_redhat_1.1.ep6.el6.noarch.rpm
- hornetq-2.3.25-16.SP14_redhat_1.1.ep6.el6.src.rpm
- jboss-as-client-all-7.5.11-1.Final_redhat_1.1.ep6.el6.noarch.rpm
- jboss-as-jdr-7.5.11-1.Final_redhat_1.1.ep6.el6.noarch.rpm
- jboss-as-controller-client-7.5.11-1.Final_redhat_1.1.ep6.el6.noarch.rpm
- picketlink-bindings-2.5.4-13.SP11_redhat_1.1.ep6.el6.src.rpm
- jboss-as-threads-7.5.11-1.Final_redhat_1.1.ep6.el6.src.rpm
- jboss-as-server-7.5.11-1.Final_redhat_1.1.ep6.el6.src.rpm
- jbossas-appclient-7.5.11-1.Final_redhat_1.1.ep6.el6.src.rpm
- jbossas-bundles-7.5.11-1.Final_redhat_1.1.ep6.el6.src.rpm
- jboss-as-controller-7.5.11-1.Final_redhat_1.1.ep6.el6.src.rpm
- jboss-as-core-security-7.5.11-1.Final_redhat_1.1.ep6.el6.noarch.rpm
- jboss-as-webservices-7.5.11-1.Final_redhat_1.1.ep6.el6.noarch.rpm
- jboss-as-jpa-7.5.11-1.Final_redhat_1.1.ep6.el6.noarch.rpm
- jboss-as-naming-7.5.11-1.Final_redhat_1.1.ep6.el6.noarch.rpm
- jboss-as-connector-7.5.11-1.Final_redhat_1.1.ep6.el6.noarch.rpm
- apache-cxf-2.7.18-4.SP3_redhat_1.1.ep6.el6.noarch.rpm
- jboss-as-sar-7.5.11-1.Final_redhat_1.1.ep6.el6.noarch.rpm
- jbossts-4.17.35-1.Final_redhat_1.1.ep6.el6.src.rpm
- jboss-as-jacorb-7.5.11-1.Final_redhat_1.1.ep6.el6.src.rpm
- jboss-as-messaging-7.5.11-1.Final_redhat_1.1.ep6.el6.src.rpm
- jboss-as-security-7.5.11-1.Final_redhat_1.1.ep6.el6.src.rpm
- jboss-as-picketlink-7.5.11-1.Final_redhat_1.1.ep6.el6.src.rpm
- jbossas-product-eap-7.5.11-1.Final_redhat_1.1.ep6.el6.noarch.rpm
- jboss-as-web-7.5.11-1.Final_redhat_1.1.ep6.el6.src.rpm
- jboss-as-domain-http-7.5.11-1.Final_redhat_1.1.ep6.el6.noarch.rpm
- jboss-as-jacorb-7.5.11-1.Final_redhat_1.1.ep6.el6.noarch.rpm
- jboss-as-platform-mbean-7.5.11-1.Final_redhat_1.1.ep6.el6.noarch.rpm
- jboss-as-deployment-repository-7.5.11-1.Final_redhat_1.1.ep6.el6.src.rpm
- jboss-as-jaxrs-7.5.11-1.Final_redhat_1.1.ep6.el6.noarch.rpm
- jboss-remote-naming-1.0.13-1.Final_redhat_1.1.ep6.el6.src.rpm
Fixes
- This content is not included.BZ - 1349468
- This content is not included.BZ - 1375625
- This content is not included.BZ - 1376065
- This content is not included.BZ - 1376185
CVEs
References
Additional information
- The Red Hat security contact is This content is not included.secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.
- Offline Security Data data is available for integration with other systems. See Offline Security Data API to get started.