Action not permitted
Modal body text goes here.
Modal Title
Modal Body
cve-2007-3304
Vulnerability from cvelistv5
Published
2007-06-20 22:00
Modified
2024-08-07 14:14
Severity ?
EPSS score ?
0.13%
(0.34488)
Summary
Apache httpd 1.3.37, 2.0.59, and 2.2.4 with the Prefork MPM module, allows local users to cause a denial of service by modifying the worker_score and process_score arrays to reference an arbitrary process ID, which is sent a SIGUSR1 signal from the master process, aka "SIGUSR1 killer."
References
{ containers: { adp: [ { providerMetadata: { dateUpdated: "2024-08-07T14:14:12.838Z", orgId: "af854a3a-2127-422b-91ae-364da2661108", shortName: "CVE", }, references: [ { name: "28606", tags: [ "third-party-advisory", "x_refsource_SECUNIA", "x_transferred", ], url: "http://secunia.com/advisories/28606", }, { tags: [ "x_refsource_MISC", "x_transferred", ], url: "http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=245111", }, { name: "MDKSA-2007:142", tags: [ "vendor-advisory", "x_refsource_MANDRIVA", "x_transferred", ], url: "http://www.mandriva.com/security/advisories?name=MDKSA-2007:142", }, { name: "26822", tags: [ "third-party-advisory", "x_refsource_SECUNIA", "x_transferred", ], url: "http://secunia.com/advisories/26822", }, { name: "ADV-2007-4305", tags: [ "vdb-entry", "x_refsource_VUPEN", "x_transferred", ], url: "http://www.vupen.com/english/advisories/2007/4305", }, { name: "ADV-2007-3420", tags: [ "vdb-entry", "x_refsource_VUPEN", "x_transferred", ], url: "http://www.vupen.com/english/advisories/2007/3420", }, { name: "RHSA-2007:0557", tags: [ "vendor-advisory", "x_refsource_REDHAT", "x_transferred", ], url: "http://www.redhat.com/support/errata/RHSA-2007-0557.html", }, { name: "38939", tags: [ "vdb-entry", "x_refsource_OSVDB", "x_transferred", ], url: "http://osvdb.org/38939", }, { name: "PK52702", tags: [ "vendor-advisory", "x_refsource_AIXAPAR", "x_transferred", ], url: "http://www-1.ibm.com/support/docview.wss?uid=swg1PK52702", }, { name: "MDKSA-2007:140", tags: [ "vendor-advisory", "x_refsource_MANDRIVA", "x_transferred", ], url: "http://www.mandriva.com/security/advisories?name=MDKSA-2007:140", }, { name: "HPSBUX02273", tags: [ "vendor-advisory", "x_refsource_HP", "x_transferred", ], url: "http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01182588", }, { name: "25827", tags: [ "third-party-advisory", "x_refsource_SECUNIA", "x_transferred", ], url: "http://secunia.com/advisories/25827", }, { name: "25920", tags: [ "third-party-advisory", "x_refsource_SECUNIA", "x_transferred", ], url: "http://secunia.com/advisories/25920", }, { name: "26993", tags: [ "third-party-advisory", "x_refsource_SECUNIA", "x_transferred", ], url: "http://secunia.com/advisories/26993", }, { name: "28212", tags: [ "third-party-advisory", "x_refsource_SECUNIA", "x_transferred", ], url: "http://secunia.com/advisories/28212", }, { tags: [ "x_refsource_MISC", "x_transferred", ], url: "http://security.psnc.pl/files/apache_report.pdf", }, { name: "1018304", tags: [ "vdb-entry", "x_refsource_SECTRACK", "x_transferred", ], url: "http://www.securitytracker.com/id?1018304", }, { name: "27563", tags: [ "third-party-advisory", "x_refsource_SECUNIA", "x_transferred", ], url: "http://secunia.com/advisories/27563", }, { name: "27732", tags: [ "third-party-advisory", "x_refsource_SECUNIA", "x_transferred", ], url: "http://secunia.com/advisories/27732", }, { tags: [ "x_refsource_CONFIRM", "x_transferred", ], url: "http://svn.apache.org/viewvc?view=rev&revision=547987", }, { name: "103179", tags: [ "vendor-advisory", "x_refsource_SUNALERT", "x_transferred", ], url: "http://sunsolve.sun.com/search/document.do?assetkey=1-26-103179-1", }, { name: "27209", tags: [ "third-party-advisory", "x_refsource_SECUNIA", "x_transferred", ], url: "http://secunia.com/advisories/27209", }, { name: "RHSA-2007:0662", tags: [ "vendor-advisory", "x_refsource_REDHAT", "x_transferred", ], url: "http://www.redhat.com/support/errata/RHSA-2007-0662.html", }, { name: "26790", tags: [ "third-party-advisory", "x_refsource_SECUNIA", "x_transferred", ], url: "http://secunia.com/advisories/26790", }, { name: "RHSA-2007:0556", tags: [ "vendor-advisory", "x_refsource_REDHAT", "x_transferred", ], url: "http://rhn.redhat.com/errata/RHSA-2007-0556.html", }, { tags: [ "x_refsource_CONFIRM", "x_transferred", ], url: "http://httpd.apache.org/security/vulnerabilities_20.html", }, { name: "SUSE-SA:2007:061", tags: [ "vendor-advisory", "x_refsource_SUSE", "x_transferred", ], url: "http://www.novell.com/linux/security/advisories/2007_61_apache2.html", }, { name: "20070529 Apache httpd vulenrabilities", tags: [ "mailing-list", "x_refsource_BUGTRAQ", "x_transferred", ], url: "http://www.securityfocus.com/archive/1/469899/100/0/threaded", }, { name: "FEDORA-2007-2214", tags: [ "vendor-advisory", "x_refsource_FEDORA", "x_transferred", ], url: "http://www.redhat.com/archives/fedora-package-announce/2007-September/msg00320.html", }, { name: "[apache-httpd-dev] 20070622 Re: PID table changes (was Re: svn commit: r547987 - in /httpd/httpd/trunk)", tags: [ "mailing-list", "x_refsource_MLIST", "x_transferred", ], url: "http://marc.info/?l=apache-httpd-dev&m=118252946632447&w=2", }, { name: "26759", tags: [ "third-party-advisory", "x_refsource_SECUNIA", "x_transferred", ], url: "http://secunia.com/advisories/26759", }, { name: "ADV-2007-3494", tags: [ "vdb-entry", "x_refsource_VUPEN", "x_transferred", ], url: "http://www.vupen.com/english/advisories/2007/3494", }, { name: "PK50467", tags: [ "vendor-advisory", "x_refsource_AIXAPAR", "x_transferred", ], url: "http://www-1.ibm.com/support/search.wss?rs=0&q=PK50467&apar=only", }, { name: "2007-0026", tags: [ "vendor-advisory", "x_refsource_TRUSTIX", "x_transferred", ], url: "http://www.trustix.org/errata/2007/0026/", }, { name: "RHSA-2007:0532", tags: [ "vendor-advisory", "x_refsource_REDHAT", "x_transferred", ], url: "http://www.redhat.com/errata/RHSA-2007-0532.html", }, { tags: [ "x_refsource_CONFIRM", "x_transferred", ], url: "http://httpd.apache.org/security/vulnerabilities_22.html", }, { tags: [ "x_refsource_CONFIRM", "x_transferred", ], url: "https://issues.rpath.com/browse/RPL-1710", }, { name: "[apache-httpd-dev] 20070629 Re: [PATCH] pid safety checks for 2.2.x", tags: [ "mailing-list", "x_refsource_MLIST", "x_transferred", ], url: "http://mail-archives.apache.org/mod_mbox/httpd-dev/200706.mbox/%3c20070629141032.GA15192%40redhat.com%3e", }, { name: "20090821 VMSA-2009-0010 VMware Hosted products update libpng and Apache HTTP Server", tags: [ "mailing-list", "x_refsource_BUGTRAQ", "x_transferred", ], url: "http://www.securityfocus.com/archive/1/505990/100/0/threaded", }, { name: "2814", tags: [ "third-party-advisory", "x_refsource_SREASON", "x_transferred", ], url: "http://securityreason.com/securityalert/2814", }, { name: "oval:org.mitre.oval:def:11589", tags: [ "vdb-entry", "signature", "x_refsource_OVAL", "x_transferred", ], url: "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11589", }, { name: "27121", tags: [ "third-party-advisory", "x_refsource_SECUNIA", "x_transferred", ], url: "http://secunia.com/advisories/27121", }, { name: "20070619 Apache Prefork MPM vulnerabilities - Report", tags: [ "mailing-list", "x_refsource_BUGTRAQ", "x_transferred", ], url: "http://www.securityfocus.com/archive/1/471832/100/0/threaded", }, { name: "ADV-2008-0233", tags: [ "vdb-entry", "x_refsource_VUPEN", "x_transferred", ], url: "http://www.vupen.com/english/advisories/2008/0233", }, { tags: [ "x_refsource_CONFIRM", "x_transferred", ], url: "http://www.fujitsu.com/global/support/software/security/products-f/interstage-200802e.html", }, { name: "26211", tags: [ "third-party-advisory", "x_refsource_SECUNIA", "x_transferred", ], url: "http://secunia.com/advisories/26211", }, { name: "apache-child-process-dos(35095)", tags: [ "vdb-entry", "x_refsource_XF", "x_transferred", ], url: "https://exchange.xforce.ibmcloud.com/vulnerabilities/35095", }, { name: "26443", tags: [ "third-party-advisory", "x_refsource_SECUNIA", "x_transferred", ], url: "http://secunia.com/advisories/26443", }, { name: "[security-announce] 20090820 VMSA-2009-0010 VMware Hosted products update libpng and Apache HTTP Server", tags: [ "mailing-list", "x_refsource_MLIST", "x_transferred", ], url: "http://lists.vmware.com/pipermail/security-announce/2009/000062.html", }, { tags: [ "x_refsource_CONFIRM", "x_transferred", ], url: "http://httpd.apache.org/security/vulnerabilities_13.html", }, { name: "GLSA-200711-06", tags: [ "vendor-advisory", "x_refsource_GENTOO", "x_transferred", ], url: "http://security.gentoo.org/glsa/glsa-200711-06.xml", }, { name: "28224", tags: [ "third-party-advisory", "x_refsource_SECUNIA", "x_transferred", ], url: "http://secunia.com/advisories/28224", }, { name: "200032", tags: [ "vendor-advisory", "x_refsource_SUNALERT", "x_transferred", ], url: "http://sunsolve.sun.com/search/document.do?assetkey=1-66-200032-1", }, { name: "25830", tags: [ "third-party-advisory", "x_refsource_SECUNIA", "x_transferred", ], url: "http://secunia.com/advisories/25830", }, { name: "24215", tags: [ "vdb-entry", "x_refsource_BID", "x_transferred", ], url: "http://www.securityfocus.com/bid/24215", }, { tags: [ "x_refsource_CONFIRM", "x_transferred", ], url: "http://support.avaya.com/elmodocs2/security/ASA-2007-363.htm", }, { name: "USN-499-1", tags: [ "vendor-advisory", "x_refsource_UBUNTU", "x_transferred", ], url: "http://www.ubuntu.com/usn/usn-499-1", }, { name: "RHSA-2008:0261", tags: [ "vendor-advisory", "x_refsource_REDHAT", "x_transferred", ], url: "http://www.redhat.com/support/errata/RHSA-2008-0261.html", }, { name: "26508", tags: [ "third-party-advisory", "x_refsource_SECUNIA", "x_transferred", ], url: "http://secunia.com/advisories/26508", }, { tags: [ "x_refsource_CONFIRM", "x_transferred", ], url: "http://support.avaya.com/elmodocs2/security/ASA-2007-353.htm", }, { name: "26842", tags: [ "third-party-advisory", "x_refsource_SECUNIA", "x_transferred", ], url: "http://secunia.com/advisories/26842", }, { name: "ADV-2007-3283", tags: [ "vdb-entry", "x_refsource_VUPEN", "x_transferred", ], url: "http://www.vupen.com/english/advisories/2007/3283", }, { name: "20070701-01-P", tags: [ "vendor-advisory", "x_refsource_SGI", "x_transferred", ], url: "ftp://patches.sgi.com/support/free/security/advisories/20070701-01-P.asc", }, { name: "PK53984", tags: [ "vendor-advisory", "x_refsource_AIXAPAR", "x_transferred", ], url: "http://www-1.ibm.com/support/docview.wss?uid=swg1PK53984", }, { name: "ADV-2007-2727", tags: [ "vdb-entry", "x_refsource_VUPEN", "x_transferred", ], url: "http://www.vupen.com/english/advisories/2007/2727", }, { name: "26611", tags: [ "third-party-advisory", "x_refsource_SECUNIA", "x_transferred", ], url: "http://secunia.com/advisories/26611", }, { name: "26273", tags: [ "third-party-advisory", "x_refsource_SECUNIA", "x_transferred", ], url: "http://secunia.com/advisories/26273", }, { tags: [ "x_refsource_CONFIRM", "x_transferred", ], url: "http://bugs.gentoo.org/show_bug.cgi?id=186219", }, { name: "ADV-2007-3100", tags: [ "vdb-entry", "x_refsource_VUPEN", "x_transferred", ], url: "http://www.vupen.com/english/advisories/2007/3100", }, { name: "SSRT071476", tags: [ "vendor-advisory", "x_refsource_HP", "x_transferred", ], url: "http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01182588", }, { name: "[httpd-cvs] 20190815 svn commit: r1048742 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html", tags: [ "mailing-list", "x_refsource_MLIST", "x_transferred", ], url: "https://lists.apache.org/thread.html/54a42d4b01968df1117cea77fc53d6beb931c0e05936ad02af93e9ac%40%3Ccvs.httpd.apache.org%3E", }, { name: "[httpd-cvs] 20190815 svn commit: r1048743 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html", tags: [ "mailing-list", "x_refsource_MLIST", "x_transferred", ], url: "https://lists.apache.org/thread.html/5df9bfb86a3b054bb985a45ff9250b0332c9ecc181eec232489e7f79%40%3Ccvs.httpd.apache.org%3E", }, { name: "[httpd-cvs] 20190815 svn commit: r1048743 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html", tags: [ "mailing-list", "x_refsource_MLIST", "x_transferred", ], url: "https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E", }, { name: "[httpd-cvs] 20190815 svn commit: r1048742 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html", tags: [ "mailing-list", "x_refsource_MLIST", "x_transferred", ], url: "https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E", }, { name: "[httpd-cvs] 20200401 svn commit: r1058586 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html", tags: [ "mailing-list", "x_refsource_MLIST", "x_transferred", ], url: "https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E", }, { name: "[httpd-cvs] 20200401 svn commit: r1058586 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html", tags: [ "mailing-list", "x_refsource_MLIST", "x_transferred", ], url: "https://lists.apache.org/thread.html/r0276683d8e1e07153fc8642618830ac0ade85b9ae0dc7b07f63bb8fc%40%3Ccvs.httpd.apache.org%3E", }, { name: "[httpd-cvs] 20200401 svn commit: r1058587 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html", tags: [ "mailing-list", "x_refsource_MLIST", "x_transferred", ], url: "https://lists.apache.org/thread.html/r8828e649175df56f1f9e3919938ac7826128525426e2748f0ab62feb%40%3Ccvs.httpd.apache.org%3E", }, { name: "[httpd-cvs] 20200401 svn commit: r1058587 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html", tags: [ "mailing-list", "x_refsource_MLIST", "x_transferred", ], url: "https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E", }, { name: "[httpd-cvs] 20210330 svn commit: r1073139 [1/13] - in /websites/staging/httpd/trunk/content: ./ security/json/", tags: [ "mailing-list", "x_refsource_MLIST", "x_transferred", ], url: "https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E", }, { name: "[httpd-cvs] 20210330 svn commit: r1073140 [1/4] - in /websites/staging/httpd/trunk/content: ./ security/cvejsontohtml.py security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html", tags: [ "mailing-list", "x_refsource_MLIST", "x_transferred", ], url: "https://lists.apache.org/thread.html/r5419c9ba0951ef73a655362403d12bb8d10fab38274deb3f005816f5%40%3Ccvs.httpd.apache.org%3E", }, { name: "[httpd-cvs] 20210330 svn commit: r1073140 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/cvejsontohtml.py security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html", tags: [ "mailing-list", "x_refsource_MLIST", "x_transferred", ], url: "https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E", }, { name: "[httpd-cvs] 20210330 svn commit: r1888194 [4/13] - /httpd/site/trunk/content/security/json/", tags: [ "mailing-list", "x_refsource_MLIST", "x_transferred", ], url: "https://lists.apache.org/thread.html/r652fc951306cdeca5a276e2021a34878a76695a9f3cfb6490b4a6840%40%3Ccvs.httpd.apache.org%3E", }, { name: "[httpd-cvs] 20210330 svn commit: r1073140 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/cvejsontohtml.py security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html", tags: [ "mailing-list", "x_refsource_MLIST", "x_transferred", ], url: "https://lists.apache.org/thread.html/r2cb985de917e7da0848c440535f65a247754db8b2154a10089e4247b%40%3Ccvs.httpd.apache.org%3E", }, { name: "[httpd-cvs] 20210330 svn commit: r1073143 [2/3] - in /websites/staging/httpd/trunk/content: ./ security/", tags: [ "mailing-list", "x_refsource_MLIST", "x_transferred", ], url: "https://lists.apache.org/thread.html/r9e8622254184645bc963a1d47c5d47f6d5a36d6f080d8d2c43b2b142%40%3Ccvs.httpd.apache.org%3E", }, { name: "[httpd-cvs] 20210330 svn commit: r1073139 [4/13] - in /websites/staging/httpd/trunk/content: ./ security/json/", tags: [ "mailing-list", "x_refsource_MLIST", "x_transferred", ], url: "https://lists.apache.org/thread.html/reb542d2038e9c331506e0cbff881b47e40fbe2bd93ff00979e60cdf7%40%3Ccvs.httpd.apache.org%3E", }, { name: "[httpd-cvs] 20210330 svn commit: r1073149 [5/13] - in /websites/staging/httpd/trunk/content: ./ security/ security/json/", tags: [ "mailing-list", "x_refsource_MLIST", "x_transferred", ], url: "https://lists.apache.org/thread.html/rafd145ba6cd0a4ced113a5823cdaff45aeb36eb09855b216401c66d6%40%3Ccvs.httpd.apache.org%3E", }, { name: "[httpd-cvs] 20210330 svn commit: r1073146 [2/3] - in /websites/staging/httpd/trunk/content: ./ security/cvejsontohtml.py security/vulnerabilities-httpd.xml security/vulnerabilities_22.html security/vulnerabilities_24.html", tags: [ "mailing-list", "x_refsource_MLIST", "x_transferred", ], url: "https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E", }, { name: "[httpd-cvs] 20210330 svn commit: r1073149 [1/13] - in /websites/staging/httpd/trunk/content: ./ security/ security/json/", tags: [ "mailing-list", "x_refsource_MLIST", "x_transferred", ], url: "https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E", }, { name: "[httpd-cvs] 20210603 svn commit: r1075360 [2/3] - in /websites/staging/httpd/trunk/content: ./ security/json/CVE-2021-31618.json security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html", tags: [ "mailing-list", "x_refsource_MLIST", "x_transferred", ], url: "https://lists.apache.org/thread.html/rad01d817195e6cc871cb1d73b207ca326379a20a6e7f30febaf56d24%40%3Ccvs.httpd.apache.org%3E", }, { name: "[httpd-cvs] 20210603 svn commit: r1075360 [1/3] - in /websites/staging/httpd/trunk/content: ./ security/json/CVE-2021-31618.json security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html", tags: [ "mailing-list", "x_refsource_MLIST", "x_transferred", ], url: "https://lists.apache.org/thread.html/r5f9c22f9c28adbd9f00556059edc7b03a5d5bb71d4bb80257c0d34e4%40%3Ccvs.httpd.apache.org%3E", }, { name: "[httpd-cvs] 20210606 svn commit: r1075467 [2/2] - in /websites/staging/httpd/trunk/content: ./ security/json/CVE-2021-31618.json security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html", tags: [ "mailing-list", "x_refsource_MLIST", "x_transferred", ], url: "https://lists.apache.org/thread.html/r476d175be0aaf4a17680ef98c5153b4d336eaef76fb2224cc94c463a%40%3Ccvs.httpd.apache.org%3E", }, { name: "[httpd-cvs] 20210606 svn commit: r1075467 [1/2] - in /websites/staging/httpd/trunk/content: ./ security/json/CVE-2021-31618.json security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html", tags: [ "mailing-list", "x_refsource_MLIST", "x_transferred", ], url: "https://lists.apache.org/thread.html/rb9c9f42dafa25d2f669dac2a536a03f2575bc5ec1be6f480618aee10%40%3Ccvs.httpd.apache.org%3E", }, { name: "[httpd-cvs] 20210606 svn commit: r1075470 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/json/CVE-2020-13938.json security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html", tags: [ "mailing-list", "x_refsource_MLIST", "x_transferred", ], url: "https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E", }, ], title: "CVE Program Container", }, ], cna: { affected: [ { product: "n/a", vendor: "n/a", versions: [ { status: "affected", version: "n/a", }, ], }, ], datePublic: "2007-05-29T00:00:00", descriptions: [ { lang: "en", value: "Apache httpd 1.3.37, 2.0.59, and 2.2.4 with the Prefork MPM module, allows local users to cause a denial of service by modifying the worker_score and process_score arrays to reference an arbitrary process ID, which is sent a SIGUSR1 signal from the master process, aka \"SIGUSR1 killer.\"", }, ], problemTypes: [ { descriptions: [ { description: "n/a", lang: "en", type: "text", }, ], }, ], providerMetadata: { dateUpdated: "2021-06-06T10:10:41", orgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca", shortName: "mitre", }, references: [ { name: "28606", tags: [ "third-party-advisory", "x_refsource_SECUNIA", ], url: "http://secunia.com/advisories/28606", }, { tags: [ "x_refsource_MISC", ], url: "http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=245111", }, { name: "MDKSA-2007:142", tags: [ "vendor-advisory", "x_refsource_MANDRIVA", ], url: "http://www.mandriva.com/security/advisories?name=MDKSA-2007:142", }, { name: "26822", tags: [ "third-party-advisory", "x_refsource_SECUNIA", ], url: "http://secunia.com/advisories/26822", }, { name: "ADV-2007-4305", tags: [ "vdb-entry", "x_refsource_VUPEN", ], url: "http://www.vupen.com/english/advisories/2007/4305", }, { name: "ADV-2007-3420", tags: [ "vdb-entry", "x_refsource_VUPEN", ], url: "http://www.vupen.com/english/advisories/2007/3420", }, { name: "RHSA-2007:0557", tags: [ "vendor-advisory", "x_refsource_REDHAT", ], url: "http://www.redhat.com/support/errata/RHSA-2007-0557.html", }, { name: "38939", tags: [ "vdb-entry", "x_refsource_OSVDB", ], url: "http://osvdb.org/38939", }, { name: "PK52702", tags: [ "vendor-advisory", "x_refsource_AIXAPAR", ], url: "http://www-1.ibm.com/support/docview.wss?uid=swg1PK52702", }, { name: "MDKSA-2007:140", tags: [ "vendor-advisory", "x_refsource_MANDRIVA", ], url: "http://www.mandriva.com/security/advisories?name=MDKSA-2007:140", }, { name: "HPSBUX02273", tags: [ "vendor-advisory", "x_refsource_HP", ], url: "http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01182588", }, { name: "25827", tags: [ "third-party-advisory", "x_refsource_SECUNIA", ], url: "http://secunia.com/advisories/25827", }, { name: "25920", tags: [ "third-party-advisory", "x_refsource_SECUNIA", ], url: "http://secunia.com/advisories/25920", }, { name: "26993", tags: [ "third-party-advisory", "x_refsource_SECUNIA", ], url: "http://secunia.com/advisories/26993", }, { name: "28212", tags: [ "third-party-advisory", "x_refsource_SECUNIA", ], url: "http://secunia.com/advisories/28212", }, { tags: [ "x_refsource_MISC", ], url: "http://security.psnc.pl/files/apache_report.pdf", }, { name: "1018304", tags: [ "vdb-entry", "x_refsource_SECTRACK", ], url: "http://www.securitytracker.com/id?1018304", }, { name: "27563", tags: [ "third-party-advisory", "x_refsource_SECUNIA", ], url: "http://secunia.com/advisories/27563", }, { name: "27732", tags: [ "third-party-advisory", "x_refsource_SECUNIA", ], url: "http://secunia.com/advisories/27732", }, { tags: [ "x_refsource_CONFIRM", ], url: "http://svn.apache.org/viewvc?view=rev&revision=547987", }, { name: "103179", tags: [ "vendor-advisory", "x_refsource_SUNALERT", ], url: "http://sunsolve.sun.com/search/document.do?assetkey=1-26-103179-1", }, { name: "27209", tags: [ "third-party-advisory", "x_refsource_SECUNIA", ], url: "http://secunia.com/advisories/27209", }, { name: "RHSA-2007:0662", tags: [ "vendor-advisory", "x_refsource_REDHAT", ], url: "http://www.redhat.com/support/errata/RHSA-2007-0662.html", }, { name: "26790", tags: [ "third-party-advisory", "x_refsource_SECUNIA", ], url: "http://secunia.com/advisories/26790", }, { name: "RHSA-2007:0556", tags: [ "vendor-advisory", "x_refsource_REDHAT", ], url: "http://rhn.redhat.com/errata/RHSA-2007-0556.html", }, { tags: [ "x_refsource_CONFIRM", ], url: "http://httpd.apache.org/security/vulnerabilities_20.html", }, { name: "SUSE-SA:2007:061", tags: [ "vendor-advisory", "x_refsource_SUSE", ], url: "http://www.novell.com/linux/security/advisories/2007_61_apache2.html", }, { name: "20070529 Apache httpd vulenrabilities", tags: [ "mailing-list", "x_refsource_BUGTRAQ", ], url: "http://www.securityfocus.com/archive/1/469899/100/0/threaded", }, { name: "FEDORA-2007-2214", tags: [ "vendor-advisory", "x_refsource_FEDORA", ], url: "http://www.redhat.com/archives/fedora-package-announce/2007-September/msg00320.html", }, { name: "[apache-httpd-dev] 20070622 Re: PID table changes (was Re: svn commit: r547987 - in /httpd/httpd/trunk)", tags: [ "mailing-list", "x_refsource_MLIST", ], url: "http://marc.info/?l=apache-httpd-dev&m=118252946632447&w=2", }, { name: "26759", tags: [ "third-party-advisory", "x_refsource_SECUNIA", ], url: "http://secunia.com/advisories/26759", }, { name: "ADV-2007-3494", tags: [ "vdb-entry", "x_refsource_VUPEN", ], url: "http://www.vupen.com/english/advisories/2007/3494", }, { name: "PK50467", tags: [ "vendor-advisory", "x_refsource_AIXAPAR", ], url: "http://www-1.ibm.com/support/search.wss?rs=0&q=PK50467&apar=only", }, { name: "2007-0026", tags: [ "vendor-advisory", "x_refsource_TRUSTIX", ], url: "http://www.trustix.org/errata/2007/0026/", }, { name: "RHSA-2007:0532", tags: [ "vendor-advisory", "x_refsource_REDHAT", ], url: "http://www.redhat.com/errata/RHSA-2007-0532.html", }, { tags: [ "x_refsource_CONFIRM", ], url: "http://httpd.apache.org/security/vulnerabilities_22.html", }, { tags: [ "x_refsource_CONFIRM", ], url: "https://issues.rpath.com/browse/RPL-1710", }, { name: "[apache-httpd-dev] 20070629 Re: [PATCH] pid safety checks for 2.2.x", tags: [ "mailing-list", "x_refsource_MLIST", ], url: "http://mail-archives.apache.org/mod_mbox/httpd-dev/200706.mbox/%3c20070629141032.GA15192%40redhat.com%3e", }, { name: "20090821 VMSA-2009-0010 VMware Hosted products update libpng and Apache HTTP Server", tags: [ "mailing-list", "x_refsource_BUGTRAQ", ], url: "http://www.securityfocus.com/archive/1/505990/100/0/threaded", }, { name: "2814", tags: [ "third-party-advisory", "x_refsource_SREASON", ], url: "http://securityreason.com/securityalert/2814", }, { name: "oval:org.mitre.oval:def:11589", tags: [ "vdb-entry", "signature", "x_refsource_OVAL", ], url: "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11589", }, { name: "27121", tags: [ "third-party-advisory", "x_refsource_SECUNIA", ], url: "http://secunia.com/advisories/27121", }, { name: "20070619 Apache Prefork MPM vulnerabilities - Report", tags: [ "mailing-list", "x_refsource_BUGTRAQ", ], url: "http://www.securityfocus.com/archive/1/471832/100/0/threaded", }, { name: "ADV-2008-0233", tags: [ "vdb-entry", "x_refsource_VUPEN", ], url: "http://www.vupen.com/english/advisories/2008/0233", }, { tags: [ "x_refsource_CONFIRM", ], url: "http://www.fujitsu.com/global/support/software/security/products-f/interstage-200802e.html", }, { name: "26211", tags: [ "third-party-advisory", "x_refsource_SECUNIA", ], url: "http://secunia.com/advisories/26211", }, { name: "apache-child-process-dos(35095)", tags: [ "vdb-entry", "x_refsource_XF", ], url: "https://exchange.xforce.ibmcloud.com/vulnerabilities/35095", }, { name: "26443", tags: [ "third-party-advisory", "x_refsource_SECUNIA", ], url: "http://secunia.com/advisories/26443", }, { name: "[security-announce] 20090820 VMSA-2009-0010 VMware Hosted products update libpng and Apache HTTP Server", tags: [ "mailing-list", "x_refsource_MLIST", ], url: "http://lists.vmware.com/pipermail/security-announce/2009/000062.html", }, { tags: [ "x_refsource_CONFIRM", ], url: "http://httpd.apache.org/security/vulnerabilities_13.html", }, { name: "GLSA-200711-06", tags: [ "vendor-advisory", "x_refsource_GENTOO", ], url: "http://security.gentoo.org/glsa/glsa-200711-06.xml", }, { name: "28224", tags: [ "third-party-advisory", "x_refsource_SECUNIA", ], url: "http://secunia.com/advisories/28224", }, { name: "200032", tags: [ "vendor-advisory", "x_refsource_SUNALERT", ], url: "http://sunsolve.sun.com/search/document.do?assetkey=1-66-200032-1", }, { name: "25830", tags: [ "third-party-advisory", "x_refsource_SECUNIA", ], url: "http://secunia.com/advisories/25830", }, { name: "24215", tags: [ "vdb-entry", "x_refsource_BID", ], url: "http://www.securityfocus.com/bid/24215", }, { tags: [ "x_refsource_CONFIRM", ], url: "http://support.avaya.com/elmodocs2/security/ASA-2007-363.htm", }, { name: "USN-499-1", tags: [ "vendor-advisory", "x_refsource_UBUNTU", ], url: "http://www.ubuntu.com/usn/usn-499-1", }, { name: "RHSA-2008:0261", tags: [ "vendor-advisory", "x_refsource_REDHAT", ], url: "http://www.redhat.com/support/errata/RHSA-2008-0261.html", }, { name: "26508", tags: [ "third-party-advisory", "x_refsource_SECUNIA", ], url: "http://secunia.com/advisories/26508", }, { tags: [ "x_refsource_CONFIRM", ], url: "http://support.avaya.com/elmodocs2/security/ASA-2007-353.htm", }, { name: "26842", tags: [ "third-party-advisory", "x_refsource_SECUNIA", ], url: "http://secunia.com/advisories/26842", }, { name: "ADV-2007-3283", tags: [ "vdb-entry", "x_refsource_VUPEN", ], url: "http://www.vupen.com/english/advisories/2007/3283", }, { name: "20070701-01-P", tags: [ "vendor-advisory", "x_refsource_SGI", ], url: "ftp://patches.sgi.com/support/free/security/advisories/20070701-01-P.asc", }, { name: "PK53984", tags: [ "vendor-advisory", "x_refsource_AIXAPAR", ], url: "http://www-1.ibm.com/support/docview.wss?uid=swg1PK53984", }, { name: "ADV-2007-2727", tags: [ "vdb-entry", "x_refsource_VUPEN", ], url: "http://www.vupen.com/english/advisories/2007/2727", }, { name: "26611", tags: [ "third-party-advisory", "x_refsource_SECUNIA", ], url: "http://secunia.com/advisories/26611", }, { name: "26273", tags: [ "third-party-advisory", "x_refsource_SECUNIA", ], url: "http://secunia.com/advisories/26273", }, { tags: [ "x_refsource_CONFIRM", ], url: "http://bugs.gentoo.org/show_bug.cgi?id=186219", }, { name: "ADV-2007-3100", tags: [ "vdb-entry", "x_refsource_VUPEN", ], url: "http://www.vupen.com/english/advisories/2007/3100", }, { name: "SSRT071476", tags: [ "vendor-advisory", "x_refsource_HP", ], url: "http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01182588", }, { name: "[httpd-cvs] 20190815 svn commit: r1048742 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html", tags: [ "mailing-list", "x_refsource_MLIST", ], url: "https://lists.apache.org/thread.html/54a42d4b01968df1117cea77fc53d6beb931c0e05936ad02af93e9ac%40%3Ccvs.httpd.apache.org%3E", }, { name: "[httpd-cvs] 20190815 svn commit: r1048743 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html", tags: [ "mailing-list", "x_refsource_MLIST", ], url: "https://lists.apache.org/thread.html/5df9bfb86a3b054bb985a45ff9250b0332c9ecc181eec232489e7f79%40%3Ccvs.httpd.apache.org%3E", }, { name: "[httpd-cvs] 20190815 svn commit: r1048743 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html", tags: [ "mailing-list", "x_refsource_MLIST", ], url: "https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E", }, { name: "[httpd-cvs] 20190815 svn commit: r1048742 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html", tags: [ "mailing-list", "x_refsource_MLIST", ], url: "https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E", }, { name: "[httpd-cvs] 20200401 svn commit: r1058586 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html", tags: [ "mailing-list", "x_refsource_MLIST", ], url: "https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E", }, { name: "[httpd-cvs] 20200401 svn commit: r1058586 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html", tags: [ "mailing-list", "x_refsource_MLIST", ], url: "https://lists.apache.org/thread.html/r0276683d8e1e07153fc8642618830ac0ade85b9ae0dc7b07f63bb8fc%40%3Ccvs.httpd.apache.org%3E", }, { name: "[httpd-cvs] 20200401 svn commit: r1058587 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html", tags: [ "mailing-list", "x_refsource_MLIST", ], url: "https://lists.apache.org/thread.html/r8828e649175df56f1f9e3919938ac7826128525426e2748f0ab62feb%40%3Ccvs.httpd.apache.org%3E", }, { name: "[httpd-cvs] 20200401 svn commit: r1058587 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html", tags: [ "mailing-list", "x_refsource_MLIST", ], url: "https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E", }, { name: "[httpd-cvs] 20210330 svn commit: r1073139 [1/13] - in /websites/staging/httpd/trunk/content: ./ security/json/", tags: [ "mailing-list", "x_refsource_MLIST", ], url: "https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E", }, { name: "[httpd-cvs] 20210330 svn commit: r1073140 [1/4] - in /websites/staging/httpd/trunk/content: ./ security/cvejsontohtml.py security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html", tags: [ "mailing-list", "x_refsource_MLIST", ], url: "https://lists.apache.org/thread.html/r5419c9ba0951ef73a655362403d12bb8d10fab38274deb3f005816f5%40%3Ccvs.httpd.apache.org%3E", }, { name: "[httpd-cvs] 20210330 svn commit: r1073140 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/cvejsontohtml.py security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html", tags: [ "mailing-list", "x_refsource_MLIST", ], url: "https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E", }, { name: "[httpd-cvs] 20210330 svn commit: r1888194 [4/13] - /httpd/site/trunk/content/security/json/", tags: [ "mailing-list", "x_refsource_MLIST", ], url: "https://lists.apache.org/thread.html/r652fc951306cdeca5a276e2021a34878a76695a9f3cfb6490b4a6840%40%3Ccvs.httpd.apache.org%3E", }, { name: "[httpd-cvs] 20210330 svn commit: r1073140 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/cvejsontohtml.py security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html", tags: [ "mailing-list", "x_refsource_MLIST", ], url: "https://lists.apache.org/thread.html/r2cb985de917e7da0848c440535f65a247754db8b2154a10089e4247b%40%3Ccvs.httpd.apache.org%3E", }, { name: "[httpd-cvs] 20210330 svn commit: r1073143 [2/3] - in /websites/staging/httpd/trunk/content: ./ security/", tags: [ "mailing-list", "x_refsource_MLIST", ], url: "https://lists.apache.org/thread.html/r9e8622254184645bc963a1d47c5d47f6d5a36d6f080d8d2c43b2b142%40%3Ccvs.httpd.apache.org%3E", }, { name: "[httpd-cvs] 20210330 svn commit: r1073139 [4/13] - in /websites/staging/httpd/trunk/content: ./ security/json/", tags: [ "mailing-list", "x_refsource_MLIST", ], url: "https://lists.apache.org/thread.html/reb542d2038e9c331506e0cbff881b47e40fbe2bd93ff00979e60cdf7%40%3Ccvs.httpd.apache.org%3E", }, { name: "[httpd-cvs] 20210330 svn commit: r1073149 [5/13] - in /websites/staging/httpd/trunk/content: ./ security/ security/json/", tags: [ "mailing-list", "x_refsource_MLIST", ], url: "https://lists.apache.org/thread.html/rafd145ba6cd0a4ced113a5823cdaff45aeb36eb09855b216401c66d6%40%3Ccvs.httpd.apache.org%3E", }, { name: "[httpd-cvs] 20210330 svn commit: r1073146 [2/3] - in /websites/staging/httpd/trunk/content: ./ security/cvejsontohtml.py security/vulnerabilities-httpd.xml security/vulnerabilities_22.html security/vulnerabilities_24.html", tags: [ "mailing-list", "x_refsource_MLIST", ], url: "https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E", }, { name: "[httpd-cvs] 20210330 svn commit: r1073149 [1/13] - in /websites/staging/httpd/trunk/content: ./ security/ security/json/", tags: [ "mailing-list", "x_refsource_MLIST", ], url: "https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E", }, { name: "[httpd-cvs] 20210603 svn commit: r1075360 [2/3] - in /websites/staging/httpd/trunk/content: ./ security/json/CVE-2021-31618.json security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html", tags: [ "mailing-list", "x_refsource_MLIST", ], url: "https://lists.apache.org/thread.html/rad01d817195e6cc871cb1d73b207ca326379a20a6e7f30febaf56d24%40%3Ccvs.httpd.apache.org%3E", }, { name: "[httpd-cvs] 20210603 svn commit: r1075360 [1/3] - in /websites/staging/httpd/trunk/content: ./ security/json/CVE-2021-31618.json security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html", tags: [ "mailing-list", "x_refsource_MLIST", ], url: "https://lists.apache.org/thread.html/r5f9c22f9c28adbd9f00556059edc7b03a5d5bb71d4bb80257c0d34e4%40%3Ccvs.httpd.apache.org%3E", }, { name: "[httpd-cvs] 20210606 svn commit: r1075467 [2/2] - in /websites/staging/httpd/trunk/content: ./ security/json/CVE-2021-31618.json security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html", tags: [ "mailing-list", "x_refsource_MLIST", ], url: "https://lists.apache.org/thread.html/r476d175be0aaf4a17680ef98c5153b4d336eaef76fb2224cc94c463a%40%3Ccvs.httpd.apache.org%3E", }, { name: "[httpd-cvs] 20210606 svn commit: r1075467 [1/2] - in /websites/staging/httpd/trunk/content: ./ security/json/CVE-2021-31618.json security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html", tags: [ "mailing-list", "x_refsource_MLIST", ], url: "https://lists.apache.org/thread.html/rb9c9f42dafa25d2f669dac2a536a03f2575bc5ec1be6f480618aee10%40%3Ccvs.httpd.apache.org%3E", }, { name: "[httpd-cvs] 20210606 svn commit: r1075470 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/json/CVE-2020-13938.json security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html", tags: [ "mailing-list", "x_refsource_MLIST", ], url: "https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E", }, ], x_legacyV4Record: { CVE_data_meta: { ASSIGNER: "cve@mitre.org", ID: "CVE-2007-3304", STATE: "PUBLIC", }, affects: { vendor: { vendor_data: [ { product: { product_data: [ { product_name: "n/a", version: { version_data: [ { version_value: "n/a", }, ], }, }, ], }, vendor_name: "n/a", }, ], }, }, data_format: "MITRE", data_type: "CVE", data_version: "4.0", description: { description_data: [ { lang: "eng", value: "Apache httpd 1.3.37, 2.0.59, and 2.2.4 with the Prefork MPM module, allows local users to cause a denial of service by modifying the worker_score and process_score arrays to reference an arbitrary process ID, which is sent a SIGUSR1 signal from the master process, aka \"SIGUSR1 killer.\"", }, ], }, problemtype: { problemtype_data: [ { description: [ { lang: "eng", value: "n/a", }, ], }, ], }, references: { reference_data: [ { name: "28606", refsource: "SECUNIA", url: "http://secunia.com/advisories/28606", }, { name: "http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=245111", refsource: "MISC", url: "http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=245111", }, { name: "MDKSA-2007:142", refsource: "MANDRIVA", url: "http://www.mandriva.com/security/advisories?name=MDKSA-2007:142", }, { name: "26822", refsource: "SECUNIA", url: "http://secunia.com/advisories/26822", }, { name: "ADV-2007-4305", refsource: "VUPEN", url: "http://www.vupen.com/english/advisories/2007/4305", }, { name: "ADV-2007-3420", refsource: "VUPEN", url: "http://www.vupen.com/english/advisories/2007/3420", }, { name: "RHSA-2007:0557", refsource: "REDHAT", url: "http://www.redhat.com/support/errata/RHSA-2007-0557.html", }, { name: "38939", refsource: "OSVDB", url: "http://osvdb.org/38939", }, { name: "PK52702", refsource: "AIXAPAR", url: "http://www-1.ibm.com/support/docview.wss?uid=swg1PK52702", }, { name: "MDKSA-2007:140", refsource: "MANDRIVA", url: "http://www.mandriva.com/security/advisories?name=MDKSA-2007:140", }, { name: "HPSBUX02273", refsource: "HP", url: "http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01182588", }, { name: "25827", refsource: "SECUNIA", url: "http://secunia.com/advisories/25827", }, { name: "25920", refsource: "SECUNIA", url: "http://secunia.com/advisories/25920", }, { name: "26993", refsource: "SECUNIA", url: "http://secunia.com/advisories/26993", }, { name: "28212", refsource: "SECUNIA", url: "http://secunia.com/advisories/28212", }, { name: "http://security.psnc.pl/files/apache_report.pdf", refsource: "MISC", url: "http://security.psnc.pl/files/apache_report.pdf", }, { name: "1018304", refsource: "SECTRACK", url: "http://www.securitytracker.com/id?1018304", }, { name: "27563", refsource: "SECUNIA", url: "http://secunia.com/advisories/27563", }, { name: "27732", refsource: "SECUNIA", url: "http://secunia.com/advisories/27732", }, { name: "http://svn.apache.org/viewvc?view=rev&revision=547987", refsource: "CONFIRM", url: "http://svn.apache.org/viewvc?view=rev&revision=547987", }, { name: "103179", refsource: "SUNALERT", url: "http://sunsolve.sun.com/search/document.do?assetkey=1-26-103179-1", }, { name: "27209", refsource: "SECUNIA", url: "http://secunia.com/advisories/27209", }, { name: "RHSA-2007:0662", refsource: "REDHAT", url: "http://www.redhat.com/support/errata/RHSA-2007-0662.html", }, { name: "26790", refsource: "SECUNIA", url: "http://secunia.com/advisories/26790", }, { name: "RHSA-2007:0556", refsource: "REDHAT", url: "http://rhn.redhat.com/errata/RHSA-2007-0556.html", }, { name: "http://httpd.apache.org/security/vulnerabilities_20.html", refsource: "CONFIRM", url: "http://httpd.apache.org/security/vulnerabilities_20.html", }, { name: "SUSE-SA:2007:061", refsource: "SUSE", url: "http://www.novell.com/linux/security/advisories/2007_61_apache2.html", }, { name: "20070529 Apache httpd vulenrabilities", refsource: "BUGTRAQ", url: "http://www.securityfocus.com/archive/1/469899/100/0/threaded", }, { name: "FEDORA-2007-2214", refsource: "FEDORA", url: "http://www.redhat.com/archives/fedora-package-announce/2007-September/msg00320.html", }, { name: "[apache-httpd-dev] 20070622 Re: PID table changes (was Re: svn commit: r547987 - in /httpd/httpd/trunk)", refsource: "MLIST", url: "http://marc.info/?l=apache-httpd-dev&m=118252946632447&w=2", }, { name: "26759", refsource: "SECUNIA", url: "http://secunia.com/advisories/26759", }, { name: "ADV-2007-3494", refsource: "VUPEN", url: "http://www.vupen.com/english/advisories/2007/3494", }, { name: "PK50467", refsource: "AIXAPAR", url: "http://www-1.ibm.com/support/search.wss?rs=0&q=PK50467&apar=only", }, { name: "2007-0026", refsource: "TRUSTIX", url: "http://www.trustix.org/errata/2007/0026/", }, { name: "RHSA-2007:0532", refsource: "REDHAT", url: "http://www.redhat.com/errata/RHSA-2007-0532.html", }, { name: "http://httpd.apache.org/security/vulnerabilities_22.html", refsource: "CONFIRM", url: "http://httpd.apache.org/security/vulnerabilities_22.html", }, { name: "https://issues.rpath.com/browse/RPL-1710", refsource: "CONFIRM", url: "https://issues.rpath.com/browse/RPL-1710", }, { name: "[apache-httpd-dev] 20070629 Re: [PATCH] pid safety checks for 2.2.x", refsource: "MLIST", url: "http://mail-archives.apache.org/mod_mbox/httpd-dev/200706.mbox/%3c20070629141032.GA15192@redhat.com%3e", }, { name: "20090821 VMSA-2009-0010 VMware Hosted products update libpng and Apache HTTP Server", refsource: "BUGTRAQ", url: "http://www.securityfocus.com/archive/1/505990/100/0/threaded", }, { name: "2814", refsource: "SREASON", url: "http://securityreason.com/securityalert/2814", }, { name: "oval:org.mitre.oval:def:11589", refsource: "OVAL", url: "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11589", }, { name: "27121", refsource: "SECUNIA", url: "http://secunia.com/advisories/27121", }, { name: "20070619 Apache Prefork MPM vulnerabilities - Report", refsource: "BUGTRAQ", url: "http://www.securityfocus.com/archive/1/471832/100/0/threaded", }, { name: "ADV-2008-0233", refsource: "VUPEN", url: "http://www.vupen.com/english/advisories/2008/0233", }, { name: "http://www.fujitsu.com/global/support/software/security/products-f/interstage-200802e.html", refsource: "CONFIRM", url: "http://www.fujitsu.com/global/support/software/security/products-f/interstage-200802e.html", }, { name: "26211", refsource: "SECUNIA", url: "http://secunia.com/advisories/26211", }, { name: "apache-child-process-dos(35095)", refsource: "XF", url: "https://exchange.xforce.ibmcloud.com/vulnerabilities/35095", }, { name: "26443", refsource: "SECUNIA", url: "http://secunia.com/advisories/26443", }, { name: "[security-announce] 20090820 VMSA-2009-0010 VMware Hosted products update libpng and Apache HTTP Server", refsource: "MLIST", url: "http://lists.vmware.com/pipermail/security-announce/2009/000062.html", }, { name: "http://httpd.apache.org/security/vulnerabilities_13.html", refsource: "CONFIRM", url: "http://httpd.apache.org/security/vulnerabilities_13.html", }, { name: "GLSA-200711-06", refsource: "GENTOO", url: "http://security.gentoo.org/glsa/glsa-200711-06.xml", }, { name: "28224", refsource: "SECUNIA", url: "http://secunia.com/advisories/28224", }, { name: "200032", refsource: "SUNALERT", url: "http://sunsolve.sun.com/search/document.do?assetkey=1-66-200032-1", }, { name: "25830", refsource: "SECUNIA", url: "http://secunia.com/advisories/25830", }, { name: "24215", refsource: "BID", url: "http://www.securityfocus.com/bid/24215", }, { name: "http://support.avaya.com/elmodocs2/security/ASA-2007-363.htm", refsource: "CONFIRM", url: "http://support.avaya.com/elmodocs2/security/ASA-2007-363.htm", }, { name: "USN-499-1", refsource: "UBUNTU", url: "http://www.ubuntu.com/usn/usn-499-1", }, { name: "RHSA-2008:0261", refsource: "REDHAT", url: "http://www.redhat.com/support/errata/RHSA-2008-0261.html", }, { name: "26508", refsource: "SECUNIA", url: "http://secunia.com/advisories/26508", }, { name: "http://support.avaya.com/elmodocs2/security/ASA-2007-353.htm", refsource: "CONFIRM", url: "http://support.avaya.com/elmodocs2/security/ASA-2007-353.htm", }, { name: "26842", refsource: "SECUNIA", url: "http://secunia.com/advisories/26842", }, { name: "ADV-2007-3283", refsource: "VUPEN", url: "http://www.vupen.com/english/advisories/2007/3283", }, { name: "20070701-01-P", refsource: "SGI", url: "ftp://patches.sgi.com/support/free/security/advisories/20070701-01-P.asc", }, { name: "PK53984", refsource: "AIXAPAR", url: "http://www-1.ibm.com/support/docview.wss?uid=swg1PK53984", }, { name: "ADV-2007-2727", refsource: "VUPEN", url: "http://www.vupen.com/english/advisories/2007/2727", }, { name: "26611", refsource: "SECUNIA", url: "http://secunia.com/advisories/26611", }, { name: "26273", refsource: "SECUNIA", url: "http://secunia.com/advisories/26273", }, { name: "http://bugs.gentoo.org/show_bug.cgi?id=186219", refsource: "CONFIRM", url: "http://bugs.gentoo.org/show_bug.cgi?id=186219", }, { name: "ADV-2007-3100", refsource: "VUPEN", url: "http://www.vupen.com/english/advisories/2007/3100", }, { name: "SSRT071476", refsource: "HP", url: "http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01182588", }, { name: "[httpd-cvs] 20190815 svn commit: r1048742 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html", refsource: "MLIST", url: "https://lists.apache.org/thread.html/54a42d4b01968df1117cea77fc53d6beb931c0e05936ad02af93e9ac@%3Ccvs.httpd.apache.org%3E", }, { name: "[httpd-cvs] 20190815 svn commit: r1048743 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html", refsource: "MLIST", url: "https://lists.apache.org/thread.html/5df9bfb86a3b054bb985a45ff9250b0332c9ecc181eec232489e7f79@%3Ccvs.httpd.apache.org%3E", }, { name: "[httpd-cvs] 20190815 svn commit: r1048743 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html", refsource: "MLIST", url: "https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f@%3Ccvs.httpd.apache.org%3E", }, { name: "[httpd-cvs] 20190815 svn commit: r1048742 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html", refsource: "MLIST", url: "https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53@%3Ccvs.httpd.apache.org%3E", }, { name: "[httpd-cvs] 20200401 svn commit: r1058586 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html", refsource: "MLIST", url: "https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7@%3Ccvs.httpd.apache.org%3E", }, { name: "[httpd-cvs] 20200401 svn commit: r1058586 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html", refsource: "MLIST", url: "https://lists.apache.org/thread.html/r0276683d8e1e07153fc8642618830ac0ade85b9ae0dc7b07f63bb8fc@%3Ccvs.httpd.apache.org%3E", }, { name: "[httpd-cvs] 20200401 svn commit: r1058587 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html", refsource: "MLIST", url: "https://lists.apache.org/thread.html/r8828e649175df56f1f9e3919938ac7826128525426e2748f0ab62feb@%3Ccvs.httpd.apache.org%3E", }, { name: "[httpd-cvs] 20200401 svn commit: r1058587 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html", refsource: "MLIST", url: "https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b@%3Ccvs.httpd.apache.org%3E", }, { name: "[httpd-cvs] 20210330 svn commit: r1073139 [1/13] - in /websites/staging/httpd/trunk/content: ./ security/json/", refsource: "MLIST", url: "https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9@%3Ccvs.httpd.apache.org%3E", }, { name: "[httpd-cvs] 20210330 svn commit: r1073140 [1/4] - in /websites/staging/httpd/trunk/content: ./ security/cvejsontohtml.py security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html", refsource: "MLIST", url: "https://lists.apache.org/thread.html/r5419c9ba0951ef73a655362403d12bb8d10fab38274deb3f005816f5@%3Ccvs.httpd.apache.org%3E", }, { name: "[httpd-cvs] 20210330 svn commit: r1073140 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/cvejsontohtml.py security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html", refsource: "MLIST", url: "https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b@%3Ccvs.httpd.apache.org%3E", }, { name: "[httpd-cvs] 20210330 svn commit: r1888194 [4/13] - /httpd/site/trunk/content/security/json/", refsource: "MLIST", url: "https://lists.apache.org/thread.html/r652fc951306cdeca5a276e2021a34878a76695a9f3cfb6490b4a6840@%3Ccvs.httpd.apache.org%3E", }, { name: "[httpd-cvs] 20210330 svn commit: r1073140 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/cvejsontohtml.py security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html", refsource: "MLIST", url: "https://lists.apache.org/thread.html/r2cb985de917e7da0848c440535f65a247754db8b2154a10089e4247b@%3Ccvs.httpd.apache.org%3E", }, { name: "[httpd-cvs] 20210330 svn commit: r1073143 [2/3] - in /websites/staging/httpd/trunk/content: ./ security/", refsource: "MLIST", url: "https://lists.apache.org/thread.html/r9e8622254184645bc963a1d47c5d47f6d5a36d6f080d8d2c43b2b142@%3Ccvs.httpd.apache.org%3E", }, { name: "[httpd-cvs] 20210330 svn commit: r1073139 [4/13] - in /websites/staging/httpd/trunk/content: ./ security/json/", refsource: "MLIST", url: "https://lists.apache.org/thread.html/reb542d2038e9c331506e0cbff881b47e40fbe2bd93ff00979e60cdf7@%3Ccvs.httpd.apache.org%3E", }, { name: "[httpd-cvs] 20210330 svn commit: r1073149 [5/13] - in /websites/staging/httpd/trunk/content: ./ security/ security/json/", refsource: "MLIST", url: "https://lists.apache.org/thread.html/rafd145ba6cd0a4ced113a5823cdaff45aeb36eb09855b216401c66d6@%3Ccvs.httpd.apache.org%3E", }, { name: "[httpd-cvs] 20210330 svn commit: r1073146 [2/3] - in /websites/staging/httpd/trunk/content: ./ security/cvejsontohtml.py security/vulnerabilities-httpd.xml security/vulnerabilities_22.html security/vulnerabilities_24.html", refsource: "MLIST", url: "https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064@%3Ccvs.httpd.apache.org%3E", }, { name: "[httpd-cvs] 20210330 svn commit: r1073149 [1/13] - in /websites/staging/httpd/trunk/content: ./ security/ security/json/", refsource: "MLIST", url: "https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920@%3Ccvs.httpd.apache.org%3E", }, { name: "[httpd-cvs] 20210603 svn commit: r1075360 [2/3] - in /websites/staging/httpd/trunk/content: ./ security/json/CVE-2021-31618.json security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html", refsource: "MLIST", url: "https://lists.apache.org/thread.html/rad01d817195e6cc871cb1d73b207ca326379a20a6e7f30febaf56d24@%3Ccvs.httpd.apache.org%3E", }, { name: "[httpd-cvs] 20210603 svn commit: r1075360 [1/3] - in /websites/staging/httpd/trunk/content: ./ security/json/CVE-2021-31618.json security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html", refsource: "MLIST", url: "https://lists.apache.org/thread.html/r5f9c22f9c28adbd9f00556059edc7b03a5d5bb71d4bb80257c0d34e4@%3Ccvs.httpd.apache.org%3E", }, { name: "[httpd-cvs] 20210606 svn commit: r1075467 [2/2] - in /websites/staging/httpd/trunk/content: ./ security/json/CVE-2021-31618.json security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html", refsource: "MLIST", url: "https://lists.apache.org/thread.html/r476d175be0aaf4a17680ef98c5153b4d336eaef76fb2224cc94c463a@%3Ccvs.httpd.apache.org%3E", }, { name: "[httpd-cvs] 20210606 svn commit: r1075467 [1/2] - in /websites/staging/httpd/trunk/content: ./ security/json/CVE-2021-31618.json security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html", refsource: "MLIST", url: "https://lists.apache.org/thread.html/rb9c9f42dafa25d2f669dac2a536a03f2575bc5ec1be6f480618aee10@%3Ccvs.httpd.apache.org%3E", }, { name: "[httpd-cvs] 20210606 svn commit: r1075470 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/json/CVE-2020-13938.json security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html", refsource: "MLIST", url: "https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f@%3Ccvs.httpd.apache.org%3E", }, ], }, }, }, }, cveMetadata: { assignerOrgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca", assignerShortName: "mitre", cveId: "CVE-2007-3304", datePublished: "2007-06-20T22:00:00", dateReserved: "2007-06-20T00:00:00", dateUpdated: "2024-08-07T14:14:12.838Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", "vulnerability-lookup:meta": { nvd: "{\"cve\":{\"id\":\"CVE-2007-3304\",\"sourceIdentifier\":\"cve@mitre.org\",\"published\":\"2007-06-20T22:30:00.000\",\"lastModified\":\"2025-04-09T00:30:58.490\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Apache httpd 1.3.37, 2.0.59, and 2.2.4 with the Prefork MPM module, allows local users to cause a denial of service by modifying the worker_score and process_score arrays to reference an arbitrary process ID, which is sent a SIGUSR1 signal from the master process, aka \\\"SIGUSR1 killer.\\\"\"},{\"lang\":\"es\",\"value\":\"Apache httpd versiones 1.3.37, 2.0.59 y 2.2.4 con el módulo Prefork MPM, permite a los usuarios locales causar una denegación de servicio por la modificación de las matrices worker_score y process_score para hacer referencia a un ID de proceso arbitrario, al que se envía una señal SIGUSR1 desde el proceso maestro, también se conoce como \\\"SIGUSR1 killer\\\".\"}],\"metrics\":{\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:L/AC:M/Au:N/C:N/I:N/A:C\",\"baseScore\":4.7,\"accessVector\":\"LOCAL\",\"accessComplexity\":\"MEDIUM\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"COMPLETE\"},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":3.4,\"impactScore\":6.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"1.3.0\",\"versionEndExcluding\":\"1.3.39\",\"matchCriteriaId\":\"F369DFA9-7EDE-4244-9BA0-14A64743B6E2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"2.0.0\",\"versionEndExcluding\":\"2.0.61\",\"matchCriteriaId\":\"9C551481-3F93-4186-85B9-7B07D94B86D9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"2.2.0\",\"versionEndExcluding\":\"2.2.6\",\"matchCriteriaId\":\"D9EE889E-37B4-4DF6-8327-7D621E287F4F\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:fedoraproject:fedora:7:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E3EFD171-01F7-450B-B6F3-0F7E443A2337\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:redhat:enterprise_linux_desktop:5.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"133AAFA7-AF42-4D7B-8822-AA2E85611BF5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:redhat:enterprise_linux_server:5.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"54D669D4-6D7E-449D-80C1-28FA44F06FFE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:redhat:enterprise_linux_workstation:5.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D0AC5CD5-6E58-433C-9EB3-6DFE5656463E\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:canonical:ubuntu_linux:6.06:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"454A5D17-B171-4F1F-9E0B-F18D1E5CA9FD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:canonical:ubuntu_linux:6.10:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"23E304C9-F780-4358-A58D-1E4C93977704\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:canonical:ubuntu_linux:7.04:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"6EBDAFF8-DE44-4E80-B6BD-E341F767F501\"}]}]}],\"references\":[{\"url\":\"ftp://patches.sgi.com/support/free/security/advisories/20070701-01-P.asc\",\"source\":\"cve@mitre.org\",\"tags\":[\"Broken Link\"]},{\"url\":\"http://bugs.gentoo.org/show_bug.cgi?id=186219\",\"source\":\"cve@mitre.org\",\"tags\":[\"Issue Tracking\",\"Third Party Advisory\"]},{\"url\":\"http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=245111\",\"source\":\"cve@mitre.org\",\"tags\":[\"Issue Tracking\",\"Third Party Advisory\"]},{\"url\":\"http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01182588\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01182588\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://httpd.apache.org/security/vulnerabilities_13.html\",\"source\":\"cve@mitre.org\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://httpd.apache.org/security/vulnerabilities_20.html\",\"source\":\"cve@mitre.org\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://httpd.apache.org/security/vulnerabilities_22.html\",\"source\":\"cve@mitre.org\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://lists.vmware.com/pipermail/security-announce/2009/000062.html\",\"source\":\"cve@mitre.org\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"http://mail-archives.apache.org/mod_mbox/httpd-dev/200706.mbox/%3c20070629141032.GA15192%40redhat.com%3e\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://marc.info/?l=apache-httpd-dev&m=118252946632447&w=2\",\"source\":\"cve@mitre.org\",\"tags\":[\"Issue Tracking\",\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"http://osvdb.org/38939\",\"source\":\"cve@mitre.org\",\"tags\":[\"Broken Link\"]},{\"url\":\"http://rhn.redhat.com/errata/RHSA-2007-0556.html\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://secunia.com/advisories/25827\",\"source\":\"cve@mitre.org\",\"tags\":[\"Not Applicable\",\"Vendor Advisory\"]},{\"url\":\"http://secunia.com/advisories/25830\",\"source\":\"cve@mitre.org\",\"tags\":[\"Not Applicable\",\"Vendor Advisory\"]},{\"url\":\"http://secunia.com/advisories/25920\",\"source\":\"cve@mitre.org\",\"tags\":[\"Not Applicable\",\"Vendor Advisory\"]},{\"url\":\"http://secunia.com/advisories/26211\",\"source\":\"cve@mitre.org\",\"tags\":[\"Not Applicable\",\"Vendor Advisory\"]},{\"url\":\"http://secunia.com/advisories/26273\",\"source\":\"cve@mitre.org\",\"tags\":[\"Not Applicable\",\"Vendor Advisory\"]},{\"url\":\"http://secunia.com/advisories/26443\",\"source\":\"cve@mitre.org\",\"tags\":[\"Not Applicable\",\"Vendor Advisory\"]},{\"url\":\"http://secunia.com/advisories/26508\",\"source\":\"cve@mitre.org\",\"tags\":[\"Not Applicable\",\"Vendor Advisory\"]},{\"url\":\"http://secunia.com/advisories/26611\",\"source\":\"cve@mitre.org\",\"tags\":[\"Not Applicable\",\"Vendor Advisory\"]},{\"url\":\"http://secunia.com/advisories/26759\",\"source\":\"cve@mitre.org\",\"tags\":[\"Not Applicable\",\"Vendor Advisory\"]},{\"url\":\"http://secunia.com/advisories/26790\",\"source\":\"cve@mitre.org\",\"tags\":[\"Not Applicable\",\"Vendor Advisory\"]},{\"url\":\"http://secunia.com/advisories/26822\",\"source\":\"cve@mitre.org\",\"tags\":[\"Not Applicable\",\"Vendor Advisory\"]},{\"url\":\"http://secunia.com/advisories/26842\",\"source\":\"cve@mitre.org\",\"tags\":[\"Not Applicable\",\"Vendor Advisory\"]},{\"url\":\"http://secunia.com/advisories/26993\",\"source\":\"cve@mitre.org\",\"tags\":[\"Not Applicable\",\"Vendor Advisory\"]},{\"url\":\"http://secunia.com/advisories/27121\",\"source\":\"cve@mitre.org\",\"tags\":[\"Not Applicable\"]},{\"url\":\"http://secunia.com/advisories/27209\",\"source\":\"cve@mitre.org\",\"tags\":[\"Not Applicable\"]},{\"url\":\"http://secunia.com/advisories/27563\",\"source\":\"cve@mitre.org\",\"tags\":[\"Not Applicable\"]},{\"url\":\"http://secunia.com/advisories/27732\",\"source\":\"cve@mitre.org\",\"tags\":[\"Not Applicable\"]},{\"url\":\"http://secunia.com/advisories/28212\",\"source\":\"cve@mitre.org\",\"tags\":[\"Not Applicable\"]},{\"url\":\"http://secunia.com/advisories/28224\",\"source\":\"cve@mitre.org\",\"tags\":[\"Not Applicable\"]},{\"url\":\"http://secunia.com/advisories/28606\",\"source\":\"cve@mitre.org\",\"tags\":[\"Not Applicable\"]},{\"url\":\"http://security.gentoo.org/glsa/glsa-200711-06.xml\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://security.psnc.pl/files/apache_report.pdf\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://securityreason.com/securityalert/2814\",\"source\":\"cve@mitre.org\",\"tags\":[\"Exploit\",\"Third Party Advisory\"]},{\"url\":\"http://sunsolve.sun.com/search/document.do?assetkey=1-26-103179-1\",\"source\":\"cve@mitre.org\",\"tags\":[\"Broken Link\"]},{\"url\":\"http://sunsolve.sun.com/search/document.do?assetkey=1-66-200032-1\",\"source\":\"cve@mitre.org\",\"tags\":[\"Broken Link\"]},{\"url\":\"http://support.avaya.com/elmodocs2/security/ASA-2007-353.htm\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://support.avaya.com/elmodocs2/security/ASA-2007-363.htm\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://svn.apache.org/viewvc?view=rev&revision=547987\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://www-1.ibm.com/support/docview.wss?uid=swg1PK52702\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://www-1.ibm.com/support/docview.wss?uid=swg1PK53984\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://www-1.ibm.com/support/search.wss?rs=0&q=PK50467&apar=only\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://www.fujitsu.com/global/support/software/security/products-f/interstage-200802e.html\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://www.mandriva.com/security/advisories?name=MDKSA-2007:140\",\"source\":\"cve@mitre.org\",\"tags\":[\"Broken Link\"]},{\"url\":\"http://www.mandriva.com/security/advisories?name=MDKSA-2007:142\",\"source\":\"cve@mitre.org\",\"tags\":[\"Broken Link\"]},{\"url\":\"http://www.novell.com/linux/security/advisories/2007_61_apache2.html\",\"source\":\"cve@mitre.org\",\"tags\":[\"Broken Link\"]},{\"url\":\"http://www.redhat.com/archives/fedora-package-announce/2007-September/msg00320.html\",\"source\":\"cve@mitre.org\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"http://www.redhat.com/errata/RHSA-2007-0532.html\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://www.redhat.com/support/errata/RHSA-2007-0557.html\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://www.redhat.com/support/errata/RHSA-2007-0662.html\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://www.redhat.com/support/errata/RHSA-2008-0261.html\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://www.securityfocus.com/archive/1/469899/100/0/threaded\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"http://www.securityfocus.com/archive/1/471832/100/0/threaded\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"http://www.securityfocus.com/archive/1/505990/100/0/threaded\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"http://www.securityfocus.com/bid/24215\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"http://www.securitytracker.com/id?1018304\",\"source\":\"cve@mitre.org\",\"tags\":[\"Broken Link\",\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"http://www.trustix.org/errata/2007/0026/\",\"source\":\"cve@mitre.org\",\"tags\":[\"Broken Link\"]},{\"url\":\"http://www.ubuntu.com/usn/usn-499-1\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://www.vupen.com/english/advisories/2007/2727\",\"source\":\"cve@mitre.org\",\"tags\":[\"Permissions Required\"]},{\"url\":\"http://www.vupen.com/english/advisories/2007/3100\",\"source\":\"cve@mitre.org\",\"tags\":[\"Permissions Required\"]},{\"url\":\"http://www.vupen.com/english/advisories/2007/3283\",\"source\":\"cve@mitre.org\",\"tags\":[\"Permissions Required\"]},{\"url\":\"http://www.vupen.com/english/advisories/2007/3420\",\"source\":\"cve@mitre.org\",\"tags\":[\"Permissions Required\"]},{\"url\":\"http://www.vupen.com/english/advisories/2007/3494\",\"source\":\"cve@mitre.org\",\"tags\":[\"Permissions Required\"]},{\"url\":\"http://www.vupen.com/english/advisories/2007/4305\",\"source\":\"cve@mitre.org\",\"tags\":[\"Permissions Required\"]},{\"url\":\"http://www.vupen.com/english/advisories/2008/0233\",\"source\":\"cve@mitre.org\",\"tags\":[\"Permissions Required\"]},{\"url\":\"https://exchange.xforce.ibmcloud.com/vulnerabilities/35095\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"https://issues.rpath.com/browse/RPL-1710\",\"source\":\"cve@mitre.org\",\"tags\":[\"Broken Link\"]},{\"url\":\"https://lists.apache.org/thread.html/54a42d4b01968df1117cea77fc53d6beb931c0e05936ad02af93e9ac%40%3Ccvs.httpd.apache.org%3E\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://lists.apache.org/thread.html/5df9bfb86a3b054bb985a45ff9250b0332c9ecc181eec232489e7f79%40%3Ccvs.httpd.apache.org%3E\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://lists.apache.org/thread.html/r0276683d8e1e07153fc8642618830ac0ade85b9ae0dc7b07f63bb8fc%40%3Ccvs.httpd.apache.org%3E\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://lists.apache.org/thread.html/r2cb985de917e7da0848c440535f65a247754db8b2154a10089e4247b%40%3Ccvs.httpd.apache.org%3E\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://lists.apache.org/thread.html/r476d175be0aaf4a17680ef98c5153b4d336eaef76fb2224cc94c463a%40%3Ccvs.httpd.apache.org%3E\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://lists.apache.org/thread.html/r5419c9ba0951ef73a655362403d12bb8d10fab38274deb3f005816f5%40%3Ccvs.httpd.apache.org%3E\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://lists.apache.org/thread.html/r5f9c22f9c28adbd9f00556059edc7b03a5d5bb71d4bb80257c0d34e4%40%3Ccvs.httpd.apache.org%3E\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://lists.apache.org/thread.html/r652fc951306cdeca5a276e2021a34878a76695a9f3cfb6490b4a6840%40%3Ccvs.httpd.apache.org%3E\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://lists.apache.org/thread.html/r8828e649175df56f1f9e3919938ac7826128525426e2748f0ab62feb%40%3Ccvs.httpd.apache.org%3E\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://lists.apache.org/thread.html/r9e8622254184645bc963a1d47c5d47f6d5a36d6f080d8d2c43b2b142%40%3Ccvs.httpd.apache.org%3E\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://lists.apache.org/thread.html/rad01d817195e6cc871cb1d73b207ca326379a20a6e7f30febaf56d24%40%3Ccvs.httpd.apache.org%3E\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://lists.apache.org/thread.html/rafd145ba6cd0a4ced113a5823cdaff45aeb36eb09855b216401c66d6%40%3Ccvs.httpd.apache.org%3E\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://lists.apache.org/thread.html/rb9c9f42dafa25d2f669dac2a536a03f2575bc5ec1be6f480618aee10%40%3Ccvs.httpd.apache.org%3E\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://lists.apache.org/thread.html/reb542d2038e9c331506e0cbff881b47e40fbe2bd93ff00979e60cdf7%40%3Ccvs.httpd.apache.org%3E\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11589\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"ftp://patches.sgi.com/support/free/security/advisories/20070701-01-P.asc\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Broken Link\"]},{\"url\":\"http://bugs.gentoo.org/show_bug.cgi?id=186219\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Issue Tracking\",\"Third Party Advisory\"]},{\"url\":\"http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=245111\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Issue Tracking\",\"Third Party Advisory\"]},{\"url\":\"http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01182588\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01182588\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://httpd.apache.org/security/vulnerabilities_13.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://httpd.apache.org/security/vulnerabilities_20.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://httpd.apache.org/security/vulnerabilities_22.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://lists.vmware.com/pipermail/security-announce/2009/000062.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"http://mail-archives.apache.org/mod_mbox/httpd-dev/200706.mbox/%3c20070629141032.GA15192%40redhat.com%3e\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://marc.info/?l=apache-httpd-dev&m=118252946632447&w=2\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Issue Tracking\",\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"http://osvdb.org/38939\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Broken Link\"]},{\"url\":\"http://rhn.redhat.com/errata/RHSA-2007-0556.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://secunia.com/advisories/25827\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Not Applicable\",\"Vendor Advisory\"]},{\"url\":\"http://secunia.com/advisories/25830\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Not Applicable\",\"Vendor Advisory\"]},{\"url\":\"http://secunia.com/advisories/25920\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Not Applicable\",\"Vendor Advisory\"]},{\"url\":\"http://secunia.com/advisories/26211\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Not Applicable\",\"Vendor Advisory\"]},{\"url\":\"http://secunia.com/advisories/26273\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Not Applicable\",\"Vendor Advisory\"]},{\"url\":\"http://secunia.com/advisories/26443\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Not Applicable\",\"Vendor Advisory\"]},{\"url\":\"http://secunia.com/advisories/26508\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Not Applicable\",\"Vendor Advisory\"]},{\"url\":\"http://secunia.com/advisories/26611\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Not Applicable\",\"Vendor Advisory\"]},{\"url\":\"http://secunia.com/advisories/26759\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Not Applicable\",\"Vendor Advisory\"]},{\"url\":\"http://secunia.com/advisories/26790\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Not Applicable\",\"Vendor Advisory\"]},{\"url\":\"http://secunia.com/advisories/26822\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Not Applicable\",\"Vendor Advisory\"]},{\"url\":\"http://secunia.com/advisories/26842\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Not Applicable\",\"Vendor Advisory\"]},{\"url\":\"http://secunia.com/advisories/26993\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Not Applicable\",\"Vendor Advisory\"]},{\"url\":\"http://secunia.com/advisories/27121\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Not Applicable\"]},{\"url\":\"http://secunia.com/advisories/27209\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Not Applicable\"]},{\"url\":\"http://secunia.com/advisories/27563\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Not Applicable\"]},{\"url\":\"http://secunia.com/advisories/27732\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Not Applicable\"]},{\"url\":\"http://secunia.com/advisories/28212\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Not Applicable\"]},{\"url\":\"http://secunia.com/advisories/28224\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Not Applicable\"]},{\"url\":\"http://secunia.com/advisories/28606\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Not Applicable\"]},{\"url\":\"http://security.gentoo.org/glsa/glsa-200711-06.xml\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://security.psnc.pl/files/apache_report.pdf\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://securityreason.com/securityalert/2814\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Exploit\",\"Third Party Advisory\"]},{\"url\":\"http://sunsolve.sun.com/search/document.do?assetkey=1-26-103179-1\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Broken Link\"]},{\"url\":\"http://sunsolve.sun.com/search/document.do?assetkey=1-66-200032-1\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Broken Link\"]},{\"url\":\"http://support.avaya.com/elmodocs2/security/ASA-2007-353.htm\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://support.avaya.com/elmodocs2/security/ASA-2007-363.htm\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://svn.apache.org/viewvc?view=rev&revision=547987\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://www-1.ibm.com/support/docview.wss?uid=swg1PK52702\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://www-1.ibm.com/support/docview.wss?uid=swg1PK53984\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://www-1.ibm.com/support/search.wss?rs=0&q=PK50467&apar=only\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://www.fujitsu.com/global/support/software/security/products-f/interstage-200802e.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://www.mandriva.com/security/advisories?name=MDKSA-2007:140\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Broken Link\"]},{\"url\":\"http://www.mandriva.com/security/advisories?name=MDKSA-2007:142\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Broken Link\"]},{\"url\":\"http://www.novell.com/linux/security/advisories/2007_61_apache2.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Broken Link\"]},{\"url\":\"http://www.redhat.com/archives/fedora-package-announce/2007-September/msg00320.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"http://www.redhat.com/errata/RHSA-2007-0532.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://www.redhat.com/support/errata/RHSA-2007-0557.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://www.redhat.com/support/errata/RHSA-2007-0662.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://www.redhat.com/support/errata/RHSA-2008-0261.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://www.securityfocus.com/archive/1/469899/100/0/threaded\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"http://www.securityfocus.com/archive/1/471832/100/0/threaded\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"http://www.securityfocus.com/archive/1/505990/100/0/threaded\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"http://www.securityfocus.com/bid/24215\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"http://www.securitytracker.com/id?1018304\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Broken Link\",\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"http://www.trustix.org/errata/2007/0026/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Broken Link\"]},{\"url\":\"http://www.ubuntu.com/usn/usn-499-1\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://www.vupen.com/english/advisories/2007/2727\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Permissions Required\"]},{\"url\":\"http://www.vupen.com/english/advisories/2007/3100\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Permissions Required\"]},{\"url\":\"http://www.vupen.com/english/advisories/2007/3283\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Permissions Required\"]},{\"url\":\"http://www.vupen.com/english/advisories/2007/3420\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Permissions Required\"]},{\"url\":\"http://www.vupen.com/english/advisories/2007/3494\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Permissions Required\"]},{\"url\":\"http://www.vupen.com/english/advisories/2007/4305\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Permissions Required\"]},{\"url\":\"http://www.vupen.com/english/advisories/2008/0233\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Permissions Required\"]},{\"url\":\"https://exchange.xforce.ibmcloud.com/vulnerabilities/35095\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"https://issues.rpath.com/browse/RPL-1710\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Broken Link\"]},{\"url\":\"https://lists.apache.org/thread.html/54a42d4b01968df1117cea77fc53d6beb931c0e05936ad02af93e9ac%40%3Ccvs.httpd.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.apache.org/thread.html/5df9bfb86a3b054bb985a45ff9250b0332c9ecc181eec232489e7f79%40%3Ccvs.httpd.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.apache.org/thread.html/r0276683d8e1e07153fc8642618830ac0ade85b9ae0dc7b07f63bb8fc%40%3Ccvs.httpd.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.apache.org/thread.html/r2cb985de917e7da0848c440535f65a247754db8b2154a10089e4247b%40%3Ccvs.httpd.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.apache.org/thread.html/r476d175be0aaf4a17680ef98c5153b4d336eaef76fb2224cc94c463a%40%3Ccvs.httpd.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.apache.org/thread.html/r5419c9ba0951ef73a655362403d12bb8d10fab38274deb3f005816f5%40%3Ccvs.httpd.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.apache.org/thread.html/r5f9c22f9c28adbd9f00556059edc7b03a5d5bb71d4bb80257c0d34e4%40%3Ccvs.httpd.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.apache.org/thread.html/r652fc951306cdeca5a276e2021a34878a76695a9f3cfb6490b4a6840%40%3Ccvs.httpd.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.apache.org/thread.html/r8828e649175df56f1f9e3919938ac7826128525426e2748f0ab62feb%40%3Ccvs.httpd.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.apache.org/thread.html/r9e8622254184645bc963a1d47c5d47f6d5a36d6f080d8d2c43b2b142%40%3Ccvs.httpd.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.apache.org/thread.html/rad01d817195e6cc871cb1d73b207ca326379a20a6e7f30febaf56d24%40%3Ccvs.httpd.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.apache.org/thread.html/rafd145ba6cd0a4ced113a5823cdaff45aeb36eb09855b216401c66d6%40%3Ccvs.httpd.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.apache.org/thread.html/rb9c9f42dafa25d2f669dac2a536a03f2575bc5ec1be6f480618aee10%40%3Ccvs.httpd.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.apache.org/thread.html/reb542d2038e9c331506e0cbff881b47e40fbe2bd93ff00979e60cdf7%40%3Ccvs.httpd.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11589\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]}],\"vendorComments\":[{\"organization\":\"Apache\",\"comment\":\"Fixed in Apache HTTP Server 2.2.6, 2.0.61, and 1.3.39:\\nhttp://httpd.apache.org/security/vulnerabilities_22.html\\nhttp://httpd.apache.org/security/vulnerabilities_20.html\\nhttp://httpd.apache.org/security/vulnerabilities_13.html\",\"lastModified\":\"2008-07-02T00:00:00\"}]}}", }, }
rhsa-2007_0662
Vulnerability from csaf_redhat
Published
2007-07-13 07:48
Modified
2024-11-22 02:04
Summary
Red Hat Security Advisory: httpd security update
Notes
Topic
Updated Apache httpd packages that correct a security issue are now
available for Red Hat Enterprise Linux 3 and 4.
This update has been rated as having moderate security impact by the Red
Hat Security Response Team.
Details
The Apache HTTP Server is a popular Web server.
The Apache HTTP Server did not verify that a process was an Apache child
process before sending it signals. A local attacker with the ability to run
scripts on the Apache HTTP Server could manipulate the scoreboard and cause
arbitrary processes to be terminated which could lead to a denial of
service. (CVE-2007-3304).
Users of httpd should upgrade to these updated packages, which contain
backported patches to correct this issue. Users should restart Apache
after installing this update.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ document: { aggregate_severity: { namespace: "https://access.redhat.com/security/updates/classification/", text: "Moderate", }, category: "csaf_security_advisory", csaf_version: "2.0", distribution: { text: "Copyright © Red Hat, Inc. All rights reserved.", tlp: { label: "WHITE", url: "https://www.first.org/tlp/", }, }, lang: "en", notes: [ { category: "summary", text: "Updated Apache httpd packages that correct a security issue are now\navailable for Red Hat Enterprise Linux 3 and 4.\n\nThis update has been rated as having moderate security impact by the Red\nHat Security Response Team.", title: "Topic", }, { category: "general", text: "The Apache HTTP Server is a popular Web server. \n\nThe Apache HTTP Server did not verify that a process was an Apache child\nprocess before sending it signals. A local attacker with the ability to run\nscripts on the Apache HTTP Server could manipulate the scoreboard and cause\narbitrary processes to be terminated which could lead to a denial of\nservice. (CVE-2007-3304).\n\nUsers of httpd should upgrade to these updated packages, which contain\nbackported patches to correct this issue. Users should restart Apache\nafter installing this update.", title: "Details", }, { category: "legal_disclaimer", text: "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", title: "Terms of Use", }, ], publisher: { category: "vendor", contact_details: "https://access.redhat.com/security/team/contact/", issuing_authority: "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", name: "Red Hat Product Security", namespace: "https://www.redhat.com", }, references: [ { category: "self", summary: "https://access.redhat.com/errata/RHSA-2007:0662", url: "https://access.redhat.com/errata/RHSA-2007:0662", }, { category: "external", summary: "https://access.redhat.com/security/updates/classification/#moderate", url: "https://access.redhat.com/security/updates/classification/#moderate", }, { category: "external", summary: "245111", url: "https://bugzilla.redhat.com/show_bug.cgi?id=245111", }, { category: "self", summary: "Canonical URL", url: "https://security.access.redhat.com/data/csaf/v2/advisories/2007/rhsa-2007_0662.json", }, ], title: "Red Hat Security Advisory: httpd security update", tracking: { current_release_date: "2024-11-22T02:04:26+00:00", generator: { date: "2024-11-22T02:04:26+00:00", engine: { name: "Red Hat SDEngine", version: "4.2.1", }, }, id: "RHSA-2007:0662", initial_release_date: "2007-07-13T07:48:00+00:00", revision_history: [ { date: "2007-07-13T07:48:00+00:00", number: "1", summary: "Initial version", }, { date: "2008-01-07T17:32:33+00:00", number: "2", summary: "Last updated version", }, { date: "2024-11-22T02:04:26+00:00", number: "3", summary: "Last generated version", }, ], status: "final", version: "3", }, }, product_tree: { branches: [ { branches: [ { branches: [ { category: "product_name", name: "Red Hat Enterprise Linux AS version 4", product: { name: "Red Hat Enterprise Linux AS version 4", product_id: "4AS", product_identification_helper: { cpe: "cpe:/o:redhat:enterprise_linux:4::as", }, }, }, { category: "product_name", name: "Red Hat Enterprise Linux Desktop version 4", product: { name: "Red Hat Enterprise Linux Desktop version 4", product_id: "4Desktop", product_identification_helper: { cpe: "cpe:/o:redhat:enterprise_linux:4::desktop", }, }, }, { category: "product_name", name: "Red Hat Enterprise Linux ES version 4", product: { name: "Red Hat Enterprise Linux ES version 4", product_id: "4ES", product_identification_helper: { cpe: "cpe:/o:redhat:enterprise_linux:4::es", }, }, }, { category: "product_name", name: "Red Hat Enterprise Linux WS version 4", product: { name: "Red Hat Enterprise Linux WS version 4", product_id: "4WS", product_identification_helper: { cpe: "cpe:/o:redhat:enterprise_linux:4::ws", }, }, }, { category: "product_name", name: "Red Hat Enterprise Linux AS version 3", product: { name: "Red Hat Enterprise Linux AS version 3", product_id: "3AS", product_identification_helper: { cpe: "cpe:/o:redhat:enterprise_linux:3::as", }, }, }, { category: "product_name", name: "Red Hat Desktop version 3", product: { name: "Red Hat Desktop version 3", product_id: "3Desktop", product_identification_helper: { cpe: "cpe:/o:redhat:enterprise_linux:3::desktop", }, }, }, { category: "product_name", name: "Red Hat Enterprise Linux ES version 3", product: { name: "Red Hat Enterprise Linux ES version 3", product_id: "3ES", product_identification_helper: { cpe: "cpe:/o:redhat:enterprise_linux:3::es", }, }, }, { category: "product_name", name: "Red Hat Enterprise Linux WS version 3", product: { name: "Red Hat Enterprise Linux WS version 3", product_id: "3WS", product_identification_helper: { cpe: "cpe:/o:redhat:enterprise_linux:3::ws", }, }, }, ], category: "product_family", name: "Red Hat Enterprise Linux", }, { branches: [ { category: "product_version", name: "httpd-manual-0:2.0.52-32.3.ent.ia64", product: { name: "httpd-manual-0:2.0.52-32.3.ent.ia64", product_id: "httpd-manual-0:2.0.52-32.3.ent.ia64", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-manual@2.0.52-32.3.ent?arch=ia64", }, }, }, { category: "product_version", name: "mod_ssl-1:2.0.52-32.3.ent.ia64", product: { name: "mod_ssl-1:2.0.52-32.3.ent.ia64", product_id: "mod_ssl-1:2.0.52-32.3.ent.ia64", product_identification_helper: { purl: "pkg:rpm/redhat/mod_ssl@2.0.52-32.3.ent?arch=ia64&epoch=1", }, }, }, { category: "product_version", name: "httpd-suexec-0:2.0.52-32.3.ent.ia64", product: { name: "httpd-suexec-0:2.0.52-32.3.ent.ia64", product_id: "httpd-suexec-0:2.0.52-32.3.ent.ia64", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-suexec@2.0.52-32.3.ent?arch=ia64", }, }, }, { category: "product_version", name: "httpd-debuginfo-0:2.0.52-32.3.ent.ia64", product: { name: "httpd-debuginfo-0:2.0.52-32.3.ent.ia64", product_id: "httpd-debuginfo-0:2.0.52-32.3.ent.ia64", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-debuginfo@2.0.52-32.3.ent?arch=ia64", }, }, }, { category: "product_version", name: "httpd-devel-0:2.0.52-32.3.ent.ia64", product: { name: "httpd-devel-0:2.0.52-32.3.ent.ia64", product_id: "httpd-devel-0:2.0.52-32.3.ent.ia64", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-devel@2.0.52-32.3.ent?arch=ia64", }, }, }, { category: "product_version", name: "httpd-0:2.0.52-32.3.ent.ia64", product: { name: "httpd-0:2.0.52-32.3.ent.ia64", product_id: "httpd-0:2.0.52-32.3.ent.ia64", product_identification_helper: { purl: "pkg:rpm/redhat/httpd@2.0.52-32.3.ent?arch=ia64", }, }, }, { category: "product_version", name: "httpd-0:2.0.46-68.ent.ia64", product: { name: "httpd-0:2.0.46-68.ent.ia64", product_id: "httpd-0:2.0.46-68.ent.ia64", product_identification_helper: { purl: "pkg:rpm/redhat/httpd@2.0.46-68.ent?arch=ia64", }, }, }, { category: "product_version", name: "mod_ssl-1:2.0.46-68.ent.ia64", product: { name: "mod_ssl-1:2.0.46-68.ent.ia64", product_id: "mod_ssl-1:2.0.46-68.ent.ia64", product_identification_helper: { purl: "pkg:rpm/redhat/mod_ssl@2.0.46-68.ent?arch=ia64&epoch=1", }, }, }, { category: "product_version", name: "httpd-devel-0:2.0.46-68.ent.ia64", product: { name: "httpd-devel-0:2.0.46-68.ent.ia64", product_id: "httpd-devel-0:2.0.46-68.ent.ia64", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-devel@2.0.46-68.ent?arch=ia64", }, }, }, { category: "product_version", name: "httpd-debuginfo-0:2.0.46-68.ent.ia64", product: { name: "httpd-debuginfo-0:2.0.46-68.ent.ia64", product_id: "httpd-debuginfo-0:2.0.46-68.ent.ia64", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-debuginfo@2.0.46-68.ent?arch=ia64", }, }, }, ], category: "architecture", name: "ia64", }, { branches: [ { category: "product_version", name: "httpd-manual-0:2.0.52-32.3.ent.x86_64", product: { name: "httpd-manual-0:2.0.52-32.3.ent.x86_64", product_id: "httpd-manual-0:2.0.52-32.3.ent.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-manual@2.0.52-32.3.ent?arch=x86_64", }, }, }, { category: "product_version", name: "mod_ssl-1:2.0.52-32.3.ent.x86_64", product: { name: "mod_ssl-1:2.0.52-32.3.ent.x86_64", product_id: "mod_ssl-1:2.0.52-32.3.ent.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/mod_ssl@2.0.52-32.3.ent?arch=x86_64&epoch=1", }, }, }, { category: "product_version", name: "httpd-suexec-0:2.0.52-32.3.ent.x86_64", product: { name: "httpd-suexec-0:2.0.52-32.3.ent.x86_64", product_id: "httpd-suexec-0:2.0.52-32.3.ent.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-suexec@2.0.52-32.3.ent?arch=x86_64", }, }, }, { category: "product_version", name: "httpd-debuginfo-0:2.0.52-32.3.ent.x86_64", product: { name: "httpd-debuginfo-0:2.0.52-32.3.ent.x86_64", product_id: "httpd-debuginfo-0:2.0.52-32.3.ent.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-debuginfo@2.0.52-32.3.ent?arch=x86_64", }, }, }, { category: "product_version", name: "httpd-devel-0:2.0.52-32.3.ent.x86_64", product: { name: "httpd-devel-0:2.0.52-32.3.ent.x86_64", product_id: "httpd-devel-0:2.0.52-32.3.ent.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-devel@2.0.52-32.3.ent?arch=x86_64", }, }, }, { category: "product_version", name: "httpd-0:2.0.52-32.3.ent.x86_64", product: { name: "httpd-0:2.0.52-32.3.ent.x86_64", product_id: "httpd-0:2.0.52-32.3.ent.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/httpd@2.0.52-32.3.ent?arch=x86_64", }, }, }, { category: "product_version", name: "httpd-0:2.0.46-68.ent.x86_64", product: { name: "httpd-0:2.0.46-68.ent.x86_64", product_id: "httpd-0:2.0.46-68.ent.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/httpd@2.0.46-68.ent?arch=x86_64", }, }, }, { category: "product_version", name: "mod_ssl-1:2.0.46-68.ent.x86_64", product: { name: "mod_ssl-1:2.0.46-68.ent.x86_64", product_id: "mod_ssl-1:2.0.46-68.ent.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/mod_ssl@2.0.46-68.ent?arch=x86_64&epoch=1", }, }, }, { category: "product_version", name: "httpd-devel-0:2.0.46-68.ent.x86_64", product: { name: "httpd-devel-0:2.0.46-68.ent.x86_64", product_id: "httpd-devel-0:2.0.46-68.ent.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-devel@2.0.46-68.ent?arch=x86_64", }, }, }, { category: "product_version", name: "httpd-debuginfo-0:2.0.46-68.ent.x86_64", product: { name: "httpd-debuginfo-0:2.0.46-68.ent.x86_64", product_id: "httpd-debuginfo-0:2.0.46-68.ent.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-debuginfo@2.0.46-68.ent?arch=x86_64", }, }, }, ], category: "architecture", name: "x86_64", }, { branches: [ { category: "product_version", name: "httpd-manual-0:2.0.52-32.3.ent.i386", product: { name: "httpd-manual-0:2.0.52-32.3.ent.i386", product_id: "httpd-manual-0:2.0.52-32.3.ent.i386", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-manual@2.0.52-32.3.ent?arch=i386", }, }, }, { category: "product_version", name: "mod_ssl-1:2.0.52-32.3.ent.i386", product: { name: "mod_ssl-1:2.0.52-32.3.ent.i386", product_id: "mod_ssl-1:2.0.52-32.3.ent.i386", product_identification_helper: { purl: "pkg:rpm/redhat/mod_ssl@2.0.52-32.3.ent?arch=i386&epoch=1", }, }, }, { category: "product_version", name: "httpd-suexec-0:2.0.52-32.3.ent.i386", product: { name: "httpd-suexec-0:2.0.52-32.3.ent.i386", product_id: "httpd-suexec-0:2.0.52-32.3.ent.i386", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-suexec@2.0.52-32.3.ent?arch=i386", }, }, }, { category: "product_version", name: "httpd-debuginfo-0:2.0.52-32.3.ent.i386", product: { name: "httpd-debuginfo-0:2.0.52-32.3.ent.i386", product_id: "httpd-debuginfo-0:2.0.52-32.3.ent.i386", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-debuginfo@2.0.52-32.3.ent?arch=i386", }, }, }, { category: "product_version", name: "httpd-devel-0:2.0.52-32.3.ent.i386", product: { name: "httpd-devel-0:2.0.52-32.3.ent.i386", product_id: "httpd-devel-0:2.0.52-32.3.ent.i386", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-devel@2.0.52-32.3.ent?arch=i386", }, }, }, { category: "product_version", name: "httpd-0:2.0.52-32.3.ent.i386", product: { name: "httpd-0:2.0.52-32.3.ent.i386", product_id: "httpd-0:2.0.52-32.3.ent.i386", product_identification_helper: { purl: "pkg:rpm/redhat/httpd@2.0.52-32.3.ent?arch=i386", }, }, }, { category: "product_version", name: "httpd-0:2.0.46-68.ent.i386", product: { name: "httpd-0:2.0.46-68.ent.i386", product_id: "httpd-0:2.0.46-68.ent.i386", product_identification_helper: { purl: "pkg:rpm/redhat/httpd@2.0.46-68.ent?arch=i386", }, }, }, { category: "product_version", name: "mod_ssl-1:2.0.46-68.ent.i386", product: { name: "mod_ssl-1:2.0.46-68.ent.i386", product_id: "mod_ssl-1:2.0.46-68.ent.i386", product_identification_helper: { purl: "pkg:rpm/redhat/mod_ssl@2.0.46-68.ent?arch=i386&epoch=1", }, }, }, { category: "product_version", name: "httpd-devel-0:2.0.46-68.ent.i386", product: { name: "httpd-devel-0:2.0.46-68.ent.i386", product_id: "httpd-devel-0:2.0.46-68.ent.i386", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-devel@2.0.46-68.ent?arch=i386", }, }, }, { category: "product_version", name: "httpd-debuginfo-0:2.0.46-68.ent.i386", product: { name: "httpd-debuginfo-0:2.0.46-68.ent.i386", product_id: "httpd-debuginfo-0:2.0.46-68.ent.i386", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-debuginfo@2.0.46-68.ent?arch=i386", }, }, }, ], category: "architecture", name: "i386", }, { branches: [ { category: "product_version", name: "httpd-0:2.0.52-32.3.ent.src", product: { name: "httpd-0:2.0.52-32.3.ent.src", product_id: "httpd-0:2.0.52-32.3.ent.src", product_identification_helper: { purl: "pkg:rpm/redhat/httpd@2.0.52-32.3.ent?arch=src", }, }, }, { category: "product_version", name: "httpd-0:2.0.46-68.ent.src", product: { name: "httpd-0:2.0.46-68.ent.src", product_id: "httpd-0:2.0.46-68.ent.src", product_identification_helper: { purl: "pkg:rpm/redhat/httpd@2.0.46-68.ent?arch=src", }, }, }, ], category: "architecture", name: "src", }, { branches: [ { category: "product_version", name: "httpd-manual-0:2.0.52-32.3.ent.ppc", product: { name: "httpd-manual-0:2.0.52-32.3.ent.ppc", product_id: "httpd-manual-0:2.0.52-32.3.ent.ppc", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-manual@2.0.52-32.3.ent?arch=ppc", }, }, }, { category: "product_version", name: "mod_ssl-1:2.0.52-32.3.ent.ppc", product: { name: "mod_ssl-1:2.0.52-32.3.ent.ppc", product_id: "mod_ssl-1:2.0.52-32.3.ent.ppc", product_identification_helper: { purl: "pkg:rpm/redhat/mod_ssl@2.0.52-32.3.ent?arch=ppc&epoch=1", }, }, }, { category: "product_version", name: "httpd-suexec-0:2.0.52-32.3.ent.ppc", product: { name: "httpd-suexec-0:2.0.52-32.3.ent.ppc", product_id: "httpd-suexec-0:2.0.52-32.3.ent.ppc", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-suexec@2.0.52-32.3.ent?arch=ppc", }, }, }, { category: "product_version", name: "httpd-debuginfo-0:2.0.52-32.3.ent.ppc", product: { name: "httpd-debuginfo-0:2.0.52-32.3.ent.ppc", product_id: "httpd-debuginfo-0:2.0.52-32.3.ent.ppc", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-debuginfo@2.0.52-32.3.ent?arch=ppc", }, }, }, { category: "product_version", name: "httpd-devel-0:2.0.52-32.3.ent.ppc", product: { name: "httpd-devel-0:2.0.52-32.3.ent.ppc", product_id: "httpd-devel-0:2.0.52-32.3.ent.ppc", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-devel@2.0.52-32.3.ent?arch=ppc", }, }, }, { category: "product_version", name: "httpd-0:2.0.52-32.3.ent.ppc", product: { name: "httpd-0:2.0.52-32.3.ent.ppc", product_id: "httpd-0:2.0.52-32.3.ent.ppc", product_identification_helper: { purl: "pkg:rpm/redhat/httpd@2.0.52-32.3.ent?arch=ppc", }, }, }, { category: "product_version", name: "httpd-0:2.0.46-68.ent.ppc", product: { name: "httpd-0:2.0.46-68.ent.ppc", product_id: "httpd-0:2.0.46-68.ent.ppc", product_identification_helper: { purl: "pkg:rpm/redhat/httpd@2.0.46-68.ent?arch=ppc", }, }, }, { category: "product_version", name: "mod_ssl-1:2.0.46-68.ent.ppc", product: { name: "mod_ssl-1:2.0.46-68.ent.ppc", product_id: "mod_ssl-1:2.0.46-68.ent.ppc", product_identification_helper: { purl: "pkg:rpm/redhat/mod_ssl@2.0.46-68.ent?arch=ppc&epoch=1", }, }, }, { category: "product_version", name: "httpd-devel-0:2.0.46-68.ent.ppc", product: { name: "httpd-devel-0:2.0.46-68.ent.ppc", product_id: "httpd-devel-0:2.0.46-68.ent.ppc", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-devel@2.0.46-68.ent?arch=ppc", }, }, }, { category: "product_version", name: "httpd-debuginfo-0:2.0.46-68.ent.ppc", product: { name: "httpd-debuginfo-0:2.0.46-68.ent.ppc", product_id: "httpd-debuginfo-0:2.0.46-68.ent.ppc", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-debuginfo@2.0.46-68.ent?arch=ppc", }, }, }, ], category: "architecture", name: "ppc", }, { branches: [ { category: "product_version", name: "httpd-manual-0:2.0.52-32.3.ent.s390x", product: { name: "httpd-manual-0:2.0.52-32.3.ent.s390x", product_id: "httpd-manual-0:2.0.52-32.3.ent.s390x", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-manual@2.0.52-32.3.ent?arch=s390x", }, }, }, { category: "product_version", name: "mod_ssl-1:2.0.52-32.3.ent.s390x", product: { name: "mod_ssl-1:2.0.52-32.3.ent.s390x", product_id: "mod_ssl-1:2.0.52-32.3.ent.s390x", product_identification_helper: { purl: "pkg:rpm/redhat/mod_ssl@2.0.52-32.3.ent?arch=s390x&epoch=1", }, }, }, { category: "product_version", name: "httpd-suexec-0:2.0.52-32.3.ent.s390x", product: { name: "httpd-suexec-0:2.0.52-32.3.ent.s390x", product_id: "httpd-suexec-0:2.0.52-32.3.ent.s390x", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-suexec@2.0.52-32.3.ent?arch=s390x", }, }, }, { category: "product_version", name: "httpd-debuginfo-0:2.0.52-32.3.ent.s390x", product: { name: "httpd-debuginfo-0:2.0.52-32.3.ent.s390x", product_id: "httpd-debuginfo-0:2.0.52-32.3.ent.s390x", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-debuginfo@2.0.52-32.3.ent?arch=s390x", }, }, }, { category: "product_version", name: "httpd-devel-0:2.0.52-32.3.ent.s390x", product: { name: "httpd-devel-0:2.0.52-32.3.ent.s390x", product_id: "httpd-devel-0:2.0.52-32.3.ent.s390x", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-devel@2.0.52-32.3.ent?arch=s390x", }, }, }, { category: "product_version", name: "httpd-0:2.0.52-32.3.ent.s390x", product: { name: "httpd-0:2.0.52-32.3.ent.s390x", product_id: "httpd-0:2.0.52-32.3.ent.s390x", product_identification_helper: { purl: "pkg:rpm/redhat/httpd@2.0.52-32.3.ent?arch=s390x", }, }, }, { category: "product_version", name: "httpd-0:2.0.46-68.ent.s390x", product: { name: "httpd-0:2.0.46-68.ent.s390x", product_id: "httpd-0:2.0.46-68.ent.s390x", product_identification_helper: { purl: "pkg:rpm/redhat/httpd@2.0.46-68.ent?arch=s390x", }, }, }, { category: "product_version", name: "mod_ssl-1:2.0.46-68.ent.s390x", product: { name: "mod_ssl-1:2.0.46-68.ent.s390x", product_id: "mod_ssl-1:2.0.46-68.ent.s390x", product_identification_helper: { purl: "pkg:rpm/redhat/mod_ssl@2.0.46-68.ent?arch=s390x&epoch=1", }, }, }, { category: "product_version", name: "httpd-devel-0:2.0.46-68.ent.s390x", product: { name: "httpd-devel-0:2.0.46-68.ent.s390x", product_id: "httpd-devel-0:2.0.46-68.ent.s390x", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-devel@2.0.46-68.ent?arch=s390x", }, }, }, { category: "product_version", name: "httpd-debuginfo-0:2.0.46-68.ent.s390x", product: { name: "httpd-debuginfo-0:2.0.46-68.ent.s390x", product_id: "httpd-debuginfo-0:2.0.46-68.ent.s390x", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-debuginfo@2.0.46-68.ent?arch=s390x", }, }, }, ], category: "architecture", name: "s390x", }, { branches: [ { category: "product_version", name: "httpd-manual-0:2.0.52-32.3.ent.s390", product: { name: "httpd-manual-0:2.0.52-32.3.ent.s390", product_id: "httpd-manual-0:2.0.52-32.3.ent.s390", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-manual@2.0.52-32.3.ent?arch=s390", }, }, }, { category: "product_version", name: "mod_ssl-1:2.0.52-32.3.ent.s390", product: { name: "mod_ssl-1:2.0.52-32.3.ent.s390", product_id: "mod_ssl-1:2.0.52-32.3.ent.s390", product_identification_helper: { purl: "pkg:rpm/redhat/mod_ssl@2.0.52-32.3.ent?arch=s390&epoch=1", }, }, }, { category: "product_version", name: "httpd-suexec-0:2.0.52-32.3.ent.s390", product: { name: "httpd-suexec-0:2.0.52-32.3.ent.s390", product_id: "httpd-suexec-0:2.0.52-32.3.ent.s390", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-suexec@2.0.52-32.3.ent?arch=s390", }, }, }, { category: "product_version", name: "httpd-debuginfo-0:2.0.52-32.3.ent.s390", product: { name: "httpd-debuginfo-0:2.0.52-32.3.ent.s390", product_id: "httpd-debuginfo-0:2.0.52-32.3.ent.s390", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-debuginfo@2.0.52-32.3.ent?arch=s390", }, }, }, { category: "product_version", name: "httpd-devel-0:2.0.52-32.3.ent.s390", product: { name: "httpd-devel-0:2.0.52-32.3.ent.s390", product_id: "httpd-devel-0:2.0.52-32.3.ent.s390", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-devel@2.0.52-32.3.ent?arch=s390", }, }, }, { category: "product_version", name: "httpd-0:2.0.52-32.3.ent.s390", product: { name: "httpd-0:2.0.52-32.3.ent.s390", product_id: "httpd-0:2.0.52-32.3.ent.s390", product_identification_helper: { purl: "pkg:rpm/redhat/httpd@2.0.52-32.3.ent?arch=s390", }, }, }, { category: "product_version", name: "httpd-0:2.0.46-68.ent.s390", product: { name: "httpd-0:2.0.46-68.ent.s390", product_id: "httpd-0:2.0.46-68.ent.s390", product_identification_helper: { purl: "pkg:rpm/redhat/httpd@2.0.46-68.ent?arch=s390", }, }, }, { category: "product_version", name: "mod_ssl-1:2.0.46-68.ent.s390", product: { name: "mod_ssl-1:2.0.46-68.ent.s390", product_id: "mod_ssl-1:2.0.46-68.ent.s390", product_identification_helper: { purl: "pkg:rpm/redhat/mod_ssl@2.0.46-68.ent?arch=s390&epoch=1", }, }, }, { category: "product_version", name: "httpd-devel-0:2.0.46-68.ent.s390", product: { name: "httpd-devel-0:2.0.46-68.ent.s390", product_id: "httpd-devel-0:2.0.46-68.ent.s390", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-devel@2.0.46-68.ent?arch=s390", }, }, }, { category: "product_version", name: "httpd-debuginfo-0:2.0.46-68.ent.s390", product: { name: "httpd-debuginfo-0:2.0.46-68.ent.s390", product_id: "httpd-debuginfo-0:2.0.46-68.ent.s390", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-debuginfo@2.0.46-68.ent?arch=s390", }, }, }, ], category: "architecture", name: "s390", }, ], category: "vendor", name: "Red Hat", }, ], relationships: [ { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.46-68.ent.i386 as a component of Red Hat Enterprise Linux AS version 3", product_id: "3AS:httpd-0:2.0.46-68.ent.i386", }, product_reference: "httpd-0:2.0.46-68.ent.i386", relates_to_product_reference: "3AS", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.46-68.ent.ia64 as a component of Red Hat Enterprise Linux AS version 3", product_id: "3AS:httpd-0:2.0.46-68.ent.ia64", }, product_reference: "httpd-0:2.0.46-68.ent.ia64", relates_to_product_reference: "3AS", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.46-68.ent.ppc as a component of Red Hat Enterprise Linux AS version 3", product_id: "3AS:httpd-0:2.0.46-68.ent.ppc", }, product_reference: "httpd-0:2.0.46-68.ent.ppc", relates_to_product_reference: "3AS", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.46-68.ent.s390 as a component of Red Hat Enterprise Linux AS version 3", product_id: "3AS:httpd-0:2.0.46-68.ent.s390", }, product_reference: "httpd-0:2.0.46-68.ent.s390", relates_to_product_reference: "3AS", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.46-68.ent.s390x as a component of Red Hat Enterprise Linux AS version 3", product_id: "3AS:httpd-0:2.0.46-68.ent.s390x", }, product_reference: "httpd-0:2.0.46-68.ent.s390x", relates_to_product_reference: "3AS", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.46-68.ent.src as a component of Red Hat Enterprise Linux AS version 3", product_id: "3AS:httpd-0:2.0.46-68.ent.src", }, product_reference: "httpd-0:2.0.46-68.ent.src", relates_to_product_reference: "3AS", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.46-68.ent.x86_64 as a component of Red Hat Enterprise Linux AS version 3", product_id: "3AS:httpd-0:2.0.46-68.ent.x86_64", }, product_reference: "httpd-0:2.0.46-68.ent.x86_64", relates_to_product_reference: "3AS", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.46-68.ent.i386 as a component of Red Hat Enterprise Linux AS version 3", product_id: "3AS:httpd-debuginfo-0:2.0.46-68.ent.i386", }, product_reference: "httpd-debuginfo-0:2.0.46-68.ent.i386", relates_to_product_reference: "3AS", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.46-68.ent.ia64 as a component of Red Hat Enterprise Linux AS version 3", product_id: "3AS:httpd-debuginfo-0:2.0.46-68.ent.ia64", }, product_reference: "httpd-debuginfo-0:2.0.46-68.ent.ia64", relates_to_product_reference: "3AS", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.46-68.ent.ppc as a component of Red Hat Enterprise Linux AS version 3", product_id: "3AS:httpd-debuginfo-0:2.0.46-68.ent.ppc", }, product_reference: "httpd-debuginfo-0:2.0.46-68.ent.ppc", relates_to_product_reference: "3AS", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.46-68.ent.s390 as a component of Red Hat Enterprise Linux AS version 3", product_id: "3AS:httpd-debuginfo-0:2.0.46-68.ent.s390", }, product_reference: "httpd-debuginfo-0:2.0.46-68.ent.s390", relates_to_product_reference: "3AS", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.46-68.ent.s390x as a component of Red Hat Enterprise Linux AS version 3", product_id: "3AS:httpd-debuginfo-0:2.0.46-68.ent.s390x", }, product_reference: "httpd-debuginfo-0:2.0.46-68.ent.s390x", relates_to_product_reference: "3AS", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.46-68.ent.x86_64 as a component of Red Hat Enterprise Linux AS version 3", product_id: "3AS:httpd-debuginfo-0:2.0.46-68.ent.x86_64", }, product_reference: "httpd-debuginfo-0:2.0.46-68.ent.x86_64", relates_to_product_reference: "3AS", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.46-68.ent.i386 as a component of Red Hat Enterprise Linux AS version 3", product_id: "3AS:httpd-devel-0:2.0.46-68.ent.i386", }, product_reference: "httpd-devel-0:2.0.46-68.ent.i386", relates_to_product_reference: "3AS", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.46-68.ent.ia64 as a component of Red Hat Enterprise Linux AS version 3", product_id: "3AS:httpd-devel-0:2.0.46-68.ent.ia64", }, product_reference: "httpd-devel-0:2.0.46-68.ent.ia64", relates_to_product_reference: "3AS", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.46-68.ent.ppc as a component of Red Hat Enterprise Linux AS version 3", product_id: "3AS:httpd-devel-0:2.0.46-68.ent.ppc", }, product_reference: "httpd-devel-0:2.0.46-68.ent.ppc", relates_to_product_reference: "3AS", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.46-68.ent.s390 as a component of Red Hat Enterprise Linux AS version 3", product_id: "3AS:httpd-devel-0:2.0.46-68.ent.s390", }, product_reference: "httpd-devel-0:2.0.46-68.ent.s390", relates_to_product_reference: "3AS", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.46-68.ent.s390x as a component of Red Hat Enterprise Linux AS version 3", product_id: "3AS:httpd-devel-0:2.0.46-68.ent.s390x", }, product_reference: "httpd-devel-0:2.0.46-68.ent.s390x", relates_to_product_reference: "3AS", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.46-68.ent.x86_64 as a component of Red Hat Enterprise Linux AS version 3", product_id: "3AS:httpd-devel-0:2.0.46-68.ent.x86_64", }, product_reference: "httpd-devel-0:2.0.46-68.ent.x86_64", relates_to_product_reference: "3AS", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.46-68.ent.i386 as a component of Red Hat Enterprise Linux AS version 3", product_id: "3AS:mod_ssl-1:2.0.46-68.ent.i386", }, product_reference: "mod_ssl-1:2.0.46-68.ent.i386", relates_to_product_reference: "3AS", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.46-68.ent.ia64 as a component of Red Hat Enterprise Linux AS version 3", product_id: "3AS:mod_ssl-1:2.0.46-68.ent.ia64", }, product_reference: "mod_ssl-1:2.0.46-68.ent.ia64", relates_to_product_reference: "3AS", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.46-68.ent.ppc as a component of Red Hat Enterprise Linux AS version 3", product_id: "3AS:mod_ssl-1:2.0.46-68.ent.ppc", }, product_reference: "mod_ssl-1:2.0.46-68.ent.ppc", relates_to_product_reference: "3AS", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.46-68.ent.s390 as a component of Red Hat Enterprise Linux AS version 3", product_id: "3AS:mod_ssl-1:2.0.46-68.ent.s390", }, product_reference: "mod_ssl-1:2.0.46-68.ent.s390", relates_to_product_reference: "3AS", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.46-68.ent.s390x as a component of Red Hat Enterprise Linux AS version 3", product_id: "3AS:mod_ssl-1:2.0.46-68.ent.s390x", }, product_reference: "mod_ssl-1:2.0.46-68.ent.s390x", relates_to_product_reference: "3AS", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.46-68.ent.x86_64 as a component of Red Hat Enterprise Linux AS version 3", product_id: "3AS:mod_ssl-1:2.0.46-68.ent.x86_64", }, product_reference: "mod_ssl-1:2.0.46-68.ent.x86_64", relates_to_product_reference: "3AS", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.46-68.ent.i386 as a component of Red Hat Desktop version 3", product_id: "3Desktop:httpd-0:2.0.46-68.ent.i386", }, product_reference: "httpd-0:2.0.46-68.ent.i386", relates_to_product_reference: "3Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.46-68.ent.ia64 as a component of Red Hat Desktop version 3", product_id: "3Desktop:httpd-0:2.0.46-68.ent.ia64", }, product_reference: "httpd-0:2.0.46-68.ent.ia64", relates_to_product_reference: "3Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.46-68.ent.ppc as a component of Red Hat Desktop version 3", product_id: "3Desktop:httpd-0:2.0.46-68.ent.ppc", }, product_reference: "httpd-0:2.0.46-68.ent.ppc", relates_to_product_reference: "3Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.46-68.ent.s390 as a component of Red Hat Desktop version 3", product_id: "3Desktop:httpd-0:2.0.46-68.ent.s390", }, product_reference: "httpd-0:2.0.46-68.ent.s390", relates_to_product_reference: "3Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.46-68.ent.s390x as a component of Red Hat Desktop version 3", product_id: "3Desktop:httpd-0:2.0.46-68.ent.s390x", }, product_reference: "httpd-0:2.0.46-68.ent.s390x", relates_to_product_reference: "3Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.46-68.ent.src as a component of Red Hat Desktop version 3", product_id: "3Desktop:httpd-0:2.0.46-68.ent.src", }, product_reference: "httpd-0:2.0.46-68.ent.src", relates_to_product_reference: "3Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.46-68.ent.x86_64 as a component of Red Hat Desktop version 3", product_id: "3Desktop:httpd-0:2.0.46-68.ent.x86_64", }, product_reference: "httpd-0:2.0.46-68.ent.x86_64", relates_to_product_reference: "3Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.46-68.ent.i386 as a component of Red Hat Desktop version 3", product_id: "3Desktop:httpd-debuginfo-0:2.0.46-68.ent.i386", }, product_reference: "httpd-debuginfo-0:2.0.46-68.ent.i386", relates_to_product_reference: "3Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.46-68.ent.ia64 as a component of Red Hat Desktop version 3", product_id: "3Desktop:httpd-debuginfo-0:2.0.46-68.ent.ia64", }, product_reference: "httpd-debuginfo-0:2.0.46-68.ent.ia64", relates_to_product_reference: "3Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.46-68.ent.ppc as a component of Red Hat Desktop version 3", product_id: "3Desktop:httpd-debuginfo-0:2.0.46-68.ent.ppc", }, product_reference: "httpd-debuginfo-0:2.0.46-68.ent.ppc", relates_to_product_reference: "3Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.46-68.ent.s390 as a component of Red Hat Desktop version 3", product_id: "3Desktop:httpd-debuginfo-0:2.0.46-68.ent.s390", }, product_reference: "httpd-debuginfo-0:2.0.46-68.ent.s390", relates_to_product_reference: "3Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.46-68.ent.s390x as a component of Red Hat Desktop version 3", product_id: "3Desktop:httpd-debuginfo-0:2.0.46-68.ent.s390x", }, product_reference: "httpd-debuginfo-0:2.0.46-68.ent.s390x", relates_to_product_reference: "3Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.46-68.ent.x86_64 as a component of Red Hat Desktop version 3", product_id: "3Desktop:httpd-debuginfo-0:2.0.46-68.ent.x86_64", }, product_reference: "httpd-debuginfo-0:2.0.46-68.ent.x86_64", relates_to_product_reference: "3Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.46-68.ent.i386 as a component of Red Hat Desktop version 3", product_id: "3Desktop:httpd-devel-0:2.0.46-68.ent.i386", }, product_reference: "httpd-devel-0:2.0.46-68.ent.i386", relates_to_product_reference: "3Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.46-68.ent.ia64 as a component of Red Hat Desktop version 3", product_id: "3Desktop:httpd-devel-0:2.0.46-68.ent.ia64", }, product_reference: "httpd-devel-0:2.0.46-68.ent.ia64", relates_to_product_reference: "3Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.46-68.ent.ppc as a component of Red Hat Desktop version 3", product_id: "3Desktop:httpd-devel-0:2.0.46-68.ent.ppc", }, product_reference: "httpd-devel-0:2.0.46-68.ent.ppc", relates_to_product_reference: "3Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.46-68.ent.s390 as a component of Red Hat Desktop version 3", product_id: "3Desktop:httpd-devel-0:2.0.46-68.ent.s390", }, product_reference: "httpd-devel-0:2.0.46-68.ent.s390", relates_to_product_reference: "3Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.46-68.ent.s390x as a component of Red Hat Desktop version 3", product_id: "3Desktop:httpd-devel-0:2.0.46-68.ent.s390x", }, product_reference: "httpd-devel-0:2.0.46-68.ent.s390x", relates_to_product_reference: "3Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.46-68.ent.x86_64 as a component of Red Hat Desktop version 3", product_id: "3Desktop:httpd-devel-0:2.0.46-68.ent.x86_64", }, product_reference: "httpd-devel-0:2.0.46-68.ent.x86_64", relates_to_product_reference: "3Desktop", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.46-68.ent.i386 as a component of Red Hat Desktop version 3", product_id: "3Desktop:mod_ssl-1:2.0.46-68.ent.i386", }, product_reference: "mod_ssl-1:2.0.46-68.ent.i386", relates_to_product_reference: "3Desktop", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.46-68.ent.ia64 as a component of Red Hat Desktop version 3", product_id: "3Desktop:mod_ssl-1:2.0.46-68.ent.ia64", }, product_reference: "mod_ssl-1:2.0.46-68.ent.ia64", relates_to_product_reference: "3Desktop", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.46-68.ent.ppc as a component of Red Hat Desktop version 3", product_id: "3Desktop:mod_ssl-1:2.0.46-68.ent.ppc", }, product_reference: "mod_ssl-1:2.0.46-68.ent.ppc", relates_to_product_reference: "3Desktop", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.46-68.ent.s390 as a component of Red Hat Desktop version 3", product_id: "3Desktop:mod_ssl-1:2.0.46-68.ent.s390", }, product_reference: "mod_ssl-1:2.0.46-68.ent.s390", relates_to_product_reference: "3Desktop", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.46-68.ent.s390x as a component of Red Hat Desktop version 3", product_id: "3Desktop:mod_ssl-1:2.0.46-68.ent.s390x", }, product_reference: "mod_ssl-1:2.0.46-68.ent.s390x", relates_to_product_reference: "3Desktop", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.46-68.ent.x86_64 as a component of Red Hat Desktop version 3", product_id: "3Desktop:mod_ssl-1:2.0.46-68.ent.x86_64", }, product_reference: "mod_ssl-1:2.0.46-68.ent.x86_64", relates_to_product_reference: "3Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.46-68.ent.i386 as a component of Red Hat Enterprise Linux ES version 3", product_id: "3ES:httpd-0:2.0.46-68.ent.i386", }, product_reference: "httpd-0:2.0.46-68.ent.i386", relates_to_product_reference: "3ES", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.46-68.ent.ia64 as a component of Red Hat Enterprise Linux ES version 3", product_id: "3ES:httpd-0:2.0.46-68.ent.ia64", }, product_reference: "httpd-0:2.0.46-68.ent.ia64", relates_to_product_reference: "3ES", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.46-68.ent.ppc as a component of Red Hat Enterprise Linux ES version 3", product_id: "3ES:httpd-0:2.0.46-68.ent.ppc", }, product_reference: "httpd-0:2.0.46-68.ent.ppc", relates_to_product_reference: "3ES", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.46-68.ent.s390 as a component of Red Hat Enterprise Linux ES version 3", product_id: "3ES:httpd-0:2.0.46-68.ent.s390", }, product_reference: "httpd-0:2.0.46-68.ent.s390", relates_to_product_reference: "3ES", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.46-68.ent.s390x as a component of Red Hat Enterprise Linux ES version 3", product_id: "3ES:httpd-0:2.0.46-68.ent.s390x", }, product_reference: "httpd-0:2.0.46-68.ent.s390x", relates_to_product_reference: "3ES", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.46-68.ent.src as a component of Red Hat Enterprise Linux ES version 3", product_id: "3ES:httpd-0:2.0.46-68.ent.src", }, product_reference: "httpd-0:2.0.46-68.ent.src", relates_to_product_reference: "3ES", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.46-68.ent.x86_64 as a component of Red Hat Enterprise Linux ES version 3", product_id: "3ES:httpd-0:2.0.46-68.ent.x86_64", }, product_reference: "httpd-0:2.0.46-68.ent.x86_64", relates_to_product_reference: "3ES", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.46-68.ent.i386 as a component of Red Hat Enterprise Linux ES version 3", product_id: "3ES:httpd-debuginfo-0:2.0.46-68.ent.i386", }, product_reference: "httpd-debuginfo-0:2.0.46-68.ent.i386", relates_to_product_reference: "3ES", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.46-68.ent.ia64 as a component of Red Hat Enterprise Linux ES version 3", product_id: "3ES:httpd-debuginfo-0:2.0.46-68.ent.ia64", }, product_reference: "httpd-debuginfo-0:2.0.46-68.ent.ia64", relates_to_product_reference: "3ES", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.46-68.ent.ppc as a component of Red Hat Enterprise Linux ES version 3", product_id: "3ES:httpd-debuginfo-0:2.0.46-68.ent.ppc", }, product_reference: "httpd-debuginfo-0:2.0.46-68.ent.ppc", relates_to_product_reference: "3ES", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.46-68.ent.s390 as a component of Red Hat Enterprise Linux ES version 3", product_id: "3ES:httpd-debuginfo-0:2.0.46-68.ent.s390", }, product_reference: "httpd-debuginfo-0:2.0.46-68.ent.s390", relates_to_product_reference: "3ES", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.46-68.ent.s390x as a component of Red Hat Enterprise Linux ES version 3", product_id: "3ES:httpd-debuginfo-0:2.0.46-68.ent.s390x", }, product_reference: "httpd-debuginfo-0:2.0.46-68.ent.s390x", relates_to_product_reference: "3ES", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.46-68.ent.x86_64 as a component of Red Hat Enterprise Linux ES version 3", product_id: "3ES:httpd-debuginfo-0:2.0.46-68.ent.x86_64", }, product_reference: "httpd-debuginfo-0:2.0.46-68.ent.x86_64", relates_to_product_reference: "3ES", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.46-68.ent.i386 as a component of Red Hat Enterprise Linux ES version 3", product_id: "3ES:httpd-devel-0:2.0.46-68.ent.i386", }, product_reference: "httpd-devel-0:2.0.46-68.ent.i386", relates_to_product_reference: "3ES", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.46-68.ent.ia64 as a component of Red Hat Enterprise Linux ES version 3", product_id: "3ES:httpd-devel-0:2.0.46-68.ent.ia64", }, product_reference: "httpd-devel-0:2.0.46-68.ent.ia64", relates_to_product_reference: "3ES", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.46-68.ent.ppc as a component of Red Hat Enterprise Linux ES version 3", product_id: "3ES:httpd-devel-0:2.0.46-68.ent.ppc", }, product_reference: "httpd-devel-0:2.0.46-68.ent.ppc", relates_to_product_reference: "3ES", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.46-68.ent.s390 as a component of Red Hat Enterprise Linux ES version 3", product_id: "3ES:httpd-devel-0:2.0.46-68.ent.s390", }, product_reference: "httpd-devel-0:2.0.46-68.ent.s390", relates_to_product_reference: "3ES", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.46-68.ent.s390x as a component of Red Hat Enterprise Linux ES version 3", product_id: "3ES:httpd-devel-0:2.0.46-68.ent.s390x", }, product_reference: "httpd-devel-0:2.0.46-68.ent.s390x", relates_to_product_reference: "3ES", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.46-68.ent.x86_64 as a component of Red Hat Enterprise Linux ES version 3", product_id: "3ES:httpd-devel-0:2.0.46-68.ent.x86_64", }, product_reference: "httpd-devel-0:2.0.46-68.ent.x86_64", relates_to_product_reference: "3ES", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.46-68.ent.i386 as a component of Red Hat Enterprise Linux ES version 3", product_id: "3ES:mod_ssl-1:2.0.46-68.ent.i386", }, product_reference: "mod_ssl-1:2.0.46-68.ent.i386", relates_to_product_reference: "3ES", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.46-68.ent.ia64 as a component of Red Hat Enterprise Linux ES version 3", product_id: "3ES:mod_ssl-1:2.0.46-68.ent.ia64", }, product_reference: "mod_ssl-1:2.0.46-68.ent.ia64", relates_to_product_reference: "3ES", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.46-68.ent.ppc as a component of Red Hat Enterprise Linux ES version 3", product_id: "3ES:mod_ssl-1:2.0.46-68.ent.ppc", }, product_reference: "mod_ssl-1:2.0.46-68.ent.ppc", relates_to_product_reference: "3ES", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.46-68.ent.s390 as a component of Red Hat Enterprise Linux ES version 3", product_id: "3ES:mod_ssl-1:2.0.46-68.ent.s390", }, product_reference: "mod_ssl-1:2.0.46-68.ent.s390", relates_to_product_reference: "3ES", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.46-68.ent.s390x as a component of Red Hat Enterprise Linux ES version 3", product_id: "3ES:mod_ssl-1:2.0.46-68.ent.s390x", }, product_reference: "mod_ssl-1:2.0.46-68.ent.s390x", relates_to_product_reference: "3ES", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.46-68.ent.x86_64 as a component of Red Hat Enterprise Linux ES version 3", product_id: "3ES:mod_ssl-1:2.0.46-68.ent.x86_64", }, product_reference: "mod_ssl-1:2.0.46-68.ent.x86_64", relates_to_product_reference: "3ES", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.46-68.ent.i386 as a component of Red Hat Enterprise Linux WS version 3", product_id: "3WS:httpd-0:2.0.46-68.ent.i386", }, product_reference: "httpd-0:2.0.46-68.ent.i386", relates_to_product_reference: "3WS", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.46-68.ent.ia64 as a component of Red Hat Enterprise Linux WS version 3", product_id: "3WS:httpd-0:2.0.46-68.ent.ia64", }, product_reference: "httpd-0:2.0.46-68.ent.ia64", relates_to_product_reference: "3WS", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.46-68.ent.ppc as a component of Red Hat Enterprise Linux WS version 3", product_id: "3WS:httpd-0:2.0.46-68.ent.ppc", }, product_reference: "httpd-0:2.0.46-68.ent.ppc", relates_to_product_reference: "3WS", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.46-68.ent.s390 as a component of Red Hat Enterprise Linux WS version 3", product_id: "3WS:httpd-0:2.0.46-68.ent.s390", }, product_reference: "httpd-0:2.0.46-68.ent.s390", relates_to_product_reference: "3WS", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.46-68.ent.s390x as a component of Red Hat Enterprise Linux WS version 3", product_id: "3WS:httpd-0:2.0.46-68.ent.s390x", }, product_reference: "httpd-0:2.0.46-68.ent.s390x", relates_to_product_reference: "3WS", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.46-68.ent.src as a component of Red Hat Enterprise Linux WS version 3", product_id: "3WS:httpd-0:2.0.46-68.ent.src", }, product_reference: "httpd-0:2.0.46-68.ent.src", relates_to_product_reference: "3WS", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.46-68.ent.x86_64 as a component of Red Hat Enterprise Linux WS version 3", product_id: "3WS:httpd-0:2.0.46-68.ent.x86_64", }, product_reference: "httpd-0:2.0.46-68.ent.x86_64", relates_to_product_reference: "3WS", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.46-68.ent.i386 as a component of Red Hat Enterprise Linux WS version 3", product_id: "3WS:httpd-debuginfo-0:2.0.46-68.ent.i386", }, product_reference: "httpd-debuginfo-0:2.0.46-68.ent.i386", relates_to_product_reference: "3WS", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.46-68.ent.ia64 as a component of Red Hat Enterprise Linux WS version 3", product_id: "3WS:httpd-debuginfo-0:2.0.46-68.ent.ia64", }, product_reference: "httpd-debuginfo-0:2.0.46-68.ent.ia64", relates_to_product_reference: "3WS", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.46-68.ent.ppc as a component of Red Hat Enterprise Linux WS version 3", product_id: "3WS:httpd-debuginfo-0:2.0.46-68.ent.ppc", }, product_reference: "httpd-debuginfo-0:2.0.46-68.ent.ppc", relates_to_product_reference: "3WS", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.46-68.ent.s390 as a component of Red Hat Enterprise Linux WS version 3", product_id: "3WS:httpd-debuginfo-0:2.0.46-68.ent.s390", }, product_reference: "httpd-debuginfo-0:2.0.46-68.ent.s390", relates_to_product_reference: "3WS", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.46-68.ent.s390x as a component of Red Hat Enterprise Linux WS version 3", product_id: "3WS:httpd-debuginfo-0:2.0.46-68.ent.s390x", }, product_reference: "httpd-debuginfo-0:2.0.46-68.ent.s390x", relates_to_product_reference: "3WS", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.46-68.ent.x86_64 as a component of Red Hat Enterprise Linux WS version 3", product_id: "3WS:httpd-debuginfo-0:2.0.46-68.ent.x86_64", }, product_reference: "httpd-debuginfo-0:2.0.46-68.ent.x86_64", relates_to_product_reference: "3WS", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.46-68.ent.i386 as a component of Red Hat Enterprise Linux WS version 3", product_id: "3WS:httpd-devel-0:2.0.46-68.ent.i386", }, product_reference: "httpd-devel-0:2.0.46-68.ent.i386", relates_to_product_reference: "3WS", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.46-68.ent.ia64 as a component of Red Hat Enterprise Linux WS version 3", product_id: "3WS:httpd-devel-0:2.0.46-68.ent.ia64", }, product_reference: "httpd-devel-0:2.0.46-68.ent.ia64", relates_to_product_reference: "3WS", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.46-68.ent.ppc as a component of Red Hat Enterprise Linux WS version 3", product_id: "3WS:httpd-devel-0:2.0.46-68.ent.ppc", }, product_reference: "httpd-devel-0:2.0.46-68.ent.ppc", relates_to_product_reference: "3WS", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.46-68.ent.s390 as a component of Red Hat Enterprise Linux WS version 3", product_id: "3WS:httpd-devel-0:2.0.46-68.ent.s390", }, product_reference: "httpd-devel-0:2.0.46-68.ent.s390", relates_to_product_reference: "3WS", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.46-68.ent.s390x as a component of Red Hat Enterprise Linux WS version 3", product_id: "3WS:httpd-devel-0:2.0.46-68.ent.s390x", }, product_reference: "httpd-devel-0:2.0.46-68.ent.s390x", relates_to_product_reference: "3WS", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.46-68.ent.x86_64 as a component of Red Hat Enterprise Linux WS version 3", product_id: "3WS:httpd-devel-0:2.0.46-68.ent.x86_64", }, product_reference: "httpd-devel-0:2.0.46-68.ent.x86_64", relates_to_product_reference: "3WS", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.46-68.ent.i386 as a component of Red Hat Enterprise Linux WS version 3", product_id: "3WS:mod_ssl-1:2.0.46-68.ent.i386", }, product_reference: "mod_ssl-1:2.0.46-68.ent.i386", relates_to_product_reference: "3WS", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.46-68.ent.ia64 as a component of Red Hat Enterprise Linux WS version 3", product_id: "3WS:mod_ssl-1:2.0.46-68.ent.ia64", }, product_reference: "mod_ssl-1:2.0.46-68.ent.ia64", relates_to_product_reference: "3WS", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.46-68.ent.ppc as a component of Red Hat Enterprise Linux WS version 3", product_id: "3WS:mod_ssl-1:2.0.46-68.ent.ppc", }, product_reference: "mod_ssl-1:2.0.46-68.ent.ppc", relates_to_product_reference: "3WS", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.46-68.ent.s390 as a component of Red Hat Enterprise Linux WS version 3", product_id: "3WS:mod_ssl-1:2.0.46-68.ent.s390", }, product_reference: "mod_ssl-1:2.0.46-68.ent.s390", relates_to_product_reference: "3WS", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.46-68.ent.s390x as a component of Red Hat Enterprise Linux WS version 3", product_id: "3WS:mod_ssl-1:2.0.46-68.ent.s390x", }, product_reference: "mod_ssl-1:2.0.46-68.ent.s390x", relates_to_product_reference: "3WS", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.46-68.ent.x86_64 as a component of Red Hat Enterprise Linux WS version 3", product_id: "3WS:mod_ssl-1:2.0.46-68.ent.x86_64", }, product_reference: "mod_ssl-1:2.0.46-68.ent.x86_64", relates_to_product_reference: "3WS", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.52-32.3.ent.i386 as a component of Red Hat Enterprise Linux AS version 4", product_id: "4AS:httpd-0:2.0.52-32.3.ent.i386", }, product_reference: "httpd-0:2.0.52-32.3.ent.i386", relates_to_product_reference: "4AS", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.52-32.3.ent.ia64 as a component of Red Hat Enterprise Linux AS version 4", product_id: "4AS:httpd-0:2.0.52-32.3.ent.ia64", }, product_reference: "httpd-0:2.0.52-32.3.ent.ia64", relates_to_product_reference: "4AS", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.52-32.3.ent.ppc as a component of Red Hat Enterprise Linux AS version 4", product_id: "4AS:httpd-0:2.0.52-32.3.ent.ppc", }, product_reference: "httpd-0:2.0.52-32.3.ent.ppc", relates_to_product_reference: "4AS", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.52-32.3.ent.s390 as a component of Red Hat Enterprise Linux AS version 4", product_id: "4AS:httpd-0:2.0.52-32.3.ent.s390", }, product_reference: "httpd-0:2.0.52-32.3.ent.s390", relates_to_product_reference: "4AS", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.52-32.3.ent.s390x as a component of Red Hat Enterprise Linux AS version 4", product_id: "4AS:httpd-0:2.0.52-32.3.ent.s390x", }, product_reference: "httpd-0:2.0.52-32.3.ent.s390x", relates_to_product_reference: "4AS", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.52-32.3.ent.src as a component of Red Hat Enterprise Linux AS version 4", product_id: "4AS:httpd-0:2.0.52-32.3.ent.src", }, product_reference: "httpd-0:2.0.52-32.3.ent.src", relates_to_product_reference: "4AS", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.52-32.3.ent.x86_64 as a component of Red Hat Enterprise Linux AS version 4", product_id: "4AS:httpd-0:2.0.52-32.3.ent.x86_64", }, product_reference: "httpd-0:2.0.52-32.3.ent.x86_64", relates_to_product_reference: "4AS", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.52-32.3.ent.i386 as a component of Red Hat Enterprise Linux AS version 4", product_id: "4AS:httpd-debuginfo-0:2.0.52-32.3.ent.i386", }, product_reference: "httpd-debuginfo-0:2.0.52-32.3.ent.i386", relates_to_product_reference: "4AS", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.52-32.3.ent.ia64 as a component of Red Hat Enterprise Linux AS version 4", product_id: "4AS:httpd-debuginfo-0:2.0.52-32.3.ent.ia64", }, product_reference: "httpd-debuginfo-0:2.0.52-32.3.ent.ia64", relates_to_product_reference: "4AS", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.52-32.3.ent.ppc as a component of Red Hat Enterprise Linux AS version 4", product_id: "4AS:httpd-debuginfo-0:2.0.52-32.3.ent.ppc", }, product_reference: "httpd-debuginfo-0:2.0.52-32.3.ent.ppc", relates_to_product_reference: "4AS", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.52-32.3.ent.s390 as a component of Red Hat Enterprise Linux AS version 4", product_id: "4AS:httpd-debuginfo-0:2.0.52-32.3.ent.s390", }, product_reference: "httpd-debuginfo-0:2.0.52-32.3.ent.s390", relates_to_product_reference: "4AS", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.52-32.3.ent.s390x as a component of Red Hat Enterprise Linux AS version 4", product_id: "4AS:httpd-debuginfo-0:2.0.52-32.3.ent.s390x", }, product_reference: "httpd-debuginfo-0:2.0.52-32.3.ent.s390x", relates_to_product_reference: "4AS", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.52-32.3.ent.x86_64 as a component of Red Hat Enterprise Linux AS version 4", product_id: "4AS:httpd-debuginfo-0:2.0.52-32.3.ent.x86_64", }, product_reference: "httpd-debuginfo-0:2.0.52-32.3.ent.x86_64", relates_to_product_reference: "4AS", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.52-32.3.ent.i386 as a component of Red Hat Enterprise Linux AS version 4", product_id: "4AS:httpd-devel-0:2.0.52-32.3.ent.i386", }, product_reference: "httpd-devel-0:2.0.52-32.3.ent.i386", relates_to_product_reference: "4AS", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.52-32.3.ent.ia64 as a component of Red Hat Enterprise Linux AS version 4", product_id: "4AS:httpd-devel-0:2.0.52-32.3.ent.ia64", }, product_reference: "httpd-devel-0:2.0.52-32.3.ent.ia64", relates_to_product_reference: "4AS", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.52-32.3.ent.ppc as a component of Red Hat Enterprise Linux AS version 4", product_id: "4AS:httpd-devel-0:2.0.52-32.3.ent.ppc", }, product_reference: "httpd-devel-0:2.0.52-32.3.ent.ppc", relates_to_product_reference: "4AS", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.52-32.3.ent.s390 as a component of Red Hat Enterprise Linux AS version 4", product_id: "4AS:httpd-devel-0:2.0.52-32.3.ent.s390", }, product_reference: "httpd-devel-0:2.0.52-32.3.ent.s390", relates_to_product_reference: "4AS", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.52-32.3.ent.s390x as a component of Red Hat Enterprise Linux AS version 4", product_id: "4AS:httpd-devel-0:2.0.52-32.3.ent.s390x", }, product_reference: "httpd-devel-0:2.0.52-32.3.ent.s390x", relates_to_product_reference: "4AS", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.52-32.3.ent.x86_64 as a component of Red Hat Enterprise Linux AS version 4", product_id: "4AS:httpd-devel-0:2.0.52-32.3.ent.x86_64", }, product_reference: "httpd-devel-0:2.0.52-32.3.ent.x86_64", relates_to_product_reference: "4AS", }, { category: "default_component_of", full_product_name: { name: "httpd-manual-0:2.0.52-32.3.ent.i386 as a component of Red Hat Enterprise Linux AS version 4", product_id: "4AS:httpd-manual-0:2.0.52-32.3.ent.i386", }, product_reference: "httpd-manual-0:2.0.52-32.3.ent.i386", relates_to_product_reference: "4AS", }, { category: "default_component_of", full_product_name: { name: "httpd-manual-0:2.0.52-32.3.ent.ia64 as a component of Red Hat Enterprise Linux AS version 4", product_id: "4AS:httpd-manual-0:2.0.52-32.3.ent.ia64", }, product_reference: "httpd-manual-0:2.0.52-32.3.ent.ia64", relates_to_product_reference: "4AS", }, { category: "default_component_of", full_product_name: { name: "httpd-manual-0:2.0.52-32.3.ent.ppc as a component of Red Hat Enterprise Linux AS version 4", product_id: "4AS:httpd-manual-0:2.0.52-32.3.ent.ppc", }, product_reference: "httpd-manual-0:2.0.52-32.3.ent.ppc", relates_to_product_reference: "4AS", }, { category: "default_component_of", full_product_name: { name: "httpd-manual-0:2.0.52-32.3.ent.s390 as a component of Red Hat Enterprise Linux AS version 4", product_id: "4AS:httpd-manual-0:2.0.52-32.3.ent.s390", }, product_reference: "httpd-manual-0:2.0.52-32.3.ent.s390", relates_to_product_reference: "4AS", }, { category: "default_component_of", full_product_name: { name: "httpd-manual-0:2.0.52-32.3.ent.s390x as a component of Red Hat Enterprise Linux AS version 4", product_id: "4AS:httpd-manual-0:2.0.52-32.3.ent.s390x", }, product_reference: "httpd-manual-0:2.0.52-32.3.ent.s390x", relates_to_product_reference: "4AS", }, { category: "default_component_of", full_product_name: { name: "httpd-manual-0:2.0.52-32.3.ent.x86_64 as a component of Red Hat Enterprise Linux AS version 4", product_id: "4AS:httpd-manual-0:2.0.52-32.3.ent.x86_64", }, product_reference: "httpd-manual-0:2.0.52-32.3.ent.x86_64", relates_to_product_reference: "4AS", }, { category: "default_component_of", full_product_name: { name: "httpd-suexec-0:2.0.52-32.3.ent.i386 as a component of Red Hat Enterprise Linux AS version 4", product_id: "4AS:httpd-suexec-0:2.0.52-32.3.ent.i386", }, product_reference: "httpd-suexec-0:2.0.52-32.3.ent.i386", relates_to_product_reference: "4AS", }, { category: "default_component_of", full_product_name: { name: "httpd-suexec-0:2.0.52-32.3.ent.ia64 as a component of Red Hat Enterprise Linux AS version 4", product_id: "4AS:httpd-suexec-0:2.0.52-32.3.ent.ia64", }, product_reference: "httpd-suexec-0:2.0.52-32.3.ent.ia64", relates_to_product_reference: "4AS", }, { category: "default_component_of", full_product_name: { name: "httpd-suexec-0:2.0.52-32.3.ent.ppc as a component of Red Hat Enterprise Linux AS version 4", product_id: "4AS:httpd-suexec-0:2.0.52-32.3.ent.ppc", }, product_reference: "httpd-suexec-0:2.0.52-32.3.ent.ppc", relates_to_product_reference: "4AS", }, { category: "default_component_of", full_product_name: { name: "httpd-suexec-0:2.0.52-32.3.ent.s390 as a component of Red Hat Enterprise Linux AS version 4", product_id: "4AS:httpd-suexec-0:2.0.52-32.3.ent.s390", }, product_reference: "httpd-suexec-0:2.0.52-32.3.ent.s390", relates_to_product_reference: "4AS", }, { category: "default_component_of", full_product_name: { name: "httpd-suexec-0:2.0.52-32.3.ent.s390x as a component of Red Hat Enterprise Linux AS version 4", product_id: "4AS:httpd-suexec-0:2.0.52-32.3.ent.s390x", }, product_reference: "httpd-suexec-0:2.0.52-32.3.ent.s390x", relates_to_product_reference: "4AS", }, { category: "default_component_of", full_product_name: { name: "httpd-suexec-0:2.0.52-32.3.ent.x86_64 as a component of Red Hat Enterprise Linux AS version 4", product_id: "4AS:httpd-suexec-0:2.0.52-32.3.ent.x86_64", }, product_reference: "httpd-suexec-0:2.0.52-32.3.ent.x86_64", relates_to_product_reference: "4AS", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.52-32.3.ent.i386 as a component of Red Hat Enterprise Linux AS version 4", product_id: "4AS:mod_ssl-1:2.0.52-32.3.ent.i386", }, product_reference: "mod_ssl-1:2.0.52-32.3.ent.i386", relates_to_product_reference: "4AS", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.52-32.3.ent.ia64 as a component of Red Hat Enterprise Linux AS version 4", product_id: "4AS:mod_ssl-1:2.0.52-32.3.ent.ia64", }, product_reference: "mod_ssl-1:2.0.52-32.3.ent.ia64", relates_to_product_reference: "4AS", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.52-32.3.ent.ppc as a component of Red Hat Enterprise Linux AS version 4", product_id: "4AS:mod_ssl-1:2.0.52-32.3.ent.ppc", }, product_reference: "mod_ssl-1:2.0.52-32.3.ent.ppc", relates_to_product_reference: "4AS", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.52-32.3.ent.s390 as a component of Red Hat Enterprise Linux AS version 4", product_id: "4AS:mod_ssl-1:2.0.52-32.3.ent.s390", }, product_reference: "mod_ssl-1:2.0.52-32.3.ent.s390", relates_to_product_reference: "4AS", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.52-32.3.ent.s390x as a component of Red Hat Enterprise Linux AS version 4", product_id: "4AS:mod_ssl-1:2.0.52-32.3.ent.s390x", }, product_reference: "mod_ssl-1:2.0.52-32.3.ent.s390x", relates_to_product_reference: "4AS", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.52-32.3.ent.x86_64 as a component of Red Hat Enterprise Linux AS version 4", product_id: "4AS:mod_ssl-1:2.0.52-32.3.ent.x86_64", }, product_reference: "mod_ssl-1:2.0.52-32.3.ent.x86_64", relates_to_product_reference: "4AS", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.52-32.3.ent.i386 as a component of Red Hat Enterprise Linux Desktop version 4", product_id: "4Desktop:httpd-0:2.0.52-32.3.ent.i386", }, product_reference: "httpd-0:2.0.52-32.3.ent.i386", relates_to_product_reference: "4Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.52-32.3.ent.ia64 as a component of Red Hat Enterprise Linux Desktop version 4", product_id: "4Desktop:httpd-0:2.0.52-32.3.ent.ia64", }, product_reference: "httpd-0:2.0.52-32.3.ent.ia64", relates_to_product_reference: "4Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.52-32.3.ent.ppc as a component of Red Hat Enterprise Linux Desktop version 4", product_id: "4Desktop:httpd-0:2.0.52-32.3.ent.ppc", }, product_reference: "httpd-0:2.0.52-32.3.ent.ppc", relates_to_product_reference: "4Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.52-32.3.ent.s390 as a component of Red Hat Enterprise Linux Desktop version 4", product_id: "4Desktop:httpd-0:2.0.52-32.3.ent.s390", }, product_reference: "httpd-0:2.0.52-32.3.ent.s390", relates_to_product_reference: "4Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.52-32.3.ent.s390x as a component of Red Hat Enterprise Linux Desktop version 4", product_id: "4Desktop:httpd-0:2.0.52-32.3.ent.s390x", }, product_reference: "httpd-0:2.0.52-32.3.ent.s390x", relates_to_product_reference: "4Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.52-32.3.ent.src as a component of Red Hat Enterprise Linux Desktop version 4", product_id: "4Desktop:httpd-0:2.0.52-32.3.ent.src", }, product_reference: "httpd-0:2.0.52-32.3.ent.src", relates_to_product_reference: "4Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.52-32.3.ent.x86_64 as a component of Red Hat Enterprise Linux Desktop version 4", product_id: "4Desktop:httpd-0:2.0.52-32.3.ent.x86_64", }, product_reference: "httpd-0:2.0.52-32.3.ent.x86_64", relates_to_product_reference: "4Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.52-32.3.ent.i386 as a component of Red Hat Enterprise Linux Desktop version 4", product_id: "4Desktop:httpd-debuginfo-0:2.0.52-32.3.ent.i386", }, product_reference: "httpd-debuginfo-0:2.0.52-32.3.ent.i386", relates_to_product_reference: "4Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.52-32.3.ent.ia64 as a component of Red Hat Enterprise Linux Desktop version 4", product_id: "4Desktop:httpd-debuginfo-0:2.0.52-32.3.ent.ia64", }, product_reference: "httpd-debuginfo-0:2.0.52-32.3.ent.ia64", relates_to_product_reference: "4Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.52-32.3.ent.ppc as a component of Red Hat Enterprise Linux Desktop version 4", product_id: "4Desktop:httpd-debuginfo-0:2.0.52-32.3.ent.ppc", }, product_reference: "httpd-debuginfo-0:2.0.52-32.3.ent.ppc", relates_to_product_reference: "4Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.52-32.3.ent.s390 as a component of Red Hat Enterprise Linux Desktop version 4", product_id: "4Desktop:httpd-debuginfo-0:2.0.52-32.3.ent.s390", }, product_reference: "httpd-debuginfo-0:2.0.52-32.3.ent.s390", relates_to_product_reference: "4Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.52-32.3.ent.s390x as a component of Red Hat Enterprise Linux Desktop version 4", product_id: "4Desktop:httpd-debuginfo-0:2.0.52-32.3.ent.s390x", }, product_reference: "httpd-debuginfo-0:2.0.52-32.3.ent.s390x", relates_to_product_reference: "4Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.52-32.3.ent.x86_64 as a component of Red Hat Enterprise Linux Desktop version 4", product_id: "4Desktop:httpd-debuginfo-0:2.0.52-32.3.ent.x86_64", }, product_reference: "httpd-debuginfo-0:2.0.52-32.3.ent.x86_64", relates_to_product_reference: "4Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.52-32.3.ent.i386 as a component of Red Hat Enterprise Linux Desktop version 4", product_id: "4Desktop:httpd-devel-0:2.0.52-32.3.ent.i386", }, product_reference: "httpd-devel-0:2.0.52-32.3.ent.i386", relates_to_product_reference: "4Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.52-32.3.ent.ia64 as a component of Red Hat Enterprise Linux Desktop version 4", product_id: "4Desktop:httpd-devel-0:2.0.52-32.3.ent.ia64", }, product_reference: "httpd-devel-0:2.0.52-32.3.ent.ia64", relates_to_product_reference: "4Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.52-32.3.ent.ppc as a component of Red Hat Enterprise Linux Desktop version 4", product_id: "4Desktop:httpd-devel-0:2.0.52-32.3.ent.ppc", }, product_reference: "httpd-devel-0:2.0.52-32.3.ent.ppc", relates_to_product_reference: "4Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.52-32.3.ent.s390 as a component of Red Hat Enterprise Linux Desktop version 4", product_id: "4Desktop:httpd-devel-0:2.0.52-32.3.ent.s390", }, product_reference: "httpd-devel-0:2.0.52-32.3.ent.s390", relates_to_product_reference: "4Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.52-32.3.ent.s390x as a component of Red Hat Enterprise Linux Desktop version 4", product_id: "4Desktop:httpd-devel-0:2.0.52-32.3.ent.s390x", }, product_reference: "httpd-devel-0:2.0.52-32.3.ent.s390x", relates_to_product_reference: "4Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.52-32.3.ent.x86_64 as a component of Red Hat Enterprise Linux Desktop version 4", product_id: "4Desktop:httpd-devel-0:2.0.52-32.3.ent.x86_64", }, product_reference: "httpd-devel-0:2.0.52-32.3.ent.x86_64", relates_to_product_reference: "4Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-manual-0:2.0.52-32.3.ent.i386 as a component of Red Hat Enterprise Linux Desktop version 4", product_id: "4Desktop:httpd-manual-0:2.0.52-32.3.ent.i386", }, product_reference: "httpd-manual-0:2.0.52-32.3.ent.i386", relates_to_product_reference: "4Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-manual-0:2.0.52-32.3.ent.ia64 as a component of Red Hat Enterprise Linux Desktop version 4", product_id: "4Desktop:httpd-manual-0:2.0.52-32.3.ent.ia64", }, product_reference: "httpd-manual-0:2.0.52-32.3.ent.ia64", relates_to_product_reference: "4Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-manual-0:2.0.52-32.3.ent.ppc as a component of Red Hat Enterprise Linux Desktop version 4", product_id: "4Desktop:httpd-manual-0:2.0.52-32.3.ent.ppc", }, product_reference: "httpd-manual-0:2.0.52-32.3.ent.ppc", relates_to_product_reference: "4Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-manual-0:2.0.52-32.3.ent.s390 as a component of Red Hat Enterprise Linux Desktop version 4", product_id: "4Desktop:httpd-manual-0:2.0.52-32.3.ent.s390", }, product_reference: "httpd-manual-0:2.0.52-32.3.ent.s390", relates_to_product_reference: "4Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-manual-0:2.0.52-32.3.ent.s390x as a component of Red Hat Enterprise Linux Desktop version 4", product_id: "4Desktop:httpd-manual-0:2.0.52-32.3.ent.s390x", }, product_reference: "httpd-manual-0:2.0.52-32.3.ent.s390x", relates_to_product_reference: "4Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-manual-0:2.0.52-32.3.ent.x86_64 as a component of Red Hat Enterprise Linux Desktop version 4", product_id: "4Desktop:httpd-manual-0:2.0.52-32.3.ent.x86_64", }, product_reference: "httpd-manual-0:2.0.52-32.3.ent.x86_64", relates_to_product_reference: "4Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-suexec-0:2.0.52-32.3.ent.i386 as a component of Red Hat Enterprise Linux Desktop version 4", product_id: "4Desktop:httpd-suexec-0:2.0.52-32.3.ent.i386", }, product_reference: "httpd-suexec-0:2.0.52-32.3.ent.i386", relates_to_product_reference: "4Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-suexec-0:2.0.52-32.3.ent.ia64 as a component of Red Hat Enterprise Linux Desktop version 4", product_id: "4Desktop:httpd-suexec-0:2.0.52-32.3.ent.ia64", }, product_reference: "httpd-suexec-0:2.0.52-32.3.ent.ia64", relates_to_product_reference: "4Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-suexec-0:2.0.52-32.3.ent.ppc as a component of Red Hat Enterprise Linux Desktop version 4", product_id: "4Desktop:httpd-suexec-0:2.0.52-32.3.ent.ppc", }, product_reference: "httpd-suexec-0:2.0.52-32.3.ent.ppc", relates_to_product_reference: "4Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-suexec-0:2.0.52-32.3.ent.s390 as a component of Red Hat Enterprise Linux Desktop version 4", product_id: "4Desktop:httpd-suexec-0:2.0.52-32.3.ent.s390", }, product_reference: "httpd-suexec-0:2.0.52-32.3.ent.s390", relates_to_product_reference: "4Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-suexec-0:2.0.52-32.3.ent.s390x as a component of Red Hat Enterprise Linux Desktop version 4", product_id: "4Desktop:httpd-suexec-0:2.0.52-32.3.ent.s390x", }, product_reference: "httpd-suexec-0:2.0.52-32.3.ent.s390x", relates_to_product_reference: "4Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-suexec-0:2.0.52-32.3.ent.x86_64 as a component of Red Hat Enterprise Linux Desktop version 4", product_id: "4Desktop:httpd-suexec-0:2.0.52-32.3.ent.x86_64", }, product_reference: "httpd-suexec-0:2.0.52-32.3.ent.x86_64", relates_to_product_reference: "4Desktop", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.52-32.3.ent.i386 as a component of Red Hat Enterprise Linux Desktop version 4", product_id: "4Desktop:mod_ssl-1:2.0.52-32.3.ent.i386", }, product_reference: "mod_ssl-1:2.0.52-32.3.ent.i386", relates_to_product_reference: "4Desktop", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.52-32.3.ent.ia64 as a component of Red Hat Enterprise Linux Desktop version 4", product_id: "4Desktop:mod_ssl-1:2.0.52-32.3.ent.ia64", }, product_reference: "mod_ssl-1:2.0.52-32.3.ent.ia64", relates_to_product_reference: "4Desktop", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.52-32.3.ent.ppc as a component of Red Hat Enterprise Linux Desktop version 4", product_id: "4Desktop:mod_ssl-1:2.0.52-32.3.ent.ppc", }, product_reference: "mod_ssl-1:2.0.52-32.3.ent.ppc", relates_to_product_reference: "4Desktop", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.52-32.3.ent.s390 as a component of Red Hat Enterprise Linux Desktop version 4", product_id: "4Desktop:mod_ssl-1:2.0.52-32.3.ent.s390", }, product_reference: "mod_ssl-1:2.0.52-32.3.ent.s390", relates_to_product_reference: "4Desktop", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.52-32.3.ent.s390x as a component of Red Hat Enterprise Linux Desktop version 4", product_id: "4Desktop:mod_ssl-1:2.0.52-32.3.ent.s390x", }, product_reference: "mod_ssl-1:2.0.52-32.3.ent.s390x", relates_to_product_reference: "4Desktop", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.52-32.3.ent.x86_64 as a component of Red Hat Enterprise Linux Desktop version 4", product_id: "4Desktop:mod_ssl-1:2.0.52-32.3.ent.x86_64", }, product_reference: "mod_ssl-1:2.0.52-32.3.ent.x86_64", relates_to_product_reference: "4Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.52-32.3.ent.i386 as a component of Red Hat Enterprise Linux ES version 4", product_id: "4ES:httpd-0:2.0.52-32.3.ent.i386", }, product_reference: "httpd-0:2.0.52-32.3.ent.i386", relates_to_product_reference: "4ES", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.52-32.3.ent.ia64 as a component of Red Hat Enterprise Linux ES version 4", product_id: "4ES:httpd-0:2.0.52-32.3.ent.ia64", }, product_reference: "httpd-0:2.0.52-32.3.ent.ia64", relates_to_product_reference: "4ES", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.52-32.3.ent.ppc as a component of Red Hat Enterprise Linux ES version 4", product_id: "4ES:httpd-0:2.0.52-32.3.ent.ppc", }, product_reference: "httpd-0:2.0.52-32.3.ent.ppc", relates_to_product_reference: "4ES", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.52-32.3.ent.s390 as a component of Red Hat Enterprise Linux ES version 4", product_id: "4ES:httpd-0:2.0.52-32.3.ent.s390", }, product_reference: "httpd-0:2.0.52-32.3.ent.s390", relates_to_product_reference: "4ES", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.52-32.3.ent.s390x as a component of Red Hat Enterprise Linux ES version 4", product_id: "4ES:httpd-0:2.0.52-32.3.ent.s390x", }, product_reference: "httpd-0:2.0.52-32.3.ent.s390x", relates_to_product_reference: "4ES", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.52-32.3.ent.src as a component of Red Hat Enterprise Linux ES version 4", product_id: "4ES:httpd-0:2.0.52-32.3.ent.src", }, product_reference: "httpd-0:2.0.52-32.3.ent.src", relates_to_product_reference: "4ES", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.52-32.3.ent.x86_64 as a component of Red Hat Enterprise Linux ES version 4", product_id: "4ES:httpd-0:2.0.52-32.3.ent.x86_64", }, product_reference: "httpd-0:2.0.52-32.3.ent.x86_64", relates_to_product_reference: "4ES", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.52-32.3.ent.i386 as a component of Red Hat Enterprise Linux ES version 4", product_id: "4ES:httpd-debuginfo-0:2.0.52-32.3.ent.i386", }, product_reference: "httpd-debuginfo-0:2.0.52-32.3.ent.i386", relates_to_product_reference: "4ES", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.52-32.3.ent.ia64 as a component of Red Hat Enterprise Linux ES version 4", product_id: "4ES:httpd-debuginfo-0:2.0.52-32.3.ent.ia64", }, product_reference: "httpd-debuginfo-0:2.0.52-32.3.ent.ia64", relates_to_product_reference: "4ES", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.52-32.3.ent.ppc as a component of Red Hat Enterprise Linux ES version 4", product_id: "4ES:httpd-debuginfo-0:2.0.52-32.3.ent.ppc", }, product_reference: "httpd-debuginfo-0:2.0.52-32.3.ent.ppc", relates_to_product_reference: "4ES", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.52-32.3.ent.s390 as a component of Red Hat Enterprise Linux ES version 4", product_id: "4ES:httpd-debuginfo-0:2.0.52-32.3.ent.s390", }, product_reference: "httpd-debuginfo-0:2.0.52-32.3.ent.s390", relates_to_product_reference: "4ES", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.52-32.3.ent.s390x as a component of Red Hat Enterprise Linux ES version 4", product_id: "4ES:httpd-debuginfo-0:2.0.52-32.3.ent.s390x", }, product_reference: "httpd-debuginfo-0:2.0.52-32.3.ent.s390x", relates_to_product_reference: "4ES", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.52-32.3.ent.x86_64 as a component of Red Hat Enterprise Linux ES version 4", product_id: "4ES:httpd-debuginfo-0:2.0.52-32.3.ent.x86_64", }, product_reference: "httpd-debuginfo-0:2.0.52-32.3.ent.x86_64", relates_to_product_reference: "4ES", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.52-32.3.ent.i386 as a component of Red Hat Enterprise Linux ES version 4", product_id: "4ES:httpd-devel-0:2.0.52-32.3.ent.i386", }, product_reference: "httpd-devel-0:2.0.52-32.3.ent.i386", relates_to_product_reference: "4ES", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.52-32.3.ent.ia64 as a component of Red Hat Enterprise Linux ES version 4", product_id: "4ES:httpd-devel-0:2.0.52-32.3.ent.ia64", }, product_reference: "httpd-devel-0:2.0.52-32.3.ent.ia64", relates_to_product_reference: "4ES", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.52-32.3.ent.ppc as a component of Red Hat Enterprise Linux ES version 4", product_id: "4ES:httpd-devel-0:2.0.52-32.3.ent.ppc", }, product_reference: "httpd-devel-0:2.0.52-32.3.ent.ppc", relates_to_product_reference: "4ES", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.52-32.3.ent.s390 as a component of Red Hat Enterprise Linux ES version 4", product_id: "4ES:httpd-devel-0:2.0.52-32.3.ent.s390", }, product_reference: "httpd-devel-0:2.0.52-32.3.ent.s390", relates_to_product_reference: "4ES", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.52-32.3.ent.s390x as a component of Red Hat Enterprise Linux ES version 4", product_id: "4ES:httpd-devel-0:2.0.52-32.3.ent.s390x", }, product_reference: "httpd-devel-0:2.0.52-32.3.ent.s390x", relates_to_product_reference: "4ES", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.52-32.3.ent.x86_64 as a component of Red Hat Enterprise Linux ES version 4", product_id: "4ES:httpd-devel-0:2.0.52-32.3.ent.x86_64", }, product_reference: "httpd-devel-0:2.0.52-32.3.ent.x86_64", relates_to_product_reference: "4ES", }, { category: "default_component_of", full_product_name: { name: "httpd-manual-0:2.0.52-32.3.ent.i386 as a component of Red Hat Enterprise Linux ES version 4", product_id: "4ES:httpd-manual-0:2.0.52-32.3.ent.i386", }, product_reference: "httpd-manual-0:2.0.52-32.3.ent.i386", relates_to_product_reference: "4ES", }, { category: "default_component_of", full_product_name: { name: "httpd-manual-0:2.0.52-32.3.ent.ia64 as a component of Red Hat Enterprise Linux ES version 4", product_id: "4ES:httpd-manual-0:2.0.52-32.3.ent.ia64", }, product_reference: "httpd-manual-0:2.0.52-32.3.ent.ia64", relates_to_product_reference: "4ES", }, { category: "default_component_of", full_product_name: { name: "httpd-manual-0:2.0.52-32.3.ent.ppc as a component of Red Hat Enterprise Linux ES version 4", product_id: "4ES:httpd-manual-0:2.0.52-32.3.ent.ppc", }, product_reference: "httpd-manual-0:2.0.52-32.3.ent.ppc", relates_to_product_reference: "4ES", }, { category: "default_component_of", full_product_name: { name: "httpd-manual-0:2.0.52-32.3.ent.s390 as a component of Red Hat Enterprise Linux ES version 4", product_id: "4ES:httpd-manual-0:2.0.52-32.3.ent.s390", }, product_reference: "httpd-manual-0:2.0.52-32.3.ent.s390", relates_to_product_reference: "4ES", }, { category: "default_component_of", full_product_name: { name: "httpd-manual-0:2.0.52-32.3.ent.s390x as a component of Red Hat Enterprise Linux ES version 4", product_id: "4ES:httpd-manual-0:2.0.52-32.3.ent.s390x", }, product_reference: "httpd-manual-0:2.0.52-32.3.ent.s390x", relates_to_product_reference: "4ES", }, { category: "default_component_of", full_product_name: { name: "httpd-manual-0:2.0.52-32.3.ent.x86_64 as a component of Red Hat Enterprise Linux ES version 4", product_id: "4ES:httpd-manual-0:2.0.52-32.3.ent.x86_64", }, product_reference: "httpd-manual-0:2.0.52-32.3.ent.x86_64", relates_to_product_reference: "4ES", }, { category: "default_component_of", full_product_name: { name: "httpd-suexec-0:2.0.52-32.3.ent.i386 as a component of Red Hat Enterprise Linux ES version 4", product_id: "4ES:httpd-suexec-0:2.0.52-32.3.ent.i386", }, product_reference: "httpd-suexec-0:2.0.52-32.3.ent.i386", relates_to_product_reference: "4ES", }, { category: "default_component_of", full_product_name: { name: "httpd-suexec-0:2.0.52-32.3.ent.ia64 as a component of Red Hat Enterprise Linux ES version 4", product_id: "4ES:httpd-suexec-0:2.0.52-32.3.ent.ia64", }, product_reference: "httpd-suexec-0:2.0.52-32.3.ent.ia64", relates_to_product_reference: "4ES", }, { category: "default_component_of", full_product_name: { name: "httpd-suexec-0:2.0.52-32.3.ent.ppc as a component of Red Hat Enterprise Linux ES version 4", product_id: "4ES:httpd-suexec-0:2.0.52-32.3.ent.ppc", }, product_reference: "httpd-suexec-0:2.0.52-32.3.ent.ppc", relates_to_product_reference: "4ES", }, { category: "default_component_of", full_product_name: { name: "httpd-suexec-0:2.0.52-32.3.ent.s390 as a component of Red Hat Enterprise Linux ES version 4", product_id: "4ES:httpd-suexec-0:2.0.52-32.3.ent.s390", }, product_reference: "httpd-suexec-0:2.0.52-32.3.ent.s390", relates_to_product_reference: "4ES", }, { category: "default_component_of", full_product_name: { name: "httpd-suexec-0:2.0.52-32.3.ent.s390x as a component of Red Hat Enterprise Linux ES version 4", product_id: "4ES:httpd-suexec-0:2.0.52-32.3.ent.s390x", }, product_reference: "httpd-suexec-0:2.0.52-32.3.ent.s390x", relates_to_product_reference: "4ES", }, { category: "default_component_of", full_product_name: { name: "httpd-suexec-0:2.0.52-32.3.ent.x86_64 as a component of Red Hat Enterprise Linux ES version 4", product_id: "4ES:httpd-suexec-0:2.0.52-32.3.ent.x86_64", }, product_reference: "httpd-suexec-0:2.0.52-32.3.ent.x86_64", relates_to_product_reference: "4ES", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.52-32.3.ent.i386 as a component of Red Hat Enterprise Linux ES version 4", product_id: "4ES:mod_ssl-1:2.0.52-32.3.ent.i386", }, product_reference: "mod_ssl-1:2.0.52-32.3.ent.i386", relates_to_product_reference: "4ES", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.52-32.3.ent.ia64 as a component of Red Hat Enterprise Linux ES version 4", product_id: "4ES:mod_ssl-1:2.0.52-32.3.ent.ia64", }, product_reference: "mod_ssl-1:2.0.52-32.3.ent.ia64", relates_to_product_reference: "4ES", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.52-32.3.ent.ppc as a component of Red Hat Enterprise Linux ES version 4", product_id: "4ES:mod_ssl-1:2.0.52-32.3.ent.ppc", }, product_reference: "mod_ssl-1:2.0.52-32.3.ent.ppc", relates_to_product_reference: "4ES", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.52-32.3.ent.s390 as a component of Red Hat Enterprise Linux ES version 4", product_id: "4ES:mod_ssl-1:2.0.52-32.3.ent.s390", }, product_reference: "mod_ssl-1:2.0.52-32.3.ent.s390", relates_to_product_reference: "4ES", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.52-32.3.ent.s390x as a component of Red Hat Enterprise Linux ES version 4", product_id: "4ES:mod_ssl-1:2.0.52-32.3.ent.s390x", }, product_reference: "mod_ssl-1:2.0.52-32.3.ent.s390x", relates_to_product_reference: "4ES", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.52-32.3.ent.x86_64 as a component of Red Hat Enterprise Linux ES version 4", product_id: "4ES:mod_ssl-1:2.0.52-32.3.ent.x86_64", }, product_reference: "mod_ssl-1:2.0.52-32.3.ent.x86_64", relates_to_product_reference: "4ES", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.52-32.3.ent.i386 as a component of Red Hat Enterprise Linux WS version 4", product_id: "4WS:httpd-0:2.0.52-32.3.ent.i386", }, product_reference: "httpd-0:2.0.52-32.3.ent.i386", relates_to_product_reference: "4WS", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.52-32.3.ent.ia64 as a component of Red Hat Enterprise Linux WS version 4", product_id: "4WS:httpd-0:2.0.52-32.3.ent.ia64", }, product_reference: "httpd-0:2.0.52-32.3.ent.ia64", relates_to_product_reference: "4WS", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.52-32.3.ent.ppc as a component of Red Hat Enterprise Linux WS version 4", product_id: "4WS:httpd-0:2.0.52-32.3.ent.ppc", }, product_reference: "httpd-0:2.0.52-32.3.ent.ppc", relates_to_product_reference: "4WS", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.52-32.3.ent.s390 as a component of Red Hat Enterprise Linux WS version 4", product_id: "4WS:httpd-0:2.0.52-32.3.ent.s390", }, product_reference: "httpd-0:2.0.52-32.3.ent.s390", relates_to_product_reference: "4WS", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.52-32.3.ent.s390x as a component of Red Hat Enterprise Linux WS version 4", product_id: "4WS:httpd-0:2.0.52-32.3.ent.s390x", }, product_reference: "httpd-0:2.0.52-32.3.ent.s390x", relates_to_product_reference: "4WS", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.52-32.3.ent.src as a component of Red Hat Enterprise Linux WS version 4", product_id: "4WS:httpd-0:2.0.52-32.3.ent.src", }, product_reference: "httpd-0:2.0.52-32.3.ent.src", relates_to_product_reference: "4WS", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.52-32.3.ent.x86_64 as a component of Red Hat Enterprise Linux WS version 4", product_id: "4WS:httpd-0:2.0.52-32.3.ent.x86_64", }, product_reference: "httpd-0:2.0.52-32.3.ent.x86_64", relates_to_product_reference: "4WS", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.52-32.3.ent.i386 as a component of Red Hat Enterprise Linux WS version 4", product_id: "4WS:httpd-debuginfo-0:2.0.52-32.3.ent.i386", }, product_reference: "httpd-debuginfo-0:2.0.52-32.3.ent.i386", relates_to_product_reference: "4WS", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.52-32.3.ent.ia64 as a component of Red Hat Enterprise Linux WS version 4", product_id: "4WS:httpd-debuginfo-0:2.0.52-32.3.ent.ia64", }, product_reference: "httpd-debuginfo-0:2.0.52-32.3.ent.ia64", relates_to_product_reference: "4WS", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.52-32.3.ent.ppc as a component of Red Hat Enterprise Linux WS version 4", product_id: "4WS:httpd-debuginfo-0:2.0.52-32.3.ent.ppc", }, product_reference: "httpd-debuginfo-0:2.0.52-32.3.ent.ppc", relates_to_product_reference: "4WS", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.52-32.3.ent.s390 as a component of Red Hat Enterprise Linux WS version 4", product_id: "4WS:httpd-debuginfo-0:2.0.52-32.3.ent.s390", }, product_reference: "httpd-debuginfo-0:2.0.52-32.3.ent.s390", relates_to_product_reference: "4WS", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.52-32.3.ent.s390x as a component of Red Hat Enterprise Linux WS version 4", product_id: "4WS:httpd-debuginfo-0:2.0.52-32.3.ent.s390x", }, product_reference: "httpd-debuginfo-0:2.0.52-32.3.ent.s390x", relates_to_product_reference: "4WS", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.52-32.3.ent.x86_64 as a component of Red Hat Enterprise Linux WS version 4", product_id: "4WS:httpd-debuginfo-0:2.0.52-32.3.ent.x86_64", }, product_reference: "httpd-debuginfo-0:2.0.52-32.3.ent.x86_64", relates_to_product_reference: "4WS", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.52-32.3.ent.i386 as a component of Red Hat Enterprise Linux WS version 4", product_id: "4WS:httpd-devel-0:2.0.52-32.3.ent.i386", }, product_reference: "httpd-devel-0:2.0.52-32.3.ent.i386", relates_to_product_reference: "4WS", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.52-32.3.ent.ia64 as a component of Red Hat Enterprise Linux WS version 4", product_id: "4WS:httpd-devel-0:2.0.52-32.3.ent.ia64", }, product_reference: "httpd-devel-0:2.0.52-32.3.ent.ia64", relates_to_product_reference: "4WS", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.52-32.3.ent.ppc as a component of Red Hat Enterprise Linux WS version 4", product_id: "4WS:httpd-devel-0:2.0.52-32.3.ent.ppc", }, product_reference: "httpd-devel-0:2.0.52-32.3.ent.ppc", relates_to_product_reference: "4WS", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.52-32.3.ent.s390 as a component of Red Hat Enterprise Linux WS version 4", product_id: "4WS:httpd-devel-0:2.0.52-32.3.ent.s390", }, product_reference: "httpd-devel-0:2.0.52-32.3.ent.s390", relates_to_product_reference: "4WS", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.52-32.3.ent.s390x as a component of Red Hat Enterprise Linux WS version 4", product_id: "4WS:httpd-devel-0:2.0.52-32.3.ent.s390x", }, product_reference: "httpd-devel-0:2.0.52-32.3.ent.s390x", relates_to_product_reference: "4WS", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.52-32.3.ent.x86_64 as a component of Red Hat Enterprise Linux WS version 4", product_id: "4WS:httpd-devel-0:2.0.52-32.3.ent.x86_64", }, product_reference: "httpd-devel-0:2.0.52-32.3.ent.x86_64", relates_to_product_reference: "4WS", }, { category: "default_component_of", full_product_name: { name: "httpd-manual-0:2.0.52-32.3.ent.i386 as a component of Red Hat Enterprise Linux WS version 4", product_id: "4WS:httpd-manual-0:2.0.52-32.3.ent.i386", }, product_reference: "httpd-manual-0:2.0.52-32.3.ent.i386", relates_to_product_reference: "4WS", }, { category: "default_component_of", full_product_name: { name: "httpd-manual-0:2.0.52-32.3.ent.ia64 as a component of Red Hat Enterprise Linux WS version 4", product_id: "4WS:httpd-manual-0:2.0.52-32.3.ent.ia64", }, product_reference: "httpd-manual-0:2.0.52-32.3.ent.ia64", relates_to_product_reference: "4WS", }, { category: "default_component_of", full_product_name: { name: "httpd-manual-0:2.0.52-32.3.ent.ppc as a component of Red Hat Enterprise Linux WS version 4", product_id: "4WS:httpd-manual-0:2.0.52-32.3.ent.ppc", }, product_reference: "httpd-manual-0:2.0.52-32.3.ent.ppc", relates_to_product_reference: "4WS", }, { category: "default_component_of", full_product_name: { name: "httpd-manual-0:2.0.52-32.3.ent.s390 as a component of Red Hat Enterprise Linux WS version 4", product_id: "4WS:httpd-manual-0:2.0.52-32.3.ent.s390", }, product_reference: "httpd-manual-0:2.0.52-32.3.ent.s390", relates_to_product_reference: "4WS", }, { category: "default_component_of", full_product_name: { name: "httpd-manual-0:2.0.52-32.3.ent.s390x as a component of Red Hat Enterprise Linux WS version 4", product_id: "4WS:httpd-manual-0:2.0.52-32.3.ent.s390x", }, product_reference: "httpd-manual-0:2.0.52-32.3.ent.s390x", relates_to_product_reference: "4WS", }, { category: "default_component_of", full_product_name: { name: "httpd-manual-0:2.0.52-32.3.ent.x86_64 as a component of Red Hat Enterprise Linux WS version 4", product_id: "4WS:httpd-manual-0:2.0.52-32.3.ent.x86_64", }, product_reference: "httpd-manual-0:2.0.52-32.3.ent.x86_64", relates_to_product_reference: "4WS", }, { category: "default_component_of", full_product_name: { name: "httpd-suexec-0:2.0.52-32.3.ent.i386 as a component of Red Hat Enterprise Linux WS version 4", product_id: "4WS:httpd-suexec-0:2.0.52-32.3.ent.i386", }, product_reference: "httpd-suexec-0:2.0.52-32.3.ent.i386", relates_to_product_reference: "4WS", }, { category: "default_component_of", full_product_name: { name: "httpd-suexec-0:2.0.52-32.3.ent.ia64 as a component of Red Hat Enterprise Linux WS version 4", product_id: "4WS:httpd-suexec-0:2.0.52-32.3.ent.ia64", }, product_reference: "httpd-suexec-0:2.0.52-32.3.ent.ia64", relates_to_product_reference: "4WS", }, { category: "default_component_of", full_product_name: { name: "httpd-suexec-0:2.0.52-32.3.ent.ppc as a component of Red Hat Enterprise Linux WS version 4", product_id: "4WS:httpd-suexec-0:2.0.52-32.3.ent.ppc", }, product_reference: "httpd-suexec-0:2.0.52-32.3.ent.ppc", relates_to_product_reference: "4WS", }, { category: "default_component_of", full_product_name: { name: "httpd-suexec-0:2.0.52-32.3.ent.s390 as a component of Red Hat Enterprise Linux WS version 4", product_id: "4WS:httpd-suexec-0:2.0.52-32.3.ent.s390", }, product_reference: "httpd-suexec-0:2.0.52-32.3.ent.s390", relates_to_product_reference: "4WS", }, { category: "default_component_of", full_product_name: { name: "httpd-suexec-0:2.0.52-32.3.ent.s390x as a component of Red Hat Enterprise Linux WS version 4", product_id: "4WS:httpd-suexec-0:2.0.52-32.3.ent.s390x", }, product_reference: "httpd-suexec-0:2.0.52-32.3.ent.s390x", relates_to_product_reference: "4WS", }, { category: "default_component_of", full_product_name: { name: "httpd-suexec-0:2.0.52-32.3.ent.x86_64 as a component of Red Hat Enterprise Linux WS version 4", product_id: "4WS:httpd-suexec-0:2.0.52-32.3.ent.x86_64", }, product_reference: "httpd-suexec-0:2.0.52-32.3.ent.x86_64", relates_to_product_reference: "4WS", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.52-32.3.ent.i386 as a component of Red Hat Enterprise Linux WS version 4", product_id: "4WS:mod_ssl-1:2.0.52-32.3.ent.i386", }, product_reference: "mod_ssl-1:2.0.52-32.3.ent.i386", relates_to_product_reference: "4WS", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.52-32.3.ent.ia64 as a component of Red Hat Enterprise Linux WS version 4", product_id: "4WS:mod_ssl-1:2.0.52-32.3.ent.ia64", }, product_reference: "mod_ssl-1:2.0.52-32.3.ent.ia64", relates_to_product_reference: "4WS", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.52-32.3.ent.ppc as a component of Red Hat Enterprise Linux WS version 4", product_id: "4WS:mod_ssl-1:2.0.52-32.3.ent.ppc", }, product_reference: "mod_ssl-1:2.0.52-32.3.ent.ppc", relates_to_product_reference: "4WS", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.52-32.3.ent.s390 as a component of Red Hat Enterprise Linux WS version 4", product_id: "4WS:mod_ssl-1:2.0.52-32.3.ent.s390", }, product_reference: "mod_ssl-1:2.0.52-32.3.ent.s390", relates_to_product_reference: "4WS", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.52-32.3.ent.s390x as a component of Red Hat Enterprise Linux WS version 4", product_id: "4WS:mod_ssl-1:2.0.52-32.3.ent.s390x", }, product_reference: "mod_ssl-1:2.0.52-32.3.ent.s390x", relates_to_product_reference: "4WS", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.52-32.3.ent.x86_64 as a component of Red Hat Enterprise Linux WS version 4", product_id: "4WS:mod_ssl-1:2.0.52-32.3.ent.x86_64", }, product_reference: "mod_ssl-1:2.0.52-32.3.ent.x86_64", relates_to_product_reference: "4WS", }, ], }, vulnerabilities: [ { cve: "CVE-2007-3304", discovery_date: "2007-06-19T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "245111", }, ], notes: [ { category: "description", text: "Apache httpd 1.3.37, 2.0.59, and 2.2.4 with the Prefork MPM module, allows local users to cause a denial of service by modifying the worker_score and process_score arrays to reference an arbitrary process ID, which is sent a SIGUSR1 signal from the master process, aka \"SIGUSR1 killer.\"", title: "Vulnerability description", }, { category: "summary", text: "httpd scoreboard lack of PID protection", title: "Vulnerability summary", }, ], product_status: { fixed: [ "3AS:httpd-0:2.0.46-68.ent.i386", "3AS:httpd-0:2.0.46-68.ent.ia64", "3AS:httpd-0:2.0.46-68.ent.ppc", "3AS:httpd-0:2.0.46-68.ent.s390", "3AS:httpd-0:2.0.46-68.ent.s390x", "3AS:httpd-0:2.0.46-68.ent.src", "3AS:httpd-0:2.0.46-68.ent.x86_64", "3AS:httpd-debuginfo-0:2.0.46-68.ent.i386", "3AS:httpd-debuginfo-0:2.0.46-68.ent.ia64", "3AS:httpd-debuginfo-0:2.0.46-68.ent.ppc", "3AS:httpd-debuginfo-0:2.0.46-68.ent.s390", "3AS:httpd-debuginfo-0:2.0.46-68.ent.s390x", "3AS:httpd-debuginfo-0:2.0.46-68.ent.x86_64", "3AS:httpd-devel-0:2.0.46-68.ent.i386", "3AS:httpd-devel-0:2.0.46-68.ent.ia64", "3AS:httpd-devel-0:2.0.46-68.ent.ppc", "3AS:httpd-devel-0:2.0.46-68.ent.s390", "3AS:httpd-devel-0:2.0.46-68.ent.s390x", "3AS:httpd-devel-0:2.0.46-68.ent.x86_64", "3AS:mod_ssl-1:2.0.46-68.ent.i386", "3AS:mod_ssl-1:2.0.46-68.ent.ia64", "3AS:mod_ssl-1:2.0.46-68.ent.ppc", "3AS:mod_ssl-1:2.0.46-68.ent.s390", "3AS:mod_ssl-1:2.0.46-68.ent.s390x", "3AS:mod_ssl-1:2.0.46-68.ent.x86_64", "3Desktop:httpd-0:2.0.46-68.ent.i386", "3Desktop:httpd-0:2.0.46-68.ent.ia64", "3Desktop:httpd-0:2.0.46-68.ent.ppc", "3Desktop:httpd-0:2.0.46-68.ent.s390", "3Desktop:httpd-0:2.0.46-68.ent.s390x", "3Desktop:httpd-0:2.0.46-68.ent.src", "3Desktop:httpd-0:2.0.46-68.ent.x86_64", "3Desktop:httpd-debuginfo-0:2.0.46-68.ent.i386", "3Desktop:httpd-debuginfo-0:2.0.46-68.ent.ia64", "3Desktop:httpd-debuginfo-0:2.0.46-68.ent.ppc", "3Desktop:httpd-debuginfo-0:2.0.46-68.ent.s390", "3Desktop:httpd-debuginfo-0:2.0.46-68.ent.s390x", "3Desktop:httpd-debuginfo-0:2.0.46-68.ent.x86_64", "3Desktop:httpd-devel-0:2.0.46-68.ent.i386", "3Desktop:httpd-devel-0:2.0.46-68.ent.ia64", "3Desktop:httpd-devel-0:2.0.46-68.ent.ppc", "3Desktop:httpd-devel-0:2.0.46-68.ent.s390", "3Desktop:httpd-devel-0:2.0.46-68.ent.s390x", "3Desktop:httpd-devel-0:2.0.46-68.ent.x86_64", "3Desktop:mod_ssl-1:2.0.46-68.ent.i386", "3Desktop:mod_ssl-1:2.0.46-68.ent.ia64", "3Desktop:mod_ssl-1:2.0.46-68.ent.ppc", "3Desktop:mod_ssl-1:2.0.46-68.ent.s390", "3Desktop:mod_ssl-1:2.0.46-68.ent.s390x", "3Desktop:mod_ssl-1:2.0.46-68.ent.x86_64", "3ES:httpd-0:2.0.46-68.ent.i386", "3ES:httpd-0:2.0.46-68.ent.ia64", "3ES:httpd-0:2.0.46-68.ent.ppc", "3ES:httpd-0:2.0.46-68.ent.s390", "3ES:httpd-0:2.0.46-68.ent.s390x", "3ES:httpd-0:2.0.46-68.ent.src", "3ES:httpd-0:2.0.46-68.ent.x86_64", "3ES:httpd-debuginfo-0:2.0.46-68.ent.i386", "3ES:httpd-debuginfo-0:2.0.46-68.ent.ia64", "3ES:httpd-debuginfo-0:2.0.46-68.ent.ppc", "3ES:httpd-debuginfo-0:2.0.46-68.ent.s390", "3ES:httpd-debuginfo-0:2.0.46-68.ent.s390x", "3ES:httpd-debuginfo-0:2.0.46-68.ent.x86_64", "3ES:httpd-devel-0:2.0.46-68.ent.i386", "3ES:httpd-devel-0:2.0.46-68.ent.ia64", "3ES:httpd-devel-0:2.0.46-68.ent.ppc", "3ES:httpd-devel-0:2.0.46-68.ent.s390", "3ES:httpd-devel-0:2.0.46-68.ent.s390x", "3ES:httpd-devel-0:2.0.46-68.ent.x86_64", "3ES:mod_ssl-1:2.0.46-68.ent.i386", "3ES:mod_ssl-1:2.0.46-68.ent.ia64", "3ES:mod_ssl-1:2.0.46-68.ent.ppc", "3ES:mod_ssl-1:2.0.46-68.ent.s390", "3ES:mod_ssl-1:2.0.46-68.ent.s390x", "3ES:mod_ssl-1:2.0.46-68.ent.x86_64", "3WS:httpd-0:2.0.46-68.ent.i386", "3WS:httpd-0:2.0.46-68.ent.ia64", "3WS:httpd-0:2.0.46-68.ent.ppc", "3WS:httpd-0:2.0.46-68.ent.s390", "3WS:httpd-0:2.0.46-68.ent.s390x", "3WS:httpd-0:2.0.46-68.ent.src", "3WS:httpd-0:2.0.46-68.ent.x86_64", "3WS:httpd-debuginfo-0:2.0.46-68.ent.i386", "3WS:httpd-debuginfo-0:2.0.46-68.ent.ia64", "3WS:httpd-debuginfo-0:2.0.46-68.ent.ppc", "3WS:httpd-debuginfo-0:2.0.46-68.ent.s390", "3WS:httpd-debuginfo-0:2.0.46-68.ent.s390x", "3WS:httpd-debuginfo-0:2.0.46-68.ent.x86_64", "3WS:httpd-devel-0:2.0.46-68.ent.i386", "3WS:httpd-devel-0:2.0.46-68.ent.ia64", "3WS:httpd-devel-0:2.0.46-68.ent.ppc", "3WS:httpd-devel-0:2.0.46-68.ent.s390", "3WS:httpd-devel-0:2.0.46-68.ent.s390x", "3WS:httpd-devel-0:2.0.46-68.ent.x86_64", "3WS:mod_ssl-1:2.0.46-68.ent.i386", "3WS:mod_ssl-1:2.0.46-68.ent.ia64", "3WS:mod_ssl-1:2.0.46-68.ent.ppc", "3WS:mod_ssl-1:2.0.46-68.ent.s390", "3WS:mod_ssl-1:2.0.46-68.ent.s390x", "3WS:mod_ssl-1:2.0.46-68.ent.x86_64", "4AS:httpd-0:2.0.52-32.3.ent.i386", "4AS:httpd-0:2.0.52-32.3.ent.ia64", "4AS:httpd-0:2.0.52-32.3.ent.ppc", "4AS:httpd-0:2.0.52-32.3.ent.s390", "4AS:httpd-0:2.0.52-32.3.ent.s390x", "4AS:httpd-0:2.0.52-32.3.ent.src", "4AS:httpd-0:2.0.52-32.3.ent.x86_64", "4AS:httpd-debuginfo-0:2.0.52-32.3.ent.i386", "4AS:httpd-debuginfo-0:2.0.52-32.3.ent.ia64", "4AS:httpd-debuginfo-0:2.0.52-32.3.ent.ppc", "4AS:httpd-debuginfo-0:2.0.52-32.3.ent.s390", "4AS:httpd-debuginfo-0:2.0.52-32.3.ent.s390x", "4AS:httpd-debuginfo-0:2.0.52-32.3.ent.x86_64", "4AS:httpd-devel-0:2.0.52-32.3.ent.i386", "4AS:httpd-devel-0:2.0.52-32.3.ent.ia64", "4AS:httpd-devel-0:2.0.52-32.3.ent.ppc", "4AS:httpd-devel-0:2.0.52-32.3.ent.s390", "4AS:httpd-devel-0:2.0.52-32.3.ent.s390x", "4AS:httpd-devel-0:2.0.52-32.3.ent.x86_64", "4AS:httpd-manual-0:2.0.52-32.3.ent.i386", "4AS:httpd-manual-0:2.0.52-32.3.ent.ia64", "4AS:httpd-manual-0:2.0.52-32.3.ent.ppc", "4AS:httpd-manual-0:2.0.52-32.3.ent.s390", "4AS:httpd-manual-0:2.0.52-32.3.ent.s390x", "4AS:httpd-manual-0:2.0.52-32.3.ent.x86_64", "4AS:httpd-suexec-0:2.0.52-32.3.ent.i386", "4AS:httpd-suexec-0:2.0.52-32.3.ent.ia64", "4AS:httpd-suexec-0:2.0.52-32.3.ent.ppc", "4AS:httpd-suexec-0:2.0.52-32.3.ent.s390", "4AS:httpd-suexec-0:2.0.52-32.3.ent.s390x", "4AS:httpd-suexec-0:2.0.52-32.3.ent.x86_64", "4AS:mod_ssl-1:2.0.52-32.3.ent.i386", "4AS:mod_ssl-1:2.0.52-32.3.ent.ia64", "4AS:mod_ssl-1:2.0.52-32.3.ent.ppc", "4AS:mod_ssl-1:2.0.52-32.3.ent.s390", "4AS:mod_ssl-1:2.0.52-32.3.ent.s390x", "4AS:mod_ssl-1:2.0.52-32.3.ent.x86_64", "4Desktop:httpd-0:2.0.52-32.3.ent.i386", "4Desktop:httpd-0:2.0.52-32.3.ent.ia64", "4Desktop:httpd-0:2.0.52-32.3.ent.ppc", "4Desktop:httpd-0:2.0.52-32.3.ent.s390", "4Desktop:httpd-0:2.0.52-32.3.ent.s390x", "4Desktop:httpd-0:2.0.52-32.3.ent.src", "4Desktop:httpd-0:2.0.52-32.3.ent.x86_64", "4Desktop:httpd-debuginfo-0:2.0.52-32.3.ent.i386", "4Desktop:httpd-debuginfo-0:2.0.52-32.3.ent.ia64", "4Desktop:httpd-debuginfo-0:2.0.52-32.3.ent.ppc", "4Desktop:httpd-debuginfo-0:2.0.52-32.3.ent.s390", "4Desktop:httpd-debuginfo-0:2.0.52-32.3.ent.s390x", "4Desktop:httpd-debuginfo-0:2.0.52-32.3.ent.x86_64", "4Desktop:httpd-devel-0:2.0.52-32.3.ent.i386", "4Desktop:httpd-devel-0:2.0.52-32.3.ent.ia64", "4Desktop:httpd-devel-0:2.0.52-32.3.ent.ppc", "4Desktop:httpd-devel-0:2.0.52-32.3.ent.s390", "4Desktop:httpd-devel-0:2.0.52-32.3.ent.s390x", "4Desktop:httpd-devel-0:2.0.52-32.3.ent.x86_64", "4Desktop:httpd-manual-0:2.0.52-32.3.ent.i386", "4Desktop:httpd-manual-0:2.0.52-32.3.ent.ia64", "4Desktop:httpd-manual-0:2.0.52-32.3.ent.ppc", "4Desktop:httpd-manual-0:2.0.52-32.3.ent.s390", "4Desktop:httpd-manual-0:2.0.52-32.3.ent.s390x", "4Desktop:httpd-manual-0:2.0.52-32.3.ent.x86_64", "4Desktop:httpd-suexec-0:2.0.52-32.3.ent.i386", "4Desktop:httpd-suexec-0:2.0.52-32.3.ent.ia64", "4Desktop:httpd-suexec-0:2.0.52-32.3.ent.ppc", "4Desktop:httpd-suexec-0:2.0.52-32.3.ent.s390", "4Desktop:httpd-suexec-0:2.0.52-32.3.ent.s390x", "4Desktop:httpd-suexec-0:2.0.52-32.3.ent.x86_64", "4Desktop:mod_ssl-1:2.0.52-32.3.ent.i386", "4Desktop:mod_ssl-1:2.0.52-32.3.ent.ia64", "4Desktop:mod_ssl-1:2.0.52-32.3.ent.ppc", "4Desktop:mod_ssl-1:2.0.52-32.3.ent.s390", "4Desktop:mod_ssl-1:2.0.52-32.3.ent.s390x", "4Desktop:mod_ssl-1:2.0.52-32.3.ent.x86_64", "4ES:httpd-0:2.0.52-32.3.ent.i386", "4ES:httpd-0:2.0.52-32.3.ent.ia64", "4ES:httpd-0:2.0.52-32.3.ent.ppc", "4ES:httpd-0:2.0.52-32.3.ent.s390", "4ES:httpd-0:2.0.52-32.3.ent.s390x", "4ES:httpd-0:2.0.52-32.3.ent.src", "4ES:httpd-0:2.0.52-32.3.ent.x86_64", "4ES:httpd-debuginfo-0:2.0.52-32.3.ent.i386", "4ES:httpd-debuginfo-0:2.0.52-32.3.ent.ia64", "4ES:httpd-debuginfo-0:2.0.52-32.3.ent.ppc", "4ES:httpd-debuginfo-0:2.0.52-32.3.ent.s390", "4ES:httpd-debuginfo-0:2.0.52-32.3.ent.s390x", "4ES:httpd-debuginfo-0:2.0.52-32.3.ent.x86_64", "4ES:httpd-devel-0:2.0.52-32.3.ent.i386", "4ES:httpd-devel-0:2.0.52-32.3.ent.ia64", "4ES:httpd-devel-0:2.0.52-32.3.ent.ppc", "4ES:httpd-devel-0:2.0.52-32.3.ent.s390", "4ES:httpd-devel-0:2.0.52-32.3.ent.s390x", "4ES:httpd-devel-0:2.0.52-32.3.ent.x86_64", "4ES:httpd-manual-0:2.0.52-32.3.ent.i386", "4ES:httpd-manual-0:2.0.52-32.3.ent.ia64", "4ES:httpd-manual-0:2.0.52-32.3.ent.ppc", "4ES:httpd-manual-0:2.0.52-32.3.ent.s390", "4ES:httpd-manual-0:2.0.52-32.3.ent.s390x", "4ES:httpd-manual-0:2.0.52-32.3.ent.x86_64", "4ES:httpd-suexec-0:2.0.52-32.3.ent.i386", "4ES:httpd-suexec-0:2.0.52-32.3.ent.ia64", "4ES:httpd-suexec-0:2.0.52-32.3.ent.ppc", "4ES:httpd-suexec-0:2.0.52-32.3.ent.s390", "4ES:httpd-suexec-0:2.0.52-32.3.ent.s390x", "4ES:httpd-suexec-0:2.0.52-32.3.ent.x86_64", "4ES:mod_ssl-1:2.0.52-32.3.ent.i386", "4ES:mod_ssl-1:2.0.52-32.3.ent.ia64", "4ES:mod_ssl-1:2.0.52-32.3.ent.ppc", "4ES:mod_ssl-1:2.0.52-32.3.ent.s390", "4ES:mod_ssl-1:2.0.52-32.3.ent.s390x", "4ES:mod_ssl-1:2.0.52-32.3.ent.x86_64", "4WS:httpd-0:2.0.52-32.3.ent.i386", "4WS:httpd-0:2.0.52-32.3.ent.ia64", "4WS:httpd-0:2.0.52-32.3.ent.ppc", "4WS:httpd-0:2.0.52-32.3.ent.s390", "4WS:httpd-0:2.0.52-32.3.ent.s390x", "4WS:httpd-0:2.0.52-32.3.ent.src", "4WS:httpd-0:2.0.52-32.3.ent.x86_64", "4WS:httpd-debuginfo-0:2.0.52-32.3.ent.i386", "4WS:httpd-debuginfo-0:2.0.52-32.3.ent.ia64", "4WS:httpd-debuginfo-0:2.0.52-32.3.ent.ppc", "4WS:httpd-debuginfo-0:2.0.52-32.3.ent.s390", "4WS:httpd-debuginfo-0:2.0.52-32.3.ent.s390x", "4WS:httpd-debuginfo-0:2.0.52-32.3.ent.x86_64", "4WS:httpd-devel-0:2.0.52-32.3.ent.i386", "4WS:httpd-devel-0:2.0.52-32.3.ent.ia64", "4WS:httpd-devel-0:2.0.52-32.3.ent.ppc", "4WS:httpd-devel-0:2.0.52-32.3.ent.s390", "4WS:httpd-devel-0:2.0.52-32.3.ent.s390x", "4WS:httpd-devel-0:2.0.52-32.3.ent.x86_64", "4WS:httpd-manual-0:2.0.52-32.3.ent.i386", "4WS:httpd-manual-0:2.0.52-32.3.ent.ia64", "4WS:httpd-manual-0:2.0.52-32.3.ent.ppc", "4WS:httpd-manual-0:2.0.52-32.3.ent.s390", "4WS:httpd-manual-0:2.0.52-32.3.ent.s390x", "4WS:httpd-manual-0:2.0.52-32.3.ent.x86_64", "4WS:httpd-suexec-0:2.0.52-32.3.ent.i386", "4WS:httpd-suexec-0:2.0.52-32.3.ent.ia64", "4WS:httpd-suexec-0:2.0.52-32.3.ent.ppc", "4WS:httpd-suexec-0:2.0.52-32.3.ent.s390", "4WS:httpd-suexec-0:2.0.52-32.3.ent.s390x", "4WS:httpd-suexec-0:2.0.52-32.3.ent.x86_64", "4WS:mod_ssl-1:2.0.52-32.3.ent.i386", "4WS:mod_ssl-1:2.0.52-32.3.ent.ia64", "4WS:mod_ssl-1:2.0.52-32.3.ent.ppc", "4WS:mod_ssl-1:2.0.52-32.3.ent.s390", "4WS:mod_ssl-1:2.0.52-32.3.ent.s390x", "4WS:mod_ssl-1:2.0.52-32.3.ent.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-3304", }, { category: "external", summary: "RHBZ#245111", url: "https://bugzilla.redhat.com/show_bug.cgi?id=245111", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-3304", url: "https://www.cve.org/CVERecord?id=CVE-2007-3304", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-3304", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-3304", }, ], release_date: "2007-06-19T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2007-07-13T07:48:00+00:00", details: "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied. \n\nThis update is available via Red Hat Network. Details on how to use \nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/FAQ_58_10188", product_ids: [ "3AS:httpd-0:2.0.46-68.ent.i386", "3AS:httpd-0:2.0.46-68.ent.ia64", "3AS:httpd-0:2.0.46-68.ent.ppc", "3AS:httpd-0:2.0.46-68.ent.s390", "3AS:httpd-0:2.0.46-68.ent.s390x", "3AS:httpd-0:2.0.46-68.ent.src", "3AS:httpd-0:2.0.46-68.ent.x86_64", "3AS:httpd-debuginfo-0:2.0.46-68.ent.i386", "3AS:httpd-debuginfo-0:2.0.46-68.ent.ia64", "3AS:httpd-debuginfo-0:2.0.46-68.ent.ppc", "3AS:httpd-debuginfo-0:2.0.46-68.ent.s390", "3AS:httpd-debuginfo-0:2.0.46-68.ent.s390x", "3AS:httpd-debuginfo-0:2.0.46-68.ent.x86_64", "3AS:httpd-devel-0:2.0.46-68.ent.i386", "3AS:httpd-devel-0:2.0.46-68.ent.ia64", "3AS:httpd-devel-0:2.0.46-68.ent.ppc", "3AS:httpd-devel-0:2.0.46-68.ent.s390", "3AS:httpd-devel-0:2.0.46-68.ent.s390x", "3AS:httpd-devel-0:2.0.46-68.ent.x86_64", "3AS:mod_ssl-1:2.0.46-68.ent.i386", "3AS:mod_ssl-1:2.0.46-68.ent.ia64", "3AS:mod_ssl-1:2.0.46-68.ent.ppc", "3AS:mod_ssl-1:2.0.46-68.ent.s390", "3AS:mod_ssl-1:2.0.46-68.ent.s390x", "3AS:mod_ssl-1:2.0.46-68.ent.x86_64", "3Desktop:httpd-0:2.0.46-68.ent.i386", "3Desktop:httpd-0:2.0.46-68.ent.ia64", "3Desktop:httpd-0:2.0.46-68.ent.ppc", "3Desktop:httpd-0:2.0.46-68.ent.s390", "3Desktop:httpd-0:2.0.46-68.ent.s390x", "3Desktop:httpd-0:2.0.46-68.ent.src", "3Desktop:httpd-0:2.0.46-68.ent.x86_64", "3Desktop:httpd-debuginfo-0:2.0.46-68.ent.i386", "3Desktop:httpd-debuginfo-0:2.0.46-68.ent.ia64", "3Desktop:httpd-debuginfo-0:2.0.46-68.ent.ppc", "3Desktop:httpd-debuginfo-0:2.0.46-68.ent.s390", "3Desktop:httpd-debuginfo-0:2.0.46-68.ent.s390x", "3Desktop:httpd-debuginfo-0:2.0.46-68.ent.x86_64", "3Desktop:httpd-devel-0:2.0.46-68.ent.i386", "3Desktop:httpd-devel-0:2.0.46-68.ent.ia64", "3Desktop:httpd-devel-0:2.0.46-68.ent.ppc", "3Desktop:httpd-devel-0:2.0.46-68.ent.s390", "3Desktop:httpd-devel-0:2.0.46-68.ent.s390x", "3Desktop:httpd-devel-0:2.0.46-68.ent.x86_64", "3Desktop:mod_ssl-1:2.0.46-68.ent.i386", "3Desktop:mod_ssl-1:2.0.46-68.ent.ia64", "3Desktop:mod_ssl-1:2.0.46-68.ent.ppc", "3Desktop:mod_ssl-1:2.0.46-68.ent.s390", "3Desktop:mod_ssl-1:2.0.46-68.ent.s390x", "3Desktop:mod_ssl-1:2.0.46-68.ent.x86_64", "3ES:httpd-0:2.0.46-68.ent.i386", "3ES:httpd-0:2.0.46-68.ent.ia64", "3ES:httpd-0:2.0.46-68.ent.ppc", "3ES:httpd-0:2.0.46-68.ent.s390", "3ES:httpd-0:2.0.46-68.ent.s390x", "3ES:httpd-0:2.0.46-68.ent.src", "3ES:httpd-0:2.0.46-68.ent.x86_64", "3ES:httpd-debuginfo-0:2.0.46-68.ent.i386", "3ES:httpd-debuginfo-0:2.0.46-68.ent.ia64", "3ES:httpd-debuginfo-0:2.0.46-68.ent.ppc", "3ES:httpd-debuginfo-0:2.0.46-68.ent.s390", "3ES:httpd-debuginfo-0:2.0.46-68.ent.s390x", "3ES:httpd-debuginfo-0:2.0.46-68.ent.x86_64", "3ES:httpd-devel-0:2.0.46-68.ent.i386", "3ES:httpd-devel-0:2.0.46-68.ent.ia64", "3ES:httpd-devel-0:2.0.46-68.ent.ppc", "3ES:httpd-devel-0:2.0.46-68.ent.s390", "3ES:httpd-devel-0:2.0.46-68.ent.s390x", "3ES:httpd-devel-0:2.0.46-68.ent.x86_64", "3ES:mod_ssl-1:2.0.46-68.ent.i386", "3ES:mod_ssl-1:2.0.46-68.ent.ia64", "3ES:mod_ssl-1:2.0.46-68.ent.ppc", "3ES:mod_ssl-1:2.0.46-68.ent.s390", "3ES:mod_ssl-1:2.0.46-68.ent.s390x", "3ES:mod_ssl-1:2.0.46-68.ent.x86_64", "3WS:httpd-0:2.0.46-68.ent.i386", "3WS:httpd-0:2.0.46-68.ent.ia64", "3WS:httpd-0:2.0.46-68.ent.ppc", "3WS:httpd-0:2.0.46-68.ent.s390", "3WS:httpd-0:2.0.46-68.ent.s390x", "3WS:httpd-0:2.0.46-68.ent.src", "3WS:httpd-0:2.0.46-68.ent.x86_64", "3WS:httpd-debuginfo-0:2.0.46-68.ent.i386", "3WS:httpd-debuginfo-0:2.0.46-68.ent.ia64", "3WS:httpd-debuginfo-0:2.0.46-68.ent.ppc", "3WS:httpd-debuginfo-0:2.0.46-68.ent.s390", "3WS:httpd-debuginfo-0:2.0.46-68.ent.s390x", "3WS:httpd-debuginfo-0:2.0.46-68.ent.x86_64", "3WS:httpd-devel-0:2.0.46-68.ent.i386", "3WS:httpd-devel-0:2.0.46-68.ent.ia64", "3WS:httpd-devel-0:2.0.46-68.ent.ppc", "3WS:httpd-devel-0:2.0.46-68.ent.s390", "3WS:httpd-devel-0:2.0.46-68.ent.s390x", "3WS:httpd-devel-0:2.0.46-68.ent.x86_64", "3WS:mod_ssl-1:2.0.46-68.ent.i386", "3WS:mod_ssl-1:2.0.46-68.ent.ia64", "3WS:mod_ssl-1:2.0.46-68.ent.ppc", "3WS:mod_ssl-1:2.0.46-68.ent.s390", "3WS:mod_ssl-1:2.0.46-68.ent.s390x", "3WS:mod_ssl-1:2.0.46-68.ent.x86_64", "4AS:httpd-0:2.0.52-32.3.ent.i386", "4AS:httpd-0:2.0.52-32.3.ent.ia64", "4AS:httpd-0:2.0.52-32.3.ent.ppc", "4AS:httpd-0:2.0.52-32.3.ent.s390", "4AS:httpd-0:2.0.52-32.3.ent.s390x", "4AS:httpd-0:2.0.52-32.3.ent.src", "4AS:httpd-0:2.0.52-32.3.ent.x86_64", "4AS:httpd-debuginfo-0:2.0.52-32.3.ent.i386", "4AS:httpd-debuginfo-0:2.0.52-32.3.ent.ia64", "4AS:httpd-debuginfo-0:2.0.52-32.3.ent.ppc", "4AS:httpd-debuginfo-0:2.0.52-32.3.ent.s390", "4AS:httpd-debuginfo-0:2.0.52-32.3.ent.s390x", "4AS:httpd-debuginfo-0:2.0.52-32.3.ent.x86_64", "4AS:httpd-devel-0:2.0.52-32.3.ent.i386", "4AS:httpd-devel-0:2.0.52-32.3.ent.ia64", "4AS:httpd-devel-0:2.0.52-32.3.ent.ppc", "4AS:httpd-devel-0:2.0.52-32.3.ent.s390", "4AS:httpd-devel-0:2.0.52-32.3.ent.s390x", "4AS:httpd-devel-0:2.0.52-32.3.ent.x86_64", "4AS:httpd-manual-0:2.0.52-32.3.ent.i386", "4AS:httpd-manual-0:2.0.52-32.3.ent.ia64", "4AS:httpd-manual-0:2.0.52-32.3.ent.ppc", "4AS:httpd-manual-0:2.0.52-32.3.ent.s390", "4AS:httpd-manual-0:2.0.52-32.3.ent.s390x", "4AS:httpd-manual-0:2.0.52-32.3.ent.x86_64", "4AS:httpd-suexec-0:2.0.52-32.3.ent.i386", "4AS:httpd-suexec-0:2.0.52-32.3.ent.ia64", "4AS:httpd-suexec-0:2.0.52-32.3.ent.ppc", "4AS:httpd-suexec-0:2.0.52-32.3.ent.s390", "4AS:httpd-suexec-0:2.0.52-32.3.ent.s390x", "4AS:httpd-suexec-0:2.0.52-32.3.ent.x86_64", "4AS:mod_ssl-1:2.0.52-32.3.ent.i386", "4AS:mod_ssl-1:2.0.52-32.3.ent.ia64", "4AS:mod_ssl-1:2.0.52-32.3.ent.ppc", "4AS:mod_ssl-1:2.0.52-32.3.ent.s390", "4AS:mod_ssl-1:2.0.52-32.3.ent.s390x", "4AS:mod_ssl-1:2.0.52-32.3.ent.x86_64", "4Desktop:httpd-0:2.0.52-32.3.ent.i386", "4Desktop:httpd-0:2.0.52-32.3.ent.ia64", "4Desktop:httpd-0:2.0.52-32.3.ent.ppc", "4Desktop:httpd-0:2.0.52-32.3.ent.s390", "4Desktop:httpd-0:2.0.52-32.3.ent.s390x", "4Desktop:httpd-0:2.0.52-32.3.ent.src", "4Desktop:httpd-0:2.0.52-32.3.ent.x86_64", "4Desktop:httpd-debuginfo-0:2.0.52-32.3.ent.i386", "4Desktop:httpd-debuginfo-0:2.0.52-32.3.ent.ia64", "4Desktop:httpd-debuginfo-0:2.0.52-32.3.ent.ppc", "4Desktop:httpd-debuginfo-0:2.0.52-32.3.ent.s390", "4Desktop:httpd-debuginfo-0:2.0.52-32.3.ent.s390x", "4Desktop:httpd-debuginfo-0:2.0.52-32.3.ent.x86_64", "4Desktop:httpd-devel-0:2.0.52-32.3.ent.i386", "4Desktop:httpd-devel-0:2.0.52-32.3.ent.ia64", "4Desktop:httpd-devel-0:2.0.52-32.3.ent.ppc", "4Desktop:httpd-devel-0:2.0.52-32.3.ent.s390", "4Desktop:httpd-devel-0:2.0.52-32.3.ent.s390x", "4Desktop:httpd-devel-0:2.0.52-32.3.ent.x86_64", "4Desktop:httpd-manual-0:2.0.52-32.3.ent.i386", "4Desktop:httpd-manual-0:2.0.52-32.3.ent.ia64", "4Desktop:httpd-manual-0:2.0.52-32.3.ent.ppc", "4Desktop:httpd-manual-0:2.0.52-32.3.ent.s390", "4Desktop:httpd-manual-0:2.0.52-32.3.ent.s390x", "4Desktop:httpd-manual-0:2.0.52-32.3.ent.x86_64", "4Desktop:httpd-suexec-0:2.0.52-32.3.ent.i386", "4Desktop:httpd-suexec-0:2.0.52-32.3.ent.ia64", "4Desktop:httpd-suexec-0:2.0.52-32.3.ent.ppc", "4Desktop:httpd-suexec-0:2.0.52-32.3.ent.s390", "4Desktop:httpd-suexec-0:2.0.52-32.3.ent.s390x", "4Desktop:httpd-suexec-0:2.0.52-32.3.ent.x86_64", "4Desktop:mod_ssl-1:2.0.52-32.3.ent.i386", "4Desktop:mod_ssl-1:2.0.52-32.3.ent.ia64", "4Desktop:mod_ssl-1:2.0.52-32.3.ent.ppc", "4Desktop:mod_ssl-1:2.0.52-32.3.ent.s390", "4Desktop:mod_ssl-1:2.0.52-32.3.ent.s390x", "4Desktop:mod_ssl-1:2.0.52-32.3.ent.x86_64", "4ES:httpd-0:2.0.52-32.3.ent.i386", "4ES:httpd-0:2.0.52-32.3.ent.ia64", "4ES:httpd-0:2.0.52-32.3.ent.ppc", "4ES:httpd-0:2.0.52-32.3.ent.s390", "4ES:httpd-0:2.0.52-32.3.ent.s390x", "4ES:httpd-0:2.0.52-32.3.ent.src", "4ES:httpd-0:2.0.52-32.3.ent.x86_64", "4ES:httpd-debuginfo-0:2.0.52-32.3.ent.i386", "4ES:httpd-debuginfo-0:2.0.52-32.3.ent.ia64", "4ES:httpd-debuginfo-0:2.0.52-32.3.ent.ppc", "4ES:httpd-debuginfo-0:2.0.52-32.3.ent.s390", "4ES:httpd-debuginfo-0:2.0.52-32.3.ent.s390x", "4ES:httpd-debuginfo-0:2.0.52-32.3.ent.x86_64", "4ES:httpd-devel-0:2.0.52-32.3.ent.i386", "4ES:httpd-devel-0:2.0.52-32.3.ent.ia64", "4ES:httpd-devel-0:2.0.52-32.3.ent.ppc", "4ES:httpd-devel-0:2.0.52-32.3.ent.s390", "4ES:httpd-devel-0:2.0.52-32.3.ent.s390x", "4ES:httpd-devel-0:2.0.52-32.3.ent.x86_64", "4ES:httpd-manual-0:2.0.52-32.3.ent.i386", "4ES:httpd-manual-0:2.0.52-32.3.ent.ia64", "4ES:httpd-manual-0:2.0.52-32.3.ent.ppc", "4ES:httpd-manual-0:2.0.52-32.3.ent.s390", "4ES:httpd-manual-0:2.0.52-32.3.ent.s390x", "4ES:httpd-manual-0:2.0.52-32.3.ent.x86_64", "4ES:httpd-suexec-0:2.0.52-32.3.ent.i386", "4ES:httpd-suexec-0:2.0.52-32.3.ent.ia64", "4ES:httpd-suexec-0:2.0.52-32.3.ent.ppc", "4ES:httpd-suexec-0:2.0.52-32.3.ent.s390", "4ES:httpd-suexec-0:2.0.52-32.3.ent.s390x", "4ES:httpd-suexec-0:2.0.52-32.3.ent.x86_64", "4ES:mod_ssl-1:2.0.52-32.3.ent.i386", "4ES:mod_ssl-1:2.0.52-32.3.ent.ia64", "4ES:mod_ssl-1:2.0.52-32.3.ent.ppc", "4ES:mod_ssl-1:2.0.52-32.3.ent.s390", "4ES:mod_ssl-1:2.0.52-32.3.ent.s390x", "4ES:mod_ssl-1:2.0.52-32.3.ent.x86_64", "4WS:httpd-0:2.0.52-32.3.ent.i386", "4WS:httpd-0:2.0.52-32.3.ent.ia64", "4WS:httpd-0:2.0.52-32.3.ent.ppc", "4WS:httpd-0:2.0.52-32.3.ent.s390", "4WS:httpd-0:2.0.52-32.3.ent.s390x", "4WS:httpd-0:2.0.52-32.3.ent.src", "4WS:httpd-0:2.0.52-32.3.ent.x86_64", "4WS:httpd-debuginfo-0:2.0.52-32.3.ent.i386", "4WS:httpd-debuginfo-0:2.0.52-32.3.ent.ia64", "4WS:httpd-debuginfo-0:2.0.52-32.3.ent.ppc", "4WS:httpd-debuginfo-0:2.0.52-32.3.ent.s390", "4WS:httpd-debuginfo-0:2.0.52-32.3.ent.s390x", "4WS:httpd-debuginfo-0:2.0.52-32.3.ent.x86_64", "4WS:httpd-devel-0:2.0.52-32.3.ent.i386", "4WS:httpd-devel-0:2.0.52-32.3.ent.ia64", "4WS:httpd-devel-0:2.0.52-32.3.ent.ppc", "4WS:httpd-devel-0:2.0.52-32.3.ent.s390", "4WS:httpd-devel-0:2.0.52-32.3.ent.s390x", "4WS:httpd-devel-0:2.0.52-32.3.ent.x86_64", "4WS:httpd-manual-0:2.0.52-32.3.ent.i386", "4WS:httpd-manual-0:2.0.52-32.3.ent.ia64", "4WS:httpd-manual-0:2.0.52-32.3.ent.ppc", "4WS:httpd-manual-0:2.0.52-32.3.ent.s390", "4WS:httpd-manual-0:2.0.52-32.3.ent.s390x", "4WS:httpd-manual-0:2.0.52-32.3.ent.x86_64", "4WS:httpd-suexec-0:2.0.52-32.3.ent.i386", "4WS:httpd-suexec-0:2.0.52-32.3.ent.ia64", "4WS:httpd-suexec-0:2.0.52-32.3.ent.ppc", "4WS:httpd-suexec-0:2.0.52-32.3.ent.s390", "4WS:httpd-suexec-0:2.0.52-32.3.ent.s390x", "4WS:httpd-suexec-0:2.0.52-32.3.ent.x86_64", "4WS:mod_ssl-1:2.0.52-32.3.ent.i386", "4WS:mod_ssl-1:2.0.52-32.3.ent.ia64", "4WS:mod_ssl-1:2.0.52-32.3.ent.ppc", "4WS:mod_ssl-1:2.0.52-32.3.ent.s390", "4WS:mod_ssl-1:2.0.52-32.3.ent.s390x", "4WS:mod_ssl-1:2.0.52-32.3.ent.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2007:0662", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "httpd scoreboard lack of PID protection", }, ], }
RHSA-2010:0602
Vulnerability from csaf_redhat
Published
2010-08-04 21:30
Modified
2024-12-15 18:14
Summary
Red Hat Security Advisory: Red Hat Certificate System 7.3 security update
Notes
Topic
Updated packages that fix multiple security issues and rebase various
components are now available for Red Hat Certificate System 7.3.
The Red Hat Security Response Team has rated this update as having moderate
security impact. Common Vulnerability Scoring System (CVSS) base scores,
which give detailed severity ratings, are available for each vulnerability
from the CVE links in the References section.
Details
Red Hat Certificate System (RHCS) is an enterprise software system designed
to manage enterprise Public Key Infrastructure (PKI) deployments.
Multiple buffer overflow flaws were discovered in the way the pcscd daemon,
a resource manager that coordinates communications with smart card readers
and smart cards connected to the system, handled client requests. A local
user could create a specially-crafted request that would cause the pcscd
daemon to crash or, possibly, execute arbitrary code. (CVE-2010-0407,
CVE-2009-4901)
This erratum updates the Tomcat component shipped as part of Red Hat
Certificate System to version 5.5.23, to address multiple security issues.
In a typical operating environment, Tomcat is not exposed to users of
Certificate System in a vulnerable manner. These security updates will
reduce risk in unique Certificate System environments. (CVE-2005-2090,
CVE-2005-3510, CVE-2006-3835, CVE-2007-0450, CVE-2007-1358, CVE-2007-3382,
CVE-2007-3385, CVE-2007-5461, CVE-2007-5333, CVE-2008-0128, CVE-2008-1232,
CVE-2008-2370, CVE-2008-5515, CVE-2009-0033, CVE-2009-0580)
This erratum provides updated versions of the following components,
required by the updated Tomcat version: ant, avalon-logkit, axis,
classpathx-jaf, classpathx-mail, geronimo-specs, jakarta-commons-modeler,
log4j, mx4j, xerces-j2, and xml-commons.
A number of components have been updated to fix security issues for users
of Red Hat Certificate System for the Solaris operating system. These fixes
are for apr issue CVE-2009-2412; apr-util issues CVE-2009-0023,
CVE-2009-1955, CVE-2009-1956, and CVE-2009-2412; httpd issues
CVE-2006-3918, CVE-2006-5752, CVE-2007-1863, CVE-2007-3304, CVE-2007-3847,
CVE-2007-4465, CVE-2007-5000, CVE-2007-6388, CVE-2008-0005, CVE-2008-2364,
CVE-2008-2939, CVE-2009-1891, CVE-2009-3094, CVE-2009-3095, and
CVE-2010-0434; mod_perl issue CVE-2007-1349; and perl issues CVE-2007-5116
and CVE-2008-1927.
Note: Updated apr, apr-util, httpd, mod_perl, and perl packages were
previously available to users of Red Hat Certificate System for Red Hat
Enterprise Linux via the Red Hat Enterprise Linux 4 channels on the Red Hat
Network.
Additionally, the rhpki-ca, rhpki-kra, rhpki-ocsp, rhpki-tks,
rhpki-java-tools, and rhpki-native-tools packages were updated to address
some anomalous behavior on the Solaris operating system. (BZ#600513,
BZ#605760)
As well, this update provides an updated rhpki-manage package, which
includes installation and uninstall scripts for Red Hat Certificate System
that have been updated with the list of packages required by the Tomcat
component, and an updated dependency on the NSS and NSPR packages.
All users of Red Hat Certificate System are advised to upgrade to these
updated packages, which correct these issues. Refer to the Red Hat
Certificate System Administration Guide, linked to in the References, for
details on how to install the updated packages on the Solaris operating
system. After installing this update, all Red Hat Certificate System
subsystems must be restarted ("/etc/init.d/[instance-name] restart") for
the update to take effect.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ document: { aggregate_severity: { namespace: "https://access.redhat.com/security/updates/classification/", text: "Moderate", }, category: "csaf_security_advisory", csaf_version: "2.0", distribution: { text: "Copyright © Red Hat, Inc. All rights reserved.", tlp: { label: "WHITE", url: "https://www.first.org/tlp/", }, }, lang: "en", notes: [ { category: "summary", text: "Updated packages that fix multiple security issues and rebase various\ncomponents are now available for Red Hat Certificate System 7.3.\n\nThe Red Hat Security Response Team has rated this update as having moderate\nsecurity impact. Common Vulnerability Scoring System (CVSS) base scores,\nwhich give detailed severity ratings, are available for each vulnerability\nfrom the CVE links in the References section.", title: "Topic", }, { category: "general", text: "Red Hat Certificate System (RHCS) is an enterprise software system designed\nto manage enterprise Public Key Infrastructure (PKI) deployments.\n\nMultiple buffer overflow flaws were discovered in the way the pcscd daemon,\na resource manager that coordinates communications with smart card readers\nand smart cards connected to the system, handled client requests. A local\nuser could create a specially-crafted request that would cause the pcscd\ndaemon to crash or, possibly, execute arbitrary code. (CVE-2010-0407,\nCVE-2009-4901)\n\nThis erratum updates the Tomcat component shipped as part of Red Hat\nCertificate System to version 5.5.23, to address multiple security issues.\nIn a typical operating environment, Tomcat is not exposed to users of\nCertificate System in a vulnerable manner. These security updates will\nreduce risk in unique Certificate System environments. (CVE-2005-2090,\nCVE-2005-3510, CVE-2006-3835, CVE-2007-0450, CVE-2007-1358, CVE-2007-3382,\nCVE-2007-3385, CVE-2007-5461, CVE-2007-5333, CVE-2008-0128, CVE-2008-1232,\nCVE-2008-2370, CVE-2008-5515, CVE-2009-0033, CVE-2009-0580)\n\nThis erratum provides updated versions of the following components,\nrequired by the updated Tomcat version: ant, avalon-logkit, axis,\nclasspathx-jaf, classpathx-mail, geronimo-specs, jakarta-commons-modeler,\nlog4j, mx4j, xerces-j2, and xml-commons.\n\nA number of components have been updated to fix security issues for users\nof Red Hat Certificate System for the Solaris operating system. These fixes\nare for apr issue CVE-2009-2412; apr-util issues CVE-2009-0023,\nCVE-2009-1955, CVE-2009-1956, and CVE-2009-2412; httpd issues\nCVE-2006-3918, CVE-2006-5752, CVE-2007-1863, CVE-2007-3304, CVE-2007-3847,\nCVE-2007-4465, CVE-2007-5000, CVE-2007-6388, CVE-2008-0005, CVE-2008-2364,\nCVE-2008-2939, CVE-2009-1891, CVE-2009-3094, CVE-2009-3095, and\nCVE-2010-0434; mod_perl issue CVE-2007-1349; and perl issues CVE-2007-5116\nand CVE-2008-1927.\n\nNote: Updated apr, apr-util, httpd, mod_perl, and perl packages were\npreviously available to users of Red Hat Certificate System for Red Hat\nEnterprise Linux via the Red Hat Enterprise Linux 4 channels on the Red Hat\nNetwork.\n\nAdditionally, the rhpki-ca, rhpki-kra, rhpki-ocsp, rhpki-tks,\nrhpki-java-tools, and rhpki-native-tools packages were updated to address\nsome anomalous behavior on the Solaris operating system. (BZ#600513,\nBZ#605760)\n\nAs well, this update provides an updated rhpki-manage package, which\nincludes installation and uninstall scripts for Red Hat Certificate System\nthat have been updated with the list of packages required by the Tomcat\ncomponent, and an updated dependency on the NSS and NSPR packages.\n\nAll users of Red Hat Certificate System are advised to upgrade to these\nupdated packages, which correct these issues. Refer to the Red Hat\nCertificate System Administration Guide, linked to in the References, for\ndetails on how to install the updated packages on the Solaris operating\nsystem. After installing this update, all Red Hat Certificate System\nsubsystems must be restarted (\"/etc/init.d/[instance-name] restart\") for\nthe update to take effect.", title: "Details", }, { category: "legal_disclaimer", text: "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", title: "Terms of Use", }, ], publisher: { category: "vendor", contact_details: "https://access.redhat.com/security/team/contact/", issuing_authority: "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", name: "Red Hat Product Security", namespace: "https://www.redhat.com", }, references: [ { category: "self", summary: "https://access.redhat.com/errata/RHSA-2010:0602", url: "https://access.redhat.com/errata/RHSA-2010:0602", }, { category: "external", summary: "http://www.redhat.com/security/updates/classification/#moderate", url: "http://www.redhat.com/security/updates/classification/#moderate", }, { category: "external", summary: "http://www.redhat.com/docs/manuals/cert-system/7.3/html/Administration_Guide/Administration_Guide-Updating_Certificate_System_Packages-Updating_a_Solaris_9_system_using_pkgrm_and_pkgadd.html", url: "http://www.redhat.com/docs/manuals/cert-system/7.3/html/Administration_Guide/Administration_Guide-Updating_Certificate_System_Packages-Updating_a_Solaris_9_system_using_pkgrm_and_pkgadd.html", }, { category: "external", summary: "200732", url: "https://bugzilla.redhat.com/show_bug.cgi?id=200732", }, { category: "external", summary: "237079", url: "https://bugzilla.redhat.com/show_bug.cgi?id=237079", }, { category: "external", summary: "237080", url: "https://bugzilla.redhat.com/show_bug.cgi?id=237080", }, { category: "external", summary: "237084", url: "https://bugzilla.redhat.com/show_bug.cgi?id=237084", }, { category: "external", summary: "237085", url: "https://bugzilla.redhat.com/show_bug.cgi?id=237085", }, { category: "external", summary: "240423", url: "https://bugzilla.redhat.com/show_bug.cgi?id=240423", }, { category: "external", summary: "244658", url: "https://bugzilla.redhat.com/show_bug.cgi?id=244658", }, { category: "external", summary: "244803", url: "https://bugzilla.redhat.com/show_bug.cgi?id=244803", }, { category: "external", summary: "245111", url: "https://bugzilla.redhat.com/show_bug.cgi?id=245111", }, { category: "external", summary: "245112", url: "https://bugzilla.redhat.com/show_bug.cgi?id=245112", }, { category: "external", summary: "247972", url: "https://bugzilla.redhat.com/show_bug.cgi?id=247972", }, { category: "external", summary: "247976", url: "https://bugzilla.redhat.com/show_bug.cgi?id=247976", }, { category: "external", summary: "250731", url: "https://bugzilla.redhat.com/show_bug.cgi?id=250731", }, { category: "external", summary: "289511", url: "https://bugzilla.redhat.com/show_bug.cgi?id=289511", }, { category: "external", summary: "323571", url: "https://bugzilla.redhat.com/show_bug.cgi?id=323571", }, { category: "external", summary: "333791", url: "https://bugzilla.redhat.com/show_bug.cgi?id=333791", }, { category: "external", summary: "419931", url: "https://bugzilla.redhat.com/show_bug.cgi?id=419931", }, { category: "external", summary: "427228", url: "https://bugzilla.redhat.com/show_bug.cgi?id=427228", }, { category: "external", summary: "427739", url: "https://bugzilla.redhat.com/show_bug.cgi?id=427739", }, { category: "external", summary: "427766", url: "https://bugzilla.redhat.com/show_bug.cgi?id=427766", }, { category: "external", summary: "429821", url: "https://bugzilla.redhat.com/show_bug.cgi?id=429821", }, { category: "external", summary: "443928", url: "https://bugzilla.redhat.com/show_bug.cgi?id=443928", }, { category: "external", summary: "451615", url: "https://bugzilla.redhat.com/show_bug.cgi?id=451615", }, { category: "external", summary: "457597", url: "https://bugzilla.redhat.com/show_bug.cgi?id=457597", }, { category: "external", summary: "457934", url: "https://bugzilla.redhat.com/show_bug.cgi?id=457934", }, { category: "external", summary: "458250", url: "https://bugzilla.redhat.com/show_bug.cgi?id=458250", }, { category: "external", summary: "493381", url: "https://bugzilla.redhat.com/show_bug.cgi?id=493381", }, { category: "external", summary: "503928", url: "https://bugzilla.redhat.com/show_bug.cgi?id=503928", }, { category: "external", summary: "503978", url: "https://bugzilla.redhat.com/show_bug.cgi?id=503978", }, { category: "external", summary: "504390", url: "https://bugzilla.redhat.com/show_bug.cgi?id=504390", }, { category: "external", summary: "504555", url: "https://bugzilla.redhat.com/show_bug.cgi?id=504555", }, { category: "external", summary: "504753", url: "https://bugzilla.redhat.com/show_bug.cgi?id=504753", }, { category: "external", summary: "509125", url: "https://bugzilla.redhat.com/show_bug.cgi?id=509125", }, { category: "external", summary: "515698", url: "https://bugzilla.redhat.com/show_bug.cgi?id=515698", }, { category: "external", summary: "521619", url: "https://bugzilla.redhat.com/show_bug.cgi?id=521619", }, { category: "external", summary: "522209", url: "https://bugzilla.redhat.com/show_bug.cgi?id=522209", }, { category: "external", summary: "570171", url: "https://bugzilla.redhat.com/show_bug.cgi?id=570171", }, { category: "external", summary: "596426", url: "https://bugzilla.redhat.com/show_bug.cgi?id=596426", }, { category: "self", summary: "Canonical URL", url: "https://security.access.redhat.com/data/csaf/v2/advisories/2010/rhsa-2010_0602.json", }, ], title: "Red Hat Security Advisory: Red Hat Certificate System 7.3 security update", tracking: { current_release_date: "2024-12-15T18:14:44+00:00", generator: { date: "2024-12-15T18:14:44+00:00", engine: { name: "Red Hat SDEngine", version: "4.2.3", }, }, id: "RHSA-2010:0602", initial_release_date: "2010-08-04T21:30:00+00:00", revision_history: [ { date: "2010-08-04T21:30:00+00:00", number: "1", summary: "Initial version", }, { date: "2010-08-05T10:04:51+00:00", number: "2", summary: "Last updated version", }, { date: "2024-12-15T18:14:44+00:00", number: "3", summary: "Last generated version", }, ], status: "final", version: "3", }, }, product_tree: { branches: [ { branches: [ { branches: [ { category: "product_name", name: "Red Hat Certificate System 7.3 for 4AS", product: { name: "Red Hat Certificate System 7.3 for 4AS", product_id: "4AS-CERT-7.3", product_identification_helper: { cpe: "cpe:/a:redhat:certificate_system:7.3", }, }, }, { category: "product_name", name: "Red Hat Certificate System 7.3 for 4ES", product: { name: "Red Hat Certificate System 7.3 for 4ES", product_id: "4ES-CERT-7.3", product_identification_helper: { cpe: "cpe:/a:redhat:certificate_system:7.3", }, }, }, ], category: "product_family", name: "Red Hat Certificate System", }, { branches: [ { category: "product_version", name: "xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", product: { name: "xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", product_id: "xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/xml-commons-apis@1.3.02-2jpp_1rh?arch=noarch", }, }, }, { category: "product_version", name: "xml-commons-0:1.3.02-2jpp_1rh.noarch", product: { name: "xml-commons-0:1.3.02-2jpp_1rh.noarch", product_id: "xml-commons-0:1.3.02-2jpp_1rh.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/xml-commons@1.3.02-2jpp_1rh?arch=noarch", }, }, }, { category: "product_version", name: "xerces-j2-0:2.7.1-1jpp_1rh.noarch", product: { name: "xerces-j2-0:2.7.1-1jpp_1rh.noarch", product_id: "xerces-j2-0:2.7.1-1jpp_1rh.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/xerces-j2@2.7.1-1jpp_1rh?arch=noarch", }, }, }, { category: "product_version", name: "ant-0:1.6.5-1jpp_1rh.noarch", product: { name: "ant-0:1.6.5-1jpp_1rh.noarch", product_id: "ant-0:1.6.5-1jpp_1rh.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/ant@1.6.5-1jpp_1rh?arch=noarch", }, }, }, { category: "product_version", name: "avalon-logkit-0:1.2-2jpp_4rh.noarch", product: { name: "avalon-logkit-0:1.2-2jpp_4rh.noarch", product_id: "avalon-logkit-0:1.2-2jpp_4rh.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/avalon-logkit@1.2-2jpp_4rh?arch=noarch", }, }, }, { category: "product_version", name: "axis-0:1.2.1-1jpp_3rh.noarch", product: { name: "axis-0:1.2.1-1jpp_3rh.noarch", product_id: "axis-0:1.2.1-1jpp_3rh.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/axis@1.2.1-1jpp_3rh?arch=noarch", }, }, }, { category: "product_version", name: "classpathx-jaf-0:1.0-2jpp_6rh.noarch", product: { name: "classpathx-jaf-0:1.0-2jpp_6rh.noarch", product_id: "classpathx-jaf-0:1.0-2jpp_6rh.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/classpathx-jaf@1.0-2jpp_6rh?arch=noarch", }, }, }, { category: "product_version", name: "classpathx-mail-0:1.1.1-2jpp_8rh.noarch", product: { name: "classpathx-mail-0:1.1.1-2jpp_8rh.noarch", product_id: "classpathx-mail-0:1.1.1-2jpp_8rh.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/classpathx-mail@1.1.1-2jpp_8rh?arch=noarch", }, }, }, { category: "product_version", name: "log4j-0:1.2.12-1jpp_1rh.noarch", product: { name: "log4j-0:1.2.12-1jpp_1rh.noarch", product_id: "log4j-0:1.2.12-1jpp_1rh.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/log4j@1.2.12-1jpp_1rh?arch=noarch", }, }, }, { category: "product_version", name: "mx4j-1:3.0.1-1jpp_4rh.noarch", product: { name: "mx4j-1:3.0.1-1jpp_4rh.noarch", product_id: "mx4j-1:3.0.1-1jpp_4rh.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/mx4j@3.0.1-1jpp_4rh?arch=noarch&epoch=1", }, }, }, { category: "product_version", name: "jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", product: { name: "jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", product_id: "jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/jakarta-commons-modeler@2.0-3jpp_2rh?arch=noarch", }, }, }, { category: "product_version", name: "tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", product: { name: "tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", product_id: "tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/tomcat5-jsp-2.0-api@5.5.23-0jpp_4rh.16?arch=noarch", }, }, }, { category: "product_version", name: "tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", product: { name: "tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", product_id: "tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/tomcat5-servlet-2.4-api@5.5.23-0jpp_4rh.16?arch=noarch", }, }, }, { category: "product_version", name: "tomcat5-0:5.5.23-0jpp_4rh.16.noarch", product: { name: "tomcat5-0:5.5.23-0jpp_4rh.16.noarch", product_id: "tomcat5-0:5.5.23-0jpp_4rh.16.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/tomcat5@5.5.23-0jpp_4rh.16?arch=noarch", }, }, }, { category: "product_version", name: "tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", product: { name: "tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", product_id: "tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/tomcat5-common-lib@5.5.23-0jpp_4rh.16?arch=noarch", }, }, }, { category: "product_version", name: "tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", product: { name: "tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", product_id: "tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/tomcat5-jasper@5.5.23-0jpp_4rh.16?arch=noarch", }, }, }, { category: "product_version", name: "tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", product: { name: "tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", product_id: "tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/tomcat5-server-lib@5.5.23-0jpp_4rh.16?arch=noarch", }, }, }, { category: "product_version", name: "rhpki-manage-0:7.3.0-19.el4.noarch", product: { name: "rhpki-manage-0:7.3.0-19.el4.noarch", product_id: "rhpki-manage-0:7.3.0-19.el4.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/rhpki-manage@7.3.0-19.el4?arch=noarch", }, }, }, { category: "product_version", name: "rhpki-ca-0:7.3.0-20.el4.noarch", product: { name: "rhpki-ca-0:7.3.0-20.el4.noarch", product_id: "rhpki-ca-0:7.3.0-20.el4.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/rhpki-ca@7.3.0-20.el4?arch=noarch", }, }, }, { category: "product_version", name: "rhpki-kra-0:7.3.0-14.el4.noarch", product: { name: "rhpki-kra-0:7.3.0-14.el4.noarch", product_id: "rhpki-kra-0:7.3.0-14.el4.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/rhpki-kra@7.3.0-14.el4?arch=noarch", }, }, }, { category: "product_version", name: "rhpki-tks-0:7.3.0-13.el4.noarch", product: { name: "rhpki-tks-0:7.3.0-13.el4.noarch", product_id: "rhpki-tks-0:7.3.0-13.el4.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/rhpki-tks@7.3.0-13.el4?arch=noarch", }, }, }, { category: "product_version", name: "rhpki-ocsp-0:7.3.0-13.el4.noarch", product: { name: "rhpki-ocsp-0:7.3.0-13.el4.noarch", product_id: "rhpki-ocsp-0:7.3.0-13.el4.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/rhpki-ocsp@7.3.0-13.el4?arch=noarch", }, }, }, { category: "product_version", name: "rhpki-java-tools-0:7.3.0-10.el4.noarch", product: { name: "rhpki-java-tools-0:7.3.0-10.el4.noarch", product_id: "rhpki-java-tools-0:7.3.0-10.el4.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/rhpki-java-tools@7.3.0-10.el4?arch=noarch", }, }, }, { category: "product_version", name: "geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", product: { name: "geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", product_id: "geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/geronimo-specs@1.0-0.M4.1jpp_10rh?arch=noarch", }, }, }, { category: "product_version", name: "geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", product: { name: "geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", product_id: "geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/geronimo-jms-1.1-api@1.0-0.M4.1jpp_10rh?arch=noarch", }, }, }, { category: "product_version", name: "geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", product: { name: "geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", product_id: "geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/geronimo-jta-1.0.1B-api@1.0-0.M4.1jpp_10rh?arch=noarch", }, }, }, { category: "product_version", name: "geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", product: { name: "geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", product_id: "geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/geronimo-j2ee-deployment-1.1-api@1.0-0.M4.1jpp_10rh?arch=noarch", }, }, }, { category: "product_version", name: "geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", product: { name: "geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", product_id: "geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/geronimo-ejb-2.1-api@1.0-0.M4.1jpp_10rh?arch=noarch", }, }, }, { category: "product_version", name: "geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", product: { name: "geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", product_id: "geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/geronimo-servlet-2.4-api@1.0-0.M4.1jpp_10rh?arch=noarch", }, }, }, { category: "product_version", name: "geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", product: { name: "geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", product_id: "geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/geronimo-specs-javadoc@1.0-0.M4.1jpp_10rh?arch=noarch", }, }, }, { category: "product_version", name: "geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", product: { name: "geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", product_id: "geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/geronimo-j2ee-1.4-apis@1.0-0.M4.1jpp_10rh?arch=noarch", }, }, }, { category: "product_version", name: "geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", product: { name: "geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", product_id: "geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/geronimo-j2ee-connector-1.5-api@1.0-0.M4.1jpp_10rh?arch=noarch", }, }, }, { category: "product_version", name: "geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", product: { name: "geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", product_id: "geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/geronimo-jsp-2.0-api@1.0-0.M4.1jpp_10rh?arch=noarch", }, }, }, { category: "product_version", name: "geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", product: { name: "geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", product_id: "geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/geronimo-j2ee-management-1.0-api@1.0-0.M4.1jpp_10rh?arch=noarch", }, }, }, ], category: "architecture", name: "noarch", }, { branches: [ { category: "product_version", name: "xml-commons-0:1.3.02-2jpp_1rh.src", product: { name: "xml-commons-0:1.3.02-2jpp_1rh.src", product_id: "xml-commons-0:1.3.02-2jpp_1rh.src", product_identification_helper: { purl: "pkg:rpm/redhat/xml-commons@1.3.02-2jpp_1rh?arch=src", }, }, }, { category: "product_version", name: "xerces-j2-0:2.7.1-1jpp_1rh.src", product: { name: "xerces-j2-0:2.7.1-1jpp_1rh.src", product_id: "xerces-j2-0:2.7.1-1jpp_1rh.src", product_identification_helper: { purl: "pkg:rpm/redhat/xerces-j2@2.7.1-1jpp_1rh?arch=src", }, }, }, { category: "product_version", name: "ant-0:1.6.5-1jpp_1rh.src", product: { name: "ant-0:1.6.5-1jpp_1rh.src", product_id: "ant-0:1.6.5-1jpp_1rh.src", product_identification_helper: { purl: "pkg:rpm/redhat/ant@1.6.5-1jpp_1rh?arch=src", }, }, }, { category: "product_version", name: "avalon-logkit-0:1.2-2jpp_4rh.src", product: { name: "avalon-logkit-0:1.2-2jpp_4rh.src", product_id: "avalon-logkit-0:1.2-2jpp_4rh.src", product_identification_helper: { purl: "pkg:rpm/redhat/avalon-logkit@1.2-2jpp_4rh?arch=src", }, }, }, { category: "product_version", name: "axis-0:1.2.1-1jpp_3rh.src", product: { name: "axis-0:1.2.1-1jpp_3rh.src", product_id: "axis-0:1.2.1-1jpp_3rh.src", product_identification_helper: { purl: "pkg:rpm/redhat/axis@1.2.1-1jpp_3rh?arch=src", }, }, }, { category: "product_version", name: "classpathx-jaf-0:1.0-2jpp_6rh.src", product: { name: "classpathx-jaf-0:1.0-2jpp_6rh.src", product_id: "classpathx-jaf-0:1.0-2jpp_6rh.src", product_identification_helper: { purl: "pkg:rpm/redhat/classpathx-jaf@1.0-2jpp_6rh?arch=src", }, }, }, { category: "product_version", name: "classpathx-mail-0:1.1.1-2jpp_8rh.src", product: { name: "classpathx-mail-0:1.1.1-2jpp_8rh.src", product_id: "classpathx-mail-0:1.1.1-2jpp_8rh.src", product_identification_helper: { purl: "pkg:rpm/redhat/classpathx-mail@1.1.1-2jpp_8rh?arch=src", }, }, }, { category: "product_version", name: "log4j-0:1.2.12-1jpp_1rh.src", product: { name: "log4j-0:1.2.12-1jpp_1rh.src", product_id: "log4j-0:1.2.12-1jpp_1rh.src", product_identification_helper: { purl: "pkg:rpm/redhat/log4j@1.2.12-1jpp_1rh?arch=src", }, }, }, { category: "product_version", name: "mx4j-1:3.0.1-1jpp_4rh.src", product: { name: "mx4j-1:3.0.1-1jpp_4rh.src", product_id: "mx4j-1:3.0.1-1jpp_4rh.src", product_identification_helper: { purl: "pkg:rpm/redhat/mx4j@3.0.1-1jpp_4rh?arch=src&epoch=1", }, }, }, { category: "product_version", name: "jakarta-commons-modeler-0:2.0-3jpp_2rh.src", product: { name: "jakarta-commons-modeler-0:2.0-3jpp_2rh.src", product_id: "jakarta-commons-modeler-0:2.0-3jpp_2rh.src", product_identification_helper: { purl: "pkg:rpm/redhat/jakarta-commons-modeler@2.0-3jpp_2rh?arch=src", }, }, }, { category: "product_version", name: "tomcat5-0:5.5.23-0jpp_4rh.16.src", product: { name: "tomcat5-0:5.5.23-0jpp_4rh.16.src", product_id: "tomcat5-0:5.5.23-0jpp_4rh.16.src", product_identification_helper: { purl: "pkg:rpm/redhat/tomcat5@5.5.23-0jpp_4rh.16?arch=src", }, }, }, { category: "product_version", name: "pcsc-lite-0:1.3.3-3.el4.src", product: { name: "pcsc-lite-0:1.3.3-3.el4.src", product_id: "pcsc-lite-0:1.3.3-3.el4.src", product_identification_helper: { purl: "pkg:rpm/redhat/pcsc-lite@1.3.3-3.el4?arch=src", }, }, }, { category: "product_version", name: "geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", product: { name: "geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", product_id: "geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", product_identification_helper: { purl: "pkg:rpm/redhat/geronimo-specs@1.0-0.M4.1jpp_10rh?arch=src", }, }, }, ], category: "architecture", name: "src", }, { branches: [ { category: "product_version", name: "rhpki-native-tools-0:7.3.0-6.el4.x86_64", product: { name: "rhpki-native-tools-0:7.3.0-6.el4.x86_64", product_id: "rhpki-native-tools-0:7.3.0-6.el4.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/rhpki-native-tools@7.3.0-6.el4?arch=x86_64", }, }, }, { category: "product_version", name: "pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", product: { name: "pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", product_id: "pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/pcsc-lite-debuginfo@1.3.3-3.el4?arch=x86_64", }, }, }, { category: "product_version", name: "pcsc-lite-doc-0:1.3.3-3.el4.x86_64", product: { name: "pcsc-lite-doc-0:1.3.3-3.el4.x86_64", product_id: "pcsc-lite-doc-0:1.3.3-3.el4.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/pcsc-lite-doc@1.3.3-3.el4?arch=x86_64", }, }, }, { category: "product_version", name: "pcsc-lite-0:1.3.3-3.el4.x86_64", product: { name: "pcsc-lite-0:1.3.3-3.el4.x86_64", product_id: "pcsc-lite-0:1.3.3-3.el4.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/pcsc-lite@1.3.3-3.el4?arch=x86_64", }, }, }, { category: "product_version", name: "pcsc-lite-libs-0:1.3.3-3.el4.x86_64", product: { name: "pcsc-lite-libs-0:1.3.3-3.el4.x86_64", product_id: "pcsc-lite-libs-0:1.3.3-3.el4.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/pcsc-lite-libs@1.3.3-3.el4?arch=x86_64", }, }, }, ], category: "architecture", name: "x86_64", }, { branches: [ { category: "product_version", name: "rhpki-native-tools-0:7.3.0-6.el4.i386", product: { name: "rhpki-native-tools-0:7.3.0-6.el4.i386", product_id: "rhpki-native-tools-0:7.3.0-6.el4.i386", product_identification_helper: { purl: "pkg:rpm/redhat/rhpki-native-tools@7.3.0-6.el4?arch=i386", }, }, }, { category: "product_version", name: "pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", product: { name: "pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", product_id: "pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", product_identification_helper: { purl: "pkg:rpm/redhat/pcsc-lite-debuginfo@1.3.3-3.el4?arch=i386", }, }, }, { category: "product_version", name: "pcsc-lite-doc-0:1.3.3-3.el4.i386", product: { name: "pcsc-lite-doc-0:1.3.3-3.el4.i386", product_id: "pcsc-lite-doc-0:1.3.3-3.el4.i386", product_identification_helper: { purl: "pkg:rpm/redhat/pcsc-lite-doc@1.3.3-3.el4?arch=i386", }, }, }, { category: "product_version", name: "pcsc-lite-0:1.3.3-3.el4.i386", product: { name: "pcsc-lite-0:1.3.3-3.el4.i386", product_id: "pcsc-lite-0:1.3.3-3.el4.i386", product_identification_helper: { purl: "pkg:rpm/redhat/pcsc-lite@1.3.3-3.el4?arch=i386", }, }, }, { category: "product_version", name: "pcsc-lite-libs-0:1.3.3-3.el4.i386", product: { name: "pcsc-lite-libs-0:1.3.3-3.el4.i386", product_id: "pcsc-lite-libs-0:1.3.3-3.el4.i386", product_identification_helper: { purl: "pkg:rpm/redhat/pcsc-lite-libs@1.3.3-3.el4?arch=i386", }, }, }, ], category: "architecture", name: "i386", }, ], category: "vendor", name: "Red Hat", }, ], relationships: [ { category: "default_component_of", full_product_name: { name: "ant-0:1.6.5-1jpp_1rh.noarch as a component of Red Hat Certificate System 7.3 for 4AS", product_id: "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", }, product_reference: "ant-0:1.6.5-1jpp_1rh.noarch", relates_to_product_reference: "4AS-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "ant-0:1.6.5-1jpp_1rh.src as a component of Red Hat Certificate System 7.3 for 4AS", product_id: "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", }, product_reference: "ant-0:1.6.5-1jpp_1rh.src", relates_to_product_reference: "4AS-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "avalon-logkit-0:1.2-2jpp_4rh.noarch as a component of Red Hat Certificate System 7.3 for 4AS", product_id: "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", }, product_reference: "avalon-logkit-0:1.2-2jpp_4rh.noarch", relates_to_product_reference: "4AS-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "avalon-logkit-0:1.2-2jpp_4rh.src as a component of Red Hat Certificate System 7.3 for 4AS", product_id: "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", }, product_reference: "avalon-logkit-0:1.2-2jpp_4rh.src", relates_to_product_reference: "4AS-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "axis-0:1.2.1-1jpp_3rh.noarch as a component of Red Hat Certificate System 7.3 for 4AS", product_id: "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", }, product_reference: "axis-0:1.2.1-1jpp_3rh.noarch", relates_to_product_reference: "4AS-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "axis-0:1.2.1-1jpp_3rh.src as a component of Red Hat Certificate System 7.3 for 4AS", product_id: "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", }, product_reference: "axis-0:1.2.1-1jpp_3rh.src", relates_to_product_reference: "4AS-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "classpathx-jaf-0:1.0-2jpp_6rh.noarch as a component of Red Hat Certificate System 7.3 for 4AS", product_id: "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", }, product_reference: "classpathx-jaf-0:1.0-2jpp_6rh.noarch", relates_to_product_reference: "4AS-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "classpathx-jaf-0:1.0-2jpp_6rh.src as a component of Red Hat Certificate System 7.3 for 4AS", product_id: "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", }, product_reference: "classpathx-jaf-0:1.0-2jpp_6rh.src", relates_to_product_reference: "4AS-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "classpathx-mail-0:1.1.1-2jpp_8rh.noarch as a component of Red Hat Certificate System 7.3 for 4AS", product_id: "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", }, product_reference: "classpathx-mail-0:1.1.1-2jpp_8rh.noarch", relates_to_product_reference: "4AS-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "classpathx-mail-0:1.1.1-2jpp_8rh.src as a component of Red Hat Certificate System 7.3 for 4AS", product_id: "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", }, product_reference: "classpathx-mail-0:1.1.1-2jpp_8rh.src", relates_to_product_reference: "4AS-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch as a component of Red Hat Certificate System 7.3 for 4AS", product_id: "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", }, product_reference: "geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", relates_to_product_reference: "4AS-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch as a component of Red Hat Certificate System 7.3 for 4AS", product_id: "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", }, product_reference: "geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", relates_to_product_reference: "4AS-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch as a component of Red Hat Certificate System 7.3 for 4AS", product_id: "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", }, product_reference: "geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", relates_to_product_reference: "4AS-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch as a component of Red Hat Certificate System 7.3 for 4AS", product_id: "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", }, product_reference: "geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", relates_to_product_reference: "4AS-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch as a component of Red Hat Certificate System 7.3 for 4AS", product_id: "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", }, product_reference: "geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", relates_to_product_reference: "4AS-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch as a component of Red Hat Certificate System 7.3 for 4AS", product_id: "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", }, product_reference: "geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", relates_to_product_reference: "4AS-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch as a component of Red Hat Certificate System 7.3 for 4AS", product_id: "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", }, product_reference: "geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", relates_to_product_reference: "4AS-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch as a component of Red Hat Certificate System 7.3 for 4AS", product_id: "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", }, product_reference: "geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", relates_to_product_reference: "4AS-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch as a component of Red Hat Certificate System 7.3 for 4AS", product_id: "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", }, product_reference: "geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", relates_to_product_reference: "4AS-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch as a component of Red Hat Certificate System 7.3 for 4AS", product_id: "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", }, product_reference: "geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", relates_to_product_reference: "4AS-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "geronimo-specs-0:1.0-0.M4.1jpp_10rh.src as a component of Red Hat Certificate System 7.3 for 4AS", product_id: "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", }, product_reference: "geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", relates_to_product_reference: "4AS-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch as a component of Red Hat Certificate System 7.3 for 4AS", product_id: "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", }, product_reference: "geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", relates_to_product_reference: "4AS-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch as a component of Red Hat Certificate System 7.3 for 4AS", product_id: "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", }, product_reference: "jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", relates_to_product_reference: "4AS-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "jakarta-commons-modeler-0:2.0-3jpp_2rh.src as a component of Red Hat Certificate System 7.3 for 4AS", product_id: "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", }, product_reference: "jakarta-commons-modeler-0:2.0-3jpp_2rh.src", relates_to_product_reference: "4AS-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "log4j-0:1.2.12-1jpp_1rh.noarch as a component of Red Hat Certificate System 7.3 for 4AS", product_id: "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", }, product_reference: "log4j-0:1.2.12-1jpp_1rh.noarch", relates_to_product_reference: "4AS-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "log4j-0:1.2.12-1jpp_1rh.src as a component of Red Hat Certificate System 7.3 for 4AS", product_id: "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", }, product_reference: "log4j-0:1.2.12-1jpp_1rh.src", relates_to_product_reference: "4AS-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "mx4j-1:3.0.1-1jpp_4rh.noarch as a component of Red Hat Certificate System 7.3 for 4AS", product_id: "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", }, product_reference: "mx4j-1:3.0.1-1jpp_4rh.noarch", relates_to_product_reference: "4AS-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "mx4j-1:3.0.1-1jpp_4rh.src as a component of Red Hat Certificate System 7.3 for 4AS", product_id: "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", }, product_reference: "mx4j-1:3.0.1-1jpp_4rh.src", relates_to_product_reference: "4AS-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "pcsc-lite-0:1.3.3-3.el4.i386 as a component of Red Hat Certificate System 7.3 for 4AS", product_id: "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", }, product_reference: "pcsc-lite-0:1.3.3-3.el4.i386", relates_to_product_reference: "4AS-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "pcsc-lite-0:1.3.3-3.el4.src as a component of Red Hat Certificate System 7.3 for 4AS", product_id: "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", }, product_reference: "pcsc-lite-0:1.3.3-3.el4.src", relates_to_product_reference: "4AS-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "pcsc-lite-0:1.3.3-3.el4.x86_64 as a component of Red Hat Certificate System 7.3 for 4AS", product_id: "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", }, product_reference: "pcsc-lite-0:1.3.3-3.el4.x86_64", relates_to_product_reference: "4AS-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "pcsc-lite-debuginfo-0:1.3.3-3.el4.i386 as a component of Red Hat Certificate System 7.3 for 4AS", product_id: "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", }, product_reference: "pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", relates_to_product_reference: "4AS-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64 as a component of Red Hat Certificate System 7.3 for 4AS", product_id: "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", }, product_reference: "pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", relates_to_product_reference: "4AS-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "pcsc-lite-doc-0:1.3.3-3.el4.i386 as a component of Red Hat Certificate System 7.3 for 4AS", product_id: "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", }, product_reference: "pcsc-lite-doc-0:1.3.3-3.el4.i386", relates_to_product_reference: "4AS-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "pcsc-lite-doc-0:1.3.3-3.el4.x86_64 as a component of Red Hat Certificate System 7.3 for 4AS", product_id: "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", }, product_reference: "pcsc-lite-doc-0:1.3.3-3.el4.x86_64", relates_to_product_reference: "4AS-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "pcsc-lite-libs-0:1.3.3-3.el4.i386 as a component of Red Hat Certificate System 7.3 for 4AS", product_id: "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", }, product_reference: "pcsc-lite-libs-0:1.3.3-3.el4.i386", relates_to_product_reference: "4AS-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "pcsc-lite-libs-0:1.3.3-3.el4.x86_64 as a component of Red Hat Certificate System 7.3 for 4AS", product_id: "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", }, product_reference: "pcsc-lite-libs-0:1.3.3-3.el4.x86_64", relates_to_product_reference: "4AS-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "rhpki-ca-0:7.3.0-20.el4.noarch as a component of Red Hat Certificate System 7.3 for 4AS", product_id: "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", }, product_reference: "rhpki-ca-0:7.3.0-20.el4.noarch", relates_to_product_reference: "4AS-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "rhpki-java-tools-0:7.3.0-10.el4.noarch as a component of Red Hat Certificate System 7.3 for 4AS", product_id: "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", }, product_reference: "rhpki-java-tools-0:7.3.0-10.el4.noarch", relates_to_product_reference: "4AS-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "rhpki-kra-0:7.3.0-14.el4.noarch as a component of Red Hat Certificate System 7.3 for 4AS", product_id: "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", }, product_reference: "rhpki-kra-0:7.3.0-14.el4.noarch", relates_to_product_reference: "4AS-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "rhpki-manage-0:7.3.0-19.el4.noarch as a component of Red Hat Certificate System 7.3 for 4AS", product_id: "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", }, product_reference: "rhpki-manage-0:7.3.0-19.el4.noarch", relates_to_product_reference: "4AS-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "rhpki-native-tools-0:7.3.0-6.el4.i386 as a component of Red Hat Certificate System 7.3 for 4AS", product_id: "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", }, product_reference: "rhpki-native-tools-0:7.3.0-6.el4.i386", relates_to_product_reference: "4AS-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "rhpki-native-tools-0:7.3.0-6.el4.x86_64 as a component of Red Hat Certificate System 7.3 for 4AS", product_id: "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", }, product_reference: "rhpki-native-tools-0:7.3.0-6.el4.x86_64", relates_to_product_reference: "4AS-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "rhpki-ocsp-0:7.3.0-13.el4.noarch as a component of Red Hat Certificate System 7.3 for 4AS", product_id: "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", }, product_reference: "rhpki-ocsp-0:7.3.0-13.el4.noarch", relates_to_product_reference: "4AS-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "rhpki-tks-0:7.3.0-13.el4.noarch as a component of Red Hat Certificate System 7.3 for 4AS", product_id: "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", }, product_reference: "rhpki-tks-0:7.3.0-13.el4.noarch", relates_to_product_reference: "4AS-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "tomcat5-0:5.5.23-0jpp_4rh.16.noarch as a component of Red Hat Certificate System 7.3 for 4AS", product_id: "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", }, product_reference: "tomcat5-0:5.5.23-0jpp_4rh.16.noarch", relates_to_product_reference: "4AS-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "tomcat5-0:5.5.23-0jpp_4rh.16.src as a component of Red Hat Certificate System 7.3 for 4AS", product_id: "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", }, product_reference: "tomcat5-0:5.5.23-0jpp_4rh.16.src", relates_to_product_reference: "4AS-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch as a component of Red Hat Certificate System 7.3 for 4AS", product_id: "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", }, product_reference: "tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", relates_to_product_reference: "4AS-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch as a component of Red Hat Certificate System 7.3 for 4AS", product_id: "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", }, product_reference: "tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", relates_to_product_reference: "4AS-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch as a component of Red Hat Certificate System 7.3 for 4AS", product_id: "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", }, product_reference: "tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", relates_to_product_reference: "4AS-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch as a component of Red Hat Certificate System 7.3 for 4AS", product_id: "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", }, product_reference: "tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", relates_to_product_reference: "4AS-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch as a component of Red Hat Certificate System 7.3 for 4AS", product_id: "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", }, product_reference: "tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", relates_to_product_reference: "4AS-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "xerces-j2-0:2.7.1-1jpp_1rh.noarch as a component of Red Hat Certificate System 7.3 for 4AS", product_id: "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", }, product_reference: "xerces-j2-0:2.7.1-1jpp_1rh.noarch", relates_to_product_reference: "4AS-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "xerces-j2-0:2.7.1-1jpp_1rh.src as a component of Red Hat Certificate System 7.3 for 4AS", product_id: "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", }, product_reference: "xerces-j2-0:2.7.1-1jpp_1rh.src", relates_to_product_reference: "4AS-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "xml-commons-0:1.3.02-2jpp_1rh.noarch as a component of Red Hat Certificate System 7.3 for 4AS", product_id: "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", }, product_reference: "xml-commons-0:1.3.02-2jpp_1rh.noarch", relates_to_product_reference: "4AS-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "xml-commons-0:1.3.02-2jpp_1rh.src as a component of Red Hat Certificate System 7.3 for 4AS", product_id: "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", }, product_reference: "xml-commons-0:1.3.02-2jpp_1rh.src", relates_to_product_reference: "4AS-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "xml-commons-apis-0:1.3.02-2jpp_1rh.noarch as a component of Red Hat Certificate System 7.3 for 4AS", product_id: "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", }, product_reference: "xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", relates_to_product_reference: "4AS-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "ant-0:1.6.5-1jpp_1rh.noarch as a component of Red Hat Certificate System 7.3 for 4ES", product_id: "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", }, product_reference: "ant-0:1.6.5-1jpp_1rh.noarch", relates_to_product_reference: "4ES-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "ant-0:1.6.5-1jpp_1rh.src as a component of Red Hat Certificate System 7.3 for 4ES", product_id: "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", }, product_reference: "ant-0:1.6.5-1jpp_1rh.src", relates_to_product_reference: "4ES-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "avalon-logkit-0:1.2-2jpp_4rh.noarch as a component of Red Hat Certificate System 7.3 for 4ES", product_id: "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", }, product_reference: "avalon-logkit-0:1.2-2jpp_4rh.noarch", relates_to_product_reference: "4ES-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "avalon-logkit-0:1.2-2jpp_4rh.src as a component of Red Hat Certificate System 7.3 for 4ES", product_id: "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", }, product_reference: "avalon-logkit-0:1.2-2jpp_4rh.src", relates_to_product_reference: "4ES-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "axis-0:1.2.1-1jpp_3rh.noarch as a component of Red Hat Certificate System 7.3 for 4ES", product_id: "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", }, product_reference: "axis-0:1.2.1-1jpp_3rh.noarch", relates_to_product_reference: "4ES-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "axis-0:1.2.1-1jpp_3rh.src as a component of Red Hat Certificate System 7.3 for 4ES", product_id: "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", }, product_reference: "axis-0:1.2.1-1jpp_3rh.src", relates_to_product_reference: "4ES-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "classpathx-jaf-0:1.0-2jpp_6rh.noarch as a component of Red Hat Certificate System 7.3 for 4ES", product_id: "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", }, product_reference: "classpathx-jaf-0:1.0-2jpp_6rh.noarch", relates_to_product_reference: "4ES-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "classpathx-jaf-0:1.0-2jpp_6rh.src as a component of Red Hat Certificate System 7.3 for 4ES", product_id: "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", }, product_reference: "classpathx-jaf-0:1.0-2jpp_6rh.src", relates_to_product_reference: "4ES-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "classpathx-mail-0:1.1.1-2jpp_8rh.noarch as a component of Red Hat Certificate System 7.3 for 4ES", product_id: "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", }, product_reference: "classpathx-mail-0:1.1.1-2jpp_8rh.noarch", relates_to_product_reference: "4ES-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "classpathx-mail-0:1.1.1-2jpp_8rh.src as a component of Red Hat Certificate System 7.3 for 4ES", product_id: "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", }, product_reference: "classpathx-mail-0:1.1.1-2jpp_8rh.src", relates_to_product_reference: "4ES-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch as a component of Red Hat Certificate System 7.3 for 4ES", product_id: "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", }, product_reference: "geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", relates_to_product_reference: "4ES-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch as a component of Red Hat Certificate System 7.3 for 4ES", product_id: "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", }, product_reference: "geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", relates_to_product_reference: "4ES-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch as a component of Red Hat Certificate System 7.3 for 4ES", product_id: "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", }, product_reference: "geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", relates_to_product_reference: "4ES-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch as a component of Red Hat Certificate System 7.3 for 4ES", product_id: "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", }, product_reference: "geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", relates_to_product_reference: "4ES-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch as a component of Red Hat Certificate System 7.3 for 4ES", product_id: "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", }, product_reference: "geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", relates_to_product_reference: "4ES-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch as a component of Red Hat Certificate System 7.3 for 4ES", product_id: "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", }, product_reference: "geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", relates_to_product_reference: "4ES-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch as a component of Red Hat Certificate System 7.3 for 4ES", product_id: "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", }, product_reference: "geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", relates_to_product_reference: "4ES-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch as a component of Red Hat Certificate System 7.3 for 4ES", product_id: "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", }, product_reference: "geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", relates_to_product_reference: "4ES-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch as a component of Red Hat Certificate System 7.3 for 4ES", product_id: "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", }, product_reference: "geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", relates_to_product_reference: "4ES-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch as a component of Red Hat Certificate System 7.3 for 4ES", product_id: "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", }, product_reference: "geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", relates_to_product_reference: "4ES-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "geronimo-specs-0:1.0-0.M4.1jpp_10rh.src as a component of Red Hat Certificate System 7.3 for 4ES", product_id: "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", }, product_reference: "geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", relates_to_product_reference: "4ES-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch as a component of Red Hat Certificate System 7.3 for 4ES", product_id: "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", }, product_reference: "geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", relates_to_product_reference: "4ES-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch as a component of Red Hat Certificate System 7.3 for 4ES", product_id: "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", }, product_reference: "jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", relates_to_product_reference: "4ES-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "jakarta-commons-modeler-0:2.0-3jpp_2rh.src as a component of Red Hat Certificate System 7.3 for 4ES", product_id: "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", }, product_reference: "jakarta-commons-modeler-0:2.0-3jpp_2rh.src", relates_to_product_reference: "4ES-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "log4j-0:1.2.12-1jpp_1rh.noarch as a component of Red Hat Certificate System 7.3 for 4ES", product_id: "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", }, product_reference: "log4j-0:1.2.12-1jpp_1rh.noarch", relates_to_product_reference: "4ES-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "log4j-0:1.2.12-1jpp_1rh.src as a component of Red Hat Certificate System 7.3 for 4ES", product_id: "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", }, product_reference: "log4j-0:1.2.12-1jpp_1rh.src", relates_to_product_reference: "4ES-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "mx4j-1:3.0.1-1jpp_4rh.noarch as a component of Red Hat Certificate System 7.3 for 4ES", product_id: "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", }, product_reference: "mx4j-1:3.0.1-1jpp_4rh.noarch", relates_to_product_reference: "4ES-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "mx4j-1:3.0.1-1jpp_4rh.src as a component of Red Hat Certificate System 7.3 for 4ES", product_id: "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", }, product_reference: "mx4j-1:3.0.1-1jpp_4rh.src", relates_to_product_reference: "4ES-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "pcsc-lite-0:1.3.3-3.el4.i386 as a component of Red Hat Certificate System 7.3 for 4ES", product_id: "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", }, product_reference: "pcsc-lite-0:1.3.3-3.el4.i386", relates_to_product_reference: "4ES-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "pcsc-lite-0:1.3.3-3.el4.src as a component of Red Hat Certificate System 7.3 for 4ES", product_id: "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", }, product_reference: "pcsc-lite-0:1.3.3-3.el4.src", relates_to_product_reference: "4ES-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "pcsc-lite-0:1.3.3-3.el4.x86_64 as a component of Red Hat Certificate System 7.3 for 4ES", product_id: "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", }, product_reference: "pcsc-lite-0:1.3.3-3.el4.x86_64", relates_to_product_reference: "4ES-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "pcsc-lite-debuginfo-0:1.3.3-3.el4.i386 as a component of Red Hat Certificate System 7.3 for 4ES", product_id: "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", }, product_reference: "pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", relates_to_product_reference: "4ES-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64 as a component of Red Hat Certificate System 7.3 for 4ES", product_id: "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", }, product_reference: "pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", relates_to_product_reference: "4ES-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "pcsc-lite-doc-0:1.3.3-3.el4.i386 as a component of Red Hat Certificate System 7.3 for 4ES", product_id: "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", }, product_reference: "pcsc-lite-doc-0:1.3.3-3.el4.i386", relates_to_product_reference: "4ES-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "pcsc-lite-doc-0:1.3.3-3.el4.x86_64 as a component of Red Hat Certificate System 7.3 for 4ES", product_id: "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", }, product_reference: "pcsc-lite-doc-0:1.3.3-3.el4.x86_64", relates_to_product_reference: "4ES-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "pcsc-lite-libs-0:1.3.3-3.el4.i386 as a component of Red Hat Certificate System 7.3 for 4ES", product_id: "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", }, product_reference: "pcsc-lite-libs-0:1.3.3-3.el4.i386", relates_to_product_reference: "4ES-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "pcsc-lite-libs-0:1.3.3-3.el4.x86_64 as a component of Red Hat Certificate System 7.3 for 4ES", product_id: "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", }, product_reference: "pcsc-lite-libs-0:1.3.3-3.el4.x86_64", relates_to_product_reference: "4ES-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "rhpki-ca-0:7.3.0-20.el4.noarch as a component of Red Hat Certificate System 7.3 for 4ES", product_id: "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", }, product_reference: "rhpki-ca-0:7.3.0-20.el4.noarch", relates_to_product_reference: "4ES-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "rhpki-java-tools-0:7.3.0-10.el4.noarch as a component of Red Hat Certificate System 7.3 for 4ES", product_id: "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", }, product_reference: "rhpki-java-tools-0:7.3.0-10.el4.noarch", relates_to_product_reference: "4ES-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "rhpki-kra-0:7.3.0-14.el4.noarch as a component of Red Hat Certificate System 7.3 for 4ES", product_id: "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", }, product_reference: "rhpki-kra-0:7.3.0-14.el4.noarch", relates_to_product_reference: "4ES-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "rhpki-manage-0:7.3.0-19.el4.noarch as a component of Red Hat Certificate System 7.3 for 4ES", product_id: "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", }, product_reference: "rhpki-manage-0:7.3.0-19.el4.noarch", relates_to_product_reference: "4ES-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "rhpki-native-tools-0:7.3.0-6.el4.i386 as a component of Red Hat Certificate System 7.3 for 4ES", product_id: "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", }, product_reference: "rhpki-native-tools-0:7.3.0-6.el4.i386", relates_to_product_reference: "4ES-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "rhpki-native-tools-0:7.3.0-6.el4.x86_64 as a component of Red Hat Certificate System 7.3 for 4ES", product_id: "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", }, product_reference: "rhpki-native-tools-0:7.3.0-6.el4.x86_64", relates_to_product_reference: "4ES-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "rhpki-ocsp-0:7.3.0-13.el4.noarch as a component of Red Hat Certificate System 7.3 for 4ES", product_id: "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", }, product_reference: "rhpki-ocsp-0:7.3.0-13.el4.noarch", relates_to_product_reference: "4ES-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "rhpki-tks-0:7.3.0-13.el4.noarch as a component of Red Hat Certificate System 7.3 for 4ES", product_id: "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", }, product_reference: "rhpki-tks-0:7.3.0-13.el4.noarch", relates_to_product_reference: "4ES-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "tomcat5-0:5.5.23-0jpp_4rh.16.noarch as a component of Red Hat Certificate System 7.3 for 4ES", product_id: "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", }, product_reference: "tomcat5-0:5.5.23-0jpp_4rh.16.noarch", relates_to_product_reference: "4ES-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "tomcat5-0:5.5.23-0jpp_4rh.16.src as a component of Red Hat Certificate System 7.3 for 4ES", product_id: "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", }, product_reference: "tomcat5-0:5.5.23-0jpp_4rh.16.src", relates_to_product_reference: "4ES-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch as a component of Red Hat Certificate System 7.3 for 4ES", product_id: "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", }, product_reference: "tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", relates_to_product_reference: "4ES-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch as a component of Red Hat Certificate System 7.3 for 4ES", product_id: "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", }, product_reference: "tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", relates_to_product_reference: "4ES-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch as a component of Red Hat Certificate System 7.3 for 4ES", product_id: "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", }, product_reference: "tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", relates_to_product_reference: "4ES-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch as a component of Red Hat Certificate System 7.3 for 4ES", product_id: "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", }, product_reference: "tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", relates_to_product_reference: "4ES-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch as a component of Red Hat Certificate System 7.3 for 4ES", product_id: "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", }, product_reference: "tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", relates_to_product_reference: "4ES-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "xerces-j2-0:2.7.1-1jpp_1rh.noarch as a component of Red Hat Certificate System 7.3 for 4ES", product_id: "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", }, product_reference: "xerces-j2-0:2.7.1-1jpp_1rh.noarch", relates_to_product_reference: "4ES-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "xerces-j2-0:2.7.1-1jpp_1rh.src as a component of Red Hat Certificate System 7.3 for 4ES", product_id: "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", }, product_reference: "xerces-j2-0:2.7.1-1jpp_1rh.src", relates_to_product_reference: "4ES-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "xml-commons-0:1.3.02-2jpp_1rh.noarch as a component of Red Hat Certificate System 7.3 for 4ES", product_id: "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", }, product_reference: "xml-commons-0:1.3.02-2jpp_1rh.noarch", relates_to_product_reference: "4ES-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "xml-commons-0:1.3.02-2jpp_1rh.src as a component of Red Hat Certificate System 7.3 for 4ES", product_id: "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", }, product_reference: "xml-commons-0:1.3.02-2jpp_1rh.src", relates_to_product_reference: "4ES-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "xml-commons-apis-0:1.3.02-2jpp_1rh.noarch as a component of Red Hat Certificate System 7.3 for 4ES", product_id: "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", }, product_reference: "xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", relates_to_product_reference: "4ES-CERT-7.3", }, ], }, vulnerabilities: [ { cve: "CVE-2005-2090", discovery_date: "2005-06-06T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "237079", }, ], notes: [ { category: "description", text: "Jakarta Tomcat 5.0.19 (Coyote/1.1) and Tomcat 4.1.24 (Coyote/1.0) allows remote attackers to poison the web cache, bypass web application firewall protection, and conduct XSS attacks via an HTTP request with both a \"Transfer-Encoding: chunked\" header and a Content-Length header, which causes Tomcat to incorrectly handle and forward the body of the request in a way that causes the receiving server to process it as a separate HTTP request, aka \"HTTP Request Smuggling.\"", title: "Vulnerability description", }, { category: "summary", text: "tomcat multiple content-length header poisioning", title: "Vulnerability summary", }, ], product_status: { fixed: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2005-2090", }, { category: "external", summary: "RHBZ#237079", url: "https://bugzilla.redhat.com/show_bug.cgi?id=237079", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2005-2090", url: "https://www.cve.org/CVERecord?id=CVE-2005-2090", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2005-2090", url: "https://nvd.nist.gov/vuln/detail/CVE-2005-2090", }, ], release_date: "2005-06-06T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2010-08-04T21:30:00+00:00", details: "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259", product_ids: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2010:0602", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "tomcat multiple content-length header poisioning", }, { cve: "CVE-2005-3510", discovery_date: "2005-11-07T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "237085", }, ], notes: [ { category: "description", text: "Apache Tomcat 5.5.0 to 5.5.11 allows remote attackers to cause a denial of service (CPU consumption) via a large number of simultaneous requests to list a web directory that has a large number of files.", title: "Vulnerability description", }, { category: "summary", text: "tomcat DoS", title: "Vulnerability summary", }, ], product_status: { fixed: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2005-3510", }, { category: "external", summary: "RHBZ#237085", url: "https://bugzilla.redhat.com/show_bug.cgi?id=237085", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2005-3510", url: "https://www.cve.org/CVERecord?id=CVE-2005-3510", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2005-3510", url: "https://nvd.nist.gov/vuln/detail/CVE-2005-3510", }, ], release_date: "2005-11-03T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2010-08-04T21:30:00+00:00", details: "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259", product_ids: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2010:0602", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "tomcat DoS", }, { cve: "CVE-2006-3835", discovery_date: "2006-07-21T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "237084", }, ], notes: [ { category: "description", text: "Apache Tomcat 5 before 5.5.17 allows remote attackers to list directories via a semicolon (;) preceding a filename with a mapped extension, as demonstrated by URLs ending with /;index.jsp and /;help.do.", title: "Vulnerability description", }, { category: "summary", text: "tomcat directory listing issue", title: "Vulnerability summary", }, { category: "other", text: "This issue is not a security issue in Tomcat itself, but is caused when directory listings are enabled.\n\nDetails on how to disable directory listings are available at: http://tomcat.apache.org/faq/misc.html#listing", title: "Statement", }, ], product_status: { fixed: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2006-3835", }, { category: "external", summary: "RHBZ#237084", url: "https://bugzilla.redhat.com/show_bug.cgi?id=237084", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2006-3835", url: "https://www.cve.org/CVERecord?id=CVE-2006-3835", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2006-3835", url: "https://nvd.nist.gov/vuln/detail/CVE-2006-3835", }, ], release_date: "2006-07-21T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2010-08-04T21:30:00+00:00", details: "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259", product_ids: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2010:0602", }, ], threats: [ { category: "impact", details: "Low", }, ], title: "tomcat directory listing issue", }, { cve: "CVE-2006-3918", cwe: { id: "CWE-79", name: "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", }, discovery_date: "2006-07-31T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "200732", }, ], notes: [ { category: "description", text: "http_protocol.c in (1) IBM HTTP Server 6.0 before 6.0.2.13 and 6.1 before 6.1.0.1, and (2) Apache HTTP Server 1.3 before 1.3.35, 2.0 before 2.0.58, and 2.2 before 2.2.2, does not sanitize the Expect header from an HTTP request when it is reflected back in an error message, which might allow cross-site scripting (XSS) style attacks using web client components that can send arbitrary headers in requests, as demonstrated using a Flash SWF file.", title: "Vulnerability description", }, { category: "summary", text: "httpd: Expect header XSS", title: "Vulnerability summary", }, ], product_status: { fixed: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2006-3918", }, { category: "external", summary: "RHBZ#200732", url: "https://bugzilla.redhat.com/show_bug.cgi?id=200732", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2006-3918", url: "https://www.cve.org/CVERecord?id=CVE-2006-3918", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2006-3918", url: "https://nvd.nist.gov/vuln/detail/CVE-2006-3918", }, ], release_date: "2006-05-08T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2010-08-04T21:30:00+00:00", details: "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259", product_ids: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2010:0602", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "httpd: Expect header XSS", }, { cve: "CVE-2006-5752", cwe: { id: "CWE-79", name: "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", }, discovery_date: "2007-06-20T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "245112", }, ], notes: [ { category: "description", text: "Cross-site scripting (XSS) vulnerability in mod_status.c in the mod_status module in Apache HTTP Server (httpd), when ExtendedStatus is enabled and a public server-status page is used, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors involving charsets with browsers that perform \"charset detection\" when the content-type is not specified.", title: "Vulnerability description", }, { category: "summary", text: "httpd mod_status XSS", title: "Vulnerability summary", }, ], product_status: { fixed: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2006-5752", }, { category: "external", summary: "RHBZ#245112", url: "https://bugzilla.redhat.com/show_bug.cgi?id=245112", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2006-5752", url: "https://www.cve.org/CVERecord?id=CVE-2006-5752", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2006-5752", url: "https://nvd.nist.gov/vuln/detail/CVE-2006-5752", }, ], release_date: "2007-06-20T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2010-08-04T21:30:00+00:00", details: "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259", product_ids: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2010:0602", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "httpd mod_status XSS", }, { cve: "CVE-2007-0450", discovery_date: "2007-03-14T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "237080", }, ], notes: [ { category: "description", text: "Directory traversal vulnerability in Apache HTTP Server and Tomcat 5.x before 5.5.22 and 6.x before 6.0.10, when using certain proxy modules (mod_proxy, mod_rewrite, mod_jk), allows remote attackers to read arbitrary files via a .. (dot dot) sequence with combinations of (1) \"/\" (slash), (2) \"\\\" (backslash), and (3) URL-encoded backslash (%5C) characters in the URL, which are valid separators in Tomcat but not in Apache.", title: "Vulnerability description", }, { category: "summary", text: "tomcat directory traversal", title: "Vulnerability summary", }, ], product_status: { fixed: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-0450", }, { category: "external", summary: "RHBZ#237080", url: "https://bugzilla.redhat.com/show_bug.cgi?id=237080", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-0450", url: "https://www.cve.org/CVERecord?id=CVE-2007-0450", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-0450", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-0450", }, ], release_date: "2007-03-14T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2010-08-04T21:30:00+00:00", details: "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259", product_ids: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2010:0602", }, ], threats: [ { category: "impact", details: "Important", }, ], title: "tomcat directory traversal", }, { cve: "CVE-2007-1349", discovery_date: "2007-05-17T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "240423", }, ], notes: [ { category: "description", text: "PerlRun.pm in Apache mod_perl before 1.30, and RegistryCooker.pm in mod_perl 2.x, does not properly escape PATH_INFO before use in a regular expression, which allows remote attackers to cause a denial of service (resource consumption) via a crafted URI.", title: "Vulnerability description", }, { category: "summary", text: "mod_perl PerlRun denial of service", title: "Vulnerability summary", }, ], product_status: { fixed: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-1349", }, { category: "external", summary: "RHBZ#240423", url: "https://bugzilla.redhat.com/show_bug.cgi?id=240423", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-1349", url: "https://www.cve.org/CVERecord?id=CVE-2007-1349", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-1349", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-1349", }, ], release_date: "2007-03-22T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2010-08-04T21:30:00+00:00", details: "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259", product_ids: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2010:0602", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "mod_perl PerlRun denial of service", }, { cve: "CVE-2007-1358", cwe: { id: "CWE-79", name: "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", }, discovery_date: "2007-04-10T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "244803", }, ], notes: [ { category: "description", text: "Cross-site scripting (XSS) vulnerability in certain applications using Apache Tomcat 4.0.0 through 4.0.6 and 4.1.0 through 4.1.34 allows remote attackers to inject arbitrary web script or HTML via crafted \"Accept-Language headers that do not conform to RFC 2616\".", title: "Vulnerability description", }, { category: "summary", text: "tomcat accept-language xss flaw", title: "Vulnerability summary", }, ], product_status: { fixed: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-1358", }, { category: "external", summary: "RHBZ#244803", url: "https://bugzilla.redhat.com/show_bug.cgi?id=244803", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-1358", url: "https://www.cve.org/CVERecord?id=CVE-2007-1358", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-1358", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-1358", }, ], release_date: "2007-06-06T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2010-08-04T21:30:00+00:00", details: "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259", product_ids: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2010:0602", }, ], threats: [ { category: "impact", details: "Low", }, ], title: "tomcat accept-language xss flaw", }, { cve: "CVE-2007-1863", discovery_date: "2007-05-02T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "244658", }, ], notes: [ { category: "description", text: "cache_util.c in the mod_cache module in Apache HTTP Server (httpd), when caching is enabled and a threaded Multi-Processing Module (MPM) is used, allows remote attackers to cause a denial of service (child processing handler crash) via a request with the (1) s-maxage, (2) max-age, (3) min-fresh, or (4) max-stale Cache-Control headers without a value.", title: "Vulnerability description", }, { category: "summary", text: "httpd mod_cache segfault", title: "Vulnerability summary", }, ], product_status: { fixed: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-1863", }, { category: "external", summary: "RHBZ#244658", url: "https://bugzilla.redhat.com/show_bug.cgi?id=244658", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-1863", url: "https://www.cve.org/CVERecord?id=CVE-2007-1863", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-1863", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-1863", }, ], release_date: "2007-05-02T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2010-08-04T21:30:00+00:00", details: "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259", product_ids: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2010:0602", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "httpd mod_cache segfault", }, { cve: "CVE-2007-3304", discovery_date: "2007-06-19T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "245111", }, ], notes: [ { category: "description", text: "Apache httpd 1.3.37, 2.0.59, and 2.2.4 with the Prefork MPM module, allows local users to cause a denial of service by modifying the worker_score and process_score arrays to reference an arbitrary process ID, which is sent a SIGUSR1 signal from the master process, aka \"SIGUSR1 killer.\"", title: "Vulnerability description", }, { category: "summary", text: "httpd scoreboard lack of PID protection", title: "Vulnerability summary", }, ], product_status: { fixed: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-3304", }, { category: "external", summary: "RHBZ#245111", url: "https://bugzilla.redhat.com/show_bug.cgi?id=245111", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-3304", url: "https://www.cve.org/CVERecord?id=CVE-2007-3304", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-3304", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-3304", }, ], release_date: "2007-06-19T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2010-08-04T21:30:00+00:00", details: "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259", product_ids: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2010:0602", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "httpd scoreboard lack of PID protection", }, { cve: "CVE-2007-3382", discovery_date: "2007-07-12T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "247972", }, ], notes: [ { category: "description", text: "Apache Tomcat 6.0.0 to 6.0.13, 5.5.0 to 5.5.24, 5.0.0 to 5.0.30, 4.1.0 to 4.1.36, and 3.3 to 3.3.2 treats single quotes (\"'\") as delimiters in cookies, which might cause sensitive information such as session IDs to be leaked and allow remote attackers to conduct session hijacking attacks.", title: "Vulnerability description", }, { category: "summary", text: "tomcat handling of cookies", title: "Vulnerability summary", }, ], product_status: { fixed: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-3382", }, { category: "external", summary: "RHBZ#247972", url: "https://bugzilla.redhat.com/show_bug.cgi?id=247972", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-3382", url: "https://www.cve.org/CVERecord?id=CVE-2007-3382", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-3382", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-3382", }, ], release_date: "2007-08-14T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2010-08-04T21:30:00+00:00", details: "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259", product_ids: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2010:0602", }, ], threats: [ { category: "impact", details: "Low", }, ], title: "tomcat handling of cookies", }, { cve: "CVE-2007-3385", discovery_date: "2007-07-12T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "247976", }, ], notes: [ { category: "description", text: "Apache Tomcat 6.0.0 to 6.0.13, 5.5.0 to 5.5.24, 5.0.0 to 5.0.30, 4.1.0 to 4.1.36, and 3.3 to 3.3.2 does not properly handle the \\\" character sequence in a cookie value, which might cause sensitive information such as session IDs to be leaked to remote attackers and enable session hijacking attacks.", title: "Vulnerability description", }, { category: "summary", text: "tomcat handling of cookie values", title: "Vulnerability summary", }, ], product_status: { fixed: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-3385", }, { category: "external", summary: "RHBZ#247976", url: "https://bugzilla.redhat.com/show_bug.cgi?id=247976", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-3385", url: "https://www.cve.org/CVERecord?id=CVE-2007-3385", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-3385", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-3385", }, ], release_date: "2007-08-14T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2010-08-04T21:30:00+00:00", details: "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259", product_ids: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2010:0602", }, ], threats: [ { category: "impact", details: "Low", }, ], title: "tomcat handling of cookie values", }, { cve: "CVE-2007-3847", cwe: { id: "CWE-125", name: "Out-of-bounds Read", }, discovery_date: "2007-08-01T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "250731", }, ], notes: [ { category: "description", text: "The date handling code in modules/proxy/proxy_util.c (mod_proxy) in Apache 2.3.0, when using a threaded MPM, allows remote origin servers to cause a denial of service (caching forward proxy process crash) via crafted date headers that trigger a buffer over-read.", title: "Vulnerability description", }, { category: "summary", text: "httpd: out of bounds read", title: "Vulnerability summary", }, ], product_status: { fixed: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-3847", }, { category: "external", summary: "RHBZ#250731", url: "https://bugzilla.redhat.com/show_bug.cgi?id=250731", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-3847", url: "https://www.cve.org/CVERecord?id=CVE-2007-3847", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-3847", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-3847", }, ], release_date: "2007-08-01T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2010-08-04T21:30:00+00:00", details: "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259", product_ids: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2010:0602", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "httpd: out of bounds read", }, { cve: "CVE-2007-4465", cwe: { id: "CWE-79", name: "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", }, discovery_date: "2007-09-13T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "289511", }, ], notes: [ { category: "description", text: "Cross-site scripting (XSS) vulnerability in mod_autoindex.c in the Apache HTTP Server before 2.2.6, when the charset on a server-generated page is not defined, allows remote attackers to inject arbitrary web script or HTML via the P parameter using the UTF-7 charset. NOTE: it could be argued that this issue is due to a design limitation of browsers that attempt to perform automatic content type detection.", title: "Vulnerability description", }, { category: "summary", text: "mod_autoindex XSS", title: "Vulnerability summary", }, { category: "other", text: "This is actually a flaw in browsers that do not derive the response character set as required by RFC 2616. This does not affect the default configuration of Apache httpd in Red Hat products and will only affect customers who have removed the \"AddDefaultCharset\" directive and are using directory indexes. The Red Hat Product Security has rated this issue as having low security impact, a future update may address this flaw.", title: "Statement", }, ], product_status: { fixed: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-4465", }, { category: "external", summary: "RHBZ#289511", url: "https://bugzilla.redhat.com/show_bug.cgi?id=289511", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-4465", url: "https://www.cve.org/CVERecord?id=CVE-2007-4465", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-4465", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-4465", }, ], release_date: "2007-09-13T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2010-08-04T21:30:00+00:00", details: "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259", product_ids: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2010:0602", }, ], threats: [ { category: "impact", details: "Low", }, ], title: "mod_autoindex XSS", }, { cve: "CVE-2007-5000", cwe: { id: "CWE-79", name: "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", }, discovery_date: "2007-12-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "419931", }, ], notes: [ { category: "description", text: "Cross-site scripting (XSS) vulnerability in the (1) mod_imap module in the Apache HTTP Server 1.3.0 through 1.3.39 and 2.0.35 through 2.0.61 and the (2) mod_imagemap module in the Apache HTTP Server 2.2.0 through 2.2.6 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.", title: "Vulnerability description", }, { category: "summary", text: "httpd: mod_imagemap XSS", title: "Vulnerability summary", }, ], product_status: { fixed: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-5000", }, { category: "external", summary: "RHBZ#419931", url: "https://bugzilla.redhat.com/show_bug.cgi?id=419931", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-5000", url: "https://www.cve.org/CVERecord?id=CVE-2007-5000", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-5000", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-5000", }, ], release_date: "2007-12-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2010-08-04T21:30:00+00:00", details: "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259", product_ids: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2010:0602", }, ], threats: [ { category: "impact", details: "Low", }, ], title: "httpd: mod_imagemap XSS", }, { acknowledgments: [ { names: [ "Tavis Ormandy", "Will Drewry", ], }, ], cve: "CVE-2007-5116", discovery_date: "2007-09-26T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "323571", }, ], notes: [ { category: "description", text: "Buffer overflow in the polymorphic opcode support in the Regular Expression Engine (regcomp.c) in Perl 5.8 allows context-dependent attackers to execute arbitrary code by switching from byte to Unicode (UTF) characters in a regular expression.", title: "Vulnerability description", }, { category: "summary", text: "perl regular expression UTF parsing errors", title: "Vulnerability summary", }, ], product_status: { fixed: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-5116", }, { category: "external", summary: "RHBZ#323571", url: "https://bugzilla.redhat.com/show_bug.cgi?id=323571", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-5116", url: "https://www.cve.org/CVERecord?id=CVE-2007-5116", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-5116", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-5116", }, ], release_date: "2007-11-05T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2010-08-04T21:30:00+00:00", details: "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259", product_ids: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2010:0602", }, ], threats: [ { category: "impact", details: "Important", }, ], title: "perl regular expression UTF parsing errors", }, { cve: "CVE-2007-5333", discovery_date: "2008-01-07T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "427766", }, ], notes: [ { category: "description", text: "Apache Tomcat 6.0.0 through 6.0.14, 5.5.0 through 5.5.25, and 4.1.0 through 4.1.36 does not properly handle (1) double quote (\") characters or (2) %5C (encoded backslash) sequences in a cookie value, which might cause sensitive information such as session IDs to be leaked to remote attackers and enable session hijacking attacks. NOTE: this issue exists because of an incomplete fix for CVE-2007-3385.", title: "Vulnerability description", }, { category: "summary", text: "Improve cookie parsing for tomcat5", title: "Vulnerability summary", }, { category: "other", text: "Red Hat is aware of this issue and is tracking it via the following bug: https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=CVE-2007-5333\n\nThe Red Hat Product Security has rated this issue as having low security impact, a future update may address this flaw.", title: "Statement", }, ], product_status: { fixed: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-5333", }, { category: "external", summary: "RHBZ#427766", url: "https://bugzilla.redhat.com/show_bug.cgi?id=427766", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-5333", url: "https://www.cve.org/CVERecord?id=CVE-2007-5333", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-5333", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-5333", }, ], release_date: "2008-02-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2010-08-04T21:30:00+00:00", details: "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259", product_ids: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2010:0602", }, ], threats: [ { category: "impact", details: "Low", }, ], title: "Improve cookie parsing for tomcat5", }, { cve: "CVE-2007-5461", discovery_date: "2007-10-14T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "333791", }, ], notes: [ { category: "description", text: "Absolute path traversal vulnerability in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0, 5.0.0, 5.5.0 through 5.5.25, and 6.0.0 through 6.0.14, under certain configurations, allows remote authenticated users to read arbitrary files via a WebDAV write request that specifies an entity with a SYSTEM tag.", title: "Vulnerability description", }, { category: "summary", text: "Absolute path traversal Apache Tomcat WEBDAV", title: "Vulnerability summary", }, ], product_status: { fixed: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-5461", }, { category: "external", summary: "RHBZ#333791", url: "https://bugzilla.redhat.com/show_bug.cgi?id=333791", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-5461", url: "https://www.cve.org/CVERecord?id=CVE-2007-5461", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-5461", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-5461", }, ], release_date: "2007-10-14T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2010-08-04T21:30:00+00:00", details: "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259", product_ids: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2010:0602", }, ], threats: [ { category: "impact", details: "Important", }, ], title: "Absolute path traversal Apache Tomcat WEBDAV", }, { cve: "CVE-2007-6388", cwe: { id: "CWE-79", name: "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", }, discovery_date: "2008-01-02T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "427228", }, ], notes: [ { category: "description", text: "Cross-site scripting (XSS) vulnerability in mod_status in the Apache HTTP Server 2.2.0 through 2.2.6, 2.0.35 through 2.0.61, and 1.3.2 through 1.3.39, when the server-status page is enabled, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.", title: "Vulnerability description", }, { category: "summary", text: "apache mod_status cross-site scripting", title: "Vulnerability summary", }, ], product_status: { fixed: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-6388", }, { category: "external", summary: "RHBZ#427228", url: "https://bugzilla.redhat.com/show_bug.cgi?id=427228", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-6388", url: "https://www.cve.org/CVERecord?id=CVE-2007-6388", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-6388", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-6388", }, ], release_date: "2007-12-29T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2010-08-04T21:30:00+00:00", details: "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259", product_ids: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2010:0602", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "apache mod_status cross-site scripting", }, { cve: "CVE-2008-0005", cwe: { id: "CWE-79", name: "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", }, discovery_date: "2008-01-02T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "427739", }, ], notes: [ { category: "description", text: "mod_proxy_ftp in Apache 2.2.x before 2.2.7-dev, 2.0.x before 2.0.62-dev, and 1.3.x before 1.3.40-dev does not define a charset, which allows remote attackers to conduct cross-site scripting (XSS) attacks using UTF-7 encoding.", title: "Vulnerability description", }, { category: "summary", text: "mod_proxy_ftp XSS", title: "Vulnerability summary", }, ], product_status: { fixed: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2008-0005", }, { category: "external", summary: "RHBZ#427739", url: "https://bugzilla.redhat.com/show_bug.cgi?id=427739", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2008-0005", url: "https://www.cve.org/CVERecord?id=CVE-2008-0005", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2008-0005", url: "https://nvd.nist.gov/vuln/detail/CVE-2008-0005", }, ], release_date: "2008-01-02T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2010-08-04T21:30:00+00:00", details: "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259", product_ids: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2010:0602", }, ], threats: [ { category: "impact", details: "Low", }, ], title: "mod_proxy_ftp XSS", }, { cve: "CVE-2008-0128", discovery_date: "2008-01-23T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "429821", }, ], notes: [ { category: "description", text: "The SingleSignOn Valve (org.apache.catalina.authenticator.SingleSignOn) in Apache Tomcat before 5.5.21 does not set the secure flag for the JSESSIONIDSSO cookie in an https session, which can cause the cookie to be sent in http requests and make it easier for remote attackers to capture this cookie.", title: "Vulnerability description", }, { category: "summary", text: "tomcat5 SSO cookie login information disclosure", title: "Vulnerability summary", }, ], product_status: { fixed: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2008-0128", }, { category: "external", summary: "RHBZ#429821", url: "https://bugzilla.redhat.com/show_bug.cgi?id=429821", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2008-0128", url: "https://www.cve.org/CVERecord?id=CVE-2008-0128", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2008-0128", url: "https://nvd.nist.gov/vuln/detail/CVE-2008-0128", }, ], release_date: "2006-12-20T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2010-08-04T21:30:00+00:00", details: "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259", product_ids: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2010:0602", }, ], threats: [ { category: "impact", details: "Low", }, ], title: "tomcat5 SSO cookie login information disclosure", }, { cve: "CVE-2008-1232", cwe: { id: "CWE-79", name: "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", }, discovery_date: "2008-08-01T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "457597", }, ], notes: [ { category: "description", text: "Cross-site scripting (XSS) vulnerability in Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16 allows remote attackers to inject arbitrary web script or HTML via a crafted string that is used in the message argument to the HttpServletResponse.sendError method.", title: "Vulnerability description", }, { category: "summary", text: "tomcat: Cross-Site-Scripting enabled by sendError call", title: "Vulnerability summary", }, ], product_status: { fixed: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2008-1232", }, { category: "external", summary: "RHBZ#457597", url: "https://bugzilla.redhat.com/show_bug.cgi?id=457597", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2008-1232", url: "https://www.cve.org/CVERecord?id=CVE-2008-1232", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2008-1232", url: "https://nvd.nist.gov/vuln/detail/CVE-2008-1232", }, ], release_date: "2008-08-01T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2010-08-04T21:30:00+00:00", details: "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259", product_ids: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2010:0602", }, ], threats: [ { category: "impact", details: "Low", }, ], title: "tomcat: Cross-Site-Scripting enabled by sendError call", }, { cve: "CVE-2008-1927", discovery_date: "2008-04-20T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "443928", }, ], notes: [ { category: "description", text: "Double free vulnerability in Perl 5.8.8 allows context-dependent attackers to cause a denial of service (memory corruption and crash) via a crafted regular expression containing UTF8 characters. NOTE: this issue might only be present on certain operating systems.", title: "Vulnerability description", }, { category: "summary", text: "perl: heap corruption by regular expressions with utf8 characters", title: "Vulnerability summary", }, ], product_status: { fixed: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2008-1927", }, { category: "external", summary: "RHBZ#443928", url: "https://bugzilla.redhat.com/show_bug.cgi?id=443928", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2008-1927", url: "https://www.cve.org/CVERecord?id=CVE-2008-1927", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2008-1927", url: "https://nvd.nist.gov/vuln/detail/CVE-2008-1927", }, ], release_date: "2007-12-04T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2010-08-04T21:30:00+00:00", details: "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259", product_ids: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2010:0602", }, ], threats: [ { category: "impact", details: "Important", }, ], title: "perl: heap corruption by regular expressions with utf8 characters", }, { cve: "CVE-2008-2364", discovery_date: "2008-05-29T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "451615", }, ], notes: [ { category: "description", text: "The ap_proxy_http_process_response function in mod_proxy_http.c in the mod_proxy module in the Apache HTTP Server 2.0.63 and 2.2.8 does not limit the number of forwarded interim responses, which allows remote HTTP servers to cause a denial of service (memory consumption) via a large number of interim responses.", title: "Vulnerability description", }, { category: "summary", text: "httpd: mod_proxy_http DoS via excessive interim responses from the origin server", title: "Vulnerability summary", }, { category: "other", text: "Red Hat is aware of this issue and is tracking it via the following bug: https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=CVE-2008-2364\n\nThe Red Hat Product Security has rated this issue as having moderate security impact, a future update may address this flaw. More information regarding issue severity can be found here: https://access.redhat.com/security/updates/classification/", title: "Statement", }, ], product_status: { fixed: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2008-2364", }, { category: "external", summary: "RHBZ#451615", url: "https://bugzilla.redhat.com/show_bug.cgi?id=451615", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2008-2364", url: "https://www.cve.org/CVERecord?id=CVE-2008-2364", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2008-2364", url: "https://nvd.nist.gov/vuln/detail/CVE-2008-2364", }, ], release_date: "2008-06-10T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2010-08-04T21:30:00+00:00", details: "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259", product_ids: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2010:0602", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "httpd: mod_proxy_http DoS via excessive interim responses from the origin server", }, { cve: "CVE-2008-2370", discovery_date: "2008-08-01T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "457934", }, ], notes: [ { category: "description", text: "Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16, when a RequestDispatcher is used, performs path normalization before removing the query string from the URI, which allows remote attackers to conduct directory traversal attacks and read arbitrary files via a .. (dot dot) in a request parameter.", title: "Vulnerability description", }, { category: "summary", text: "tomcat RequestDispatcher information disclosure vulnerability", title: "Vulnerability summary", }, ], product_status: { fixed: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2008-2370", }, { category: "external", summary: "RHBZ#457934", url: "https://bugzilla.redhat.com/show_bug.cgi?id=457934", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2008-2370", url: "https://www.cve.org/CVERecord?id=CVE-2008-2370", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2008-2370", url: "https://nvd.nist.gov/vuln/detail/CVE-2008-2370", }, ], release_date: "2008-08-01T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2010-08-04T21:30:00+00:00", details: "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259", product_ids: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2010:0602", }, ], threats: [ { category: "impact", details: "Important", }, ], title: "tomcat RequestDispatcher information disclosure vulnerability", }, { cve: "CVE-2008-2939", cwe: { id: "CWE-79", name: "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", }, discovery_date: "2008-08-05T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "458250", }, ], notes: [ { category: "description", text: "Cross-site scripting (XSS) vulnerability in proxy_ftp.c in the mod_proxy_ftp module in Apache 2.0.63 and earlier, and mod_proxy_ftp.c in the mod_proxy_ftp module in Apache 2.2.9 and earlier 2.2 versions, allows remote attackers to inject arbitrary web script or HTML via a wildcard in the last directory component in the pathname in an FTP URI.", title: "Vulnerability description", }, { category: "summary", text: "httpd: mod_proxy_ftp globbing XSS", title: "Vulnerability summary", }, ], product_status: { fixed: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2008-2939", }, { category: "external", summary: "RHBZ#458250", url: "https://bugzilla.redhat.com/show_bug.cgi?id=458250", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2008-2939", url: "https://www.cve.org/CVERecord?id=CVE-2008-2939", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2008-2939", url: "https://nvd.nist.gov/vuln/detail/CVE-2008-2939", }, ], release_date: "2008-08-05T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2010-08-04T21:30:00+00:00", details: "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259", product_ids: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2010:0602", }, ], threats: [ { category: "impact", details: "Low", }, ], title: "httpd: mod_proxy_ftp globbing XSS", }, { cve: "CVE-2008-5515", discovery_date: "2009-06-08T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "504753", }, ], notes: [ { category: "description", text: "Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, 6.0.0 through 6.0.18, and possibly earlier versions normalizes the target pathname before filtering the query string when using the RequestDispatcher method, which allows remote attackers to bypass intended access restrictions and conduct directory traversal attacks via .. (dot dot) sequences and the WEB-INF directory in a Request.", title: "Vulnerability description", }, { category: "summary", text: "tomcat request dispatcher information disclosure vulnerability", title: "Vulnerability summary", }, ], product_status: { fixed: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2008-5515", }, { category: "external", summary: "RHBZ#504753", url: "https://bugzilla.redhat.com/show_bug.cgi?id=504753", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2008-5515", url: "https://www.cve.org/CVERecord?id=CVE-2008-5515", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2008-5515", url: "https://nvd.nist.gov/vuln/detail/CVE-2008-5515", }, ], release_date: "2009-06-08T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2010-08-04T21:30:00+00:00", details: "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259", product_ids: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2010:0602", }, ], threats: [ { category: "impact", details: "Important", }, ], title: "tomcat request dispatcher information disclosure vulnerability", }, { cve: "CVE-2009-0023", discovery_date: "2009-06-03T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "503928", }, ], notes: [ { category: "description", text: "The apr_strmatch_precompile function in strmatch/apr_strmatch.c in Apache APR-util before 1.3.5 allows remote attackers to cause a denial of service (daemon crash) via crafted input involving (1) a .htaccess file used with the Apache HTTP Server, (2) the SVNMasterURI directive in the mod_dav_svn module in the Apache HTTP Server, (3) the mod_apreq2 module for the Apache HTTP Server, or (4) an application that uses the libapreq2 library, which triggers a heap-based buffer underflow.", title: "Vulnerability description", }, { category: "summary", text: "apr-util heap buffer underwrite", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2009-0023", }, { category: "external", summary: "RHBZ#503928", url: "https://bugzilla.redhat.com/show_bug.cgi?id=503928", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2009-0023", url: "https://www.cve.org/CVERecord?id=CVE-2009-0023", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2009-0023", url: "https://nvd.nist.gov/vuln/detail/CVE-2009-0023", }, ], release_date: "2009-06-03T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2010-08-04T21:30:00+00:00", details: "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259", product_ids: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2010:0602", }, ], scores: [ { cvss_v2: { accessComplexity: "LOW", accessVector: "LOCAL", authentication: "SINGLE", availabilityImpact: "PARTIAL", baseScore: 4.3, confidentialityImpact: "PARTIAL", integrityImpact: "PARTIAL", vectorString: "AV:L/AC:L/Au:S/C:P/I:P/A:P", version: "2.0", }, products: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "apr-util heap buffer underwrite", }, { cve: "CVE-2009-0033", discovery_date: "2009-01-26T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "493381", }, ], notes: [ { category: "description", text: "Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18, when the Java AJP connector and mod_jk load balancing are used, allows remote attackers to cause a denial of service (application outage) via a crafted request with invalid headers, related to temporary blocking of connectors that have encountered errors, as demonstrated by an error involving a malformed HTTP Host header.", title: "Vulnerability description", }, { category: "summary", text: "tomcat6 Denial-Of-Service with AJP connection", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2009-0033", }, { category: "external", summary: "RHBZ#493381", url: "https://bugzilla.redhat.com/show_bug.cgi?id=493381", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2009-0033", url: "https://www.cve.org/CVERecord?id=CVE-2009-0033", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2009-0033", url: "https://nvd.nist.gov/vuln/detail/CVE-2009-0033", }, ], release_date: "2009-06-03T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2010-08-04T21:30:00+00:00", details: "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259", product_ids: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2010:0602", }, ], scores: [ { cvss_v2: { accessComplexity: "LOW", accessVector: "NETWORK", authentication: "NONE", availabilityImpact: "PARTIAL", baseScore: 5, confidentialityImpact: "NONE", integrityImpact: "NONE", vectorString: "AV:N/AC:L/Au:N/C:N/I:N/A:P", version: "2.0", }, products: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "tomcat6 Denial-Of-Service with AJP connection", }, { cve: "CVE-2009-0580", discovery_date: "2009-06-03T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "503978", }, ], notes: [ { category: "description", text: "Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18, when FORM authentication is used, allows remote attackers to enumerate valid usernames via requests to /j_security_check with malformed URL encoding of passwords, related to improper error checking in the (1) MemoryRealm, (2) DataSourceRealm, and (3) JDBCRealm authentication realms, as demonstrated by a % (percent) value for the j_password parameter.", title: "Vulnerability description", }, { category: "summary", text: "tomcat6 Information disclosure in authentication classes", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2009-0580", }, { category: "external", summary: "RHBZ#503978", url: "https://bugzilla.redhat.com/show_bug.cgi?id=503978", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2009-0580", url: "https://www.cve.org/CVERecord?id=CVE-2009-0580", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2009-0580", url: "https://nvd.nist.gov/vuln/detail/CVE-2009-0580", }, ], release_date: "2009-06-03T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2010-08-04T21:30:00+00:00", details: "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259", product_ids: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2010:0602", }, ], scores: [ { cvss_v2: { accessComplexity: "LOW", accessVector: "NETWORK", authentication: "NONE", availabilityImpact: "NONE", baseScore: 5, confidentialityImpact: "PARTIAL", integrityImpact: "NONE", vectorString: "AV:N/AC:L/Au:N/C:P/I:N/A:N", version: "2.0", }, products: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], }, ], threats: [ { category: "impact", details: "Low", }, ], title: "tomcat6 Information disclosure in authentication classes", }, { cve: "CVE-2009-1891", discovery_date: "2009-06-26T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "509125", }, ], notes: [ { category: "description", text: "The mod_deflate module in Apache httpd 2.2.11 and earlier compresses large files until completion even after the associated network connection is closed, which allows remote attackers to cause a denial of service (CPU consumption).", title: "Vulnerability description", }, { category: "summary", text: "httpd: possible temporary DoS (CPU consumption) in mod_deflate", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2009-1891", }, { category: "external", summary: "RHBZ#509125", url: "https://bugzilla.redhat.com/show_bug.cgi?id=509125", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2009-1891", url: "https://www.cve.org/CVERecord?id=CVE-2009-1891", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2009-1891", url: "https://nvd.nist.gov/vuln/detail/CVE-2009-1891", }, ], release_date: "2009-06-26T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2010-08-04T21:30:00+00:00", details: "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259", product_ids: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2010:0602", }, ], scores: [ { cvss_v2: { accessComplexity: "HIGH", accessVector: "NETWORK", authentication: "NONE", availabilityImpact: "PARTIAL", baseScore: 2.6, confidentialityImpact: "NONE", integrityImpact: "NONE", vectorString: "AV:N/AC:H/Au:N/C:N/I:N/A:P", version: "2.0", }, products: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], }, ], threats: [ { category: "impact", details: "Low", }, ], title: "httpd: possible temporary DoS (CPU consumption) in mod_deflate", }, { cve: "CVE-2009-1955", discovery_date: "2009-06-01T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "504555", }, ], notes: [ { category: "description", text: "The expat XML parser in the apr_xml_* interface in xml/apr_xml.c in Apache APR-util before 1.3.7, as used in the mod_dav and mod_dav_svn modules in the Apache HTTP Server, allows remote attackers to cause a denial of service (memory consumption) via a crafted XML document containing a large number of nested entity references, as demonstrated by a PROPFIND request, a similar issue to CVE-2003-1564.", title: "Vulnerability description", }, { category: "summary", text: "apr-util billion laughs attack", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2009-1955", }, { category: "external", summary: "RHBZ#504555", url: "https://bugzilla.redhat.com/show_bug.cgi?id=504555", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2009-1955", url: "https://www.cve.org/CVERecord?id=CVE-2009-1955", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2009-1955", url: "https://nvd.nist.gov/vuln/detail/CVE-2009-1955", }, ], release_date: "2009-06-01T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2010-08-04T21:30:00+00:00", details: "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259", product_ids: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2010:0602", }, ], scores: [ { cvss_v2: { accessComplexity: "LOW", accessVector: "NETWORK", authentication: "NONE", availabilityImpact: "PARTIAL", baseScore: 5, confidentialityImpact: "NONE", integrityImpact: "NONE", vectorString: "AV:N/AC:L/Au:N/C:N/I:N/A:P", version: "2.0", }, products: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "apr-util billion laughs attack", }, { cve: "CVE-2009-1956", discovery_date: "2009-06-05T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "504390", }, ], notes: [ { category: "description", text: "Off-by-one error in the apr_brigade_vprintf function in Apache APR-util before 1.3.5 on big-endian platforms allows remote attackers to obtain sensitive information or cause a denial of service (application crash) via crafted input.", title: "Vulnerability description", }, { category: "summary", text: "apr-util single NULL byte buffer overflow", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2009-1956", }, { category: "external", summary: "RHBZ#504390", url: "https://bugzilla.redhat.com/show_bug.cgi?id=504390", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2009-1956", url: "https://www.cve.org/CVERecord?id=CVE-2009-1956", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2009-1956", url: "https://nvd.nist.gov/vuln/detail/CVE-2009-1956", }, ], release_date: "2009-04-24T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2010-08-04T21:30:00+00:00", details: "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259", product_ids: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2010:0602", }, ], scores: [ { cvss_v2: { accessComplexity: "MEDIUM", accessVector: "NETWORK", authentication: "NONE", availabilityImpact: "NONE", baseScore: 4.3, confidentialityImpact: "PARTIAL", integrityImpact: "NONE", vectorString: "AV:N/AC:M/Au:N/C:P/I:N/A:N", version: "2.0", }, products: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "apr-util single NULL byte buffer overflow", }, { cve: "CVE-2009-2412", cwe: { id: "CWE-190", name: "Integer Overflow or Wraparound", }, discovery_date: "2009-07-30T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "515698", }, ], notes: [ { category: "description", text: "Multiple integer overflows in the Apache Portable Runtime (APR) library and the Apache Portable Utility library (aka APR-util) 0.9.x and 1.3.x allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via vectors that trigger crafted calls to the (1) allocator_alloc or (2) apr_palloc function in memory/unix/apr_pools.c in APR; or crafted calls to the (3) apr_rmm_malloc, (4) apr_rmm_calloc, or (5) apr_rmm_realloc function in misc/apr_rmm.c in APR-util; leading to buffer overflows. NOTE: some of these details are obtained from third party information.", title: "Vulnerability description", }, { category: "summary", text: "apr-util: Integer overflows in memory pool (apr) and relocatable memory (apr-util) management", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2009-2412", }, { category: "external", summary: "RHBZ#515698", url: "https://bugzilla.redhat.com/show_bug.cgi?id=515698", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2009-2412", url: "https://www.cve.org/CVERecord?id=CVE-2009-2412", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2009-2412", url: "https://nvd.nist.gov/vuln/detail/CVE-2009-2412", }, ], release_date: "2009-08-04T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2010-08-04T21:30:00+00:00", details: "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259", product_ids: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2010:0602", }, ], scores: [ { cvss_v2: { accessComplexity: "MEDIUM", accessVector: "NETWORK", authentication: "NONE", availabilityImpact: "PARTIAL", baseScore: 6.8, confidentialityImpact: "PARTIAL", integrityImpact: "PARTIAL", vectorString: "AV:N/AC:M/Au:N/C:P/I:P/A:P", version: "2.0", }, products: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "apr-util: Integer overflows in memory pool (apr) and relocatable memory (apr-util) management", }, { cve: "CVE-2009-3094", discovery_date: "2009-09-04T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "521619", }, ], notes: [ { category: "description", text: "The ap_proxy_ftp_handler function in modules/proxy/proxy_ftp.c in the mod_proxy_ftp module in the Apache HTTP Server 2.0.63 and 2.2.13 allows remote FTP servers to cause a denial of service (NULL pointer dereference and child process crash) via a malformed reply to an EPSV command.", title: "Vulnerability description", }, { category: "summary", text: "httpd: NULL pointer defer in mod_proxy_ftp caused by crafted EPSV and PASV reply", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2009-3094", }, { category: "external", summary: "RHBZ#521619", url: "https://bugzilla.redhat.com/show_bug.cgi?id=521619", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2009-3094", url: "https://www.cve.org/CVERecord?id=CVE-2009-3094", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2009-3094", url: "https://nvd.nist.gov/vuln/detail/CVE-2009-3094", }, ], release_date: "2009-09-02T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2010-08-04T21:30:00+00:00", details: "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259", product_ids: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2010:0602", }, ], scores: [ { cvss_v2: { accessComplexity: "HIGH", accessVector: "NETWORK", authentication: "NONE", availabilityImpact: "PARTIAL", baseScore: 2.6, confidentialityImpact: "NONE", integrityImpact: "NONE", vectorString: "AV:N/AC:H/Au:N/C:N/I:N/A:P", version: "2.0", }, products: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], }, ], threats: [ { category: "impact", details: "Low", }, ], title: "httpd: NULL pointer defer in mod_proxy_ftp caused by crafted EPSV and PASV reply", }, { cve: "CVE-2009-3095", discovery_date: "2009-09-03T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "522209", }, ], notes: [ { category: "description", text: "The mod_proxy_ftp module in the Apache HTTP Server allows remote attackers to bypass intended access restrictions and send arbitrary commands to an FTP server via vectors related to the embedding of these commands in the Authorization HTTP header, as demonstrated by a certain module in VulnDisco Pack Professional 8.11.", title: "Vulnerability description", }, { category: "summary", text: "httpd: mod_proxy_ftp FTP command injection via Authorization HTTP header", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2009-3095", }, { category: "external", summary: "RHBZ#522209", url: "https://bugzilla.redhat.com/show_bug.cgi?id=522209", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2009-3095", url: "https://www.cve.org/CVERecord?id=CVE-2009-3095", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2009-3095", url: "https://nvd.nist.gov/vuln/detail/CVE-2009-3095", }, ], release_date: "2009-09-03T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2010-08-04T21:30:00+00:00", details: "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259", product_ids: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2010:0602", }, ], scores: [ { cvss_v2: { accessComplexity: "HIGH", accessVector: "NETWORK", authentication: "NONE", availabilityImpact: "NONE", baseScore: 2.6, confidentialityImpact: "NONE", integrityImpact: "PARTIAL", vectorString: "AV:N/AC:H/Au:N/C:N/I:P/A:N", version: "2.0", }, products: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], }, ], threats: [ { category: "impact", details: "Low", }, ], title: "httpd: mod_proxy_ftp FTP command injection via Authorization HTTP header", }, { cve: "CVE-2009-4901", cwe: { id: "CWE-119", name: "Improper Restriction of Operations within the Bounds of a Memory Buffer", }, discovery_date: "2010-05-26T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "596426", }, ], notes: [ { category: "description", text: "The MSGFunctionDemarshall function in winscard_svc.c in the PC/SC Smart Card daemon (aka PCSCD) in MUSCLE PCSC-Lite before 1.5.4 might allow local users to cause a denial of service (daemon crash) via crafted SCARD_SET_ATTRIB message data, which is improperly demarshalled and triggers a buffer over-read, a related issue to CVE-2010-0407.", title: "Vulnerability description", }, { category: "summary", text: "pcsc-lite: Privilege escalation via specially-crafted client to PC/SC Smart Card daemon messages", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2009-4901", }, { category: "external", summary: "RHBZ#596426", url: "https://bugzilla.redhat.com/show_bug.cgi?id=596426", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2009-4901", url: "https://www.cve.org/CVERecord?id=CVE-2009-4901", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2009-4901", url: "https://nvd.nist.gov/vuln/detail/CVE-2009-4901", }, ], release_date: "2010-06-10T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2010-08-04T21:30:00+00:00", details: "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259", product_ids: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2010:0602", }, ], scores: [ { cvss_v2: { accessComplexity: "LOW", accessVector: "LOCAL", authentication: "NONE", availabilityImpact: "COMPLETE", baseScore: 7.2, confidentialityImpact: "COMPLETE", integrityImpact: "COMPLETE", vectorString: "AV:L/AC:L/Au:N/C:C/I:C/A:C", version: "2.0", }, products: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "pcsc-lite: Privilege escalation via specially-crafted client to PC/SC Smart Card daemon messages", }, { cve: "CVE-2010-0407", cwe: { id: "CWE-119", name: "Improper Restriction of Operations within the Bounds of a Memory Buffer", }, discovery_date: "2010-05-26T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "596426", }, ], notes: [ { category: "description", text: "Multiple buffer overflows in the MSGFunctionDemarshall function in winscard_svc.c in the PC/SC Smart Card daemon (aka PCSCD) in MUSCLE PCSC-Lite before 1.5.4 allow local users to gain privileges via crafted message data, which is improperly demarshalled.", title: "Vulnerability description", }, { category: "summary", text: "pcsc-lite: Privilege escalation via specially-crafted client to PC/SC Smart Card daemon messages", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2010-0407", }, { category: "external", summary: "RHBZ#596426", url: "https://bugzilla.redhat.com/show_bug.cgi?id=596426", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2010-0407", url: "https://www.cve.org/CVERecord?id=CVE-2010-0407", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2010-0407", url: "https://nvd.nist.gov/vuln/detail/CVE-2010-0407", }, ], release_date: "2010-06-10T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2010-08-04T21:30:00+00:00", details: "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259", product_ids: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2010:0602", }, ], scores: [ { cvss_v2: { accessComplexity: "LOW", accessVector: "LOCAL", authentication: "NONE", availabilityImpact: "COMPLETE", baseScore: 7.2, confidentialityImpact: "COMPLETE", integrityImpact: "COMPLETE", vectorString: "AV:L/AC:L/Au:N/C:C/I:C/A:C", version: "2.0", }, products: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "pcsc-lite: Privilege escalation via specially-crafted client to PC/SC Smart Card daemon messages", }, { cve: "CVE-2010-0434", discovery_date: "2010-03-03T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "570171", }, ], notes: [ { category: "description", text: "The ap_read_request function in server/protocol.c in the Apache HTTP Server 2.2.x before 2.2.15, when a multithreaded MPM is used, does not properly handle headers in subrequests in certain circumstances involving a parent request that has a body, which might allow remote attackers to obtain sensitive information via a crafted request that triggers access to memory locations associated with an earlier request.", title: "Vulnerability description", }, { category: "summary", text: "httpd: request header information leak", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2010-0434", }, { category: "external", summary: "RHBZ#570171", url: "https://bugzilla.redhat.com/show_bug.cgi?id=570171", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2010-0434", url: "https://www.cve.org/CVERecord?id=CVE-2010-0434", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2010-0434", url: "https://nvd.nist.gov/vuln/detail/CVE-2010-0434", }, ], release_date: "2009-12-09T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2010-08-04T21:30:00+00:00", details: "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259", product_ids: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2010:0602", }, ], scores: [ { cvss_v2: { accessComplexity: "HIGH", accessVector: "NETWORK", authentication: "NONE", availabilityImpact: "NONE", baseScore: 2.6, confidentialityImpact: "PARTIAL", integrityImpact: "NONE", vectorString: "AV:N/AC:H/Au:N/C:P/I:N/A:N", version: "2.0", }, products: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], }, ], threats: [ { category: "impact", details: "Low", }, ], title: "httpd: request header information leak", }, ], }
rhsa-2008_0261
Vulnerability from csaf_redhat
Published
2008-05-20 14:12
Modified
2024-12-08 10:33
Summary
Red Hat Security Advisory: Red Hat Network Satellite Server security update
Notes
Topic
Red Hat Network Satellite Server version 5.0.2 is now available. This
update includes fixes for a number of security issues in Red Hat Network
Satellite Server components.
This update has been rated as having moderate security impact by the Red
Hat Security Response Team.
Details
During an internal security review, a cross-site scripting flaw was found
that affected the Red Hat Network channel search feature. (CVE-2007-5961)
This release also corrects several security vulnerabilities in various
components shipped as part of the Red Hat Network Satellite Server. In a
typical operating environment, these components are not exposed to users of
Satellite Server in a vulnerable manner. These security updates will reduce
risk in unique Satellite Server environments.
Multiple flaws were fixed in the Apache HTTPD server. These flaws could
result in a cross-site scripting, denial-of-service, or information
disclosure attacks. (CVE-2004-0885, CVE-2006-5752, CVE-2006-7197,
CVE-2007-1860, CVE-2007-3304, CVE-2007-4465, CVE-2007-5000, CVE-2007-6388)
A denial-of-service flaw was fixed in mod_perl. (CVE-2007-1349)
A denial-of-service flaw was fixed in the jabberd server. (CVE-2006-1329)
Multiple cross-site scripting flaws were fixed in the image map feature in
the JFreeChart package. (CVE-2007-6306)
Multiple flaws were fixed in the IBM Java 1.4.2 Runtime. (CVE-2007-0243,
CVE-2007-2435, CVE-2007-2788, CVE-2007-2789)
Two arbitrary code execution flaws were fixed in the OpenMotif package.
(CVE-2005-3964, CVE-2005-0605)
A flaw which could result in weak encryption was fixed in the
perl-Crypt-CBC package. (CVE-2006-0898)
Multiple flaws were fixed in the Tomcat package. (CVE-2008-0128,
CVE-2007-5461, CVE-2007-3385, CVE-2007-3382, CVE-2007-1358, CVE-2007-1355,
CVE-2007-2450, CVE-2007-2449, CVE-2007-0450, CVE-2006-7196, CVE-2006-7195,
CVE-2006-3835, CVE-2006-0254, CVE-2005-2090, CVE-2005-4838, CVE-2005-3510)
Users of Red Hat Network Satellite Server 5.0 are advised to upgrade to
5.0.2, which resolves these issues.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ document: { aggregate_severity: { namespace: "https://access.redhat.com/security/updates/classification/", text: "Moderate", }, category: "csaf_security_advisory", csaf_version: "2.0", distribution: { text: "Copyright © Red Hat, Inc. All rights reserved.", tlp: { label: "WHITE", url: "https://www.first.org/tlp/", }, }, lang: "en", notes: [ { category: "summary", text: "Red Hat Network Satellite Server version 5.0.2 is now available. This\nupdate includes fixes for a number of security issues in Red Hat Network\nSatellite Server components.\n\nThis update has been rated as having moderate security impact by the Red\nHat Security Response Team.", title: "Topic", }, { category: "general", text: "During an internal security review, a cross-site scripting flaw was found\nthat affected the Red Hat Network channel search feature. (CVE-2007-5961)\n\nThis release also corrects several security vulnerabilities in various\ncomponents shipped as part of the Red Hat Network Satellite Server. In a\ntypical operating environment, these components are not exposed to users of\nSatellite Server in a vulnerable manner. These security updates will reduce\nrisk in unique Satellite Server environments.\n\nMultiple flaws were fixed in the Apache HTTPD server. These flaws could\nresult in a cross-site scripting, denial-of-service, or information\ndisclosure attacks. (CVE-2004-0885, CVE-2006-5752, CVE-2006-7197,\nCVE-2007-1860, CVE-2007-3304, CVE-2007-4465, CVE-2007-5000, CVE-2007-6388)\n\nA denial-of-service flaw was fixed in mod_perl. (CVE-2007-1349)\n\nA denial-of-service flaw was fixed in the jabberd server. (CVE-2006-1329)\n\nMultiple cross-site scripting flaws were fixed in the image map feature in\nthe JFreeChart package. (CVE-2007-6306)\n\nMultiple flaws were fixed in the IBM Java 1.4.2 Runtime. (CVE-2007-0243,\nCVE-2007-2435, CVE-2007-2788, CVE-2007-2789)\n\nTwo arbitrary code execution flaws were fixed in the OpenMotif package.\n(CVE-2005-3964, CVE-2005-0605)\n\nA flaw which could result in weak encryption was fixed in the\nperl-Crypt-CBC package. (CVE-2006-0898)\n\nMultiple flaws were fixed in the Tomcat package. (CVE-2008-0128,\nCVE-2007-5461, CVE-2007-3385, CVE-2007-3382, CVE-2007-1358, CVE-2007-1355,\nCVE-2007-2450, CVE-2007-2449, CVE-2007-0450, CVE-2006-7196, CVE-2006-7195,\nCVE-2006-3835, CVE-2006-0254, CVE-2005-2090, CVE-2005-4838, CVE-2005-3510)\n\nUsers of Red Hat Network Satellite Server 5.0 are advised to upgrade to\n5.0.2, which resolves these issues.", title: "Details", }, { category: "legal_disclaimer", text: "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", title: "Terms of Use", }, ], publisher: { category: "vendor", contact_details: "https://access.redhat.com/security/team/contact/", issuing_authority: "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", name: "Red Hat Product Security", namespace: "https://www.redhat.com", }, references: [ { category: "self", summary: "https://access.redhat.com/errata/RHSA-2008:0261", url: "https://access.redhat.com/errata/RHSA-2008:0261", }, { category: "external", summary: "https://access.redhat.com/security/updates/classification/#moderate", url: "https://access.redhat.com/security/updates/classification/#moderate", }, { category: "external", summary: "396641", url: "https://bugzilla.redhat.com/show_bug.cgi?id=396641", }, { category: "external", summary: "444136", url: "https://bugzilla.redhat.com/show_bug.cgi?id=444136", }, { category: "self", summary: "Canonical URL", url: "https://security.access.redhat.com/data/csaf/v2/advisories/2008/rhsa-2008_0261.json", }, ], title: "Red Hat Security Advisory: Red Hat Network Satellite Server security update", tracking: { current_release_date: "2024-12-08T10:33:34+00:00", generator: { date: "2024-12-08T10:33:34+00:00", engine: { name: "Red Hat SDEngine", version: "4.2.3", }, }, id: "RHSA-2008:0261", initial_release_date: "2008-05-20T14:12:00+00:00", revision_history: [ { date: "2008-05-20T14:12:00+00:00", number: "1", summary: "Initial version", }, { date: "2008-05-20T10:12:30+00:00", number: "2", summary: "Last updated version", }, { date: "2024-12-08T10:33:34+00:00", number: "3", summary: "Last generated version", }, ], status: "final", version: "3", }, }, product_tree: { branches: [ { branches: [ { branches: [ { category: "product_name", name: "Red Hat Satellite 5.0 (RHEL v.4 AS)", product: { name: "Red Hat Satellite 5.0 (RHEL v.4 AS)", product_id: "4AS-RHNSAT5", product_identification_helper: { cpe: "cpe:/a:redhat:network_satellite:5.0:el4", }, }, }, ], category: "product_family", name: "Red Hat Satellite", }, { branches: [ { category: "product_version", name: "rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", product: { name: "rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", product_id: "rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", product_identification_helper: { purl: "pkg:rpm/redhat/rhn-modssl@2.8.12-8.rhn.10.rhel4?arch=i386", }, }, }, { category: "product_version", name: "jabberd-0:2.0s10-3.38.rhn.i386", product: { name: "jabberd-0:2.0s10-3.38.rhn.i386", product_id: "jabberd-0:2.0s10-3.38.rhn.i386", product_identification_helper: { purl: "pkg:rpm/redhat/jabberd@2.0s10-3.38.rhn?arch=i386", }, }, }, { category: "product_version", name: "openmotif21-0:2.1.30-11.RHEL4.6.i386", product: { name: "openmotif21-0:2.1.30-11.RHEL4.6.i386", product_id: "openmotif21-0:2.1.30-11.RHEL4.6.i386", product_identification_helper: { purl: "pkg:rpm/redhat/openmotif21@2.1.30-11.RHEL4.6?arch=i386", }, }, }, { category: "product_version", name: "openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", product: { name: "openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", product_id: "openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", product_identification_helper: { purl: "pkg:rpm/redhat/openmotif21-debuginfo@2.1.30-11.RHEL4.6?arch=i386", }, }, }, { category: "product_version", name: "rhn-apache-0:1.3.27-36.rhn.rhel4.i386", product: { name: "rhn-apache-0:1.3.27-36.rhn.rhel4.i386", product_id: "rhn-apache-0:1.3.27-36.rhn.rhel4.i386", product_identification_helper: { purl: "pkg:rpm/redhat/rhn-apache@1.3.27-36.rhn.rhel4?arch=i386", }, }, }, { category: "product_version", name: "java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", product: { name: "java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", product_id: "java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", product_identification_helper: { purl: "pkg:rpm/redhat/java-1.4.2-ibm@1.4.2.10-1jpp.2.el4?arch=i386", }, }, }, { category: "product_version", name: "java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", product: { name: "java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", product_id: "java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", product_identification_helper: { purl: "pkg:rpm/redhat/java-1.4.2-ibm-devel@1.4.2.10-1jpp.2.el4?arch=i386", }, }, }, { category: "product_version", name: "rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", product: { name: "rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", product_id: "rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", product_identification_helper: { purl: "pkg:rpm/redhat/rhn-modjk-ap13@1.2.23-2rhn.rhel4?arch=i386", }, }, }, { category: "product_version", name: "rhn-modperl-0:1.29-16.rhel4.i386", product: { name: "rhn-modperl-0:1.29-16.rhel4.i386", product_id: "rhn-modperl-0:1.29-16.rhel4.i386", product_identification_helper: { purl: "pkg:rpm/redhat/rhn-modperl@1.29-16.rhel4?arch=i386", }, }, }, ], category: "architecture", name: "i386", }, { branches: [ { category: "product_version", name: "jfreechart-0:0.9.20-3.rhn.noarch", product: { name: "jfreechart-0:0.9.20-3.rhn.noarch", product_id: "jfreechart-0:0.9.20-3.rhn.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/jfreechart@0.9.20-3.rhn?arch=noarch", }, }, }, { category: "product_version", name: "tomcat5-0:5.0.30-0jpp_10rh.noarch", product: { name: "tomcat5-0:5.0.30-0jpp_10rh.noarch", product_id: "tomcat5-0:5.0.30-0jpp_10rh.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/tomcat5@5.0.30-0jpp_10rh?arch=noarch", }, }, }, { category: "product_version", name: "perl-Crypt-CBC-0:2.24-1.el4.noarch", product: { name: "perl-Crypt-CBC-0:2.24-1.el4.noarch", product_id: "perl-Crypt-CBC-0:2.24-1.el4.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/perl-Crypt-CBC@2.24-1.el4?arch=noarch", }, }, }, ], category: "architecture", name: "noarch", }, ], category: "vendor", name: "Red Hat", }, ], relationships: [ { category: "default_component_of", full_product_name: { name: "jabberd-0:2.0s10-3.38.rhn.i386 as a component of Red Hat Satellite 5.0 (RHEL v.4 AS)", product_id: "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", }, product_reference: "jabberd-0:2.0s10-3.38.rhn.i386", relates_to_product_reference: "4AS-RHNSAT5", }, { category: "default_component_of", full_product_name: { name: "java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386 as a component of Red Hat Satellite 5.0 (RHEL v.4 AS)", product_id: "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", }, product_reference: "java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", relates_to_product_reference: "4AS-RHNSAT5", }, { category: "default_component_of", full_product_name: { name: "java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386 as a component of Red Hat Satellite 5.0 (RHEL v.4 AS)", product_id: "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", }, product_reference: "java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", relates_to_product_reference: "4AS-RHNSAT5", }, { category: "default_component_of", full_product_name: { name: "jfreechart-0:0.9.20-3.rhn.noarch as a component of Red Hat Satellite 5.0 (RHEL v.4 AS)", product_id: "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", }, product_reference: "jfreechart-0:0.9.20-3.rhn.noarch", relates_to_product_reference: "4AS-RHNSAT5", }, { category: "default_component_of", full_product_name: { name: "openmotif21-0:2.1.30-11.RHEL4.6.i386 as a component of Red Hat Satellite 5.0 (RHEL v.4 AS)", product_id: "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", }, product_reference: "openmotif21-0:2.1.30-11.RHEL4.6.i386", relates_to_product_reference: "4AS-RHNSAT5", }, { category: "default_component_of", full_product_name: { name: "openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386 as a component of Red Hat Satellite 5.0 (RHEL v.4 AS)", product_id: "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", }, product_reference: "openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", relates_to_product_reference: "4AS-RHNSAT5", }, { category: "default_component_of", full_product_name: { name: "perl-Crypt-CBC-0:2.24-1.el4.noarch as a component of Red Hat Satellite 5.0 (RHEL v.4 AS)", product_id: "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", }, product_reference: "perl-Crypt-CBC-0:2.24-1.el4.noarch", relates_to_product_reference: "4AS-RHNSAT5", }, { category: "default_component_of", full_product_name: { name: "rhn-apache-0:1.3.27-36.rhn.rhel4.i386 as a component of Red Hat Satellite 5.0 (RHEL v.4 AS)", product_id: "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", }, product_reference: "rhn-apache-0:1.3.27-36.rhn.rhel4.i386", relates_to_product_reference: "4AS-RHNSAT5", }, { category: "default_component_of", full_product_name: { name: "rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386 as a component of Red Hat Satellite 5.0 (RHEL v.4 AS)", product_id: "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", }, product_reference: "rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", relates_to_product_reference: "4AS-RHNSAT5", }, { category: "default_component_of", full_product_name: { name: "rhn-modperl-0:1.29-16.rhel4.i386 as a component of Red Hat Satellite 5.0 (RHEL v.4 AS)", product_id: "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", }, product_reference: "rhn-modperl-0:1.29-16.rhel4.i386", relates_to_product_reference: "4AS-RHNSAT5", }, { category: "default_component_of", full_product_name: { name: "rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386 as a component of Red Hat Satellite 5.0 (RHEL v.4 AS)", product_id: "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", }, product_reference: "rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", relates_to_product_reference: "4AS-RHNSAT5", }, { category: "default_component_of", full_product_name: { name: "tomcat5-0:5.0.30-0jpp_10rh.noarch as a component of Red Hat Satellite 5.0 (RHEL v.4 AS)", product_id: "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", }, product_reference: "tomcat5-0:5.0.30-0jpp_10rh.noarch", relates_to_product_reference: "4AS-RHNSAT5", }, ], }, vulnerabilities: [ { cve: "CVE-2004-0885", ids: [ { system_name: "Red Hat Bugzilla ID", text: "430637", }, ], notes: [ { category: "description", text: "The mod_ssl module in Apache 2.0.35 through 2.0.52, when using the \"SSLCipherSuite\" directive in directory or location context, allows remote clients to bypass intended restrictions by using any cipher suite that is allowed by the virtual host configuration.", title: "Vulnerability description", }, { category: "summary", text: "mod_ssl SSLCipherSuite bypass", title: "Vulnerability summary", }, ], product_status: { fixed: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2004-0885", }, { category: "external", summary: "RHBZ#430637", url: "https://bugzilla.redhat.com/show_bug.cgi?id=430637", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2004-0885", url: "https://www.cve.org/CVERecord?id=CVE-2004-0885", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2004-0885", url: "https://nvd.nist.gov/vuln/detail/CVE-2004-0885", }, ], release_date: "2004-10-05T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-05-20T14:12:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0261", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "mod_ssl SSLCipherSuite bypass", }, { cve: "CVE-2005-0605", discovery_date: "2005-02-28T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "430520", }, ], notes: [ { category: "description", text: "scan.c for LibXPM may allow attackers to execute arbitrary code via a negative bitmap_unit value that leads to a buffer overflow.", title: "Vulnerability description", }, { category: "summary", text: "libxpm buffer overflow", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Enterprise Linux 5 is not vulnerable to this issue as it contains a backported patch.", title: "Statement", }, ], product_status: { fixed: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2005-0605", }, { category: "external", summary: "RHBZ#430520", url: "https://bugzilla.redhat.com/show_bug.cgi?id=430520", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2005-0605", url: "https://www.cve.org/CVERecord?id=CVE-2005-0605", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2005-0605", url: "https://nvd.nist.gov/vuln/detail/CVE-2005-0605", }, ], release_date: "2005-03-01T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-05-20T14:12:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0261", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "libxpm buffer overflow", }, { cve: "CVE-2005-2090", discovery_date: "2005-06-06T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "237079", }, ], notes: [ { category: "description", text: "Jakarta Tomcat 5.0.19 (Coyote/1.1) and Tomcat 4.1.24 (Coyote/1.0) allows remote attackers to poison the web cache, bypass web application firewall protection, and conduct XSS attacks via an HTTP request with both a \"Transfer-Encoding: chunked\" header and a Content-Length header, which causes Tomcat to incorrectly handle and forward the body of the request in a way that causes the receiving server to process it as a separate HTTP request, aka \"HTTP Request Smuggling.\"", title: "Vulnerability description", }, { category: "summary", text: "tomcat multiple content-length header poisioning", title: "Vulnerability summary", }, ], product_status: { fixed: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2005-2090", }, { category: "external", summary: "RHBZ#237079", url: "https://bugzilla.redhat.com/show_bug.cgi?id=237079", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2005-2090", url: "https://www.cve.org/CVERecord?id=CVE-2005-2090", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2005-2090", url: "https://nvd.nist.gov/vuln/detail/CVE-2005-2090", }, ], release_date: "2005-06-06T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-05-20T14:12:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0261", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "tomcat multiple content-length header poisioning", }, { cve: "CVE-2005-3510", discovery_date: "2005-11-07T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "237085", }, ], notes: [ { category: "description", text: "Apache Tomcat 5.5.0 to 5.5.11 allows remote attackers to cause a denial of service (CPU consumption) via a large number of simultaneous requests to list a web directory that has a large number of files.", title: "Vulnerability description", }, { category: "summary", text: "tomcat DoS", title: "Vulnerability summary", }, ], product_status: { fixed: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2005-3510", }, { category: "external", summary: "RHBZ#237085", url: "https://bugzilla.redhat.com/show_bug.cgi?id=237085", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2005-3510", url: "https://www.cve.org/CVERecord?id=CVE-2005-3510", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2005-3510", url: "https://nvd.nist.gov/vuln/detail/CVE-2005-3510", }, ], release_date: "2005-11-03T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-05-20T14:12:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0261", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "tomcat DoS", }, { cve: "CVE-2005-3964", discovery_date: "2005-12-02T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "430519", }, ], notes: [ { category: "description", text: "Multiple buffer overflows in libUil (libUil.so) in OpenMotif 2.2.3, and possibly other versions, allows attackers to execute arbitrary code via the (1) diag_issue_diagnostic function in UilDiags.c and (2) open_source_file function in UilSrcSrc.c.", title: "Vulnerability description", }, { category: "summary", text: "openmotif libUil buffer overflows", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Enterprise Linux 5 is not vulnerable to this issue as it contains a backported patch.", title: "Statement", }, ], product_status: { fixed: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2005-3964", }, { category: "external", summary: "RHBZ#430519", url: "https://bugzilla.redhat.com/show_bug.cgi?id=430519", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2005-3964", url: "https://www.cve.org/CVERecord?id=CVE-2005-3964", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2005-3964", url: "https://nvd.nist.gov/vuln/detail/CVE-2005-3964", }, ], release_date: "2005-12-02T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-05-20T14:12:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0261", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "openmotif libUil buffer overflows", }, { cve: "CVE-2005-4838", discovery_date: "2005-01-03T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "238401", }, ], notes: [ { category: "description", text: "Multiple cross-site scripting (XSS) vulnerabilities in the example web applications for Jakarta Tomcat 5.5.6 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) el/functions.jsp, (2) el/implicit-objects.jsp, and (3) jspx/textRotate.jspx in examples/jsp2/, as demonstrated via script in a request to snp/snoop.jsp. NOTE: other XSS issues in the manager were simultaneously reported, but these require admin access and do not cross privilege boundaries.", title: "Vulnerability description", }, { category: "summary", text: "tomcat manager example DoS", title: "Vulnerability summary", }, ], product_status: { fixed: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2005-4838", }, { category: "external", summary: "RHBZ#238401", url: "https://bugzilla.redhat.com/show_bug.cgi?id=238401", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2005-4838", url: "https://www.cve.org/CVERecord?id=CVE-2005-4838", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2005-4838", url: "https://nvd.nist.gov/vuln/detail/CVE-2005-4838", }, ], release_date: "2005-01-03T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-05-20T14:12:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0261", }, ], threats: [ { category: "impact", details: "Low", }, ], title: "tomcat manager example DoS", }, { cve: "CVE-2006-0254", cwe: { id: "CWE-79", name: "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", }, discovery_date: "2006-01-17T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "430646", }, ], notes: [ { category: "description", text: "Multiple cross-site scripting (XSS) vulnerabilities in Apache Geronimo 1.0 allow remote attackers to inject arbitrary web script or HTML via the (1) time parameter to cal2.jsp and (2) any invalid parameter, which causes an XSS when the log file is viewed by the Web-Access-Log viewer.", title: "Vulnerability description", }, { category: "summary", text: "tomcat examples XSS", title: "Vulnerability summary", }, ], product_status: { fixed: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2006-0254", }, { category: "external", summary: "RHBZ#430646", url: "https://bugzilla.redhat.com/show_bug.cgi?id=430646", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2006-0254", url: "https://www.cve.org/CVERecord?id=CVE-2006-0254", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2006-0254", url: "https://nvd.nist.gov/vuln/detail/CVE-2006-0254", }, ], release_date: "2006-01-15T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-05-20T14:12:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0261", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "tomcat examples XSS", }, { cve: "CVE-2006-0898", ids: [ { system_name: "Red Hat Bugzilla ID", text: "430522", }, ], notes: [ { category: "description", text: "Crypt::CBC Perl module 2.16 and earlier, when running in RandomIV mode, uses an initialization vector (IV) of 8 bytes, which results in weaker encryption when used with a cipher that requires a larger block size than 8 bytes, such as Rijndael.", title: "Vulnerability description", }, { category: "summary", text: "perl-Crypt-CBC weaker encryption with some ciphers", title: "Vulnerability summary", }, ], product_status: { fixed: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2006-0898", }, { category: "external", summary: "RHBZ#430522", url: "https://bugzilla.redhat.com/show_bug.cgi?id=430522", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2006-0898", url: "https://www.cve.org/CVERecord?id=CVE-2006-0898", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2006-0898", url: "https://nvd.nist.gov/vuln/detail/CVE-2006-0898", }, ], release_date: "2006-02-23T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-05-20T14:12:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0261", }, ], threats: [ { category: "impact", details: "Low", }, ], title: "perl-Crypt-CBC weaker encryption with some ciphers", }, { cve: "CVE-2006-1329", ids: [ { system_name: "Red Hat Bugzilla ID", text: "429254", }, ], notes: [ { category: "description", text: "The SASL negotiation in Jabber Studio jabberd before 2.0s11 allows remote attackers to cause a denial of service (\"c2s segfault\") by sending a \"response stanza before an auth stanza\".", title: "Vulnerability description", }, { category: "summary", text: "jabberd SASL DoS", title: "Vulnerability summary", }, ], product_status: { fixed: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2006-1329", }, { category: "external", summary: "RHBZ#429254", url: "https://bugzilla.redhat.com/show_bug.cgi?id=429254", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2006-1329", url: "https://www.cve.org/CVERecord?id=CVE-2006-1329", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2006-1329", url: "https://nvd.nist.gov/vuln/detail/CVE-2006-1329", }, ], release_date: "2006-03-09T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-05-20T14:12:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0261", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "jabberd SASL DoS", }, { cve: "CVE-2006-3835", discovery_date: "2006-07-21T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "237084", }, ], notes: [ { category: "description", text: "Apache Tomcat 5 before 5.5.17 allows remote attackers to list directories via a semicolon (;) preceding a filename with a mapped extension, as demonstrated by URLs ending with /;index.jsp and /;help.do.", title: "Vulnerability description", }, { category: "summary", text: "tomcat directory listing issue", title: "Vulnerability summary", }, { category: "other", text: "This issue is not a security issue in Tomcat itself, but is caused when directory listings are enabled.\n\nDetails on how to disable directory listings are available at: http://tomcat.apache.org/faq/misc.html#listing", title: "Statement", }, ], product_status: { fixed: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2006-3835", }, { category: "external", summary: "RHBZ#237084", url: "https://bugzilla.redhat.com/show_bug.cgi?id=237084", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2006-3835", url: "https://www.cve.org/CVERecord?id=CVE-2006-3835", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2006-3835", url: "https://nvd.nist.gov/vuln/detail/CVE-2006-3835", }, ], release_date: "2006-07-21T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-05-20T14:12:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0261", }, ], threats: [ { category: "impact", details: "Low", }, ], title: "tomcat directory listing issue", }, { cve: "CVE-2006-5752", cwe: { id: "CWE-79", name: "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", }, discovery_date: "2007-06-20T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "245112", }, ], notes: [ { category: "description", text: "Cross-site scripting (XSS) vulnerability in mod_status.c in the mod_status module in Apache HTTP Server (httpd), when ExtendedStatus is enabled and a public server-status page is used, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors involving charsets with browsers that perform \"charset detection\" when the content-type is not specified.", title: "Vulnerability description", }, { category: "summary", text: "httpd mod_status XSS", title: "Vulnerability summary", }, ], product_status: { fixed: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2006-5752", }, { category: "external", summary: "RHBZ#245112", url: "https://bugzilla.redhat.com/show_bug.cgi?id=245112", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2006-5752", url: "https://www.cve.org/CVERecord?id=CVE-2006-5752", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2006-5752", url: "https://nvd.nist.gov/vuln/detail/CVE-2006-5752", }, ], release_date: "2007-06-20T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-05-20T14:12:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0261", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "httpd mod_status XSS", }, { cve: "CVE-2006-7195", cwe: { id: "CWE-79", name: "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", }, discovery_date: "2007-04-19T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "237081", }, ], notes: [ { category: "description", text: "Cross-site scripting (XSS) vulnerability in implicit-objects.jsp in Apache Tomcat 5.0.0 through 5.0.30 and 5.5.0 through 5.5.17 allows remote attackers to inject arbitrary web script or HTML via certain header values.", title: "Vulnerability description", }, { category: "summary", text: "tomcat XSS in example webapps", title: "Vulnerability summary", }, ], product_status: { fixed: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2006-7195", }, { category: "external", summary: "RHBZ#237081", url: "https://bugzilla.redhat.com/show_bug.cgi?id=237081", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2006-7195", url: "https://www.cve.org/CVERecord?id=CVE-2006-7195", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2006-7195", url: "https://nvd.nist.gov/vuln/detail/CVE-2006-7195", }, ], release_date: "2007-04-19T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-05-20T14:12:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0261", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "tomcat XSS in example webapps", }, { cve: "CVE-2006-7196", cwe: { id: "CWE-79", name: "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", }, discovery_date: "2007-04-26T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "238131", }, ], notes: [ { category: "description", text: "Cross-site scripting (XSS) vulnerability in the calendar application example in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0 through 4.1.31, 5.0.0 through 5.0.30, and 5.5.0 through 5.5.15 allows remote attackers to inject arbitrary web script or HTML via the time parameter to cal2.jsp and possibly unspecified other vectors. NOTE: this may be related to CVE-2006-0254.1.", title: "Vulnerability description", }, { category: "summary", text: "tomcat XSS in example webapps", title: "Vulnerability summary", }, ], product_status: { fixed: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2006-7196", }, { category: "external", summary: "RHBZ#238131", url: "https://bugzilla.redhat.com/show_bug.cgi?id=238131", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2006-7196", url: "https://www.cve.org/CVERecord?id=CVE-2006-7196", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2006-7196", url: "https://nvd.nist.gov/vuln/detail/CVE-2006-7196", }, ], release_date: "2007-04-26T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-05-20T14:12:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0261", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "tomcat XSS in example webapps", }, { cve: "CVE-2006-7197", ids: [ { system_name: "Red Hat Bugzilla ID", text: "430642", }, ], notes: [ { category: "description", text: "The AJP connector in Apache Tomcat 5.5.15 uses an incorrect length for chunks, which can cause a buffer over-read in the ajp_process_callback in mod_jk, which allows remote attackers to read portions of sensitive memory.", title: "Vulnerability description", }, { category: "summary", text: "mod_jk chunk too long", title: "Vulnerability summary", }, ], product_status: { fixed: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2006-7197", }, { category: "external", summary: "RHBZ#430642", url: "https://bugzilla.redhat.com/show_bug.cgi?id=430642", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2006-7197", url: "https://www.cve.org/CVERecord?id=CVE-2006-7197", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2006-7197", url: "https://nvd.nist.gov/vuln/detail/CVE-2006-7197", }, ], release_date: "2006-03-05T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-05-20T14:12:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0261", }, ], threats: [ { category: "impact", details: "Important", }, ], title: "mod_jk chunk too long", }, { cve: "CVE-2007-0243", discovery_date: "2007-04-17T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "325941", }, ], notes: [ { category: "description", text: "Buffer overflow in Sun JDK and Java Runtime Environment (JRE) 5.0 Update 9 and earlier, SDK and JRE 1.4.2_12 and earlier, and SDK and JRE 1.3.1_18 and earlier allows applets to gain privileges via a GIF image with a block with a 0 width field, which triggers memory corruption.", title: "Vulnerability description", }, { category: "summary", text: "java-jre: GIF buffer overflow", title: "Vulnerability summary", }, ], product_status: { fixed: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-0243", }, { category: "external", summary: "RHBZ#325941", url: "https://bugzilla.redhat.com/show_bug.cgi?id=325941", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-0243", url: "https://www.cve.org/CVERecord?id=CVE-2007-0243", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-0243", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-0243", }, ], release_date: "2007-01-17T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-05-20T14:12:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0261", }, ], threats: [ { category: "impact", details: "Important", }, ], title: "java-jre: GIF buffer overflow", }, { cve: "CVE-2007-0450", discovery_date: "2007-03-14T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "237080", }, ], notes: [ { category: "description", text: "Directory traversal vulnerability in Apache HTTP Server and Tomcat 5.x before 5.5.22 and 6.x before 6.0.10, when using certain proxy modules (mod_proxy, mod_rewrite, mod_jk), allows remote attackers to read arbitrary files via a .. (dot dot) sequence with combinations of (1) \"/\" (slash), (2) \"\\\" (backslash), and (3) URL-encoded backslash (%5C) characters in the URL, which are valid separators in Tomcat but not in Apache.", title: "Vulnerability description", }, { category: "summary", text: "tomcat directory traversal", title: "Vulnerability summary", }, ], product_status: { fixed: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-0450", }, { category: "external", summary: "RHBZ#237080", url: "https://bugzilla.redhat.com/show_bug.cgi?id=237080", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-0450", url: "https://www.cve.org/CVERecord?id=CVE-2007-0450", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-0450", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-0450", }, ], release_date: "2007-03-14T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-05-20T14:12:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0261", }, ], threats: [ { category: "impact", details: "Important", }, ], title: "tomcat directory traversal", }, { cve: "CVE-2007-1349", discovery_date: "2007-05-17T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "240423", }, ], notes: [ { category: "description", text: "PerlRun.pm in Apache mod_perl before 1.30, and RegistryCooker.pm in mod_perl 2.x, does not properly escape PATH_INFO before use in a regular expression, which allows remote attackers to cause a denial of service (resource consumption) via a crafted URI.", title: "Vulnerability description", }, { category: "summary", text: "mod_perl PerlRun denial of service", title: "Vulnerability summary", }, ], product_status: { fixed: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-1349", }, { category: "external", summary: "RHBZ#240423", url: "https://bugzilla.redhat.com/show_bug.cgi?id=240423", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-1349", url: "https://www.cve.org/CVERecord?id=CVE-2007-1349", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-1349", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-1349", }, ], release_date: "2007-03-22T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-05-20T14:12:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0261", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "mod_perl PerlRun denial of service", }, { cve: "CVE-2007-1355", cwe: { id: "CWE-79", name: "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", }, discovery_date: "2007-05-19T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "253166", }, ], notes: [ { category: "description", text: "Multiple cross-site scripting (XSS) vulnerabilities in the appdev/sample/web/hello.jsp example application in Tomcat 4.0.0 through 4.0.6, 4.1.0 through 4.1.36, 5.0.0 through 5.0.30, 5.5.0 through 5.5.23, and 6.0.0 through 6.0.10 allow remote attackers to inject arbitrary web script or HTML via the test parameter and unspecified vectors.", title: "Vulnerability description", }, { category: "summary", text: "tomcat XSS in samples", title: "Vulnerability summary", }, ], product_status: { fixed: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-1355", }, { category: "external", summary: "RHBZ#253166", url: "https://bugzilla.redhat.com/show_bug.cgi?id=253166", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-1355", url: "https://www.cve.org/CVERecord?id=CVE-2007-1355", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-1355", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-1355", }, ], release_date: "2007-05-19T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-05-20T14:12:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0261", }, ], threats: [ { category: "impact", details: "Low", }, ], title: "tomcat XSS in samples", }, { cve: "CVE-2007-1358", cwe: { id: "CWE-79", name: "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", }, discovery_date: "2007-04-10T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "244803", }, ], notes: [ { category: "description", text: "Cross-site scripting (XSS) vulnerability in certain applications using Apache Tomcat 4.0.0 through 4.0.6 and 4.1.0 through 4.1.34 allows remote attackers to inject arbitrary web script or HTML via crafted \"Accept-Language headers that do not conform to RFC 2616\".", title: "Vulnerability description", }, { category: "summary", text: "tomcat accept-language xss flaw", title: "Vulnerability summary", }, ], product_status: { fixed: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-1358", }, { category: "external", summary: "RHBZ#244803", url: "https://bugzilla.redhat.com/show_bug.cgi?id=244803", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-1358", url: "https://www.cve.org/CVERecord?id=CVE-2007-1358", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-1358", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-1358", }, ], release_date: "2007-06-06T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-05-20T14:12:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0261", }, ], threats: [ { category: "impact", details: "Low", }, ], title: "tomcat accept-language xss flaw", }, { cve: "CVE-2007-1860", discovery_date: "2007-04-20T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "237656", }, ], notes: [ { category: "description", text: "mod_jk in Apache Tomcat JK Web Server Connector 1.2.x before 1.2.23 decodes request URLs within the Apache HTTP Server before passing the URL to Tomcat, which allows remote attackers to access protected pages via a crafted prefix JkMount, possibly involving double-encoded .. (dot dot) sequences and directory traversal, a related issue to CVE-2007-0450.", title: "Vulnerability description", }, { category: "summary", text: "mod_jk sends decoded URL to tomcat", title: "Vulnerability summary", }, ], product_status: { fixed: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-1860", }, { category: "external", summary: "RHBZ#237656", url: "https://bugzilla.redhat.com/show_bug.cgi?id=237656", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-1860", url: "https://www.cve.org/CVERecord?id=CVE-2007-1860", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-1860", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-1860", }, ], release_date: "2007-05-21T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-05-20T14:12:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0261", }, ], threats: [ { category: "impact", details: "Important", }, ], title: "mod_jk sends decoded URL to tomcat", }, { cve: "CVE-2007-2435", discovery_date: "2007-05-01T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "239660", }, ], notes: [ { category: "description", text: "Sun Java Web Start in JDK and JRE 5.0 Update 10 and earlier, and Java Web Start in SDK and JRE 1.4.2_13 and earlier, allows remote attackers to perform unauthorized actions via an application that grants privileges to itself, related to \"Incorrect Use of System Classes\" and probably related to support for JNLP files.", title: "Vulnerability description", }, { category: "summary", text: "javaws vulnerabilities", title: "Vulnerability summary", }, ], product_status: { fixed: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-2435", }, { category: "external", summary: "RHBZ#239660", url: "https://bugzilla.redhat.com/show_bug.cgi?id=239660", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-2435", url: "https://www.cve.org/CVERecord?id=CVE-2007-2435", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-2435", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-2435", }, ], release_date: "2007-04-30T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-05-20T14:12:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0261", }, ], threats: [ { category: "impact", details: "Critical", }, ], title: "javaws vulnerabilities", }, { cve: "CVE-2007-2449", cwe: { id: "CWE-79", name: "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", }, discovery_date: "2007-05-24T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "244804", }, ], notes: [ { category: "description", text: "Multiple cross-site scripting (XSS) vulnerabilities in certain JSP files in the examples web application in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0 through 4.1.36, 5.0.0 through 5.0.30, 5.5.0 through 5.5.24, and 6.0.0 through 6.0.13 allow remote attackers to inject arbitrary web script or HTML via the portion of the URI after the ';' character, as demonstrated by a URI containing a \"snp/snoop.jsp;\" sequence.", title: "Vulnerability description", }, { category: "summary", text: "tomcat examples jsp XSS", title: "Vulnerability summary", }, ], product_status: { fixed: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-2449", }, { category: "external", summary: "RHBZ#244804", url: "https://bugzilla.redhat.com/show_bug.cgi?id=244804", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-2449", url: "https://www.cve.org/CVERecord?id=CVE-2007-2449", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-2449", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-2449", }, ], release_date: "2007-06-13T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-05-20T14:12:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0261", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "tomcat examples jsp XSS", }, { cve: "CVE-2007-2450", cwe: { id: "CWE-79", name: "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", }, discovery_date: "2007-05-24T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "244808", }, ], notes: [ { category: "description", text: "Multiple cross-site scripting (XSS) vulnerabilities in the (1) Manager and (2) Host Manager web applications in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0 through 4.1.36, 5.0.0 through 5.0.30, 5.5.0 through 5.5.24, and 6.0.0 through 6.0.13 allow remote authenticated users to inject arbitrary web script or HTML via a parameter name to manager/html/upload, and other unspecified vectors.", title: "Vulnerability description", }, { category: "summary", text: "tomcat host manager XSS", title: "Vulnerability summary", }, ], product_status: { fixed: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-2450", }, { category: "external", summary: "RHBZ#244808", url: "https://bugzilla.redhat.com/show_bug.cgi?id=244808", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-2450", url: "https://www.cve.org/CVERecord?id=CVE-2007-2450", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-2450", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-2450", }, ], release_date: "2007-06-13T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-05-20T14:12:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0261", }, ], threats: [ { category: "impact", details: "Low", }, ], title: "tomcat host manager XSS", }, { cve: "CVE-2007-2788", cwe: { id: "CWE-190", name: "Integer Overflow or Wraparound", }, discovery_date: "2007-05-21T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "250725", }, ], notes: [ { category: "description", text: "Integer overflow in the embedded ICC profile image parser in Sun Java Development Kit (JDK) before 1.5.0_11-b03 and 1.6.x before 1.6.0_01-b06, and Sun Java Runtime Environment in JDK and JRE 6, JDK and JRE 5.0 Update 10 and earlier, SDK and JRE 1.4.2_14 and earlier, and SDK and JRE 1.3.1_20 and earlier, allows remote attackers to execute arbitrary code or cause a denial of service (JVM crash) via a crafted JPEG or BMP file that triggers a buffer overflow.", title: "Vulnerability description", }, { category: "summary", text: "Integer overflow in the embedded ICC profile image parser in Sun Java Development Kit", title: "Vulnerability summary", }, ], product_status: { fixed: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-2788", }, { category: "external", summary: "RHBZ#250725", url: "https://bugzilla.redhat.com/show_bug.cgi?id=250725", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-2788", url: "https://www.cve.org/CVERecord?id=CVE-2007-2788", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-2788", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-2788", }, ], release_date: "2007-05-21T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-05-20T14:12:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0261", }, ], threats: [ { category: "impact", details: "Critical", }, ], title: "Integer overflow in the embedded ICC profile image parser in Sun Java Development Kit", }, { cve: "CVE-2007-2789", discovery_date: "2007-05-21T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "250729", }, ], notes: [ { category: "description", text: "The BMP image parser in Sun Java Development Kit (JDK) before 1.5.0_11-b03 and 1.6.x before 1.6.0_01-b06, and Sun Java Runtime Environment in JDK and JRE 6, JDK and JRE 5.0 Update 10 and earlier, SDK and JRE 1.4.2_14 and earlier, and SDK and JRE 1.3.1_19 and earlier, when running on Unix/Linux systems, allows remote attackers to cause a denial of service (JVM hang) via untrusted applets or applications that open arbitrary local files via a crafted BMP file, such as /dev/tty.", title: "Vulnerability description", }, { category: "summary", text: "BMP image parser vulnerability", title: "Vulnerability summary", }, ], product_status: { fixed: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-2789", }, { category: "external", summary: "RHBZ#250729", url: "https://bugzilla.redhat.com/show_bug.cgi?id=250729", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-2789", url: "https://www.cve.org/CVERecord?id=CVE-2007-2789", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-2789", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-2789", }, ], release_date: "2007-05-21T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-05-20T14:12:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0261", }, ], threats: [ { category: "impact", details: "Critical", }, ], title: "BMP image parser vulnerability", }, { cve: "CVE-2007-3304", discovery_date: "2007-06-19T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "245111", }, ], notes: [ { category: "description", text: "Apache httpd 1.3.37, 2.0.59, and 2.2.4 with the Prefork MPM module, allows local users to cause a denial of service by modifying the worker_score and process_score arrays to reference an arbitrary process ID, which is sent a SIGUSR1 signal from the master process, aka \"SIGUSR1 killer.\"", title: "Vulnerability description", }, { category: "summary", text: "httpd scoreboard lack of PID protection", title: "Vulnerability summary", }, ], product_status: { fixed: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-3304", }, { category: "external", summary: "RHBZ#245111", url: "https://bugzilla.redhat.com/show_bug.cgi?id=245111", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-3304", url: "https://www.cve.org/CVERecord?id=CVE-2007-3304", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-3304", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-3304", }, ], release_date: "2007-06-19T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-05-20T14:12:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0261", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "httpd scoreboard lack of PID protection", }, { cve: "CVE-2007-3382", discovery_date: "2007-07-12T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "247972", }, ], notes: [ { category: "description", text: "Apache Tomcat 6.0.0 to 6.0.13, 5.5.0 to 5.5.24, 5.0.0 to 5.0.30, 4.1.0 to 4.1.36, and 3.3 to 3.3.2 treats single quotes (\"'\") as delimiters in cookies, which might cause sensitive information such as session IDs to be leaked and allow remote attackers to conduct session hijacking attacks.", title: "Vulnerability description", }, { category: "summary", text: "tomcat handling of cookies", title: "Vulnerability summary", }, ], product_status: { fixed: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-3382", }, { category: "external", summary: "RHBZ#247972", url: "https://bugzilla.redhat.com/show_bug.cgi?id=247972", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-3382", url: "https://www.cve.org/CVERecord?id=CVE-2007-3382", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-3382", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-3382", }, ], release_date: "2007-08-14T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-05-20T14:12:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0261", }, ], threats: [ { category: "impact", details: "Low", }, ], title: "tomcat handling of cookies", }, { cve: "CVE-2007-3385", discovery_date: "2007-07-12T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "247976", }, ], notes: [ { category: "description", text: "Apache Tomcat 6.0.0 to 6.0.13, 5.5.0 to 5.5.24, 5.0.0 to 5.0.30, 4.1.0 to 4.1.36, and 3.3 to 3.3.2 does not properly handle the \\\" character sequence in a cookie value, which might cause sensitive information such as session IDs to be leaked to remote attackers and enable session hijacking attacks.", title: "Vulnerability description", }, { category: "summary", text: "tomcat handling of cookie values", title: "Vulnerability summary", }, ], product_status: { fixed: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-3385", }, { category: "external", summary: "RHBZ#247976", url: "https://bugzilla.redhat.com/show_bug.cgi?id=247976", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-3385", url: "https://www.cve.org/CVERecord?id=CVE-2007-3385", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-3385", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-3385", }, ], release_date: "2007-08-14T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-05-20T14:12:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0261", }, ], threats: [ { category: "impact", details: "Low", }, ], title: "tomcat handling of cookie values", }, { cve: "CVE-2007-4465", cwe: { id: "CWE-79", name: "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", }, discovery_date: "2007-09-13T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "289511", }, ], notes: [ { category: "description", text: "Cross-site scripting (XSS) vulnerability in mod_autoindex.c in the Apache HTTP Server before 2.2.6, when the charset on a server-generated page is not defined, allows remote attackers to inject arbitrary web script or HTML via the P parameter using the UTF-7 charset. NOTE: it could be argued that this issue is due to a design limitation of browsers that attempt to perform automatic content type detection.", title: "Vulnerability description", }, { category: "summary", text: "mod_autoindex XSS", title: "Vulnerability summary", }, { category: "other", text: "This is actually a flaw in browsers that do not derive the response character set as required by RFC 2616. This does not affect the default configuration of Apache httpd in Red Hat products and will only affect customers who have removed the \"AddDefaultCharset\" directive and are using directory indexes. The Red Hat Product Security has rated this issue as having low security impact, a future update may address this flaw.", title: "Statement", }, ], product_status: { fixed: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-4465", }, { category: "external", summary: "RHBZ#289511", url: "https://bugzilla.redhat.com/show_bug.cgi?id=289511", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-4465", url: "https://www.cve.org/CVERecord?id=CVE-2007-4465", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-4465", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-4465", }, ], release_date: "2007-09-13T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-05-20T14:12:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0261", }, ], threats: [ { category: "impact", details: "Low", }, ], title: "mod_autoindex XSS", }, { cve: "CVE-2007-5000", cwe: { id: "CWE-79", name: "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", }, discovery_date: "2007-12-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "419931", }, ], notes: [ { category: "description", text: "Cross-site scripting (XSS) vulnerability in the (1) mod_imap module in the Apache HTTP Server 1.3.0 through 1.3.39 and 2.0.35 through 2.0.61 and the (2) mod_imagemap module in the Apache HTTP Server 2.2.0 through 2.2.6 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.", title: "Vulnerability description", }, { category: "summary", text: "httpd: mod_imagemap XSS", title: "Vulnerability summary", }, ], product_status: { fixed: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-5000", }, { category: "external", summary: "RHBZ#419931", url: "https://bugzilla.redhat.com/show_bug.cgi?id=419931", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-5000", url: "https://www.cve.org/CVERecord?id=CVE-2007-5000", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-5000", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-5000", }, ], release_date: "2007-12-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-05-20T14:12:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0261", }, ], threats: [ { category: "impact", details: "Low", }, ], title: "httpd: mod_imagemap XSS", }, { cve: "CVE-2007-5461", discovery_date: "2007-10-14T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "333791", }, ], notes: [ { category: "description", text: "Absolute path traversal vulnerability in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0, 5.0.0, 5.5.0 through 5.5.25, and 6.0.0 through 6.0.14, under certain configurations, allows remote authenticated users to read arbitrary files via a WebDAV write request that specifies an entity with a SYSTEM tag.", title: "Vulnerability description", }, { category: "summary", text: "Absolute path traversal Apache Tomcat WEBDAV", title: "Vulnerability summary", }, ], product_status: { fixed: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-5461", }, { category: "external", summary: "RHBZ#333791", url: "https://bugzilla.redhat.com/show_bug.cgi?id=333791", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-5461", url: "https://www.cve.org/CVERecord?id=CVE-2007-5461", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-5461", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-5461", }, ], release_date: "2007-10-14T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-05-20T14:12:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0261", }, ], threats: [ { category: "impact", details: "Important", }, ], title: "Absolute path traversal Apache Tomcat WEBDAV", }, { cve: "CVE-2007-5961", cwe: { id: "CWE-79", name: "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", }, discovery_date: "2007-09-26T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "396641", }, ], notes: [ { category: "description", text: "Cross-site scripting (XSS) vulnerability in the Red Hat Network channel search feature, as used in RHN and Red Hat Network Satellite before 5.0.2, allows remote attackers to inject arbitrary web script or HTML via unknown vectors.", title: "Vulnerability description", }, { category: "summary", text: "RHN XSS flaw", title: "Vulnerability summary", }, ], product_status: { fixed: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-5961", }, { category: "external", summary: "RHBZ#396641", url: "https://bugzilla.redhat.com/show_bug.cgi?id=396641", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-5961", url: "https://www.cve.org/CVERecord?id=CVE-2007-5961", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-5961", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-5961", }, ], release_date: "2008-05-20T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-05-20T14:12:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0261", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "RHN XSS flaw", }, { cve: "CVE-2007-6306", cwe: { id: "CWE-79", name: "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", }, discovery_date: "2007-12-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "421081", }, ], notes: [ { category: "description", text: "Multiple cross-site scripting (XSS) vulnerabilities in the image map feature in JFreeChart 1.0.8 allow remote attackers to inject arbitrary web script or HTML via the (1) chart name or (2) chart tool tip text; or the (3) href, (4) shape, or (5) coords attribute of a chart area.", title: "Vulnerability description", }, { category: "summary", text: "JFreeChart: XSS vulnerabilities in the image map feature", title: "Vulnerability summary", }, ], product_status: { fixed: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-6306", }, { category: "external", summary: "RHBZ#421081", url: "https://bugzilla.redhat.com/show_bug.cgi?id=421081", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-6306", url: "https://www.cve.org/CVERecord?id=CVE-2007-6306", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-6306", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-6306", }, ], release_date: "2007-12-06T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-05-20T14:12:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0261", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "JFreeChart: XSS vulnerabilities in the image map feature", }, { cve: "CVE-2007-6388", cwe: { id: "CWE-79", name: "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", }, discovery_date: "2008-01-02T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "427228", }, ], notes: [ { category: "description", text: "Cross-site scripting (XSS) vulnerability in mod_status in the Apache HTTP Server 2.2.0 through 2.2.6, 2.0.35 through 2.0.61, and 1.3.2 through 1.3.39, when the server-status page is enabled, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.", title: "Vulnerability description", }, { category: "summary", text: "apache mod_status cross-site scripting", title: "Vulnerability summary", }, ], product_status: { fixed: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-6388", }, { category: "external", summary: "RHBZ#427228", url: "https://bugzilla.redhat.com/show_bug.cgi?id=427228", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-6388", url: "https://www.cve.org/CVERecord?id=CVE-2007-6388", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-6388", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-6388", }, ], release_date: "2007-12-29T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-05-20T14:12:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0261", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "apache mod_status cross-site scripting", }, { cve: "CVE-2008-0128", discovery_date: "2008-01-23T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "429821", }, ], notes: [ { category: "description", text: "The SingleSignOn Valve (org.apache.catalina.authenticator.SingleSignOn) in Apache Tomcat before 5.5.21 does not set the secure flag for the JSESSIONIDSSO cookie in an https session, which can cause the cookie to be sent in http requests and make it easier for remote attackers to capture this cookie.", title: "Vulnerability description", }, { category: "summary", text: "tomcat5 SSO cookie login information disclosure", title: "Vulnerability summary", }, ], product_status: { fixed: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2008-0128", }, { category: "external", summary: "RHBZ#429821", url: "https://bugzilla.redhat.com/show_bug.cgi?id=429821", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2008-0128", url: "https://www.cve.org/CVERecord?id=CVE-2008-0128", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2008-0128", url: "https://nvd.nist.gov/vuln/detail/CVE-2008-0128", }, ], release_date: "2006-12-20T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-05-20T14:12:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0261", }, ], threats: [ { category: "impact", details: "Low", }, ], title: "tomcat5 SSO cookie login information disclosure", }, ], }
rhsa-2007:0532
Vulnerability from csaf_redhat
Published
2007-06-26 15:13
Modified
2024-12-01 11:53
Summary
Red Hat Security Advisory: apache security update
Notes
Topic
Updated Apache httpd packages that correct two security issues are now
available for Red Hat Enterprise Linux 2.1.
This update has been rated as having moderate security impact by the Red
Hat Security Response Team.
Details
The Apache HTTP Server is a popular Web server.
The Apache HTTP Server did not verify that a process was an Apache child
process before sending it signals. A local attacker who has the ability to
run scripts on the Apache HTTP Server could manipulate the scoreboard and
cause arbitrary processes to be terminated, which could lead to a denial of
service. (CVE-2007-3304)
A flaw was found in the Apache HTTP Server mod_status module. Sites with
the server-status page publicly accessible and ExtendedStatus enabled were
vulnerable to a cross-site scripting attack. On Red Hat Enterprise Linux
the server-status page is not enabled by default and it is best practice to
not make this publicly available. (CVE-2006-5752)
Users of Apache should upgrade to these updated packages, which contain
backported patches to correct these issues. Users should restart Apache
after installing this update.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ document: { aggregate_severity: { namespace: "https://access.redhat.com/security/updates/classification/", text: "Moderate", }, category: "csaf_security_advisory", csaf_version: "2.0", distribution: { text: "Copyright © Red Hat, Inc. All rights reserved.", tlp: { label: "WHITE", url: "https://www.first.org/tlp/", }, }, lang: "en", notes: [ { category: "summary", text: "Updated Apache httpd packages that correct two security issues are now\navailable for Red Hat Enterprise Linux 2.1.\n\nThis update has been rated as having moderate security impact by the Red\nHat Security Response Team.", title: "Topic", }, { category: "general", text: "The Apache HTTP Server is a popular Web server.\n\nThe Apache HTTP Server did not verify that a process was an Apache child\nprocess before sending it signals. A local attacker who has the ability to\nrun scripts on the Apache HTTP Server could manipulate the scoreboard and\ncause arbitrary processes to be terminated, which could lead to a denial of\nservice. (CVE-2007-3304) \n\nA flaw was found in the Apache HTTP Server mod_status module. Sites with\nthe server-status page publicly accessible and ExtendedStatus enabled were\nvulnerable to a cross-site scripting attack. On Red Hat Enterprise Linux\nthe server-status page is not enabled by default and it is best practice to\nnot make this publicly available. (CVE-2006-5752)\n\nUsers of Apache should upgrade to these updated packages, which contain\nbackported patches to correct these issues. Users should restart Apache\nafter installing this update.", title: "Details", }, { category: "legal_disclaimer", text: "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", title: "Terms of Use", }, ], publisher: { category: "vendor", contact_details: "https://access.redhat.com/security/team/contact/", issuing_authority: "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", name: "Red Hat Product Security", namespace: "https://www.redhat.com", }, references: [ { category: "self", summary: "https://access.redhat.com/errata/RHSA-2007:0532", url: "https://access.redhat.com/errata/RHSA-2007:0532", }, { category: "external", summary: "https://access.redhat.com/security/updates/classification/#moderate", url: "https://access.redhat.com/security/updates/classification/#moderate", }, { category: "external", summary: "245111", url: "https://bugzilla.redhat.com/show_bug.cgi?id=245111", }, { category: "external", summary: "245112", url: "https://bugzilla.redhat.com/show_bug.cgi?id=245112", }, { category: "self", summary: "Canonical URL", url: "https://security.access.redhat.com/data/csaf/v2/advisories/2007/rhsa-2007_0532.json", }, ], title: "Red Hat Security Advisory: apache security update", tracking: { current_release_date: "2024-12-01T11:53:04+00:00", generator: { date: "2024-12-01T11:53:04+00:00", engine: { name: "Red Hat SDEngine", version: "4.2.1", }, }, id: "RHSA-2007:0532", initial_release_date: "2007-06-26T15:13:00+00:00", revision_history: [ { date: "2007-06-26T15:13:00+00:00", number: "1", summary: "Initial version", }, { date: "2007-06-26T11:13:14+00:00", number: "2", summary: "Last updated version", }, { date: "2024-12-01T11:53:04+00:00", number: "3", summary: "Last generated version", }, ], status: "final", version: "3", }, }, product_tree: { branches: [ { branches: [ { branches: [ { category: "product_name", name: "Red Hat Enterprise Linux AS (Advanced Server) version 2.1 ", product: { name: "Red Hat Enterprise Linux AS (Advanced Server) version 2.1 ", product_id: "2.1AS", product_identification_helper: { cpe: "cpe:/o:redhat:enterprise_linux:2.1::as", }, }, }, { category: "product_name", name: "Red Hat Linux Advanced Workstation 2.1", product: { name: "Red Hat Linux Advanced Workstation 2.1", product_id: "2.1AW", product_identification_helper: { cpe: "cpe:/o:redhat:enterprise_linux:2.1::aw", }, }, }, { category: "product_name", name: "Red Hat Enterprise Linux ES version 2.1", product: { name: "Red Hat Enterprise Linux ES version 2.1", product_id: "2.1ES", product_identification_helper: { cpe: "cpe:/o:redhat:enterprise_linux:2.1::es", }, }, }, { category: "product_name", name: "Red Hat Enterprise Linux WS version 2.1", product: { name: "Red Hat Enterprise Linux WS version 2.1", product_id: "2.1WS", product_identification_helper: { cpe: "cpe:/o:redhat:enterprise_linux:2.1::ws", }, }, }, ], category: "product_family", name: "Red Hat Enterprise Linux", }, { branches: [ { category: "product_version", name: "apache-manual-0:1.3.27-12.ent.ia64", product: { name: "apache-manual-0:1.3.27-12.ent.ia64", product_id: "apache-manual-0:1.3.27-12.ent.ia64", product_identification_helper: { purl: "pkg:rpm/redhat/apache-manual@1.3.27-12.ent?arch=ia64", }, }, }, { category: "product_version", name: "apache-0:1.3.27-12.ent.ia64", product: { name: "apache-0:1.3.27-12.ent.ia64", product_id: "apache-0:1.3.27-12.ent.ia64", product_identification_helper: { purl: "pkg:rpm/redhat/apache@1.3.27-12.ent?arch=ia64", }, }, }, { category: "product_version", name: "apache-devel-0:1.3.27-12.ent.ia64", product: { name: "apache-devel-0:1.3.27-12.ent.ia64", product_id: "apache-devel-0:1.3.27-12.ent.ia64", product_identification_helper: { purl: "pkg:rpm/redhat/apache-devel@1.3.27-12.ent?arch=ia64", }, }, }, ], category: "architecture", name: "ia64", }, { branches: [ { category: "product_version", name: "apache-0:1.3.27-12.ent.src", product: { name: "apache-0:1.3.27-12.ent.src", product_id: "apache-0:1.3.27-12.ent.src", product_identification_helper: { purl: "pkg:rpm/redhat/apache@1.3.27-12.ent?arch=src", }, }, }, ], category: "architecture", name: "src", }, { branches: [ { category: "product_version", name: "apache-manual-0:1.3.27-12.ent.i386", product: { name: "apache-manual-0:1.3.27-12.ent.i386", product_id: "apache-manual-0:1.3.27-12.ent.i386", product_identification_helper: { purl: "pkg:rpm/redhat/apache-manual@1.3.27-12.ent?arch=i386", }, }, }, { category: "product_version", name: "apache-0:1.3.27-12.ent.i386", product: { name: "apache-0:1.3.27-12.ent.i386", product_id: "apache-0:1.3.27-12.ent.i386", product_identification_helper: { purl: "pkg:rpm/redhat/apache@1.3.27-12.ent?arch=i386", }, }, }, { category: "product_version", name: "apache-devel-0:1.3.27-12.ent.i386", product: { name: "apache-devel-0:1.3.27-12.ent.i386", product_id: "apache-devel-0:1.3.27-12.ent.i386", product_identification_helper: { purl: "pkg:rpm/redhat/apache-devel@1.3.27-12.ent?arch=i386", }, }, }, ], category: "architecture", name: "i386", }, ], category: "vendor", name: "Red Hat", }, ], relationships: [ { category: "default_component_of", full_product_name: { name: "apache-0:1.3.27-12.ent.i386 as a component of Red Hat Enterprise Linux AS (Advanced Server) version 2.1 ", product_id: "2.1AS:apache-0:1.3.27-12.ent.i386", }, product_reference: "apache-0:1.3.27-12.ent.i386", relates_to_product_reference: "2.1AS", }, { category: "default_component_of", full_product_name: { name: "apache-0:1.3.27-12.ent.ia64 as a component of Red Hat Enterprise Linux AS (Advanced Server) version 2.1 ", product_id: "2.1AS:apache-0:1.3.27-12.ent.ia64", }, product_reference: "apache-0:1.3.27-12.ent.ia64", relates_to_product_reference: "2.1AS", }, { category: "default_component_of", full_product_name: { name: "apache-0:1.3.27-12.ent.src as a component of Red Hat Enterprise Linux AS (Advanced Server) version 2.1 ", product_id: "2.1AS:apache-0:1.3.27-12.ent.src", }, product_reference: "apache-0:1.3.27-12.ent.src", relates_to_product_reference: "2.1AS", }, { category: "default_component_of", full_product_name: { name: "apache-devel-0:1.3.27-12.ent.i386 as a component of Red Hat Enterprise Linux AS (Advanced Server) version 2.1 ", product_id: "2.1AS:apache-devel-0:1.3.27-12.ent.i386", }, product_reference: "apache-devel-0:1.3.27-12.ent.i386", relates_to_product_reference: "2.1AS", }, { category: "default_component_of", full_product_name: { name: "apache-devel-0:1.3.27-12.ent.ia64 as a component of Red Hat Enterprise Linux AS (Advanced Server) version 2.1 ", product_id: "2.1AS:apache-devel-0:1.3.27-12.ent.ia64", }, product_reference: "apache-devel-0:1.3.27-12.ent.ia64", relates_to_product_reference: "2.1AS", }, { category: "default_component_of", full_product_name: { name: "apache-manual-0:1.3.27-12.ent.i386 as a component of Red Hat Enterprise Linux AS (Advanced Server) version 2.1 ", product_id: "2.1AS:apache-manual-0:1.3.27-12.ent.i386", }, product_reference: "apache-manual-0:1.3.27-12.ent.i386", relates_to_product_reference: "2.1AS", }, { category: "default_component_of", full_product_name: { name: "apache-manual-0:1.3.27-12.ent.ia64 as a component of Red Hat Enterprise Linux AS (Advanced Server) version 2.1 ", product_id: "2.1AS:apache-manual-0:1.3.27-12.ent.ia64", }, product_reference: "apache-manual-0:1.3.27-12.ent.ia64", relates_to_product_reference: "2.1AS", }, { category: "default_component_of", full_product_name: { name: "apache-0:1.3.27-12.ent.i386 as a component of Red Hat Linux Advanced Workstation 2.1", product_id: "2.1AW:apache-0:1.3.27-12.ent.i386", }, product_reference: "apache-0:1.3.27-12.ent.i386", relates_to_product_reference: "2.1AW", }, { category: "default_component_of", full_product_name: { name: "apache-0:1.3.27-12.ent.ia64 as a component of Red Hat Linux Advanced Workstation 2.1", product_id: "2.1AW:apache-0:1.3.27-12.ent.ia64", }, product_reference: "apache-0:1.3.27-12.ent.ia64", relates_to_product_reference: "2.1AW", }, { category: "default_component_of", full_product_name: { name: "apache-0:1.3.27-12.ent.src as a component of Red Hat Linux Advanced Workstation 2.1", product_id: "2.1AW:apache-0:1.3.27-12.ent.src", }, product_reference: "apache-0:1.3.27-12.ent.src", relates_to_product_reference: "2.1AW", }, { category: "default_component_of", full_product_name: { name: "apache-devel-0:1.3.27-12.ent.i386 as a component of Red Hat Linux Advanced Workstation 2.1", product_id: "2.1AW:apache-devel-0:1.3.27-12.ent.i386", }, product_reference: "apache-devel-0:1.3.27-12.ent.i386", relates_to_product_reference: "2.1AW", }, { category: "default_component_of", full_product_name: { name: "apache-devel-0:1.3.27-12.ent.ia64 as a component of Red Hat Linux Advanced Workstation 2.1", product_id: "2.1AW:apache-devel-0:1.3.27-12.ent.ia64", }, product_reference: "apache-devel-0:1.3.27-12.ent.ia64", relates_to_product_reference: "2.1AW", }, { category: "default_component_of", full_product_name: { name: "apache-manual-0:1.3.27-12.ent.i386 as a component of Red Hat Linux Advanced Workstation 2.1", product_id: "2.1AW:apache-manual-0:1.3.27-12.ent.i386", }, product_reference: "apache-manual-0:1.3.27-12.ent.i386", relates_to_product_reference: "2.1AW", }, { category: "default_component_of", full_product_name: { name: "apache-manual-0:1.3.27-12.ent.ia64 as a component of Red Hat Linux Advanced Workstation 2.1", product_id: "2.1AW:apache-manual-0:1.3.27-12.ent.ia64", }, product_reference: "apache-manual-0:1.3.27-12.ent.ia64", relates_to_product_reference: "2.1AW", }, { category: "default_component_of", full_product_name: { name: "apache-0:1.3.27-12.ent.i386 as a component of Red Hat Enterprise Linux ES version 2.1", product_id: "2.1ES:apache-0:1.3.27-12.ent.i386", }, product_reference: "apache-0:1.3.27-12.ent.i386", relates_to_product_reference: "2.1ES", }, { category: "default_component_of", full_product_name: { name: "apache-0:1.3.27-12.ent.ia64 as a component of Red Hat Enterprise Linux ES version 2.1", product_id: "2.1ES:apache-0:1.3.27-12.ent.ia64", }, product_reference: "apache-0:1.3.27-12.ent.ia64", relates_to_product_reference: "2.1ES", }, { category: "default_component_of", full_product_name: { name: "apache-0:1.3.27-12.ent.src as a component of Red Hat Enterprise Linux ES version 2.1", product_id: "2.1ES:apache-0:1.3.27-12.ent.src", }, product_reference: "apache-0:1.3.27-12.ent.src", relates_to_product_reference: "2.1ES", }, { category: "default_component_of", full_product_name: { name: "apache-devel-0:1.3.27-12.ent.i386 as a component of Red Hat Enterprise Linux ES version 2.1", product_id: "2.1ES:apache-devel-0:1.3.27-12.ent.i386", }, product_reference: "apache-devel-0:1.3.27-12.ent.i386", relates_to_product_reference: "2.1ES", }, { category: "default_component_of", full_product_name: { name: "apache-devel-0:1.3.27-12.ent.ia64 as a component of Red Hat Enterprise Linux ES version 2.1", product_id: "2.1ES:apache-devel-0:1.3.27-12.ent.ia64", }, product_reference: "apache-devel-0:1.3.27-12.ent.ia64", relates_to_product_reference: "2.1ES", }, { category: "default_component_of", full_product_name: { name: "apache-manual-0:1.3.27-12.ent.i386 as a component of Red Hat Enterprise Linux ES version 2.1", product_id: "2.1ES:apache-manual-0:1.3.27-12.ent.i386", }, product_reference: "apache-manual-0:1.3.27-12.ent.i386", relates_to_product_reference: "2.1ES", }, { category: "default_component_of", full_product_name: { name: "apache-manual-0:1.3.27-12.ent.ia64 as a component of Red Hat Enterprise Linux ES version 2.1", product_id: "2.1ES:apache-manual-0:1.3.27-12.ent.ia64", }, product_reference: "apache-manual-0:1.3.27-12.ent.ia64", relates_to_product_reference: "2.1ES", }, { category: "default_component_of", full_product_name: { name: "apache-0:1.3.27-12.ent.i386 as a component of Red Hat Enterprise Linux WS version 2.1", product_id: "2.1WS:apache-0:1.3.27-12.ent.i386", }, product_reference: "apache-0:1.3.27-12.ent.i386", relates_to_product_reference: "2.1WS", }, { category: "default_component_of", full_product_name: { name: "apache-0:1.3.27-12.ent.ia64 as a component of Red Hat Enterprise Linux WS version 2.1", product_id: "2.1WS:apache-0:1.3.27-12.ent.ia64", }, product_reference: "apache-0:1.3.27-12.ent.ia64", relates_to_product_reference: "2.1WS", }, { category: "default_component_of", full_product_name: { name: "apache-0:1.3.27-12.ent.src as a component of Red Hat Enterprise Linux WS version 2.1", product_id: "2.1WS:apache-0:1.3.27-12.ent.src", }, product_reference: "apache-0:1.3.27-12.ent.src", relates_to_product_reference: "2.1WS", }, { category: "default_component_of", full_product_name: { name: "apache-devel-0:1.3.27-12.ent.i386 as a component of Red Hat Enterprise Linux WS version 2.1", product_id: "2.1WS:apache-devel-0:1.3.27-12.ent.i386", }, product_reference: "apache-devel-0:1.3.27-12.ent.i386", relates_to_product_reference: "2.1WS", }, { category: "default_component_of", full_product_name: { name: "apache-devel-0:1.3.27-12.ent.ia64 as a component of Red Hat Enterprise Linux WS version 2.1", product_id: "2.1WS:apache-devel-0:1.3.27-12.ent.ia64", }, product_reference: "apache-devel-0:1.3.27-12.ent.ia64", relates_to_product_reference: "2.1WS", }, { category: "default_component_of", full_product_name: { name: "apache-manual-0:1.3.27-12.ent.i386 as a component of Red Hat Enterprise Linux WS version 2.1", product_id: "2.1WS:apache-manual-0:1.3.27-12.ent.i386", }, product_reference: "apache-manual-0:1.3.27-12.ent.i386", relates_to_product_reference: "2.1WS", }, { category: "default_component_of", full_product_name: { name: "apache-manual-0:1.3.27-12.ent.ia64 as a component of Red Hat Enterprise Linux WS version 2.1", product_id: "2.1WS:apache-manual-0:1.3.27-12.ent.ia64", }, product_reference: "apache-manual-0:1.3.27-12.ent.ia64", relates_to_product_reference: "2.1WS", }, ], }, vulnerabilities: [ { cve: "CVE-2006-5752", cwe: { id: "CWE-79", name: "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", }, discovery_date: "2007-06-20T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "245112", }, ], notes: [ { category: "description", text: "Cross-site scripting (XSS) vulnerability in mod_status.c in the mod_status module in Apache HTTP Server (httpd), when ExtendedStatus is enabled and a public server-status page is used, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors involving charsets with browsers that perform \"charset detection\" when the content-type is not specified.", title: "Vulnerability description", }, { category: "summary", text: "httpd mod_status XSS", title: "Vulnerability summary", }, ], product_status: { fixed: [ "2.1AS:apache-0:1.3.27-12.ent.i386", "2.1AS:apache-0:1.3.27-12.ent.ia64", "2.1AS:apache-0:1.3.27-12.ent.src", "2.1AS:apache-devel-0:1.3.27-12.ent.i386", "2.1AS:apache-devel-0:1.3.27-12.ent.ia64", "2.1AS:apache-manual-0:1.3.27-12.ent.i386", "2.1AS:apache-manual-0:1.3.27-12.ent.ia64", "2.1AW:apache-0:1.3.27-12.ent.i386", "2.1AW:apache-0:1.3.27-12.ent.ia64", "2.1AW:apache-0:1.3.27-12.ent.src", "2.1AW:apache-devel-0:1.3.27-12.ent.i386", "2.1AW:apache-devel-0:1.3.27-12.ent.ia64", "2.1AW:apache-manual-0:1.3.27-12.ent.i386", "2.1AW:apache-manual-0:1.3.27-12.ent.ia64", "2.1ES:apache-0:1.3.27-12.ent.i386", "2.1ES:apache-0:1.3.27-12.ent.ia64", "2.1ES:apache-0:1.3.27-12.ent.src", "2.1ES:apache-devel-0:1.3.27-12.ent.i386", "2.1ES:apache-devel-0:1.3.27-12.ent.ia64", "2.1ES:apache-manual-0:1.3.27-12.ent.i386", "2.1ES:apache-manual-0:1.3.27-12.ent.ia64", "2.1WS:apache-0:1.3.27-12.ent.i386", "2.1WS:apache-0:1.3.27-12.ent.ia64", "2.1WS:apache-0:1.3.27-12.ent.src", "2.1WS:apache-devel-0:1.3.27-12.ent.i386", "2.1WS:apache-devel-0:1.3.27-12.ent.ia64", "2.1WS:apache-manual-0:1.3.27-12.ent.i386", "2.1WS:apache-manual-0:1.3.27-12.ent.ia64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2006-5752", }, { category: "external", summary: "RHBZ#245112", url: "https://bugzilla.redhat.com/show_bug.cgi?id=245112", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2006-5752", url: "https://www.cve.org/CVERecord?id=CVE-2006-5752", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2006-5752", url: "https://nvd.nist.gov/vuln/detail/CVE-2006-5752", }, ], release_date: "2007-06-20T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2007-06-26T15:13:00+00:00", details: "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied. \n\nThis update is available via Red Hat Network. Details on how to use \nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/FAQ_58_10188", product_ids: [ "2.1AS:apache-0:1.3.27-12.ent.i386", "2.1AS:apache-0:1.3.27-12.ent.ia64", "2.1AS:apache-0:1.3.27-12.ent.src", "2.1AS:apache-devel-0:1.3.27-12.ent.i386", "2.1AS:apache-devel-0:1.3.27-12.ent.ia64", "2.1AS:apache-manual-0:1.3.27-12.ent.i386", "2.1AS:apache-manual-0:1.3.27-12.ent.ia64", "2.1AW:apache-0:1.3.27-12.ent.i386", "2.1AW:apache-0:1.3.27-12.ent.ia64", "2.1AW:apache-0:1.3.27-12.ent.src", "2.1AW:apache-devel-0:1.3.27-12.ent.i386", "2.1AW:apache-devel-0:1.3.27-12.ent.ia64", "2.1AW:apache-manual-0:1.3.27-12.ent.i386", "2.1AW:apache-manual-0:1.3.27-12.ent.ia64", "2.1ES:apache-0:1.3.27-12.ent.i386", "2.1ES:apache-0:1.3.27-12.ent.ia64", "2.1ES:apache-0:1.3.27-12.ent.src", "2.1ES:apache-devel-0:1.3.27-12.ent.i386", "2.1ES:apache-devel-0:1.3.27-12.ent.ia64", "2.1ES:apache-manual-0:1.3.27-12.ent.i386", "2.1ES:apache-manual-0:1.3.27-12.ent.ia64", "2.1WS:apache-0:1.3.27-12.ent.i386", "2.1WS:apache-0:1.3.27-12.ent.ia64", "2.1WS:apache-0:1.3.27-12.ent.src", "2.1WS:apache-devel-0:1.3.27-12.ent.i386", "2.1WS:apache-devel-0:1.3.27-12.ent.ia64", "2.1WS:apache-manual-0:1.3.27-12.ent.i386", "2.1WS:apache-manual-0:1.3.27-12.ent.ia64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2007:0532", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "httpd mod_status XSS", }, { cve: "CVE-2007-3304", discovery_date: "2007-06-19T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "245111", }, ], notes: [ { category: "description", text: "Apache httpd 1.3.37, 2.0.59, and 2.2.4 with the Prefork MPM module, allows local users to cause a denial of service by modifying the worker_score and process_score arrays to reference an arbitrary process ID, which is sent a SIGUSR1 signal from the master process, aka \"SIGUSR1 killer.\"", title: "Vulnerability description", }, { category: "summary", text: "httpd scoreboard lack of PID protection", title: "Vulnerability summary", }, ], product_status: { fixed: [ "2.1AS:apache-0:1.3.27-12.ent.i386", "2.1AS:apache-0:1.3.27-12.ent.ia64", "2.1AS:apache-0:1.3.27-12.ent.src", "2.1AS:apache-devel-0:1.3.27-12.ent.i386", "2.1AS:apache-devel-0:1.3.27-12.ent.ia64", "2.1AS:apache-manual-0:1.3.27-12.ent.i386", "2.1AS:apache-manual-0:1.3.27-12.ent.ia64", "2.1AW:apache-0:1.3.27-12.ent.i386", "2.1AW:apache-0:1.3.27-12.ent.ia64", "2.1AW:apache-0:1.3.27-12.ent.src", "2.1AW:apache-devel-0:1.3.27-12.ent.i386", "2.1AW:apache-devel-0:1.3.27-12.ent.ia64", "2.1AW:apache-manual-0:1.3.27-12.ent.i386", "2.1AW:apache-manual-0:1.3.27-12.ent.ia64", "2.1ES:apache-0:1.3.27-12.ent.i386", "2.1ES:apache-0:1.3.27-12.ent.ia64", "2.1ES:apache-0:1.3.27-12.ent.src", "2.1ES:apache-devel-0:1.3.27-12.ent.i386", "2.1ES:apache-devel-0:1.3.27-12.ent.ia64", "2.1ES:apache-manual-0:1.3.27-12.ent.i386", "2.1ES:apache-manual-0:1.3.27-12.ent.ia64", "2.1WS:apache-0:1.3.27-12.ent.i386", "2.1WS:apache-0:1.3.27-12.ent.ia64", "2.1WS:apache-0:1.3.27-12.ent.src", "2.1WS:apache-devel-0:1.3.27-12.ent.i386", "2.1WS:apache-devel-0:1.3.27-12.ent.ia64", "2.1WS:apache-manual-0:1.3.27-12.ent.i386", "2.1WS:apache-manual-0:1.3.27-12.ent.ia64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-3304", }, { category: "external", summary: "RHBZ#245111", url: "https://bugzilla.redhat.com/show_bug.cgi?id=245111", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-3304", url: "https://www.cve.org/CVERecord?id=CVE-2007-3304", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-3304", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-3304", }, ], release_date: "2007-06-19T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2007-06-26T15:13:00+00:00", details: "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied. \n\nThis update is available via Red Hat Network. Details on how to use \nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/FAQ_58_10188", product_ids: [ "2.1AS:apache-0:1.3.27-12.ent.i386", "2.1AS:apache-0:1.3.27-12.ent.ia64", "2.1AS:apache-0:1.3.27-12.ent.src", "2.1AS:apache-devel-0:1.3.27-12.ent.i386", "2.1AS:apache-devel-0:1.3.27-12.ent.ia64", "2.1AS:apache-manual-0:1.3.27-12.ent.i386", "2.1AS:apache-manual-0:1.3.27-12.ent.ia64", "2.1AW:apache-0:1.3.27-12.ent.i386", "2.1AW:apache-0:1.3.27-12.ent.ia64", "2.1AW:apache-0:1.3.27-12.ent.src", "2.1AW:apache-devel-0:1.3.27-12.ent.i386", "2.1AW:apache-devel-0:1.3.27-12.ent.ia64", "2.1AW:apache-manual-0:1.3.27-12.ent.i386", "2.1AW:apache-manual-0:1.3.27-12.ent.ia64", "2.1ES:apache-0:1.3.27-12.ent.i386", "2.1ES:apache-0:1.3.27-12.ent.ia64", "2.1ES:apache-0:1.3.27-12.ent.src", "2.1ES:apache-devel-0:1.3.27-12.ent.i386", "2.1ES:apache-devel-0:1.3.27-12.ent.ia64", "2.1ES:apache-manual-0:1.3.27-12.ent.i386", "2.1ES:apache-manual-0:1.3.27-12.ent.ia64", "2.1WS:apache-0:1.3.27-12.ent.i386", "2.1WS:apache-0:1.3.27-12.ent.ia64", "2.1WS:apache-0:1.3.27-12.ent.src", "2.1WS:apache-devel-0:1.3.27-12.ent.i386", "2.1WS:apache-devel-0:1.3.27-12.ent.ia64", "2.1WS:apache-manual-0:1.3.27-12.ent.i386", "2.1WS:apache-manual-0:1.3.27-12.ent.ia64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2007:0532", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "httpd scoreboard lack of PID protection", }, ], }
rhsa-2010_0602
Vulnerability from csaf_redhat
Published
2010-08-04 21:30
Modified
2024-12-15 18:14
Summary
Red Hat Security Advisory: Red Hat Certificate System 7.3 security update
Notes
Topic
Updated packages that fix multiple security issues and rebase various
components are now available for Red Hat Certificate System 7.3.
The Red Hat Security Response Team has rated this update as having moderate
security impact. Common Vulnerability Scoring System (CVSS) base scores,
which give detailed severity ratings, are available for each vulnerability
from the CVE links in the References section.
Details
Red Hat Certificate System (RHCS) is an enterprise software system designed
to manage enterprise Public Key Infrastructure (PKI) deployments.
Multiple buffer overflow flaws were discovered in the way the pcscd daemon,
a resource manager that coordinates communications with smart card readers
and smart cards connected to the system, handled client requests. A local
user could create a specially-crafted request that would cause the pcscd
daemon to crash or, possibly, execute arbitrary code. (CVE-2010-0407,
CVE-2009-4901)
This erratum updates the Tomcat component shipped as part of Red Hat
Certificate System to version 5.5.23, to address multiple security issues.
In a typical operating environment, Tomcat is not exposed to users of
Certificate System in a vulnerable manner. These security updates will
reduce risk in unique Certificate System environments. (CVE-2005-2090,
CVE-2005-3510, CVE-2006-3835, CVE-2007-0450, CVE-2007-1358, CVE-2007-3382,
CVE-2007-3385, CVE-2007-5461, CVE-2007-5333, CVE-2008-0128, CVE-2008-1232,
CVE-2008-2370, CVE-2008-5515, CVE-2009-0033, CVE-2009-0580)
This erratum provides updated versions of the following components,
required by the updated Tomcat version: ant, avalon-logkit, axis,
classpathx-jaf, classpathx-mail, geronimo-specs, jakarta-commons-modeler,
log4j, mx4j, xerces-j2, and xml-commons.
A number of components have been updated to fix security issues for users
of Red Hat Certificate System for the Solaris operating system. These fixes
are for apr issue CVE-2009-2412; apr-util issues CVE-2009-0023,
CVE-2009-1955, CVE-2009-1956, and CVE-2009-2412; httpd issues
CVE-2006-3918, CVE-2006-5752, CVE-2007-1863, CVE-2007-3304, CVE-2007-3847,
CVE-2007-4465, CVE-2007-5000, CVE-2007-6388, CVE-2008-0005, CVE-2008-2364,
CVE-2008-2939, CVE-2009-1891, CVE-2009-3094, CVE-2009-3095, and
CVE-2010-0434; mod_perl issue CVE-2007-1349; and perl issues CVE-2007-5116
and CVE-2008-1927.
Note: Updated apr, apr-util, httpd, mod_perl, and perl packages were
previously available to users of Red Hat Certificate System for Red Hat
Enterprise Linux via the Red Hat Enterprise Linux 4 channels on the Red Hat
Network.
Additionally, the rhpki-ca, rhpki-kra, rhpki-ocsp, rhpki-tks,
rhpki-java-tools, and rhpki-native-tools packages were updated to address
some anomalous behavior on the Solaris operating system. (BZ#600513,
BZ#605760)
As well, this update provides an updated rhpki-manage package, which
includes installation and uninstall scripts for Red Hat Certificate System
that have been updated with the list of packages required by the Tomcat
component, and an updated dependency on the NSS and NSPR packages.
All users of Red Hat Certificate System are advised to upgrade to these
updated packages, which correct these issues. Refer to the Red Hat
Certificate System Administration Guide, linked to in the References, for
details on how to install the updated packages on the Solaris operating
system. After installing this update, all Red Hat Certificate System
subsystems must be restarted ("/etc/init.d/[instance-name] restart") for
the update to take effect.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ document: { aggregate_severity: { namespace: "https://access.redhat.com/security/updates/classification/", text: "Moderate", }, category: "csaf_security_advisory", csaf_version: "2.0", distribution: { text: "Copyright © Red Hat, Inc. All rights reserved.", tlp: { label: "WHITE", url: "https://www.first.org/tlp/", }, }, lang: "en", notes: [ { category: "summary", text: "Updated packages that fix multiple security issues and rebase various\ncomponents are now available for Red Hat Certificate System 7.3.\n\nThe Red Hat Security Response Team has rated this update as having moderate\nsecurity impact. Common Vulnerability Scoring System (CVSS) base scores,\nwhich give detailed severity ratings, are available for each vulnerability\nfrom the CVE links in the References section.", title: "Topic", }, { category: "general", text: "Red Hat Certificate System (RHCS) is an enterprise software system designed\nto manage enterprise Public Key Infrastructure (PKI) deployments.\n\nMultiple buffer overflow flaws were discovered in the way the pcscd daemon,\na resource manager that coordinates communications with smart card readers\nand smart cards connected to the system, handled client requests. A local\nuser could create a specially-crafted request that would cause the pcscd\ndaemon to crash or, possibly, execute arbitrary code. (CVE-2010-0407,\nCVE-2009-4901)\n\nThis erratum updates the Tomcat component shipped as part of Red Hat\nCertificate System to version 5.5.23, to address multiple security issues.\nIn a typical operating environment, Tomcat is not exposed to users of\nCertificate System in a vulnerable manner. These security updates will\nreduce risk in unique Certificate System environments. (CVE-2005-2090,\nCVE-2005-3510, CVE-2006-3835, CVE-2007-0450, CVE-2007-1358, CVE-2007-3382,\nCVE-2007-3385, CVE-2007-5461, CVE-2007-5333, CVE-2008-0128, CVE-2008-1232,\nCVE-2008-2370, CVE-2008-5515, CVE-2009-0033, CVE-2009-0580)\n\nThis erratum provides updated versions of the following components,\nrequired by the updated Tomcat version: ant, avalon-logkit, axis,\nclasspathx-jaf, classpathx-mail, geronimo-specs, jakarta-commons-modeler,\nlog4j, mx4j, xerces-j2, and xml-commons.\n\nA number of components have been updated to fix security issues for users\nof Red Hat Certificate System for the Solaris operating system. These fixes\nare for apr issue CVE-2009-2412; apr-util issues CVE-2009-0023,\nCVE-2009-1955, CVE-2009-1956, and CVE-2009-2412; httpd issues\nCVE-2006-3918, CVE-2006-5752, CVE-2007-1863, CVE-2007-3304, CVE-2007-3847,\nCVE-2007-4465, CVE-2007-5000, CVE-2007-6388, CVE-2008-0005, CVE-2008-2364,\nCVE-2008-2939, CVE-2009-1891, CVE-2009-3094, CVE-2009-3095, and\nCVE-2010-0434; mod_perl issue CVE-2007-1349; and perl issues CVE-2007-5116\nand CVE-2008-1927.\n\nNote: Updated apr, apr-util, httpd, mod_perl, and perl packages were\npreviously available to users of Red Hat Certificate System for Red Hat\nEnterprise Linux via the Red Hat Enterprise Linux 4 channels on the Red Hat\nNetwork.\n\nAdditionally, the rhpki-ca, rhpki-kra, rhpki-ocsp, rhpki-tks,\nrhpki-java-tools, and rhpki-native-tools packages were updated to address\nsome anomalous behavior on the Solaris operating system. (BZ#600513,\nBZ#605760)\n\nAs well, this update provides an updated rhpki-manage package, which\nincludes installation and uninstall scripts for Red Hat Certificate System\nthat have been updated with the list of packages required by the Tomcat\ncomponent, and an updated dependency on the NSS and NSPR packages.\n\nAll users of Red Hat Certificate System are advised to upgrade to these\nupdated packages, which correct these issues. Refer to the Red Hat\nCertificate System Administration Guide, linked to in the References, for\ndetails on how to install the updated packages on the Solaris operating\nsystem. After installing this update, all Red Hat Certificate System\nsubsystems must be restarted (\"/etc/init.d/[instance-name] restart\") for\nthe update to take effect.", title: "Details", }, { category: "legal_disclaimer", text: "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", title: "Terms of Use", }, ], publisher: { category: "vendor", contact_details: "https://access.redhat.com/security/team/contact/", issuing_authority: "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", name: "Red Hat Product Security", namespace: "https://www.redhat.com", }, references: [ { category: "self", summary: "https://access.redhat.com/errata/RHSA-2010:0602", url: "https://access.redhat.com/errata/RHSA-2010:0602", }, { category: "external", summary: "http://www.redhat.com/security/updates/classification/#moderate", url: "http://www.redhat.com/security/updates/classification/#moderate", }, { category: "external", summary: "http://www.redhat.com/docs/manuals/cert-system/7.3/html/Administration_Guide/Administration_Guide-Updating_Certificate_System_Packages-Updating_a_Solaris_9_system_using_pkgrm_and_pkgadd.html", url: "http://www.redhat.com/docs/manuals/cert-system/7.3/html/Administration_Guide/Administration_Guide-Updating_Certificate_System_Packages-Updating_a_Solaris_9_system_using_pkgrm_and_pkgadd.html", }, { category: "external", summary: "200732", url: "https://bugzilla.redhat.com/show_bug.cgi?id=200732", }, { category: "external", summary: "237079", url: "https://bugzilla.redhat.com/show_bug.cgi?id=237079", }, { category: "external", summary: "237080", url: "https://bugzilla.redhat.com/show_bug.cgi?id=237080", }, { category: "external", summary: "237084", url: "https://bugzilla.redhat.com/show_bug.cgi?id=237084", }, { category: "external", summary: "237085", url: "https://bugzilla.redhat.com/show_bug.cgi?id=237085", }, { category: "external", summary: "240423", url: "https://bugzilla.redhat.com/show_bug.cgi?id=240423", }, { category: "external", summary: "244658", url: "https://bugzilla.redhat.com/show_bug.cgi?id=244658", }, { category: "external", summary: "244803", url: "https://bugzilla.redhat.com/show_bug.cgi?id=244803", }, { category: "external", summary: "245111", url: "https://bugzilla.redhat.com/show_bug.cgi?id=245111", }, { category: "external", summary: "245112", url: "https://bugzilla.redhat.com/show_bug.cgi?id=245112", }, { category: "external", summary: "247972", url: "https://bugzilla.redhat.com/show_bug.cgi?id=247972", }, { category: "external", summary: "247976", url: "https://bugzilla.redhat.com/show_bug.cgi?id=247976", }, { category: "external", summary: "250731", url: "https://bugzilla.redhat.com/show_bug.cgi?id=250731", }, { category: "external", summary: "289511", url: "https://bugzilla.redhat.com/show_bug.cgi?id=289511", }, { category: "external", summary: "323571", url: "https://bugzilla.redhat.com/show_bug.cgi?id=323571", }, { category: "external", summary: "333791", url: "https://bugzilla.redhat.com/show_bug.cgi?id=333791", }, { category: "external", summary: "419931", url: "https://bugzilla.redhat.com/show_bug.cgi?id=419931", }, { category: "external", summary: "427228", url: "https://bugzilla.redhat.com/show_bug.cgi?id=427228", }, { category: "external", summary: "427739", url: "https://bugzilla.redhat.com/show_bug.cgi?id=427739", }, { category: "external", summary: "427766", url: "https://bugzilla.redhat.com/show_bug.cgi?id=427766", }, { category: "external", summary: "429821", url: "https://bugzilla.redhat.com/show_bug.cgi?id=429821", }, { category: "external", summary: "443928", url: "https://bugzilla.redhat.com/show_bug.cgi?id=443928", }, { category: "external", summary: "451615", url: "https://bugzilla.redhat.com/show_bug.cgi?id=451615", }, { category: "external", summary: "457597", url: "https://bugzilla.redhat.com/show_bug.cgi?id=457597", }, { category: "external", summary: "457934", url: "https://bugzilla.redhat.com/show_bug.cgi?id=457934", }, { category: "external", summary: "458250", url: "https://bugzilla.redhat.com/show_bug.cgi?id=458250", }, { category: "external", summary: "493381", url: "https://bugzilla.redhat.com/show_bug.cgi?id=493381", }, { category: "external", summary: "503928", url: "https://bugzilla.redhat.com/show_bug.cgi?id=503928", }, { category: "external", summary: "503978", url: "https://bugzilla.redhat.com/show_bug.cgi?id=503978", }, { category: "external", summary: "504390", url: "https://bugzilla.redhat.com/show_bug.cgi?id=504390", }, { category: "external", summary: "504555", url: "https://bugzilla.redhat.com/show_bug.cgi?id=504555", }, { category: "external", summary: "504753", url: "https://bugzilla.redhat.com/show_bug.cgi?id=504753", }, { category: "external", summary: "509125", url: "https://bugzilla.redhat.com/show_bug.cgi?id=509125", }, { category: "external", summary: "515698", url: "https://bugzilla.redhat.com/show_bug.cgi?id=515698", }, { category: "external", summary: "521619", url: "https://bugzilla.redhat.com/show_bug.cgi?id=521619", }, { category: "external", summary: "522209", url: "https://bugzilla.redhat.com/show_bug.cgi?id=522209", }, { category: "external", summary: "570171", url: "https://bugzilla.redhat.com/show_bug.cgi?id=570171", }, { category: "external", summary: "596426", url: "https://bugzilla.redhat.com/show_bug.cgi?id=596426", }, { category: "self", summary: "Canonical URL", url: "https://security.access.redhat.com/data/csaf/v2/advisories/2010/rhsa-2010_0602.json", }, ], title: "Red Hat Security Advisory: Red Hat Certificate System 7.3 security update", tracking: { current_release_date: "2024-12-15T18:14:44+00:00", generator: { date: "2024-12-15T18:14:44+00:00", engine: { name: "Red Hat SDEngine", version: "4.2.3", }, }, id: "RHSA-2010:0602", initial_release_date: "2010-08-04T21:30:00+00:00", revision_history: [ { date: "2010-08-04T21:30:00+00:00", number: "1", summary: "Initial version", }, { date: "2010-08-05T10:04:51+00:00", number: "2", summary: "Last updated version", }, { date: "2024-12-15T18:14:44+00:00", number: "3", summary: "Last generated version", }, ], status: "final", version: "3", }, }, product_tree: { branches: [ { branches: [ { branches: [ { category: "product_name", name: "Red Hat Certificate System 7.3 for 4AS", product: { name: "Red Hat Certificate System 7.3 for 4AS", product_id: "4AS-CERT-7.3", product_identification_helper: { cpe: "cpe:/a:redhat:certificate_system:7.3", }, }, }, { category: "product_name", name: "Red Hat Certificate System 7.3 for 4ES", product: { name: "Red Hat Certificate System 7.3 for 4ES", product_id: "4ES-CERT-7.3", product_identification_helper: { cpe: "cpe:/a:redhat:certificate_system:7.3", }, }, }, ], category: "product_family", name: "Red Hat Certificate System", }, { branches: [ { category: "product_version", name: "xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", product: { name: "xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", product_id: "xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/xml-commons-apis@1.3.02-2jpp_1rh?arch=noarch", }, }, }, { category: "product_version", name: "xml-commons-0:1.3.02-2jpp_1rh.noarch", product: { name: "xml-commons-0:1.3.02-2jpp_1rh.noarch", product_id: "xml-commons-0:1.3.02-2jpp_1rh.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/xml-commons@1.3.02-2jpp_1rh?arch=noarch", }, }, }, { category: "product_version", name: "xerces-j2-0:2.7.1-1jpp_1rh.noarch", product: { name: "xerces-j2-0:2.7.1-1jpp_1rh.noarch", product_id: "xerces-j2-0:2.7.1-1jpp_1rh.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/xerces-j2@2.7.1-1jpp_1rh?arch=noarch", }, }, }, { category: "product_version", name: "ant-0:1.6.5-1jpp_1rh.noarch", product: { name: "ant-0:1.6.5-1jpp_1rh.noarch", product_id: "ant-0:1.6.5-1jpp_1rh.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/ant@1.6.5-1jpp_1rh?arch=noarch", }, }, }, { category: "product_version", name: "avalon-logkit-0:1.2-2jpp_4rh.noarch", product: { name: "avalon-logkit-0:1.2-2jpp_4rh.noarch", product_id: "avalon-logkit-0:1.2-2jpp_4rh.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/avalon-logkit@1.2-2jpp_4rh?arch=noarch", }, }, }, { category: "product_version", name: "axis-0:1.2.1-1jpp_3rh.noarch", product: { name: "axis-0:1.2.1-1jpp_3rh.noarch", product_id: "axis-0:1.2.1-1jpp_3rh.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/axis@1.2.1-1jpp_3rh?arch=noarch", }, }, }, { category: "product_version", name: "classpathx-jaf-0:1.0-2jpp_6rh.noarch", product: { name: "classpathx-jaf-0:1.0-2jpp_6rh.noarch", product_id: "classpathx-jaf-0:1.0-2jpp_6rh.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/classpathx-jaf@1.0-2jpp_6rh?arch=noarch", }, }, }, { category: "product_version", name: "classpathx-mail-0:1.1.1-2jpp_8rh.noarch", product: { name: "classpathx-mail-0:1.1.1-2jpp_8rh.noarch", product_id: "classpathx-mail-0:1.1.1-2jpp_8rh.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/classpathx-mail@1.1.1-2jpp_8rh?arch=noarch", }, }, }, { category: "product_version", name: "log4j-0:1.2.12-1jpp_1rh.noarch", product: { name: "log4j-0:1.2.12-1jpp_1rh.noarch", product_id: "log4j-0:1.2.12-1jpp_1rh.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/log4j@1.2.12-1jpp_1rh?arch=noarch", }, }, }, { category: "product_version", name: "mx4j-1:3.0.1-1jpp_4rh.noarch", product: { name: "mx4j-1:3.0.1-1jpp_4rh.noarch", product_id: "mx4j-1:3.0.1-1jpp_4rh.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/mx4j@3.0.1-1jpp_4rh?arch=noarch&epoch=1", }, }, }, { category: "product_version", name: "jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", product: { name: "jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", product_id: "jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/jakarta-commons-modeler@2.0-3jpp_2rh?arch=noarch", }, }, }, { category: "product_version", name: "tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", product: { name: "tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", product_id: "tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/tomcat5-jsp-2.0-api@5.5.23-0jpp_4rh.16?arch=noarch", }, }, }, { category: "product_version", name: "tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", product: { name: "tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", product_id: "tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/tomcat5-servlet-2.4-api@5.5.23-0jpp_4rh.16?arch=noarch", }, }, }, { category: "product_version", name: "tomcat5-0:5.5.23-0jpp_4rh.16.noarch", product: { name: "tomcat5-0:5.5.23-0jpp_4rh.16.noarch", product_id: "tomcat5-0:5.5.23-0jpp_4rh.16.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/tomcat5@5.5.23-0jpp_4rh.16?arch=noarch", }, }, }, { category: "product_version", name: "tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", product: { name: "tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", product_id: "tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/tomcat5-common-lib@5.5.23-0jpp_4rh.16?arch=noarch", }, }, }, { category: "product_version", name: "tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", product: { name: "tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", product_id: "tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/tomcat5-jasper@5.5.23-0jpp_4rh.16?arch=noarch", }, }, }, { category: "product_version", name: "tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", product: { name: "tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", product_id: "tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/tomcat5-server-lib@5.5.23-0jpp_4rh.16?arch=noarch", }, }, }, { category: "product_version", name: "rhpki-manage-0:7.3.0-19.el4.noarch", product: { name: "rhpki-manage-0:7.3.0-19.el4.noarch", product_id: "rhpki-manage-0:7.3.0-19.el4.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/rhpki-manage@7.3.0-19.el4?arch=noarch", }, }, }, { category: "product_version", name: "rhpki-ca-0:7.3.0-20.el4.noarch", product: { name: "rhpki-ca-0:7.3.0-20.el4.noarch", product_id: "rhpki-ca-0:7.3.0-20.el4.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/rhpki-ca@7.3.0-20.el4?arch=noarch", }, }, }, { category: "product_version", name: "rhpki-kra-0:7.3.0-14.el4.noarch", product: { name: "rhpki-kra-0:7.3.0-14.el4.noarch", product_id: "rhpki-kra-0:7.3.0-14.el4.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/rhpki-kra@7.3.0-14.el4?arch=noarch", }, }, }, { category: "product_version", name: "rhpki-tks-0:7.3.0-13.el4.noarch", product: { name: "rhpki-tks-0:7.3.0-13.el4.noarch", product_id: "rhpki-tks-0:7.3.0-13.el4.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/rhpki-tks@7.3.0-13.el4?arch=noarch", }, }, }, { category: "product_version", name: "rhpki-ocsp-0:7.3.0-13.el4.noarch", product: { name: "rhpki-ocsp-0:7.3.0-13.el4.noarch", product_id: "rhpki-ocsp-0:7.3.0-13.el4.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/rhpki-ocsp@7.3.0-13.el4?arch=noarch", }, }, }, { category: "product_version", name: "rhpki-java-tools-0:7.3.0-10.el4.noarch", product: { name: "rhpki-java-tools-0:7.3.0-10.el4.noarch", product_id: "rhpki-java-tools-0:7.3.0-10.el4.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/rhpki-java-tools@7.3.0-10.el4?arch=noarch", }, }, }, { category: "product_version", name: "geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", product: { name: "geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", product_id: "geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/geronimo-specs@1.0-0.M4.1jpp_10rh?arch=noarch", }, }, }, { category: "product_version", name: "geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", product: { name: "geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", product_id: "geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/geronimo-jms-1.1-api@1.0-0.M4.1jpp_10rh?arch=noarch", }, }, }, { category: "product_version", name: "geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", product: { name: "geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", product_id: "geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/geronimo-jta-1.0.1B-api@1.0-0.M4.1jpp_10rh?arch=noarch", }, }, }, { category: "product_version", name: "geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", product: { name: "geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", product_id: "geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/geronimo-j2ee-deployment-1.1-api@1.0-0.M4.1jpp_10rh?arch=noarch", }, }, }, { category: "product_version", name: "geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", product: { name: "geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", product_id: "geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/geronimo-ejb-2.1-api@1.0-0.M4.1jpp_10rh?arch=noarch", }, }, }, { category: "product_version", name: "geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", product: { name: "geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", product_id: "geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/geronimo-servlet-2.4-api@1.0-0.M4.1jpp_10rh?arch=noarch", }, }, }, { category: "product_version", name: "geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", product: { name: "geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", product_id: "geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/geronimo-specs-javadoc@1.0-0.M4.1jpp_10rh?arch=noarch", }, }, }, { category: "product_version", name: "geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", product: { name: "geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", product_id: "geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/geronimo-j2ee-1.4-apis@1.0-0.M4.1jpp_10rh?arch=noarch", }, }, }, { category: "product_version", name: "geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", product: { name: "geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", product_id: "geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/geronimo-j2ee-connector-1.5-api@1.0-0.M4.1jpp_10rh?arch=noarch", }, }, }, { category: "product_version", name: "geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", product: { name: "geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", product_id: "geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/geronimo-jsp-2.0-api@1.0-0.M4.1jpp_10rh?arch=noarch", }, }, }, { category: "product_version", name: "geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", product: { name: "geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", product_id: "geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/geronimo-j2ee-management-1.0-api@1.0-0.M4.1jpp_10rh?arch=noarch", }, }, }, ], category: "architecture", name: "noarch", }, { branches: [ { category: "product_version", name: "xml-commons-0:1.3.02-2jpp_1rh.src", product: { name: "xml-commons-0:1.3.02-2jpp_1rh.src", product_id: "xml-commons-0:1.3.02-2jpp_1rh.src", product_identification_helper: { purl: "pkg:rpm/redhat/xml-commons@1.3.02-2jpp_1rh?arch=src", }, }, }, { category: "product_version", name: "xerces-j2-0:2.7.1-1jpp_1rh.src", product: { name: "xerces-j2-0:2.7.1-1jpp_1rh.src", product_id: "xerces-j2-0:2.7.1-1jpp_1rh.src", product_identification_helper: { purl: "pkg:rpm/redhat/xerces-j2@2.7.1-1jpp_1rh?arch=src", }, }, }, { category: "product_version", name: "ant-0:1.6.5-1jpp_1rh.src", product: { name: "ant-0:1.6.5-1jpp_1rh.src", product_id: "ant-0:1.6.5-1jpp_1rh.src", product_identification_helper: { purl: "pkg:rpm/redhat/ant@1.6.5-1jpp_1rh?arch=src", }, }, }, { category: "product_version", name: "avalon-logkit-0:1.2-2jpp_4rh.src", product: { name: "avalon-logkit-0:1.2-2jpp_4rh.src", product_id: "avalon-logkit-0:1.2-2jpp_4rh.src", product_identification_helper: { purl: "pkg:rpm/redhat/avalon-logkit@1.2-2jpp_4rh?arch=src", }, }, }, { category: "product_version", name: "axis-0:1.2.1-1jpp_3rh.src", product: { name: "axis-0:1.2.1-1jpp_3rh.src", product_id: "axis-0:1.2.1-1jpp_3rh.src", product_identification_helper: { purl: "pkg:rpm/redhat/axis@1.2.1-1jpp_3rh?arch=src", }, }, }, { category: "product_version", name: "classpathx-jaf-0:1.0-2jpp_6rh.src", product: { name: "classpathx-jaf-0:1.0-2jpp_6rh.src", product_id: "classpathx-jaf-0:1.0-2jpp_6rh.src", product_identification_helper: { purl: "pkg:rpm/redhat/classpathx-jaf@1.0-2jpp_6rh?arch=src", }, }, }, { category: "product_version", name: "classpathx-mail-0:1.1.1-2jpp_8rh.src", product: { name: "classpathx-mail-0:1.1.1-2jpp_8rh.src", product_id: "classpathx-mail-0:1.1.1-2jpp_8rh.src", product_identification_helper: { purl: "pkg:rpm/redhat/classpathx-mail@1.1.1-2jpp_8rh?arch=src", }, }, }, { category: "product_version", name: "log4j-0:1.2.12-1jpp_1rh.src", product: { name: "log4j-0:1.2.12-1jpp_1rh.src", product_id: "log4j-0:1.2.12-1jpp_1rh.src", product_identification_helper: { purl: "pkg:rpm/redhat/log4j@1.2.12-1jpp_1rh?arch=src", }, }, }, { category: "product_version", name: "mx4j-1:3.0.1-1jpp_4rh.src", product: { name: "mx4j-1:3.0.1-1jpp_4rh.src", product_id: "mx4j-1:3.0.1-1jpp_4rh.src", product_identification_helper: { purl: "pkg:rpm/redhat/mx4j@3.0.1-1jpp_4rh?arch=src&epoch=1", }, }, }, { category: "product_version", name: "jakarta-commons-modeler-0:2.0-3jpp_2rh.src", product: { name: "jakarta-commons-modeler-0:2.0-3jpp_2rh.src", product_id: "jakarta-commons-modeler-0:2.0-3jpp_2rh.src", product_identification_helper: { purl: "pkg:rpm/redhat/jakarta-commons-modeler@2.0-3jpp_2rh?arch=src", }, }, }, { category: "product_version", name: "tomcat5-0:5.5.23-0jpp_4rh.16.src", product: { name: "tomcat5-0:5.5.23-0jpp_4rh.16.src", product_id: "tomcat5-0:5.5.23-0jpp_4rh.16.src", product_identification_helper: { purl: "pkg:rpm/redhat/tomcat5@5.5.23-0jpp_4rh.16?arch=src", }, }, }, { category: "product_version", name: "pcsc-lite-0:1.3.3-3.el4.src", product: { name: "pcsc-lite-0:1.3.3-3.el4.src", product_id: "pcsc-lite-0:1.3.3-3.el4.src", product_identification_helper: { purl: "pkg:rpm/redhat/pcsc-lite@1.3.3-3.el4?arch=src", }, }, }, { category: "product_version", name: "geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", product: { name: "geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", product_id: "geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", product_identification_helper: { purl: "pkg:rpm/redhat/geronimo-specs@1.0-0.M4.1jpp_10rh?arch=src", }, }, }, ], category: "architecture", name: "src", }, { branches: [ { category: "product_version", name: "rhpki-native-tools-0:7.3.0-6.el4.x86_64", product: { name: "rhpki-native-tools-0:7.3.0-6.el4.x86_64", product_id: "rhpki-native-tools-0:7.3.0-6.el4.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/rhpki-native-tools@7.3.0-6.el4?arch=x86_64", }, }, }, { category: "product_version", name: "pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", product: { name: "pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", product_id: "pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/pcsc-lite-debuginfo@1.3.3-3.el4?arch=x86_64", }, }, }, { category: "product_version", name: "pcsc-lite-doc-0:1.3.3-3.el4.x86_64", product: { name: "pcsc-lite-doc-0:1.3.3-3.el4.x86_64", product_id: "pcsc-lite-doc-0:1.3.3-3.el4.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/pcsc-lite-doc@1.3.3-3.el4?arch=x86_64", }, }, }, { category: "product_version", name: "pcsc-lite-0:1.3.3-3.el4.x86_64", product: { name: "pcsc-lite-0:1.3.3-3.el4.x86_64", product_id: "pcsc-lite-0:1.3.3-3.el4.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/pcsc-lite@1.3.3-3.el4?arch=x86_64", }, }, }, { category: "product_version", name: "pcsc-lite-libs-0:1.3.3-3.el4.x86_64", product: { name: "pcsc-lite-libs-0:1.3.3-3.el4.x86_64", product_id: "pcsc-lite-libs-0:1.3.3-3.el4.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/pcsc-lite-libs@1.3.3-3.el4?arch=x86_64", }, }, }, ], category: "architecture", name: "x86_64", }, { branches: [ { category: "product_version", name: "rhpki-native-tools-0:7.3.0-6.el4.i386", product: { name: "rhpki-native-tools-0:7.3.0-6.el4.i386", product_id: "rhpki-native-tools-0:7.3.0-6.el4.i386", product_identification_helper: { purl: "pkg:rpm/redhat/rhpki-native-tools@7.3.0-6.el4?arch=i386", }, }, }, { category: "product_version", name: "pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", product: { name: "pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", product_id: "pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", product_identification_helper: { purl: "pkg:rpm/redhat/pcsc-lite-debuginfo@1.3.3-3.el4?arch=i386", }, }, }, { category: "product_version", name: "pcsc-lite-doc-0:1.3.3-3.el4.i386", product: { name: "pcsc-lite-doc-0:1.3.3-3.el4.i386", product_id: "pcsc-lite-doc-0:1.3.3-3.el4.i386", product_identification_helper: { purl: "pkg:rpm/redhat/pcsc-lite-doc@1.3.3-3.el4?arch=i386", }, }, }, { category: "product_version", name: "pcsc-lite-0:1.3.3-3.el4.i386", product: { name: "pcsc-lite-0:1.3.3-3.el4.i386", product_id: "pcsc-lite-0:1.3.3-3.el4.i386", product_identification_helper: { purl: "pkg:rpm/redhat/pcsc-lite@1.3.3-3.el4?arch=i386", }, }, }, { category: "product_version", name: "pcsc-lite-libs-0:1.3.3-3.el4.i386", product: { name: "pcsc-lite-libs-0:1.3.3-3.el4.i386", product_id: "pcsc-lite-libs-0:1.3.3-3.el4.i386", product_identification_helper: { purl: "pkg:rpm/redhat/pcsc-lite-libs@1.3.3-3.el4?arch=i386", }, }, }, ], category: "architecture", name: "i386", }, ], category: "vendor", name: "Red Hat", }, ], relationships: [ { category: "default_component_of", full_product_name: { name: "ant-0:1.6.5-1jpp_1rh.noarch as a component of Red Hat Certificate System 7.3 for 4AS", product_id: "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", }, product_reference: "ant-0:1.6.5-1jpp_1rh.noarch", relates_to_product_reference: "4AS-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "ant-0:1.6.5-1jpp_1rh.src as a component of Red Hat Certificate System 7.3 for 4AS", product_id: "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", }, product_reference: "ant-0:1.6.5-1jpp_1rh.src", relates_to_product_reference: "4AS-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "avalon-logkit-0:1.2-2jpp_4rh.noarch as a component of Red Hat Certificate System 7.3 for 4AS", product_id: "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", }, product_reference: "avalon-logkit-0:1.2-2jpp_4rh.noarch", relates_to_product_reference: "4AS-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "avalon-logkit-0:1.2-2jpp_4rh.src as a component of Red Hat Certificate System 7.3 for 4AS", product_id: "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", }, product_reference: "avalon-logkit-0:1.2-2jpp_4rh.src", relates_to_product_reference: "4AS-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "axis-0:1.2.1-1jpp_3rh.noarch as a component of Red Hat Certificate System 7.3 for 4AS", product_id: "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", }, product_reference: "axis-0:1.2.1-1jpp_3rh.noarch", relates_to_product_reference: "4AS-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "axis-0:1.2.1-1jpp_3rh.src as a component of Red Hat Certificate System 7.3 for 4AS", product_id: "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", }, product_reference: "axis-0:1.2.1-1jpp_3rh.src", relates_to_product_reference: "4AS-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "classpathx-jaf-0:1.0-2jpp_6rh.noarch as a component of Red Hat Certificate System 7.3 for 4AS", product_id: "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", }, product_reference: "classpathx-jaf-0:1.0-2jpp_6rh.noarch", relates_to_product_reference: "4AS-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "classpathx-jaf-0:1.0-2jpp_6rh.src as a component of Red Hat Certificate System 7.3 for 4AS", product_id: "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", }, product_reference: "classpathx-jaf-0:1.0-2jpp_6rh.src", relates_to_product_reference: "4AS-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "classpathx-mail-0:1.1.1-2jpp_8rh.noarch as a component of Red Hat Certificate System 7.3 for 4AS", product_id: "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", }, product_reference: "classpathx-mail-0:1.1.1-2jpp_8rh.noarch", relates_to_product_reference: "4AS-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "classpathx-mail-0:1.1.1-2jpp_8rh.src as a component of Red Hat Certificate System 7.3 for 4AS", product_id: "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", }, product_reference: "classpathx-mail-0:1.1.1-2jpp_8rh.src", relates_to_product_reference: "4AS-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch as a component of Red Hat Certificate System 7.3 for 4AS", product_id: "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", }, product_reference: "geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", relates_to_product_reference: "4AS-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch as a component of Red Hat Certificate System 7.3 for 4AS", product_id: "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", }, product_reference: "geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", relates_to_product_reference: "4AS-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch as a component of Red Hat Certificate System 7.3 for 4AS", product_id: "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", }, product_reference: "geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", relates_to_product_reference: "4AS-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch as a component of Red Hat Certificate System 7.3 for 4AS", product_id: "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", }, product_reference: "geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", relates_to_product_reference: "4AS-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch as a component of Red Hat Certificate System 7.3 for 4AS", product_id: "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", }, product_reference: "geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", relates_to_product_reference: "4AS-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch as a component of Red Hat Certificate System 7.3 for 4AS", product_id: "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", }, product_reference: "geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", relates_to_product_reference: "4AS-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch as a component of Red Hat Certificate System 7.3 for 4AS", product_id: "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", }, product_reference: "geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", relates_to_product_reference: "4AS-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch as a component of Red Hat Certificate System 7.3 for 4AS", product_id: "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", }, product_reference: "geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", relates_to_product_reference: "4AS-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch as a component of Red Hat Certificate System 7.3 for 4AS", product_id: "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", }, product_reference: "geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", relates_to_product_reference: "4AS-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch as a component of Red Hat Certificate System 7.3 for 4AS", product_id: "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", }, product_reference: "geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", relates_to_product_reference: "4AS-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "geronimo-specs-0:1.0-0.M4.1jpp_10rh.src as a component of Red Hat Certificate System 7.3 for 4AS", product_id: "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", }, product_reference: "geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", relates_to_product_reference: "4AS-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch as a component of Red Hat Certificate System 7.3 for 4AS", product_id: "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", }, product_reference: "geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", relates_to_product_reference: "4AS-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch as a component of Red Hat Certificate System 7.3 for 4AS", product_id: "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", }, product_reference: "jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", relates_to_product_reference: "4AS-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "jakarta-commons-modeler-0:2.0-3jpp_2rh.src as a component of Red Hat Certificate System 7.3 for 4AS", product_id: "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", }, product_reference: "jakarta-commons-modeler-0:2.0-3jpp_2rh.src", relates_to_product_reference: "4AS-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "log4j-0:1.2.12-1jpp_1rh.noarch as a component of Red Hat Certificate System 7.3 for 4AS", product_id: "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", }, product_reference: "log4j-0:1.2.12-1jpp_1rh.noarch", relates_to_product_reference: "4AS-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "log4j-0:1.2.12-1jpp_1rh.src as a component of Red Hat Certificate System 7.3 for 4AS", product_id: "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", }, product_reference: "log4j-0:1.2.12-1jpp_1rh.src", relates_to_product_reference: "4AS-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "mx4j-1:3.0.1-1jpp_4rh.noarch as a component of Red Hat Certificate System 7.3 for 4AS", product_id: "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", }, product_reference: "mx4j-1:3.0.1-1jpp_4rh.noarch", relates_to_product_reference: "4AS-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "mx4j-1:3.0.1-1jpp_4rh.src as a component of Red Hat Certificate System 7.3 for 4AS", product_id: "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", }, product_reference: "mx4j-1:3.0.1-1jpp_4rh.src", relates_to_product_reference: "4AS-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "pcsc-lite-0:1.3.3-3.el4.i386 as a component of Red Hat Certificate System 7.3 for 4AS", product_id: "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", }, product_reference: "pcsc-lite-0:1.3.3-3.el4.i386", relates_to_product_reference: "4AS-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "pcsc-lite-0:1.3.3-3.el4.src as a component of Red Hat Certificate System 7.3 for 4AS", product_id: "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", }, product_reference: "pcsc-lite-0:1.3.3-3.el4.src", relates_to_product_reference: "4AS-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "pcsc-lite-0:1.3.3-3.el4.x86_64 as a component of Red Hat Certificate System 7.3 for 4AS", product_id: "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", }, product_reference: "pcsc-lite-0:1.3.3-3.el4.x86_64", relates_to_product_reference: "4AS-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "pcsc-lite-debuginfo-0:1.3.3-3.el4.i386 as a component of Red Hat Certificate System 7.3 for 4AS", product_id: "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", }, product_reference: "pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", relates_to_product_reference: "4AS-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64 as a component of Red Hat Certificate System 7.3 for 4AS", product_id: "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", }, product_reference: "pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", relates_to_product_reference: "4AS-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "pcsc-lite-doc-0:1.3.3-3.el4.i386 as a component of Red Hat Certificate System 7.3 for 4AS", product_id: "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", }, product_reference: "pcsc-lite-doc-0:1.3.3-3.el4.i386", relates_to_product_reference: "4AS-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "pcsc-lite-doc-0:1.3.3-3.el4.x86_64 as a component of Red Hat Certificate System 7.3 for 4AS", product_id: "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", }, product_reference: "pcsc-lite-doc-0:1.3.3-3.el4.x86_64", relates_to_product_reference: "4AS-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "pcsc-lite-libs-0:1.3.3-3.el4.i386 as a component of Red Hat Certificate System 7.3 for 4AS", product_id: "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", }, product_reference: "pcsc-lite-libs-0:1.3.3-3.el4.i386", relates_to_product_reference: "4AS-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "pcsc-lite-libs-0:1.3.3-3.el4.x86_64 as a component of Red Hat Certificate System 7.3 for 4AS", product_id: "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", }, product_reference: "pcsc-lite-libs-0:1.3.3-3.el4.x86_64", relates_to_product_reference: "4AS-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "rhpki-ca-0:7.3.0-20.el4.noarch as a component of Red Hat Certificate System 7.3 for 4AS", product_id: "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", }, product_reference: "rhpki-ca-0:7.3.0-20.el4.noarch", relates_to_product_reference: "4AS-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "rhpki-java-tools-0:7.3.0-10.el4.noarch as a component of Red Hat Certificate System 7.3 for 4AS", product_id: "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", }, product_reference: "rhpki-java-tools-0:7.3.0-10.el4.noarch", relates_to_product_reference: "4AS-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "rhpki-kra-0:7.3.0-14.el4.noarch as a component of Red Hat Certificate System 7.3 for 4AS", product_id: "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", }, product_reference: "rhpki-kra-0:7.3.0-14.el4.noarch", relates_to_product_reference: "4AS-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "rhpki-manage-0:7.3.0-19.el4.noarch as a component of Red Hat Certificate System 7.3 for 4AS", product_id: "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", }, product_reference: "rhpki-manage-0:7.3.0-19.el4.noarch", relates_to_product_reference: "4AS-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "rhpki-native-tools-0:7.3.0-6.el4.i386 as a component of Red Hat Certificate System 7.3 for 4AS", product_id: "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", }, product_reference: "rhpki-native-tools-0:7.3.0-6.el4.i386", relates_to_product_reference: "4AS-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "rhpki-native-tools-0:7.3.0-6.el4.x86_64 as a component of Red Hat Certificate System 7.3 for 4AS", product_id: "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", }, product_reference: "rhpki-native-tools-0:7.3.0-6.el4.x86_64", relates_to_product_reference: "4AS-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "rhpki-ocsp-0:7.3.0-13.el4.noarch as a component of Red Hat Certificate System 7.3 for 4AS", product_id: "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", }, product_reference: "rhpki-ocsp-0:7.3.0-13.el4.noarch", relates_to_product_reference: "4AS-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "rhpki-tks-0:7.3.0-13.el4.noarch as a component of Red Hat Certificate System 7.3 for 4AS", product_id: "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", }, product_reference: "rhpki-tks-0:7.3.0-13.el4.noarch", relates_to_product_reference: "4AS-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "tomcat5-0:5.5.23-0jpp_4rh.16.noarch as a component of Red Hat Certificate System 7.3 for 4AS", product_id: "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", }, product_reference: "tomcat5-0:5.5.23-0jpp_4rh.16.noarch", relates_to_product_reference: "4AS-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "tomcat5-0:5.5.23-0jpp_4rh.16.src as a component of Red Hat Certificate System 7.3 for 4AS", product_id: "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", }, product_reference: "tomcat5-0:5.5.23-0jpp_4rh.16.src", relates_to_product_reference: "4AS-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch as a component of Red Hat Certificate System 7.3 for 4AS", product_id: "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", }, product_reference: "tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", relates_to_product_reference: "4AS-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch as a component of Red Hat Certificate System 7.3 for 4AS", product_id: "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", }, product_reference: "tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", relates_to_product_reference: "4AS-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch as a component of Red Hat Certificate System 7.3 for 4AS", product_id: "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", }, product_reference: "tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", relates_to_product_reference: "4AS-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch as a component of Red Hat Certificate System 7.3 for 4AS", product_id: "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", }, product_reference: "tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", relates_to_product_reference: "4AS-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch as a component of Red Hat Certificate System 7.3 for 4AS", product_id: "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", }, product_reference: "tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", relates_to_product_reference: "4AS-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "xerces-j2-0:2.7.1-1jpp_1rh.noarch as a component of Red Hat Certificate System 7.3 for 4AS", product_id: "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", }, product_reference: "xerces-j2-0:2.7.1-1jpp_1rh.noarch", relates_to_product_reference: "4AS-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "xerces-j2-0:2.7.1-1jpp_1rh.src as a component of Red Hat Certificate System 7.3 for 4AS", product_id: "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", }, product_reference: "xerces-j2-0:2.7.1-1jpp_1rh.src", relates_to_product_reference: "4AS-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "xml-commons-0:1.3.02-2jpp_1rh.noarch as a component of Red Hat Certificate System 7.3 for 4AS", product_id: "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", }, product_reference: "xml-commons-0:1.3.02-2jpp_1rh.noarch", relates_to_product_reference: "4AS-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "xml-commons-0:1.3.02-2jpp_1rh.src as a component of Red Hat Certificate System 7.3 for 4AS", product_id: "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", }, product_reference: "xml-commons-0:1.3.02-2jpp_1rh.src", relates_to_product_reference: "4AS-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "xml-commons-apis-0:1.3.02-2jpp_1rh.noarch as a component of Red Hat Certificate System 7.3 for 4AS", product_id: "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", }, product_reference: "xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", relates_to_product_reference: "4AS-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "ant-0:1.6.5-1jpp_1rh.noarch as a component of Red Hat Certificate System 7.3 for 4ES", product_id: "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", }, product_reference: "ant-0:1.6.5-1jpp_1rh.noarch", relates_to_product_reference: "4ES-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "ant-0:1.6.5-1jpp_1rh.src as a component of Red Hat Certificate System 7.3 for 4ES", product_id: "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", }, product_reference: "ant-0:1.6.5-1jpp_1rh.src", relates_to_product_reference: "4ES-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "avalon-logkit-0:1.2-2jpp_4rh.noarch as a component of Red Hat Certificate System 7.3 for 4ES", product_id: "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", }, product_reference: "avalon-logkit-0:1.2-2jpp_4rh.noarch", relates_to_product_reference: "4ES-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "avalon-logkit-0:1.2-2jpp_4rh.src as a component of Red Hat Certificate System 7.3 for 4ES", product_id: "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", }, product_reference: "avalon-logkit-0:1.2-2jpp_4rh.src", relates_to_product_reference: "4ES-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "axis-0:1.2.1-1jpp_3rh.noarch as a component of Red Hat Certificate System 7.3 for 4ES", product_id: "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", }, product_reference: "axis-0:1.2.1-1jpp_3rh.noarch", relates_to_product_reference: "4ES-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "axis-0:1.2.1-1jpp_3rh.src as a component of Red Hat Certificate System 7.3 for 4ES", product_id: "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", }, product_reference: "axis-0:1.2.1-1jpp_3rh.src", relates_to_product_reference: "4ES-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "classpathx-jaf-0:1.0-2jpp_6rh.noarch as a component of Red Hat Certificate System 7.3 for 4ES", product_id: "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", }, product_reference: "classpathx-jaf-0:1.0-2jpp_6rh.noarch", relates_to_product_reference: "4ES-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "classpathx-jaf-0:1.0-2jpp_6rh.src as a component of Red Hat Certificate System 7.3 for 4ES", product_id: "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", }, product_reference: "classpathx-jaf-0:1.0-2jpp_6rh.src", relates_to_product_reference: "4ES-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "classpathx-mail-0:1.1.1-2jpp_8rh.noarch as a component of Red Hat Certificate System 7.3 for 4ES", product_id: "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", }, product_reference: "classpathx-mail-0:1.1.1-2jpp_8rh.noarch", relates_to_product_reference: "4ES-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "classpathx-mail-0:1.1.1-2jpp_8rh.src as a component of Red Hat Certificate System 7.3 for 4ES", product_id: "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", }, product_reference: "classpathx-mail-0:1.1.1-2jpp_8rh.src", relates_to_product_reference: "4ES-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch as a component of Red Hat Certificate System 7.3 for 4ES", product_id: "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", }, product_reference: "geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", relates_to_product_reference: "4ES-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch as a component of Red Hat Certificate System 7.3 for 4ES", product_id: "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", }, product_reference: "geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", relates_to_product_reference: "4ES-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch as a component of Red Hat Certificate System 7.3 for 4ES", product_id: "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", }, product_reference: "geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", relates_to_product_reference: "4ES-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch as a component of Red Hat Certificate System 7.3 for 4ES", product_id: "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", }, product_reference: "geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", relates_to_product_reference: "4ES-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch as a component of Red Hat Certificate System 7.3 for 4ES", product_id: "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", }, product_reference: "geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", relates_to_product_reference: "4ES-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch as a component of Red Hat Certificate System 7.3 for 4ES", product_id: "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", }, product_reference: "geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", relates_to_product_reference: "4ES-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch as a component of Red Hat Certificate System 7.3 for 4ES", product_id: "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", }, product_reference: "geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", relates_to_product_reference: "4ES-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch as a component of Red Hat Certificate System 7.3 for 4ES", product_id: "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", }, product_reference: "geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", relates_to_product_reference: "4ES-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch as a component of Red Hat Certificate System 7.3 for 4ES", product_id: "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", }, product_reference: "geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", relates_to_product_reference: "4ES-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch as a component of Red Hat Certificate System 7.3 for 4ES", product_id: "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", }, product_reference: "geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", relates_to_product_reference: "4ES-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "geronimo-specs-0:1.0-0.M4.1jpp_10rh.src as a component of Red Hat Certificate System 7.3 for 4ES", product_id: "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", }, product_reference: "geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", relates_to_product_reference: "4ES-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch as a component of Red Hat Certificate System 7.3 for 4ES", product_id: "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", }, product_reference: "geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", relates_to_product_reference: "4ES-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch as a component of Red Hat Certificate System 7.3 for 4ES", product_id: "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", }, product_reference: "jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", relates_to_product_reference: "4ES-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "jakarta-commons-modeler-0:2.0-3jpp_2rh.src as a component of Red Hat Certificate System 7.3 for 4ES", product_id: "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", }, product_reference: "jakarta-commons-modeler-0:2.0-3jpp_2rh.src", relates_to_product_reference: "4ES-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "log4j-0:1.2.12-1jpp_1rh.noarch as a component of Red Hat Certificate System 7.3 for 4ES", product_id: "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", }, product_reference: "log4j-0:1.2.12-1jpp_1rh.noarch", relates_to_product_reference: "4ES-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "log4j-0:1.2.12-1jpp_1rh.src as a component of Red Hat Certificate System 7.3 for 4ES", product_id: "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", }, product_reference: "log4j-0:1.2.12-1jpp_1rh.src", relates_to_product_reference: "4ES-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "mx4j-1:3.0.1-1jpp_4rh.noarch as a component of Red Hat Certificate System 7.3 for 4ES", product_id: "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", }, product_reference: "mx4j-1:3.0.1-1jpp_4rh.noarch", relates_to_product_reference: "4ES-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "mx4j-1:3.0.1-1jpp_4rh.src as a component of Red Hat Certificate System 7.3 for 4ES", product_id: "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", }, product_reference: "mx4j-1:3.0.1-1jpp_4rh.src", relates_to_product_reference: "4ES-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "pcsc-lite-0:1.3.3-3.el4.i386 as a component of Red Hat Certificate System 7.3 for 4ES", product_id: "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", }, product_reference: "pcsc-lite-0:1.3.3-3.el4.i386", relates_to_product_reference: "4ES-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "pcsc-lite-0:1.3.3-3.el4.src as a component of Red Hat Certificate System 7.3 for 4ES", product_id: "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", }, product_reference: "pcsc-lite-0:1.3.3-3.el4.src", relates_to_product_reference: "4ES-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "pcsc-lite-0:1.3.3-3.el4.x86_64 as a component of Red Hat Certificate System 7.3 for 4ES", product_id: "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", }, product_reference: "pcsc-lite-0:1.3.3-3.el4.x86_64", relates_to_product_reference: "4ES-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "pcsc-lite-debuginfo-0:1.3.3-3.el4.i386 as a component of Red Hat Certificate System 7.3 for 4ES", product_id: "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", }, product_reference: "pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", relates_to_product_reference: "4ES-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64 as a component of Red Hat Certificate System 7.3 for 4ES", product_id: "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", }, product_reference: "pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", relates_to_product_reference: "4ES-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "pcsc-lite-doc-0:1.3.3-3.el4.i386 as a component of Red Hat Certificate System 7.3 for 4ES", product_id: "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", }, product_reference: "pcsc-lite-doc-0:1.3.3-3.el4.i386", relates_to_product_reference: "4ES-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "pcsc-lite-doc-0:1.3.3-3.el4.x86_64 as a component of Red Hat Certificate System 7.3 for 4ES", product_id: "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", }, product_reference: "pcsc-lite-doc-0:1.3.3-3.el4.x86_64", relates_to_product_reference: "4ES-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "pcsc-lite-libs-0:1.3.3-3.el4.i386 as a component of Red Hat Certificate System 7.3 for 4ES", product_id: "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", }, product_reference: "pcsc-lite-libs-0:1.3.3-3.el4.i386", relates_to_product_reference: "4ES-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "pcsc-lite-libs-0:1.3.3-3.el4.x86_64 as a component of Red Hat Certificate System 7.3 for 4ES", product_id: "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", }, product_reference: "pcsc-lite-libs-0:1.3.3-3.el4.x86_64", relates_to_product_reference: "4ES-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "rhpki-ca-0:7.3.0-20.el4.noarch as a component of Red Hat Certificate System 7.3 for 4ES", product_id: "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", }, product_reference: "rhpki-ca-0:7.3.0-20.el4.noarch", relates_to_product_reference: "4ES-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "rhpki-java-tools-0:7.3.0-10.el4.noarch as a component of Red Hat Certificate System 7.3 for 4ES", product_id: "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", }, product_reference: "rhpki-java-tools-0:7.3.0-10.el4.noarch", relates_to_product_reference: "4ES-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "rhpki-kra-0:7.3.0-14.el4.noarch as a component of Red Hat Certificate System 7.3 for 4ES", product_id: "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", }, product_reference: "rhpki-kra-0:7.3.0-14.el4.noarch", relates_to_product_reference: "4ES-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "rhpki-manage-0:7.3.0-19.el4.noarch as a component of Red Hat Certificate System 7.3 for 4ES", product_id: "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", }, product_reference: "rhpki-manage-0:7.3.0-19.el4.noarch", relates_to_product_reference: "4ES-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "rhpki-native-tools-0:7.3.0-6.el4.i386 as a component of Red Hat Certificate System 7.3 for 4ES", product_id: "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", }, product_reference: "rhpki-native-tools-0:7.3.0-6.el4.i386", relates_to_product_reference: "4ES-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "rhpki-native-tools-0:7.3.0-6.el4.x86_64 as a component of Red Hat Certificate System 7.3 for 4ES", product_id: "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", }, product_reference: "rhpki-native-tools-0:7.3.0-6.el4.x86_64", relates_to_product_reference: "4ES-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "rhpki-ocsp-0:7.3.0-13.el4.noarch as a component of Red Hat Certificate System 7.3 for 4ES", product_id: "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", }, product_reference: "rhpki-ocsp-0:7.3.0-13.el4.noarch", relates_to_product_reference: "4ES-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "rhpki-tks-0:7.3.0-13.el4.noarch as a component of Red Hat Certificate System 7.3 for 4ES", product_id: "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", }, product_reference: "rhpki-tks-0:7.3.0-13.el4.noarch", relates_to_product_reference: "4ES-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "tomcat5-0:5.5.23-0jpp_4rh.16.noarch as a component of Red Hat Certificate System 7.3 for 4ES", product_id: "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", }, product_reference: "tomcat5-0:5.5.23-0jpp_4rh.16.noarch", relates_to_product_reference: "4ES-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "tomcat5-0:5.5.23-0jpp_4rh.16.src as a component of Red Hat Certificate System 7.3 for 4ES", product_id: "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", }, product_reference: "tomcat5-0:5.5.23-0jpp_4rh.16.src", relates_to_product_reference: "4ES-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch as a component of Red Hat Certificate System 7.3 for 4ES", product_id: "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", }, product_reference: "tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", relates_to_product_reference: "4ES-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch as a component of Red Hat Certificate System 7.3 for 4ES", product_id: "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", }, product_reference: "tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", relates_to_product_reference: "4ES-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch as a component of Red Hat Certificate System 7.3 for 4ES", product_id: "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", }, product_reference: "tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", relates_to_product_reference: "4ES-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch as a component of Red Hat Certificate System 7.3 for 4ES", product_id: "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", }, product_reference: "tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", relates_to_product_reference: "4ES-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch as a component of Red Hat Certificate System 7.3 for 4ES", product_id: "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", }, product_reference: "tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", relates_to_product_reference: "4ES-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "xerces-j2-0:2.7.1-1jpp_1rh.noarch as a component of Red Hat Certificate System 7.3 for 4ES", product_id: "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", }, product_reference: "xerces-j2-0:2.7.1-1jpp_1rh.noarch", relates_to_product_reference: "4ES-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "xerces-j2-0:2.7.1-1jpp_1rh.src as a component of Red Hat Certificate System 7.3 for 4ES", product_id: "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", }, product_reference: "xerces-j2-0:2.7.1-1jpp_1rh.src", relates_to_product_reference: "4ES-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "xml-commons-0:1.3.02-2jpp_1rh.noarch as a component of Red Hat Certificate System 7.3 for 4ES", product_id: "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", }, product_reference: "xml-commons-0:1.3.02-2jpp_1rh.noarch", relates_to_product_reference: "4ES-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "xml-commons-0:1.3.02-2jpp_1rh.src as a component of Red Hat Certificate System 7.3 for 4ES", product_id: "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", }, product_reference: "xml-commons-0:1.3.02-2jpp_1rh.src", relates_to_product_reference: "4ES-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "xml-commons-apis-0:1.3.02-2jpp_1rh.noarch as a component of Red Hat Certificate System 7.3 for 4ES", product_id: "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", }, product_reference: "xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", relates_to_product_reference: "4ES-CERT-7.3", }, ], }, vulnerabilities: [ { cve: "CVE-2005-2090", discovery_date: "2005-06-06T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "237079", }, ], notes: [ { category: "description", text: "Jakarta Tomcat 5.0.19 (Coyote/1.1) and Tomcat 4.1.24 (Coyote/1.0) allows remote attackers to poison the web cache, bypass web application firewall protection, and conduct XSS attacks via an HTTP request with both a \"Transfer-Encoding: chunked\" header and a Content-Length header, which causes Tomcat to incorrectly handle and forward the body of the request in a way that causes the receiving server to process it as a separate HTTP request, aka \"HTTP Request Smuggling.\"", title: "Vulnerability description", }, { category: "summary", text: "tomcat multiple content-length header poisioning", title: "Vulnerability summary", }, ], product_status: { fixed: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2005-2090", }, { category: "external", summary: "RHBZ#237079", url: "https://bugzilla.redhat.com/show_bug.cgi?id=237079", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2005-2090", url: "https://www.cve.org/CVERecord?id=CVE-2005-2090", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2005-2090", url: "https://nvd.nist.gov/vuln/detail/CVE-2005-2090", }, ], release_date: "2005-06-06T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2010-08-04T21:30:00+00:00", details: "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259", product_ids: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2010:0602", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "tomcat multiple content-length header poisioning", }, { cve: "CVE-2005-3510", discovery_date: "2005-11-07T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "237085", }, ], notes: [ { category: "description", text: "Apache Tomcat 5.5.0 to 5.5.11 allows remote attackers to cause a denial of service (CPU consumption) via a large number of simultaneous requests to list a web directory that has a large number of files.", title: "Vulnerability description", }, { category: "summary", text: "tomcat DoS", title: "Vulnerability summary", }, ], product_status: { fixed: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2005-3510", }, { category: "external", summary: "RHBZ#237085", url: "https://bugzilla.redhat.com/show_bug.cgi?id=237085", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2005-3510", url: "https://www.cve.org/CVERecord?id=CVE-2005-3510", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2005-3510", url: "https://nvd.nist.gov/vuln/detail/CVE-2005-3510", }, ], release_date: "2005-11-03T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2010-08-04T21:30:00+00:00", details: "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259", product_ids: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2010:0602", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "tomcat DoS", }, { cve: "CVE-2006-3835", discovery_date: "2006-07-21T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "237084", }, ], notes: [ { category: "description", text: "Apache Tomcat 5 before 5.5.17 allows remote attackers to list directories via a semicolon (;) preceding a filename with a mapped extension, as demonstrated by URLs ending with /;index.jsp and /;help.do.", title: "Vulnerability description", }, { category: "summary", text: "tomcat directory listing issue", title: "Vulnerability summary", }, { category: "other", text: "This issue is not a security issue in Tomcat itself, but is caused when directory listings are enabled.\n\nDetails on how to disable directory listings are available at: http://tomcat.apache.org/faq/misc.html#listing", title: "Statement", }, ], product_status: { fixed: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2006-3835", }, { category: "external", summary: "RHBZ#237084", url: "https://bugzilla.redhat.com/show_bug.cgi?id=237084", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2006-3835", url: "https://www.cve.org/CVERecord?id=CVE-2006-3835", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2006-3835", url: "https://nvd.nist.gov/vuln/detail/CVE-2006-3835", }, ], release_date: "2006-07-21T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2010-08-04T21:30:00+00:00", details: "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259", product_ids: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2010:0602", }, ], threats: [ { category: "impact", details: "Low", }, ], title: "tomcat directory listing issue", }, { cve: "CVE-2006-3918", cwe: { id: "CWE-79", name: "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", }, discovery_date: "2006-07-31T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "200732", }, ], notes: [ { category: "description", text: "http_protocol.c in (1) IBM HTTP Server 6.0 before 6.0.2.13 and 6.1 before 6.1.0.1, and (2) Apache HTTP Server 1.3 before 1.3.35, 2.0 before 2.0.58, and 2.2 before 2.2.2, does not sanitize the Expect header from an HTTP request when it is reflected back in an error message, which might allow cross-site scripting (XSS) style attacks using web client components that can send arbitrary headers in requests, as demonstrated using a Flash SWF file.", title: "Vulnerability description", }, { category: "summary", text: "httpd: Expect header XSS", title: "Vulnerability summary", }, ], product_status: { fixed: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2006-3918", }, { category: "external", summary: "RHBZ#200732", url: "https://bugzilla.redhat.com/show_bug.cgi?id=200732", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2006-3918", url: "https://www.cve.org/CVERecord?id=CVE-2006-3918", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2006-3918", url: "https://nvd.nist.gov/vuln/detail/CVE-2006-3918", }, ], release_date: "2006-05-08T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2010-08-04T21:30:00+00:00", details: "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259", product_ids: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2010:0602", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "httpd: Expect header XSS", }, { cve: "CVE-2006-5752", cwe: { id: "CWE-79", name: "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", }, discovery_date: "2007-06-20T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "245112", }, ], notes: [ { category: "description", text: "Cross-site scripting (XSS) vulnerability in mod_status.c in the mod_status module in Apache HTTP Server (httpd), when ExtendedStatus is enabled and a public server-status page is used, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors involving charsets with browsers that perform \"charset detection\" when the content-type is not specified.", title: "Vulnerability description", }, { category: "summary", text: "httpd mod_status XSS", title: "Vulnerability summary", }, ], product_status: { fixed: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2006-5752", }, { category: "external", summary: "RHBZ#245112", url: "https://bugzilla.redhat.com/show_bug.cgi?id=245112", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2006-5752", url: "https://www.cve.org/CVERecord?id=CVE-2006-5752", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2006-5752", url: "https://nvd.nist.gov/vuln/detail/CVE-2006-5752", }, ], release_date: "2007-06-20T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2010-08-04T21:30:00+00:00", details: "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259", product_ids: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2010:0602", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "httpd mod_status XSS", }, { cve: "CVE-2007-0450", discovery_date: "2007-03-14T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "237080", }, ], notes: [ { category: "description", text: "Directory traversal vulnerability in Apache HTTP Server and Tomcat 5.x before 5.5.22 and 6.x before 6.0.10, when using certain proxy modules (mod_proxy, mod_rewrite, mod_jk), allows remote attackers to read arbitrary files via a .. (dot dot) sequence with combinations of (1) \"/\" (slash), (2) \"\\\" (backslash), and (3) URL-encoded backslash (%5C) characters in the URL, which are valid separators in Tomcat but not in Apache.", title: "Vulnerability description", }, { category: "summary", text: "tomcat directory traversal", title: "Vulnerability summary", }, ], product_status: { fixed: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-0450", }, { category: "external", summary: "RHBZ#237080", url: "https://bugzilla.redhat.com/show_bug.cgi?id=237080", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-0450", url: "https://www.cve.org/CVERecord?id=CVE-2007-0450", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-0450", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-0450", }, ], release_date: "2007-03-14T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2010-08-04T21:30:00+00:00", details: "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259", product_ids: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2010:0602", }, ], threats: [ { category: "impact", details: "Important", }, ], title: "tomcat directory traversal", }, { cve: "CVE-2007-1349", discovery_date: "2007-05-17T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "240423", }, ], notes: [ { category: "description", text: "PerlRun.pm in Apache mod_perl before 1.30, and RegistryCooker.pm in mod_perl 2.x, does not properly escape PATH_INFO before use in a regular expression, which allows remote attackers to cause a denial of service (resource consumption) via a crafted URI.", title: "Vulnerability description", }, { category: "summary", text: "mod_perl PerlRun denial of service", title: "Vulnerability summary", }, ], product_status: { fixed: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-1349", }, { category: "external", summary: "RHBZ#240423", url: "https://bugzilla.redhat.com/show_bug.cgi?id=240423", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-1349", url: "https://www.cve.org/CVERecord?id=CVE-2007-1349", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-1349", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-1349", }, ], release_date: "2007-03-22T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2010-08-04T21:30:00+00:00", details: "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259", product_ids: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2010:0602", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "mod_perl PerlRun denial of service", }, { cve: "CVE-2007-1358", cwe: { id: "CWE-79", name: "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", }, discovery_date: "2007-04-10T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "244803", }, ], notes: [ { category: "description", text: "Cross-site scripting (XSS) vulnerability in certain applications using Apache Tomcat 4.0.0 through 4.0.6 and 4.1.0 through 4.1.34 allows remote attackers to inject arbitrary web script or HTML via crafted \"Accept-Language headers that do not conform to RFC 2616\".", title: "Vulnerability description", }, { category: "summary", text: "tomcat accept-language xss flaw", title: "Vulnerability summary", }, ], product_status: { fixed: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-1358", }, { category: "external", summary: "RHBZ#244803", url: "https://bugzilla.redhat.com/show_bug.cgi?id=244803", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-1358", url: "https://www.cve.org/CVERecord?id=CVE-2007-1358", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-1358", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-1358", }, ], release_date: "2007-06-06T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2010-08-04T21:30:00+00:00", details: "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259", product_ids: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2010:0602", }, ], threats: [ { category: "impact", details: "Low", }, ], title: "tomcat accept-language xss flaw", }, { cve: "CVE-2007-1863", discovery_date: "2007-05-02T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "244658", }, ], notes: [ { category: "description", text: "cache_util.c in the mod_cache module in Apache HTTP Server (httpd), when caching is enabled and a threaded Multi-Processing Module (MPM) is used, allows remote attackers to cause a denial of service (child processing handler crash) via a request with the (1) s-maxage, (2) max-age, (3) min-fresh, or (4) max-stale Cache-Control headers without a value.", title: "Vulnerability description", }, { category: "summary", text: "httpd mod_cache segfault", title: "Vulnerability summary", }, ], product_status: { fixed: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-1863", }, { category: "external", summary: "RHBZ#244658", url: "https://bugzilla.redhat.com/show_bug.cgi?id=244658", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-1863", url: "https://www.cve.org/CVERecord?id=CVE-2007-1863", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-1863", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-1863", }, ], release_date: "2007-05-02T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2010-08-04T21:30:00+00:00", details: "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259", product_ids: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2010:0602", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "httpd mod_cache segfault", }, { cve: "CVE-2007-3304", discovery_date: "2007-06-19T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "245111", }, ], notes: [ { category: "description", text: "Apache httpd 1.3.37, 2.0.59, and 2.2.4 with the Prefork MPM module, allows local users to cause a denial of service by modifying the worker_score and process_score arrays to reference an arbitrary process ID, which is sent a SIGUSR1 signal from the master process, aka \"SIGUSR1 killer.\"", title: "Vulnerability description", }, { category: "summary", text: "httpd scoreboard lack of PID protection", title: "Vulnerability summary", }, ], product_status: { fixed: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-3304", }, { category: "external", summary: "RHBZ#245111", url: "https://bugzilla.redhat.com/show_bug.cgi?id=245111", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-3304", url: "https://www.cve.org/CVERecord?id=CVE-2007-3304", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-3304", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-3304", }, ], release_date: "2007-06-19T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2010-08-04T21:30:00+00:00", details: "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259", product_ids: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2010:0602", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "httpd scoreboard lack of PID protection", }, { cve: "CVE-2007-3382", discovery_date: "2007-07-12T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "247972", }, ], notes: [ { category: "description", text: "Apache Tomcat 6.0.0 to 6.0.13, 5.5.0 to 5.5.24, 5.0.0 to 5.0.30, 4.1.0 to 4.1.36, and 3.3 to 3.3.2 treats single quotes (\"'\") as delimiters in cookies, which might cause sensitive information such as session IDs to be leaked and allow remote attackers to conduct session hijacking attacks.", title: "Vulnerability description", }, { category: "summary", text: "tomcat handling of cookies", title: "Vulnerability summary", }, ], product_status: { fixed: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-3382", }, { category: "external", summary: "RHBZ#247972", url: "https://bugzilla.redhat.com/show_bug.cgi?id=247972", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-3382", url: "https://www.cve.org/CVERecord?id=CVE-2007-3382", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-3382", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-3382", }, ], release_date: "2007-08-14T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2010-08-04T21:30:00+00:00", details: "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259", product_ids: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2010:0602", }, ], threats: [ { category: "impact", details: "Low", }, ], title: "tomcat handling of cookies", }, { cve: "CVE-2007-3385", discovery_date: "2007-07-12T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "247976", }, ], notes: [ { category: "description", text: "Apache Tomcat 6.0.0 to 6.0.13, 5.5.0 to 5.5.24, 5.0.0 to 5.0.30, 4.1.0 to 4.1.36, and 3.3 to 3.3.2 does not properly handle the \\\" character sequence in a cookie value, which might cause sensitive information such as session IDs to be leaked to remote attackers and enable session hijacking attacks.", title: "Vulnerability description", }, { category: "summary", text: "tomcat handling of cookie values", title: "Vulnerability summary", }, ], product_status: { fixed: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-3385", }, { category: "external", summary: "RHBZ#247976", url: "https://bugzilla.redhat.com/show_bug.cgi?id=247976", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-3385", url: "https://www.cve.org/CVERecord?id=CVE-2007-3385", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-3385", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-3385", }, ], release_date: "2007-08-14T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2010-08-04T21:30:00+00:00", details: "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259", product_ids: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2010:0602", }, ], threats: [ { category: "impact", details: "Low", }, ], title: "tomcat handling of cookie values", }, { cve: "CVE-2007-3847", cwe: { id: "CWE-125", name: "Out-of-bounds Read", }, discovery_date: "2007-08-01T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "250731", }, ], notes: [ { category: "description", text: "The date handling code in modules/proxy/proxy_util.c (mod_proxy) in Apache 2.3.0, when using a threaded MPM, allows remote origin servers to cause a denial of service (caching forward proxy process crash) via crafted date headers that trigger a buffer over-read.", title: "Vulnerability description", }, { category: "summary", text: "httpd: out of bounds read", title: "Vulnerability summary", }, ], product_status: { fixed: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-3847", }, { category: "external", summary: "RHBZ#250731", url: "https://bugzilla.redhat.com/show_bug.cgi?id=250731", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-3847", url: "https://www.cve.org/CVERecord?id=CVE-2007-3847", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-3847", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-3847", }, ], release_date: "2007-08-01T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2010-08-04T21:30:00+00:00", details: "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259", product_ids: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2010:0602", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "httpd: out of bounds read", }, { cve: "CVE-2007-4465", cwe: { id: "CWE-79", name: "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", }, discovery_date: "2007-09-13T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "289511", }, ], notes: [ { category: "description", text: "Cross-site scripting (XSS) vulnerability in mod_autoindex.c in the Apache HTTP Server before 2.2.6, when the charset on a server-generated page is not defined, allows remote attackers to inject arbitrary web script or HTML via the P parameter using the UTF-7 charset. NOTE: it could be argued that this issue is due to a design limitation of browsers that attempt to perform automatic content type detection.", title: "Vulnerability description", }, { category: "summary", text: "mod_autoindex XSS", title: "Vulnerability summary", }, { category: "other", text: "This is actually a flaw in browsers that do not derive the response character set as required by RFC 2616. This does not affect the default configuration of Apache httpd in Red Hat products and will only affect customers who have removed the \"AddDefaultCharset\" directive and are using directory indexes. The Red Hat Product Security has rated this issue as having low security impact, a future update may address this flaw.", title: "Statement", }, ], product_status: { fixed: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-4465", }, { category: "external", summary: "RHBZ#289511", url: "https://bugzilla.redhat.com/show_bug.cgi?id=289511", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-4465", url: "https://www.cve.org/CVERecord?id=CVE-2007-4465", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-4465", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-4465", }, ], release_date: "2007-09-13T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2010-08-04T21:30:00+00:00", details: "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259", product_ids: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2010:0602", }, ], threats: [ { category: "impact", details: "Low", }, ], title: "mod_autoindex XSS", }, { cve: "CVE-2007-5000", cwe: { id: "CWE-79", name: "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", }, discovery_date: "2007-12-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "419931", }, ], notes: [ { category: "description", text: "Cross-site scripting (XSS) vulnerability in the (1) mod_imap module in the Apache HTTP Server 1.3.0 through 1.3.39 and 2.0.35 through 2.0.61 and the (2) mod_imagemap module in the Apache HTTP Server 2.2.0 through 2.2.6 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.", title: "Vulnerability description", }, { category: "summary", text: "httpd: mod_imagemap XSS", title: "Vulnerability summary", }, ], product_status: { fixed: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-5000", }, { category: "external", summary: "RHBZ#419931", url: "https://bugzilla.redhat.com/show_bug.cgi?id=419931", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-5000", url: "https://www.cve.org/CVERecord?id=CVE-2007-5000", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-5000", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-5000", }, ], release_date: "2007-12-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2010-08-04T21:30:00+00:00", details: "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259", product_ids: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2010:0602", }, ], threats: [ { category: "impact", details: "Low", }, ], title: "httpd: mod_imagemap XSS", }, { acknowledgments: [ { names: [ "Tavis Ormandy", "Will Drewry", ], }, ], cve: "CVE-2007-5116", discovery_date: "2007-09-26T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "323571", }, ], notes: [ { category: "description", text: "Buffer overflow in the polymorphic opcode support in the Regular Expression Engine (regcomp.c) in Perl 5.8 allows context-dependent attackers to execute arbitrary code by switching from byte to Unicode (UTF) characters in a regular expression.", title: "Vulnerability description", }, { category: "summary", text: "perl regular expression UTF parsing errors", title: "Vulnerability summary", }, ], product_status: { fixed: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-5116", }, { category: "external", summary: "RHBZ#323571", url: "https://bugzilla.redhat.com/show_bug.cgi?id=323571", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-5116", url: "https://www.cve.org/CVERecord?id=CVE-2007-5116", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-5116", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-5116", }, ], release_date: "2007-11-05T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2010-08-04T21:30:00+00:00", details: "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259", product_ids: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2010:0602", }, ], threats: [ { category: "impact", details: "Important", }, ], title: "perl regular expression UTF parsing errors", }, { cve: "CVE-2007-5333", discovery_date: "2008-01-07T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "427766", }, ], notes: [ { category: "description", text: "Apache Tomcat 6.0.0 through 6.0.14, 5.5.0 through 5.5.25, and 4.1.0 through 4.1.36 does not properly handle (1) double quote (\") characters or (2) %5C (encoded backslash) sequences in a cookie value, which might cause sensitive information such as session IDs to be leaked to remote attackers and enable session hijacking attacks. NOTE: this issue exists because of an incomplete fix for CVE-2007-3385.", title: "Vulnerability description", }, { category: "summary", text: "Improve cookie parsing for tomcat5", title: "Vulnerability summary", }, { category: "other", text: "Red Hat is aware of this issue and is tracking it via the following bug: https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=CVE-2007-5333\n\nThe Red Hat Product Security has rated this issue as having low security impact, a future update may address this flaw.", title: "Statement", }, ], product_status: { fixed: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-5333", }, { category: "external", summary: "RHBZ#427766", url: "https://bugzilla.redhat.com/show_bug.cgi?id=427766", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-5333", url: "https://www.cve.org/CVERecord?id=CVE-2007-5333", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-5333", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-5333", }, ], release_date: "2008-02-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2010-08-04T21:30:00+00:00", details: "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259", product_ids: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2010:0602", }, ], threats: [ { category: "impact", details: "Low", }, ], title: "Improve cookie parsing for tomcat5", }, { cve: "CVE-2007-5461", discovery_date: "2007-10-14T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "333791", }, ], notes: [ { category: "description", text: "Absolute path traversal vulnerability in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0, 5.0.0, 5.5.0 through 5.5.25, and 6.0.0 through 6.0.14, under certain configurations, allows remote authenticated users to read arbitrary files via a WebDAV write request that specifies an entity with a SYSTEM tag.", title: "Vulnerability description", }, { category: "summary", text: "Absolute path traversal Apache Tomcat WEBDAV", title: "Vulnerability summary", }, ], product_status: { fixed: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-5461", }, { category: "external", summary: "RHBZ#333791", url: "https://bugzilla.redhat.com/show_bug.cgi?id=333791", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-5461", url: "https://www.cve.org/CVERecord?id=CVE-2007-5461", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-5461", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-5461", }, ], release_date: "2007-10-14T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2010-08-04T21:30:00+00:00", details: "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259", product_ids: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2010:0602", }, ], threats: [ { category: "impact", details: "Important", }, ], title: "Absolute path traversal Apache Tomcat WEBDAV", }, { cve: "CVE-2007-6388", cwe: { id: "CWE-79", name: "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", }, discovery_date: "2008-01-02T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "427228", }, ], notes: [ { category: "description", text: "Cross-site scripting (XSS) vulnerability in mod_status in the Apache HTTP Server 2.2.0 through 2.2.6, 2.0.35 through 2.0.61, and 1.3.2 through 1.3.39, when the server-status page is enabled, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.", title: "Vulnerability description", }, { category: "summary", text: "apache mod_status cross-site scripting", title: "Vulnerability summary", }, ], product_status: { fixed: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-6388", }, { category: "external", summary: "RHBZ#427228", url: "https://bugzilla.redhat.com/show_bug.cgi?id=427228", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-6388", url: "https://www.cve.org/CVERecord?id=CVE-2007-6388", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-6388", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-6388", }, ], release_date: "2007-12-29T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2010-08-04T21:30:00+00:00", details: "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259", product_ids: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2010:0602", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "apache mod_status cross-site scripting", }, { cve: "CVE-2008-0005", cwe: { id: "CWE-79", name: "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", }, discovery_date: "2008-01-02T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "427739", }, ], notes: [ { category: "description", text: "mod_proxy_ftp in Apache 2.2.x before 2.2.7-dev, 2.0.x before 2.0.62-dev, and 1.3.x before 1.3.40-dev does not define a charset, which allows remote attackers to conduct cross-site scripting (XSS) attacks using UTF-7 encoding.", title: "Vulnerability description", }, { category: "summary", text: "mod_proxy_ftp XSS", title: "Vulnerability summary", }, ], product_status: { fixed: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2008-0005", }, { category: "external", summary: "RHBZ#427739", url: "https://bugzilla.redhat.com/show_bug.cgi?id=427739", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2008-0005", url: "https://www.cve.org/CVERecord?id=CVE-2008-0005", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2008-0005", url: "https://nvd.nist.gov/vuln/detail/CVE-2008-0005", }, ], release_date: "2008-01-02T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2010-08-04T21:30:00+00:00", details: "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259", product_ids: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2010:0602", }, ], threats: [ { category: "impact", details: "Low", }, ], title: "mod_proxy_ftp XSS", }, { cve: "CVE-2008-0128", discovery_date: "2008-01-23T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "429821", }, ], notes: [ { category: "description", text: "The SingleSignOn Valve (org.apache.catalina.authenticator.SingleSignOn) in Apache Tomcat before 5.5.21 does not set the secure flag for the JSESSIONIDSSO cookie in an https session, which can cause the cookie to be sent in http requests and make it easier for remote attackers to capture this cookie.", title: "Vulnerability description", }, { category: "summary", text: "tomcat5 SSO cookie login information disclosure", title: "Vulnerability summary", }, ], product_status: { fixed: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2008-0128", }, { category: "external", summary: "RHBZ#429821", url: "https://bugzilla.redhat.com/show_bug.cgi?id=429821", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2008-0128", url: "https://www.cve.org/CVERecord?id=CVE-2008-0128", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2008-0128", url: "https://nvd.nist.gov/vuln/detail/CVE-2008-0128", }, ], release_date: "2006-12-20T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2010-08-04T21:30:00+00:00", details: "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259", product_ids: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2010:0602", }, ], threats: [ { category: "impact", details: "Low", }, ], title: "tomcat5 SSO cookie login information disclosure", }, { cve: "CVE-2008-1232", cwe: { id: "CWE-79", name: "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", }, discovery_date: "2008-08-01T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "457597", }, ], notes: [ { category: "description", text: "Cross-site scripting (XSS) vulnerability in Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16 allows remote attackers to inject arbitrary web script or HTML via a crafted string that is used in the message argument to the HttpServletResponse.sendError method.", title: "Vulnerability description", }, { category: "summary", text: "tomcat: Cross-Site-Scripting enabled by sendError call", title: "Vulnerability summary", }, ], product_status: { fixed: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2008-1232", }, { category: "external", summary: "RHBZ#457597", url: "https://bugzilla.redhat.com/show_bug.cgi?id=457597", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2008-1232", url: "https://www.cve.org/CVERecord?id=CVE-2008-1232", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2008-1232", url: "https://nvd.nist.gov/vuln/detail/CVE-2008-1232", }, ], release_date: "2008-08-01T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2010-08-04T21:30:00+00:00", details: "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259", product_ids: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2010:0602", }, ], threats: [ { category: "impact", details: "Low", }, ], title: "tomcat: Cross-Site-Scripting enabled by sendError call", }, { cve: "CVE-2008-1927", discovery_date: "2008-04-20T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "443928", }, ], notes: [ { category: "description", text: "Double free vulnerability in Perl 5.8.8 allows context-dependent attackers to cause a denial of service (memory corruption and crash) via a crafted regular expression containing UTF8 characters. NOTE: this issue might only be present on certain operating systems.", title: "Vulnerability description", }, { category: "summary", text: "perl: heap corruption by regular expressions with utf8 characters", title: "Vulnerability summary", }, ], product_status: { fixed: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2008-1927", }, { category: "external", summary: "RHBZ#443928", url: "https://bugzilla.redhat.com/show_bug.cgi?id=443928", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2008-1927", url: "https://www.cve.org/CVERecord?id=CVE-2008-1927", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2008-1927", url: "https://nvd.nist.gov/vuln/detail/CVE-2008-1927", }, ], release_date: "2007-12-04T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2010-08-04T21:30:00+00:00", details: "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259", product_ids: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2010:0602", }, ], threats: [ { category: "impact", details: "Important", }, ], title: "perl: heap corruption by regular expressions with utf8 characters", }, { cve: "CVE-2008-2364", discovery_date: "2008-05-29T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "451615", }, ], notes: [ { category: "description", text: "The ap_proxy_http_process_response function in mod_proxy_http.c in the mod_proxy module in the Apache HTTP Server 2.0.63 and 2.2.8 does not limit the number of forwarded interim responses, which allows remote HTTP servers to cause a denial of service (memory consumption) via a large number of interim responses.", title: "Vulnerability description", }, { category: "summary", text: "httpd: mod_proxy_http DoS via excessive interim responses from the origin server", title: "Vulnerability summary", }, { category: "other", text: "Red Hat is aware of this issue and is tracking it via the following bug: https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=CVE-2008-2364\n\nThe Red Hat Product Security has rated this issue as having moderate security impact, a future update may address this flaw. More information regarding issue severity can be found here: https://access.redhat.com/security/updates/classification/", title: "Statement", }, ], product_status: { fixed: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2008-2364", }, { category: "external", summary: "RHBZ#451615", url: "https://bugzilla.redhat.com/show_bug.cgi?id=451615", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2008-2364", url: "https://www.cve.org/CVERecord?id=CVE-2008-2364", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2008-2364", url: "https://nvd.nist.gov/vuln/detail/CVE-2008-2364", }, ], release_date: "2008-06-10T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2010-08-04T21:30:00+00:00", details: "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259", product_ids: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2010:0602", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "httpd: mod_proxy_http DoS via excessive interim responses from the origin server", }, { cve: "CVE-2008-2370", discovery_date: "2008-08-01T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "457934", }, ], notes: [ { category: "description", text: "Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16, when a RequestDispatcher is used, performs path normalization before removing the query string from the URI, which allows remote attackers to conduct directory traversal attacks and read arbitrary files via a .. (dot dot) in a request parameter.", title: "Vulnerability description", }, { category: "summary", text: "tomcat RequestDispatcher information disclosure vulnerability", title: "Vulnerability summary", }, ], product_status: { fixed: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2008-2370", }, { category: "external", summary: "RHBZ#457934", url: "https://bugzilla.redhat.com/show_bug.cgi?id=457934", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2008-2370", url: "https://www.cve.org/CVERecord?id=CVE-2008-2370", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2008-2370", url: "https://nvd.nist.gov/vuln/detail/CVE-2008-2370", }, ], release_date: "2008-08-01T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2010-08-04T21:30:00+00:00", details: "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259", product_ids: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2010:0602", }, ], threats: [ { category: "impact", details: "Important", }, ], title: "tomcat RequestDispatcher information disclosure vulnerability", }, { cve: "CVE-2008-2939", cwe: { id: "CWE-79", name: "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", }, discovery_date: "2008-08-05T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "458250", }, ], notes: [ { category: "description", text: "Cross-site scripting (XSS) vulnerability in proxy_ftp.c in the mod_proxy_ftp module in Apache 2.0.63 and earlier, and mod_proxy_ftp.c in the mod_proxy_ftp module in Apache 2.2.9 and earlier 2.2 versions, allows remote attackers to inject arbitrary web script or HTML via a wildcard in the last directory component in the pathname in an FTP URI.", title: "Vulnerability description", }, { category: "summary", text: "httpd: mod_proxy_ftp globbing XSS", title: "Vulnerability summary", }, ], product_status: { fixed: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2008-2939", }, { category: "external", summary: "RHBZ#458250", url: "https://bugzilla.redhat.com/show_bug.cgi?id=458250", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2008-2939", url: "https://www.cve.org/CVERecord?id=CVE-2008-2939", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2008-2939", url: "https://nvd.nist.gov/vuln/detail/CVE-2008-2939", }, ], release_date: "2008-08-05T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2010-08-04T21:30:00+00:00", details: "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259", product_ids: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2010:0602", }, ], threats: [ { category: "impact", details: "Low", }, ], title: "httpd: mod_proxy_ftp globbing XSS", }, { cve: "CVE-2008-5515", discovery_date: "2009-06-08T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "504753", }, ], notes: [ { category: "description", text: "Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, 6.0.0 through 6.0.18, and possibly earlier versions normalizes the target pathname before filtering the query string when using the RequestDispatcher method, which allows remote attackers to bypass intended access restrictions and conduct directory traversal attacks via .. (dot dot) sequences and the WEB-INF directory in a Request.", title: "Vulnerability description", }, { category: "summary", text: "tomcat request dispatcher information disclosure vulnerability", title: "Vulnerability summary", }, ], product_status: { fixed: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2008-5515", }, { category: "external", summary: "RHBZ#504753", url: "https://bugzilla.redhat.com/show_bug.cgi?id=504753", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2008-5515", url: "https://www.cve.org/CVERecord?id=CVE-2008-5515", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2008-5515", url: "https://nvd.nist.gov/vuln/detail/CVE-2008-5515", }, ], release_date: "2009-06-08T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2010-08-04T21:30:00+00:00", details: "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259", product_ids: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2010:0602", }, ], threats: [ { category: "impact", details: "Important", }, ], title: "tomcat request dispatcher information disclosure vulnerability", }, { cve: "CVE-2009-0023", discovery_date: "2009-06-03T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "503928", }, ], notes: [ { category: "description", text: "The apr_strmatch_precompile function in strmatch/apr_strmatch.c in Apache APR-util before 1.3.5 allows remote attackers to cause a denial of service (daemon crash) via crafted input involving (1) a .htaccess file used with the Apache HTTP Server, (2) the SVNMasterURI directive in the mod_dav_svn module in the Apache HTTP Server, (3) the mod_apreq2 module for the Apache HTTP Server, or (4) an application that uses the libapreq2 library, which triggers a heap-based buffer underflow.", title: "Vulnerability description", }, { category: "summary", text: "apr-util heap buffer underwrite", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2009-0023", }, { category: "external", summary: "RHBZ#503928", url: "https://bugzilla.redhat.com/show_bug.cgi?id=503928", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2009-0023", url: "https://www.cve.org/CVERecord?id=CVE-2009-0023", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2009-0023", url: "https://nvd.nist.gov/vuln/detail/CVE-2009-0023", }, ], release_date: "2009-06-03T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2010-08-04T21:30:00+00:00", details: "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259", product_ids: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2010:0602", }, ], scores: [ { cvss_v2: { accessComplexity: "LOW", accessVector: "LOCAL", authentication: "SINGLE", availabilityImpact: "PARTIAL", baseScore: 4.3, confidentialityImpact: "PARTIAL", integrityImpact: "PARTIAL", vectorString: "AV:L/AC:L/Au:S/C:P/I:P/A:P", version: "2.0", }, products: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "apr-util heap buffer underwrite", }, { cve: "CVE-2009-0033", discovery_date: "2009-01-26T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "493381", }, ], notes: [ { category: "description", text: "Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18, when the Java AJP connector and mod_jk load balancing are used, allows remote attackers to cause a denial of service (application outage) via a crafted request with invalid headers, related to temporary blocking of connectors that have encountered errors, as demonstrated by an error involving a malformed HTTP Host header.", title: "Vulnerability description", }, { category: "summary", text: "tomcat6 Denial-Of-Service with AJP connection", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2009-0033", }, { category: "external", summary: "RHBZ#493381", url: "https://bugzilla.redhat.com/show_bug.cgi?id=493381", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2009-0033", url: "https://www.cve.org/CVERecord?id=CVE-2009-0033", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2009-0033", url: "https://nvd.nist.gov/vuln/detail/CVE-2009-0033", }, ], release_date: "2009-06-03T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2010-08-04T21:30:00+00:00", details: "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259", product_ids: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2010:0602", }, ], scores: [ { cvss_v2: { accessComplexity: "LOW", accessVector: "NETWORK", authentication: "NONE", availabilityImpact: "PARTIAL", baseScore: 5, confidentialityImpact: "NONE", integrityImpact: "NONE", vectorString: "AV:N/AC:L/Au:N/C:N/I:N/A:P", version: "2.0", }, products: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "tomcat6 Denial-Of-Service with AJP connection", }, { cve: "CVE-2009-0580", discovery_date: "2009-06-03T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "503978", }, ], notes: [ { category: "description", text: "Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18, when FORM authentication is used, allows remote attackers to enumerate valid usernames via requests to /j_security_check with malformed URL encoding of passwords, related to improper error checking in the (1) MemoryRealm, (2) DataSourceRealm, and (3) JDBCRealm authentication realms, as demonstrated by a % (percent) value for the j_password parameter.", title: "Vulnerability description", }, { category: "summary", text: "tomcat6 Information disclosure in authentication classes", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2009-0580", }, { category: "external", summary: "RHBZ#503978", url: "https://bugzilla.redhat.com/show_bug.cgi?id=503978", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2009-0580", url: "https://www.cve.org/CVERecord?id=CVE-2009-0580", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2009-0580", url: "https://nvd.nist.gov/vuln/detail/CVE-2009-0580", }, ], release_date: "2009-06-03T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2010-08-04T21:30:00+00:00", details: "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259", product_ids: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2010:0602", }, ], scores: [ { cvss_v2: { accessComplexity: "LOW", accessVector: "NETWORK", authentication: "NONE", availabilityImpact: "NONE", baseScore: 5, confidentialityImpact: "PARTIAL", integrityImpact: "NONE", vectorString: "AV:N/AC:L/Au:N/C:P/I:N/A:N", version: "2.0", }, products: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], }, ], threats: [ { category: "impact", details: "Low", }, ], title: "tomcat6 Information disclosure in authentication classes", }, { cve: "CVE-2009-1891", discovery_date: "2009-06-26T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "509125", }, ], notes: [ { category: "description", text: "The mod_deflate module in Apache httpd 2.2.11 and earlier compresses large files until completion even after the associated network connection is closed, which allows remote attackers to cause a denial of service (CPU consumption).", title: "Vulnerability description", }, { category: "summary", text: "httpd: possible temporary DoS (CPU consumption) in mod_deflate", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2009-1891", }, { category: "external", summary: "RHBZ#509125", url: "https://bugzilla.redhat.com/show_bug.cgi?id=509125", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2009-1891", url: "https://www.cve.org/CVERecord?id=CVE-2009-1891", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2009-1891", url: "https://nvd.nist.gov/vuln/detail/CVE-2009-1891", }, ], release_date: "2009-06-26T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2010-08-04T21:30:00+00:00", details: "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259", product_ids: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2010:0602", }, ], scores: [ { cvss_v2: { accessComplexity: "HIGH", accessVector: "NETWORK", authentication: "NONE", availabilityImpact: "PARTIAL", baseScore: 2.6, confidentialityImpact: "NONE", integrityImpact: "NONE", vectorString: "AV:N/AC:H/Au:N/C:N/I:N/A:P", version: "2.0", }, products: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], }, ], threats: [ { category: "impact", details: "Low", }, ], title: "httpd: possible temporary DoS (CPU consumption) in mod_deflate", }, { cve: "CVE-2009-1955", discovery_date: "2009-06-01T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "504555", }, ], notes: [ { category: "description", text: "The expat XML parser in the apr_xml_* interface in xml/apr_xml.c in Apache APR-util before 1.3.7, as used in the mod_dav and mod_dav_svn modules in the Apache HTTP Server, allows remote attackers to cause a denial of service (memory consumption) via a crafted XML document containing a large number of nested entity references, as demonstrated by a PROPFIND request, a similar issue to CVE-2003-1564.", title: "Vulnerability description", }, { category: "summary", text: "apr-util billion laughs attack", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2009-1955", }, { category: "external", summary: "RHBZ#504555", url: "https://bugzilla.redhat.com/show_bug.cgi?id=504555", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2009-1955", url: "https://www.cve.org/CVERecord?id=CVE-2009-1955", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2009-1955", url: "https://nvd.nist.gov/vuln/detail/CVE-2009-1955", }, ], release_date: "2009-06-01T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2010-08-04T21:30:00+00:00", details: "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259", product_ids: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2010:0602", }, ], scores: [ { cvss_v2: { accessComplexity: "LOW", accessVector: "NETWORK", authentication: "NONE", availabilityImpact: "PARTIAL", baseScore: 5, confidentialityImpact: "NONE", integrityImpact: "NONE", vectorString: "AV:N/AC:L/Au:N/C:N/I:N/A:P", version: "2.0", }, products: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "apr-util billion laughs attack", }, { cve: "CVE-2009-1956", discovery_date: "2009-06-05T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "504390", }, ], notes: [ { category: "description", text: "Off-by-one error in the apr_brigade_vprintf function in Apache APR-util before 1.3.5 on big-endian platforms allows remote attackers to obtain sensitive information or cause a denial of service (application crash) via crafted input.", title: "Vulnerability description", }, { category: "summary", text: "apr-util single NULL byte buffer overflow", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2009-1956", }, { category: "external", summary: "RHBZ#504390", url: "https://bugzilla.redhat.com/show_bug.cgi?id=504390", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2009-1956", url: "https://www.cve.org/CVERecord?id=CVE-2009-1956", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2009-1956", url: "https://nvd.nist.gov/vuln/detail/CVE-2009-1956", }, ], release_date: "2009-04-24T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2010-08-04T21:30:00+00:00", details: "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259", product_ids: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2010:0602", }, ], scores: [ { cvss_v2: { accessComplexity: "MEDIUM", accessVector: "NETWORK", authentication: "NONE", availabilityImpact: "NONE", baseScore: 4.3, confidentialityImpact: "PARTIAL", integrityImpact: "NONE", vectorString: "AV:N/AC:M/Au:N/C:P/I:N/A:N", version: "2.0", }, products: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "apr-util single NULL byte buffer overflow", }, { cve: "CVE-2009-2412", cwe: { id: "CWE-190", name: "Integer Overflow or Wraparound", }, discovery_date: "2009-07-30T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "515698", }, ], notes: [ { category: "description", text: "Multiple integer overflows in the Apache Portable Runtime (APR) library and the Apache Portable Utility library (aka APR-util) 0.9.x and 1.3.x allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via vectors that trigger crafted calls to the (1) allocator_alloc or (2) apr_palloc function in memory/unix/apr_pools.c in APR; or crafted calls to the (3) apr_rmm_malloc, (4) apr_rmm_calloc, or (5) apr_rmm_realloc function in misc/apr_rmm.c in APR-util; leading to buffer overflows. NOTE: some of these details are obtained from third party information.", title: "Vulnerability description", }, { category: "summary", text: "apr-util: Integer overflows in memory pool (apr) and relocatable memory (apr-util) management", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2009-2412", }, { category: "external", summary: "RHBZ#515698", url: "https://bugzilla.redhat.com/show_bug.cgi?id=515698", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2009-2412", url: "https://www.cve.org/CVERecord?id=CVE-2009-2412", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2009-2412", url: "https://nvd.nist.gov/vuln/detail/CVE-2009-2412", }, ], release_date: "2009-08-04T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2010-08-04T21:30:00+00:00", details: "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259", product_ids: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2010:0602", }, ], scores: [ { cvss_v2: { accessComplexity: "MEDIUM", accessVector: "NETWORK", authentication: "NONE", availabilityImpact: "PARTIAL", baseScore: 6.8, confidentialityImpact: "PARTIAL", integrityImpact: "PARTIAL", vectorString: "AV:N/AC:M/Au:N/C:P/I:P/A:P", version: "2.0", }, products: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "apr-util: Integer overflows in memory pool (apr) and relocatable memory (apr-util) management", }, { cve: "CVE-2009-3094", discovery_date: "2009-09-04T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "521619", }, ], notes: [ { category: "description", text: "The ap_proxy_ftp_handler function in modules/proxy/proxy_ftp.c in the mod_proxy_ftp module in the Apache HTTP Server 2.0.63 and 2.2.13 allows remote FTP servers to cause a denial of service (NULL pointer dereference and child process crash) via a malformed reply to an EPSV command.", title: "Vulnerability description", }, { category: "summary", text: "httpd: NULL pointer defer in mod_proxy_ftp caused by crafted EPSV and PASV reply", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2009-3094", }, { category: "external", summary: "RHBZ#521619", url: "https://bugzilla.redhat.com/show_bug.cgi?id=521619", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2009-3094", url: "https://www.cve.org/CVERecord?id=CVE-2009-3094", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2009-3094", url: "https://nvd.nist.gov/vuln/detail/CVE-2009-3094", }, ], release_date: "2009-09-02T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2010-08-04T21:30:00+00:00", details: "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259", product_ids: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2010:0602", }, ], scores: [ { cvss_v2: { accessComplexity: "HIGH", accessVector: "NETWORK", authentication: "NONE", availabilityImpact: "PARTIAL", baseScore: 2.6, confidentialityImpact: "NONE", integrityImpact: "NONE", vectorString: "AV:N/AC:H/Au:N/C:N/I:N/A:P", version: "2.0", }, products: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], }, ], threats: [ { category: "impact", details: "Low", }, ], title: "httpd: NULL pointer defer in mod_proxy_ftp caused by crafted EPSV and PASV reply", }, { cve: "CVE-2009-3095", discovery_date: "2009-09-03T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "522209", }, ], notes: [ { category: "description", text: "The mod_proxy_ftp module in the Apache HTTP Server allows remote attackers to bypass intended access restrictions and send arbitrary commands to an FTP server via vectors related to the embedding of these commands in the Authorization HTTP header, as demonstrated by a certain module in VulnDisco Pack Professional 8.11.", title: "Vulnerability description", }, { category: "summary", text: "httpd: mod_proxy_ftp FTP command injection via Authorization HTTP header", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2009-3095", }, { category: "external", summary: "RHBZ#522209", url: "https://bugzilla.redhat.com/show_bug.cgi?id=522209", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2009-3095", url: "https://www.cve.org/CVERecord?id=CVE-2009-3095", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2009-3095", url: "https://nvd.nist.gov/vuln/detail/CVE-2009-3095", }, ], release_date: "2009-09-03T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2010-08-04T21:30:00+00:00", details: "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259", product_ids: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2010:0602", }, ], scores: [ { cvss_v2: { accessComplexity: "HIGH", accessVector: "NETWORK", authentication: "NONE", availabilityImpact: "NONE", baseScore: 2.6, confidentialityImpact: "NONE", integrityImpact: "PARTIAL", vectorString: "AV:N/AC:H/Au:N/C:N/I:P/A:N", version: "2.0", }, products: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], }, ], threats: [ { category: "impact", details: "Low", }, ], title: "httpd: mod_proxy_ftp FTP command injection via Authorization HTTP header", }, { cve: "CVE-2009-4901", cwe: { id: "CWE-119", name: "Improper Restriction of Operations within the Bounds of a Memory Buffer", }, discovery_date: "2010-05-26T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "596426", }, ], notes: [ { category: "description", text: "The MSGFunctionDemarshall function in winscard_svc.c in the PC/SC Smart Card daemon (aka PCSCD) in MUSCLE PCSC-Lite before 1.5.4 might allow local users to cause a denial of service (daemon crash) via crafted SCARD_SET_ATTRIB message data, which is improperly demarshalled and triggers a buffer over-read, a related issue to CVE-2010-0407.", title: "Vulnerability description", }, { category: "summary", text: "pcsc-lite: Privilege escalation via specially-crafted client to PC/SC Smart Card daemon messages", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2009-4901", }, { category: "external", summary: "RHBZ#596426", url: "https://bugzilla.redhat.com/show_bug.cgi?id=596426", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2009-4901", url: "https://www.cve.org/CVERecord?id=CVE-2009-4901", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2009-4901", url: "https://nvd.nist.gov/vuln/detail/CVE-2009-4901", }, ], release_date: "2010-06-10T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2010-08-04T21:30:00+00:00", details: "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259", product_ids: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2010:0602", }, ], scores: [ { cvss_v2: { accessComplexity: "LOW", accessVector: "LOCAL", authentication: "NONE", availabilityImpact: "COMPLETE", baseScore: 7.2, confidentialityImpact: "COMPLETE", integrityImpact: "COMPLETE", vectorString: "AV:L/AC:L/Au:N/C:C/I:C/A:C", version: "2.0", }, products: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "pcsc-lite: Privilege escalation via specially-crafted client to PC/SC Smart Card daemon messages", }, { cve: "CVE-2010-0407", cwe: { id: "CWE-119", name: "Improper Restriction of Operations within the Bounds of a Memory Buffer", }, discovery_date: "2010-05-26T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "596426", }, ], notes: [ { category: "description", text: "Multiple buffer overflows in the MSGFunctionDemarshall function in winscard_svc.c in the PC/SC Smart Card daemon (aka PCSCD) in MUSCLE PCSC-Lite before 1.5.4 allow local users to gain privileges via crafted message data, which is improperly demarshalled.", title: "Vulnerability description", }, { category: "summary", text: "pcsc-lite: Privilege escalation via specially-crafted client to PC/SC Smart Card daemon messages", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2010-0407", }, { category: "external", summary: "RHBZ#596426", url: "https://bugzilla.redhat.com/show_bug.cgi?id=596426", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2010-0407", url: "https://www.cve.org/CVERecord?id=CVE-2010-0407", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2010-0407", url: "https://nvd.nist.gov/vuln/detail/CVE-2010-0407", }, ], release_date: "2010-06-10T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2010-08-04T21:30:00+00:00", details: "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259", product_ids: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2010:0602", }, ], scores: [ { cvss_v2: { accessComplexity: "LOW", accessVector: "LOCAL", authentication: "NONE", availabilityImpact: "COMPLETE", baseScore: 7.2, confidentialityImpact: "COMPLETE", integrityImpact: "COMPLETE", vectorString: "AV:L/AC:L/Au:N/C:C/I:C/A:C", version: "2.0", }, products: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "pcsc-lite: Privilege escalation via specially-crafted client to PC/SC Smart Card daemon messages", }, { cve: "CVE-2010-0434", discovery_date: "2010-03-03T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "570171", }, ], notes: [ { category: "description", text: "The ap_read_request function in server/protocol.c in the Apache HTTP Server 2.2.x before 2.2.15, when a multithreaded MPM is used, does not properly handle headers in subrequests in certain circumstances involving a parent request that has a body, which might allow remote attackers to obtain sensitive information via a crafted request that triggers access to memory locations associated with an earlier request.", title: "Vulnerability description", }, { category: "summary", text: "httpd: request header information leak", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2010-0434", }, { category: "external", summary: "RHBZ#570171", url: "https://bugzilla.redhat.com/show_bug.cgi?id=570171", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2010-0434", url: "https://www.cve.org/CVERecord?id=CVE-2010-0434", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2010-0434", url: "https://nvd.nist.gov/vuln/detail/CVE-2010-0434", }, ], release_date: "2009-12-09T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2010-08-04T21:30:00+00:00", details: "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259", product_ids: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2010:0602", }, ], scores: [ { cvss_v2: { accessComplexity: "HIGH", accessVector: "NETWORK", authentication: "NONE", availabilityImpact: "NONE", baseScore: 2.6, confidentialityImpact: "PARTIAL", integrityImpact: "NONE", vectorString: "AV:N/AC:H/Au:N/C:P/I:N/A:N", version: "2.0", }, products: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], }, ], threats: [ { category: "impact", details: "Low", }, ], title: "httpd: request header information leak", }, ], }
RHSA-2007:0662
Vulnerability from csaf_redhat
Published
2007-07-13 07:48
Modified
2024-11-22 02:04
Summary
Red Hat Security Advisory: httpd security update
Notes
Topic
Updated Apache httpd packages that correct a security issue are now
available for Red Hat Enterprise Linux 3 and 4.
This update has been rated as having moderate security impact by the Red
Hat Security Response Team.
Details
The Apache HTTP Server is a popular Web server.
The Apache HTTP Server did not verify that a process was an Apache child
process before sending it signals. A local attacker with the ability to run
scripts on the Apache HTTP Server could manipulate the scoreboard and cause
arbitrary processes to be terminated which could lead to a denial of
service. (CVE-2007-3304).
Users of httpd should upgrade to these updated packages, which contain
backported patches to correct this issue. Users should restart Apache
after installing this update.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ document: { aggregate_severity: { namespace: "https://access.redhat.com/security/updates/classification/", text: "Moderate", }, category: "csaf_security_advisory", csaf_version: "2.0", distribution: { text: "Copyright © Red Hat, Inc. All rights reserved.", tlp: { label: "WHITE", url: "https://www.first.org/tlp/", }, }, lang: "en", notes: [ { category: "summary", text: "Updated Apache httpd packages that correct a security issue are now\navailable for Red Hat Enterprise Linux 3 and 4.\n\nThis update has been rated as having moderate security impact by the Red\nHat Security Response Team.", title: "Topic", }, { category: "general", text: "The Apache HTTP Server is a popular Web server. \n\nThe Apache HTTP Server did not verify that a process was an Apache child\nprocess before sending it signals. A local attacker with the ability to run\nscripts on the Apache HTTP Server could manipulate the scoreboard and cause\narbitrary processes to be terminated which could lead to a denial of\nservice. (CVE-2007-3304).\n\nUsers of httpd should upgrade to these updated packages, which contain\nbackported patches to correct this issue. Users should restart Apache\nafter installing this update.", title: "Details", }, { category: "legal_disclaimer", text: "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", title: "Terms of Use", }, ], publisher: { category: "vendor", contact_details: "https://access.redhat.com/security/team/contact/", issuing_authority: "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", name: "Red Hat Product Security", namespace: "https://www.redhat.com", }, references: [ { category: "self", summary: "https://access.redhat.com/errata/RHSA-2007:0662", url: "https://access.redhat.com/errata/RHSA-2007:0662", }, { category: "external", summary: "https://access.redhat.com/security/updates/classification/#moderate", url: "https://access.redhat.com/security/updates/classification/#moderate", }, { category: "external", summary: "245111", url: "https://bugzilla.redhat.com/show_bug.cgi?id=245111", }, { category: "self", summary: "Canonical URL", url: "https://security.access.redhat.com/data/csaf/v2/advisories/2007/rhsa-2007_0662.json", }, ], title: "Red Hat Security Advisory: httpd security update", tracking: { current_release_date: "2024-11-22T02:04:26+00:00", generator: { date: "2024-11-22T02:04:26+00:00", engine: { name: "Red Hat SDEngine", version: "4.2.1", }, }, id: "RHSA-2007:0662", initial_release_date: "2007-07-13T07:48:00+00:00", revision_history: [ { date: "2007-07-13T07:48:00+00:00", number: "1", summary: "Initial version", }, { date: "2008-01-07T17:32:33+00:00", number: "2", summary: "Last updated version", }, { date: "2024-11-22T02:04:26+00:00", number: "3", summary: "Last generated version", }, ], status: "final", version: "3", }, }, product_tree: { branches: [ { branches: [ { branches: [ { category: "product_name", name: "Red Hat Enterprise Linux AS version 4", product: { name: "Red Hat Enterprise Linux AS version 4", product_id: "4AS", product_identification_helper: { cpe: "cpe:/o:redhat:enterprise_linux:4::as", }, }, }, { category: "product_name", name: "Red Hat Enterprise Linux Desktop version 4", product: { name: "Red Hat Enterprise Linux Desktop version 4", product_id: "4Desktop", product_identification_helper: { cpe: "cpe:/o:redhat:enterprise_linux:4::desktop", }, }, }, { category: "product_name", name: "Red Hat Enterprise Linux ES version 4", product: { name: "Red Hat Enterprise Linux ES version 4", product_id: "4ES", product_identification_helper: { cpe: "cpe:/o:redhat:enterprise_linux:4::es", }, }, }, { category: "product_name", name: "Red Hat Enterprise Linux WS version 4", product: { name: "Red Hat Enterprise Linux WS version 4", product_id: "4WS", product_identification_helper: { cpe: "cpe:/o:redhat:enterprise_linux:4::ws", }, }, }, { category: "product_name", name: "Red Hat Enterprise Linux AS version 3", product: { name: "Red Hat Enterprise Linux AS version 3", product_id: "3AS", product_identification_helper: { cpe: "cpe:/o:redhat:enterprise_linux:3::as", }, }, }, { category: "product_name", name: "Red Hat Desktop version 3", product: { name: "Red Hat Desktop version 3", product_id: "3Desktop", product_identification_helper: { cpe: "cpe:/o:redhat:enterprise_linux:3::desktop", }, }, }, { category: "product_name", name: "Red Hat Enterprise Linux ES version 3", product: { name: "Red Hat Enterprise Linux ES version 3", product_id: "3ES", product_identification_helper: { cpe: "cpe:/o:redhat:enterprise_linux:3::es", }, }, }, { category: "product_name", name: "Red Hat Enterprise Linux WS version 3", product: { name: "Red Hat Enterprise Linux WS version 3", product_id: "3WS", product_identification_helper: { cpe: "cpe:/o:redhat:enterprise_linux:3::ws", }, }, }, ], category: "product_family", name: "Red Hat Enterprise Linux", }, { branches: [ { category: "product_version", name: "httpd-manual-0:2.0.52-32.3.ent.ia64", product: { name: "httpd-manual-0:2.0.52-32.3.ent.ia64", product_id: "httpd-manual-0:2.0.52-32.3.ent.ia64", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-manual@2.0.52-32.3.ent?arch=ia64", }, }, }, { category: "product_version", name: "mod_ssl-1:2.0.52-32.3.ent.ia64", product: { name: "mod_ssl-1:2.0.52-32.3.ent.ia64", product_id: "mod_ssl-1:2.0.52-32.3.ent.ia64", product_identification_helper: { purl: "pkg:rpm/redhat/mod_ssl@2.0.52-32.3.ent?arch=ia64&epoch=1", }, }, }, { category: "product_version", name: "httpd-suexec-0:2.0.52-32.3.ent.ia64", product: { name: "httpd-suexec-0:2.0.52-32.3.ent.ia64", product_id: "httpd-suexec-0:2.0.52-32.3.ent.ia64", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-suexec@2.0.52-32.3.ent?arch=ia64", }, }, }, { category: "product_version", name: "httpd-debuginfo-0:2.0.52-32.3.ent.ia64", product: { name: "httpd-debuginfo-0:2.0.52-32.3.ent.ia64", product_id: "httpd-debuginfo-0:2.0.52-32.3.ent.ia64", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-debuginfo@2.0.52-32.3.ent?arch=ia64", }, }, }, { category: "product_version", name: "httpd-devel-0:2.0.52-32.3.ent.ia64", product: { name: "httpd-devel-0:2.0.52-32.3.ent.ia64", product_id: "httpd-devel-0:2.0.52-32.3.ent.ia64", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-devel@2.0.52-32.3.ent?arch=ia64", }, }, }, { category: "product_version", name: "httpd-0:2.0.52-32.3.ent.ia64", product: { name: "httpd-0:2.0.52-32.3.ent.ia64", product_id: "httpd-0:2.0.52-32.3.ent.ia64", product_identification_helper: { purl: "pkg:rpm/redhat/httpd@2.0.52-32.3.ent?arch=ia64", }, }, }, { category: "product_version", name: "httpd-0:2.0.46-68.ent.ia64", product: { name: "httpd-0:2.0.46-68.ent.ia64", product_id: "httpd-0:2.0.46-68.ent.ia64", product_identification_helper: { purl: "pkg:rpm/redhat/httpd@2.0.46-68.ent?arch=ia64", }, }, }, { category: "product_version", name: "mod_ssl-1:2.0.46-68.ent.ia64", product: { name: "mod_ssl-1:2.0.46-68.ent.ia64", product_id: "mod_ssl-1:2.0.46-68.ent.ia64", product_identification_helper: { purl: "pkg:rpm/redhat/mod_ssl@2.0.46-68.ent?arch=ia64&epoch=1", }, }, }, { category: "product_version", name: "httpd-devel-0:2.0.46-68.ent.ia64", product: { name: "httpd-devel-0:2.0.46-68.ent.ia64", product_id: "httpd-devel-0:2.0.46-68.ent.ia64", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-devel@2.0.46-68.ent?arch=ia64", }, }, }, { category: "product_version", name: "httpd-debuginfo-0:2.0.46-68.ent.ia64", product: { name: "httpd-debuginfo-0:2.0.46-68.ent.ia64", product_id: "httpd-debuginfo-0:2.0.46-68.ent.ia64", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-debuginfo@2.0.46-68.ent?arch=ia64", }, }, }, ], category: "architecture", name: "ia64", }, { branches: [ { category: "product_version", name: "httpd-manual-0:2.0.52-32.3.ent.x86_64", product: { name: "httpd-manual-0:2.0.52-32.3.ent.x86_64", product_id: "httpd-manual-0:2.0.52-32.3.ent.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-manual@2.0.52-32.3.ent?arch=x86_64", }, }, }, { category: "product_version", name: "mod_ssl-1:2.0.52-32.3.ent.x86_64", product: { name: "mod_ssl-1:2.0.52-32.3.ent.x86_64", product_id: "mod_ssl-1:2.0.52-32.3.ent.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/mod_ssl@2.0.52-32.3.ent?arch=x86_64&epoch=1", }, }, }, { category: "product_version", name: "httpd-suexec-0:2.0.52-32.3.ent.x86_64", product: { name: "httpd-suexec-0:2.0.52-32.3.ent.x86_64", product_id: "httpd-suexec-0:2.0.52-32.3.ent.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-suexec@2.0.52-32.3.ent?arch=x86_64", }, }, }, { category: "product_version", name: "httpd-debuginfo-0:2.0.52-32.3.ent.x86_64", product: { name: "httpd-debuginfo-0:2.0.52-32.3.ent.x86_64", product_id: "httpd-debuginfo-0:2.0.52-32.3.ent.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-debuginfo@2.0.52-32.3.ent?arch=x86_64", }, }, }, { category: "product_version", name: "httpd-devel-0:2.0.52-32.3.ent.x86_64", product: { name: "httpd-devel-0:2.0.52-32.3.ent.x86_64", product_id: "httpd-devel-0:2.0.52-32.3.ent.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-devel@2.0.52-32.3.ent?arch=x86_64", }, }, }, { category: "product_version", name: "httpd-0:2.0.52-32.3.ent.x86_64", product: { name: "httpd-0:2.0.52-32.3.ent.x86_64", product_id: "httpd-0:2.0.52-32.3.ent.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/httpd@2.0.52-32.3.ent?arch=x86_64", }, }, }, { category: "product_version", name: "httpd-0:2.0.46-68.ent.x86_64", product: { name: "httpd-0:2.0.46-68.ent.x86_64", product_id: "httpd-0:2.0.46-68.ent.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/httpd@2.0.46-68.ent?arch=x86_64", }, }, }, { category: "product_version", name: "mod_ssl-1:2.0.46-68.ent.x86_64", product: { name: "mod_ssl-1:2.0.46-68.ent.x86_64", product_id: "mod_ssl-1:2.0.46-68.ent.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/mod_ssl@2.0.46-68.ent?arch=x86_64&epoch=1", }, }, }, { category: "product_version", name: "httpd-devel-0:2.0.46-68.ent.x86_64", product: { name: "httpd-devel-0:2.0.46-68.ent.x86_64", product_id: "httpd-devel-0:2.0.46-68.ent.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-devel@2.0.46-68.ent?arch=x86_64", }, }, }, { category: "product_version", name: "httpd-debuginfo-0:2.0.46-68.ent.x86_64", product: { name: "httpd-debuginfo-0:2.0.46-68.ent.x86_64", product_id: "httpd-debuginfo-0:2.0.46-68.ent.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-debuginfo@2.0.46-68.ent?arch=x86_64", }, }, }, ], category: "architecture", name: "x86_64", }, { branches: [ { category: "product_version", name: "httpd-manual-0:2.0.52-32.3.ent.i386", product: { name: "httpd-manual-0:2.0.52-32.3.ent.i386", product_id: "httpd-manual-0:2.0.52-32.3.ent.i386", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-manual@2.0.52-32.3.ent?arch=i386", }, }, }, { category: "product_version", name: "mod_ssl-1:2.0.52-32.3.ent.i386", product: { name: "mod_ssl-1:2.0.52-32.3.ent.i386", product_id: "mod_ssl-1:2.0.52-32.3.ent.i386", product_identification_helper: { purl: "pkg:rpm/redhat/mod_ssl@2.0.52-32.3.ent?arch=i386&epoch=1", }, }, }, { category: "product_version", name: "httpd-suexec-0:2.0.52-32.3.ent.i386", product: { name: "httpd-suexec-0:2.0.52-32.3.ent.i386", product_id: "httpd-suexec-0:2.0.52-32.3.ent.i386", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-suexec@2.0.52-32.3.ent?arch=i386", }, }, }, { category: "product_version", name: "httpd-debuginfo-0:2.0.52-32.3.ent.i386", product: { name: "httpd-debuginfo-0:2.0.52-32.3.ent.i386", product_id: "httpd-debuginfo-0:2.0.52-32.3.ent.i386", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-debuginfo@2.0.52-32.3.ent?arch=i386", }, }, }, { category: "product_version", name: "httpd-devel-0:2.0.52-32.3.ent.i386", product: { name: "httpd-devel-0:2.0.52-32.3.ent.i386", product_id: "httpd-devel-0:2.0.52-32.3.ent.i386", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-devel@2.0.52-32.3.ent?arch=i386", }, }, }, { category: "product_version", name: "httpd-0:2.0.52-32.3.ent.i386", product: { name: "httpd-0:2.0.52-32.3.ent.i386", product_id: "httpd-0:2.0.52-32.3.ent.i386", product_identification_helper: { purl: "pkg:rpm/redhat/httpd@2.0.52-32.3.ent?arch=i386", }, }, }, { category: "product_version", name: "httpd-0:2.0.46-68.ent.i386", product: { name: "httpd-0:2.0.46-68.ent.i386", product_id: "httpd-0:2.0.46-68.ent.i386", product_identification_helper: { purl: "pkg:rpm/redhat/httpd@2.0.46-68.ent?arch=i386", }, }, }, { category: "product_version", name: "mod_ssl-1:2.0.46-68.ent.i386", product: { name: "mod_ssl-1:2.0.46-68.ent.i386", product_id: "mod_ssl-1:2.0.46-68.ent.i386", product_identification_helper: { purl: "pkg:rpm/redhat/mod_ssl@2.0.46-68.ent?arch=i386&epoch=1", }, }, }, { category: "product_version", name: "httpd-devel-0:2.0.46-68.ent.i386", product: { name: "httpd-devel-0:2.0.46-68.ent.i386", product_id: "httpd-devel-0:2.0.46-68.ent.i386", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-devel@2.0.46-68.ent?arch=i386", }, }, }, { category: "product_version", name: "httpd-debuginfo-0:2.0.46-68.ent.i386", product: { name: "httpd-debuginfo-0:2.0.46-68.ent.i386", product_id: "httpd-debuginfo-0:2.0.46-68.ent.i386", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-debuginfo@2.0.46-68.ent?arch=i386", }, }, }, ], category: "architecture", name: "i386", }, { branches: [ { category: "product_version", name: "httpd-0:2.0.52-32.3.ent.src", product: { name: "httpd-0:2.0.52-32.3.ent.src", product_id: "httpd-0:2.0.52-32.3.ent.src", product_identification_helper: { purl: "pkg:rpm/redhat/httpd@2.0.52-32.3.ent?arch=src", }, }, }, { category: "product_version", name: "httpd-0:2.0.46-68.ent.src", product: { name: "httpd-0:2.0.46-68.ent.src", product_id: "httpd-0:2.0.46-68.ent.src", product_identification_helper: { purl: "pkg:rpm/redhat/httpd@2.0.46-68.ent?arch=src", }, }, }, ], category: "architecture", name: "src", }, { branches: [ { category: "product_version", name: "httpd-manual-0:2.0.52-32.3.ent.ppc", product: { name: "httpd-manual-0:2.0.52-32.3.ent.ppc", product_id: "httpd-manual-0:2.0.52-32.3.ent.ppc", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-manual@2.0.52-32.3.ent?arch=ppc", }, }, }, { category: "product_version", name: "mod_ssl-1:2.0.52-32.3.ent.ppc", product: { name: "mod_ssl-1:2.0.52-32.3.ent.ppc", product_id: "mod_ssl-1:2.0.52-32.3.ent.ppc", product_identification_helper: { purl: "pkg:rpm/redhat/mod_ssl@2.0.52-32.3.ent?arch=ppc&epoch=1", }, }, }, { category: "product_version", name: "httpd-suexec-0:2.0.52-32.3.ent.ppc", product: { name: "httpd-suexec-0:2.0.52-32.3.ent.ppc", product_id: "httpd-suexec-0:2.0.52-32.3.ent.ppc", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-suexec@2.0.52-32.3.ent?arch=ppc", }, }, }, { category: "product_version", name: "httpd-debuginfo-0:2.0.52-32.3.ent.ppc", product: { name: "httpd-debuginfo-0:2.0.52-32.3.ent.ppc", product_id: "httpd-debuginfo-0:2.0.52-32.3.ent.ppc", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-debuginfo@2.0.52-32.3.ent?arch=ppc", }, }, }, { category: "product_version", name: "httpd-devel-0:2.0.52-32.3.ent.ppc", product: { name: "httpd-devel-0:2.0.52-32.3.ent.ppc", product_id: "httpd-devel-0:2.0.52-32.3.ent.ppc", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-devel@2.0.52-32.3.ent?arch=ppc", }, }, }, { category: "product_version", name: "httpd-0:2.0.52-32.3.ent.ppc", product: { name: "httpd-0:2.0.52-32.3.ent.ppc", product_id: "httpd-0:2.0.52-32.3.ent.ppc", product_identification_helper: { purl: "pkg:rpm/redhat/httpd@2.0.52-32.3.ent?arch=ppc", }, }, }, { category: "product_version", name: "httpd-0:2.0.46-68.ent.ppc", product: { name: "httpd-0:2.0.46-68.ent.ppc", product_id: "httpd-0:2.0.46-68.ent.ppc", product_identification_helper: { purl: "pkg:rpm/redhat/httpd@2.0.46-68.ent?arch=ppc", }, }, }, { category: "product_version", name: "mod_ssl-1:2.0.46-68.ent.ppc", product: { name: "mod_ssl-1:2.0.46-68.ent.ppc", product_id: "mod_ssl-1:2.0.46-68.ent.ppc", product_identification_helper: { purl: "pkg:rpm/redhat/mod_ssl@2.0.46-68.ent?arch=ppc&epoch=1", }, }, }, { category: "product_version", name: "httpd-devel-0:2.0.46-68.ent.ppc", product: { name: "httpd-devel-0:2.0.46-68.ent.ppc", product_id: "httpd-devel-0:2.0.46-68.ent.ppc", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-devel@2.0.46-68.ent?arch=ppc", }, }, }, { category: "product_version", name: "httpd-debuginfo-0:2.0.46-68.ent.ppc", product: { name: "httpd-debuginfo-0:2.0.46-68.ent.ppc", product_id: "httpd-debuginfo-0:2.0.46-68.ent.ppc", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-debuginfo@2.0.46-68.ent?arch=ppc", }, }, }, ], category: "architecture", name: "ppc", }, { branches: [ { category: "product_version", name: "httpd-manual-0:2.0.52-32.3.ent.s390x", product: { name: "httpd-manual-0:2.0.52-32.3.ent.s390x", product_id: "httpd-manual-0:2.0.52-32.3.ent.s390x", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-manual@2.0.52-32.3.ent?arch=s390x", }, }, }, { category: "product_version", name: "mod_ssl-1:2.0.52-32.3.ent.s390x", product: { name: "mod_ssl-1:2.0.52-32.3.ent.s390x", product_id: "mod_ssl-1:2.0.52-32.3.ent.s390x", product_identification_helper: { purl: "pkg:rpm/redhat/mod_ssl@2.0.52-32.3.ent?arch=s390x&epoch=1", }, }, }, { category: "product_version", name: "httpd-suexec-0:2.0.52-32.3.ent.s390x", product: { name: "httpd-suexec-0:2.0.52-32.3.ent.s390x", product_id: "httpd-suexec-0:2.0.52-32.3.ent.s390x", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-suexec@2.0.52-32.3.ent?arch=s390x", }, }, }, { category: "product_version", name: "httpd-debuginfo-0:2.0.52-32.3.ent.s390x", product: { name: "httpd-debuginfo-0:2.0.52-32.3.ent.s390x", product_id: "httpd-debuginfo-0:2.0.52-32.3.ent.s390x", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-debuginfo@2.0.52-32.3.ent?arch=s390x", }, }, }, { category: "product_version", name: "httpd-devel-0:2.0.52-32.3.ent.s390x", product: { name: "httpd-devel-0:2.0.52-32.3.ent.s390x", product_id: "httpd-devel-0:2.0.52-32.3.ent.s390x", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-devel@2.0.52-32.3.ent?arch=s390x", }, }, }, { category: "product_version", name: "httpd-0:2.0.52-32.3.ent.s390x", product: { name: "httpd-0:2.0.52-32.3.ent.s390x", product_id: "httpd-0:2.0.52-32.3.ent.s390x", product_identification_helper: { purl: "pkg:rpm/redhat/httpd@2.0.52-32.3.ent?arch=s390x", }, }, }, { category: "product_version", name: "httpd-0:2.0.46-68.ent.s390x", product: { name: "httpd-0:2.0.46-68.ent.s390x", product_id: "httpd-0:2.0.46-68.ent.s390x", product_identification_helper: { purl: "pkg:rpm/redhat/httpd@2.0.46-68.ent?arch=s390x", }, }, }, { category: "product_version", name: "mod_ssl-1:2.0.46-68.ent.s390x", product: { name: "mod_ssl-1:2.0.46-68.ent.s390x", product_id: "mod_ssl-1:2.0.46-68.ent.s390x", product_identification_helper: { purl: "pkg:rpm/redhat/mod_ssl@2.0.46-68.ent?arch=s390x&epoch=1", }, }, }, { category: "product_version", name: "httpd-devel-0:2.0.46-68.ent.s390x", product: { name: "httpd-devel-0:2.0.46-68.ent.s390x", product_id: "httpd-devel-0:2.0.46-68.ent.s390x", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-devel@2.0.46-68.ent?arch=s390x", }, }, }, { category: "product_version", name: "httpd-debuginfo-0:2.0.46-68.ent.s390x", product: { name: "httpd-debuginfo-0:2.0.46-68.ent.s390x", product_id: "httpd-debuginfo-0:2.0.46-68.ent.s390x", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-debuginfo@2.0.46-68.ent?arch=s390x", }, }, }, ], category: "architecture", name: "s390x", }, { branches: [ { category: "product_version", name: "httpd-manual-0:2.0.52-32.3.ent.s390", product: { name: "httpd-manual-0:2.0.52-32.3.ent.s390", product_id: "httpd-manual-0:2.0.52-32.3.ent.s390", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-manual@2.0.52-32.3.ent?arch=s390", }, }, }, { category: "product_version", name: "mod_ssl-1:2.0.52-32.3.ent.s390", product: { name: "mod_ssl-1:2.0.52-32.3.ent.s390", product_id: "mod_ssl-1:2.0.52-32.3.ent.s390", product_identification_helper: { purl: "pkg:rpm/redhat/mod_ssl@2.0.52-32.3.ent?arch=s390&epoch=1", }, }, }, { category: "product_version", name: "httpd-suexec-0:2.0.52-32.3.ent.s390", product: { name: "httpd-suexec-0:2.0.52-32.3.ent.s390", product_id: "httpd-suexec-0:2.0.52-32.3.ent.s390", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-suexec@2.0.52-32.3.ent?arch=s390", }, }, }, { category: "product_version", name: "httpd-debuginfo-0:2.0.52-32.3.ent.s390", product: { name: "httpd-debuginfo-0:2.0.52-32.3.ent.s390", product_id: "httpd-debuginfo-0:2.0.52-32.3.ent.s390", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-debuginfo@2.0.52-32.3.ent?arch=s390", }, }, }, { category: "product_version", name: "httpd-devel-0:2.0.52-32.3.ent.s390", product: { name: "httpd-devel-0:2.0.52-32.3.ent.s390", product_id: "httpd-devel-0:2.0.52-32.3.ent.s390", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-devel@2.0.52-32.3.ent?arch=s390", }, }, }, { category: "product_version", name: "httpd-0:2.0.52-32.3.ent.s390", product: { name: "httpd-0:2.0.52-32.3.ent.s390", product_id: "httpd-0:2.0.52-32.3.ent.s390", product_identification_helper: { purl: "pkg:rpm/redhat/httpd@2.0.52-32.3.ent?arch=s390", }, }, }, { category: "product_version", name: "httpd-0:2.0.46-68.ent.s390", product: { name: "httpd-0:2.0.46-68.ent.s390", product_id: "httpd-0:2.0.46-68.ent.s390", product_identification_helper: { purl: "pkg:rpm/redhat/httpd@2.0.46-68.ent?arch=s390", }, }, }, { category: "product_version", name: "mod_ssl-1:2.0.46-68.ent.s390", product: { name: "mod_ssl-1:2.0.46-68.ent.s390", product_id: "mod_ssl-1:2.0.46-68.ent.s390", product_identification_helper: { purl: "pkg:rpm/redhat/mod_ssl@2.0.46-68.ent?arch=s390&epoch=1", }, }, }, { category: "product_version", name: "httpd-devel-0:2.0.46-68.ent.s390", product: { name: "httpd-devel-0:2.0.46-68.ent.s390", product_id: "httpd-devel-0:2.0.46-68.ent.s390", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-devel@2.0.46-68.ent?arch=s390", }, }, }, { category: "product_version", name: "httpd-debuginfo-0:2.0.46-68.ent.s390", product: { name: "httpd-debuginfo-0:2.0.46-68.ent.s390", product_id: "httpd-debuginfo-0:2.0.46-68.ent.s390", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-debuginfo@2.0.46-68.ent?arch=s390", }, }, }, ], category: "architecture", name: "s390", }, ], category: "vendor", name: "Red Hat", }, ], relationships: [ { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.46-68.ent.i386 as a component of Red Hat Enterprise Linux AS version 3", product_id: "3AS:httpd-0:2.0.46-68.ent.i386", }, product_reference: "httpd-0:2.0.46-68.ent.i386", relates_to_product_reference: "3AS", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.46-68.ent.ia64 as a component of Red Hat Enterprise Linux AS version 3", product_id: "3AS:httpd-0:2.0.46-68.ent.ia64", }, product_reference: "httpd-0:2.0.46-68.ent.ia64", relates_to_product_reference: "3AS", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.46-68.ent.ppc as a component of Red Hat Enterprise Linux AS version 3", product_id: "3AS:httpd-0:2.0.46-68.ent.ppc", }, product_reference: "httpd-0:2.0.46-68.ent.ppc", relates_to_product_reference: "3AS", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.46-68.ent.s390 as a component of Red Hat Enterprise Linux AS version 3", product_id: "3AS:httpd-0:2.0.46-68.ent.s390", }, product_reference: "httpd-0:2.0.46-68.ent.s390", relates_to_product_reference: "3AS", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.46-68.ent.s390x as a component of Red Hat Enterprise Linux AS version 3", product_id: "3AS:httpd-0:2.0.46-68.ent.s390x", }, product_reference: "httpd-0:2.0.46-68.ent.s390x", relates_to_product_reference: "3AS", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.46-68.ent.src as a component of Red Hat Enterprise Linux AS version 3", product_id: "3AS:httpd-0:2.0.46-68.ent.src", }, product_reference: "httpd-0:2.0.46-68.ent.src", relates_to_product_reference: "3AS", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.46-68.ent.x86_64 as a component of Red Hat Enterprise Linux AS version 3", product_id: "3AS:httpd-0:2.0.46-68.ent.x86_64", }, product_reference: "httpd-0:2.0.46-68.ent.x86_64", relates_to_product_reference: "3AS", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.46-68.ent.i386 as a component of Red Hat Enterprise Linux AS version 3", product_id: "3AS:httpd-debuginfo-0:2.0.46-68.ent.i386", }, product_reference: "httpd-debuginfo-0:2.0.46-68.ent.i386", relates_to_product_reference: "3AS", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.46-68.ent.ia64 as a component of Red Hat Enterprise Linux AS version 3", product_id: "3AS:httpd-debuginfo-0:2.0.46-68.ent.ia64", }, product_reference: "httpd-debuginfo-0:2.0.46-68.ent.ia64", relates_to_product_reference: "3AS", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.46-68.ent.ppc as a component of Red Hat Enterprise Linux AS version 3", product_id: "3AS:httpd-debuginfo-0:2.0.46-68.ent.ppc", }, product_reference: "httpd-debuginfo-0:2.0.46-68.ent.ppc", relates_to_product_reference: "3AS", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.46-68.ent.s390 as a component of Red Hat Enterprise Linux AS version 3", product_id: "3AS:httpd-debuginfo-0:2.0.46-68.ent.s390", }, product_reference: "httpd-debuginfo-0:2.0.46-68.ent.s390", relates_to_product_reference: "3AS", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.46-68.ent.s390x as a component of Red Hat Enterprise Linux AS version 3", product_id: "3AS:httpd-debuginfo-0:2.0.46-68.ent.s390x", }, product_reference: "httpd-debuginfo-0:2.0.46-68.ent.s390x", relates_to_product_reference: "3AS", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.46-68.ent.x86_64 as a component of Red Hat Enterprise Linux AS version 3", product_id: "3AS:httpd-debuginfo-0:2.0.46-68.ent.x86_64", }, product_reference: "httpd-debuginfo-0:2.0.46-68.ent.x86_64", relates_to_product_reference: "3AS", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.46-68.ent.i386 as a component of Red Hat Enterprise Linux AS version 3", product_id: "3AS:httpd-devel-0:2.0.46-68.ent.i386", }, product_reference: "httpd-devel-0:2.0.46-68.ent.i386", relates_to_product_reference: "3AS", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.46-68.ent.ia64 as a component of Red Hat Enterprise Linux AS version 3", product_id: "3AS:httpd-devel-0:2.0.46-68.ent.ia64", }, product_reference: "httpd-devel-0:2.0.46-68.ent.ia64", relates_to_product_reference: "3AS", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.46-68.ent.ppc as a component of Red Hat Enterprise Linux AS version 3", product_id: "3AS:httpd-devel-0:2.0.46-68.ent.ppc", }, product_reference: "httpd-devel-0:2.0.46-68.ent.ppc", relates_to_product_reference: "3AS", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.46-68.ent.s390 as a component of Red Hat Enterprise Linux AS version 3", product_id: "3AS:httpd-devel-0:2.0.46-68.ent.s390", }, product_reference: "httpd-devel-0:2.0.46-68.ent.s390", relates_to_product_reference: "3AS", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.46-68.ent.s390x as a component of Red Hat Enterprise Linux AS version 3", product_id: "3AS:httpd-devel-0:2.0.46-68.ent.s390x", }, product_reference: "httpd-devel-0:2.0.46-68.ent.s390x", relates_to_product_reference: "3AS", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.46-68.ent.x86_64 as a component of Red Hat Enterprise Linux AS version 3", product_id: "3AS:httpd-devel-0:2.0.46-68.ent.x86_64", }, product_reference: "httpd-devel-0:2.0.46-68.ent.x86_64", relates_to_product_reference: "3AS", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.46-68.ent.i386 as a component of Red Hat Enterprise Linux AS version 3", product_id: "3AS:mod_ssl-1:2.0.46-68.ent.i386", }, product_reference: "mod_ssl-1:2.0.46-68.ent.i386", relates_to_product_reference: "3AS", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.46-68.ent.ia64 as a component of Red Hat Enterprise Linux AS version 3", product_id: "3AS:mod_ssl-1:2.0.46-68.ent.ia64", }, product_reference: "mod_ssl-1:2.0.46-68.ent.ia64", relates_to_product_reference: "3AS", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.46-68.ent.ppc as a component of Red Hat Enterprise Linux AS version 3", product_id: "3AS:mod_ssl-1:2.0.46-68.ent.ppc", }, product_reference: "mod_ssl-1:2.0.46-68.ent.ppc", relates_to_product_reference: "3AS", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.46-68.ent.s390 as a component of Red Hat Enterprise Linux AS version 3", product_id: "3AS:mod_ssl-1:2.0.46-68.ent.s390", }, product_reference: "mod_ssl-1:2.0.46-68.ent.s390", relates_to_product_reference: "3AS", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.46-68.ent.s390x as a component of Red Hat Enterprise Linux AS version 3", product_id: "3AS:mod_ssl-1:2.0.46-68.ent.s390x", }, product_reference: "mod_ssl-1:2.0.46-68.ent.s390x", relates_to_product_reference: "3AS", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.46-68.ent.x86_64 as a component of Red Hat Enterprise Linux AS version 3", product_id: "3AS:mod_ssl-1:2.0.46-68.ent.x86_64", }, product_reference: "mod_ssl-1:2.0.46-68.ent.x86_64", relates_to_product_reference: "3AS", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.46-68.ent.i386 as a component of Red Hat Desktop version 3", product_id: "3Desktop:httpd-0:2.0.46-68.ent.i386", }, product_reference: "httpd-0:2.0.46-68.ent.i386", relates_to_product_reference: "3Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.46-68.ent.ia64 as a component of Red Hat Desktop version 3", product_id: "3Desktop:httpd-0:2.0.46-68.ent.ia64", }, product_reference: "httpd-0:2.0.46-68.ent.ia64", relates_to_product_reference: "3Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.46-68.ent.ppc as a component of Red Hat Desktop version 3", product_id: "3Desktop:httpd-0:2.0.46-68.ent.ppc", }, product_reference: "httpd-0:2.0.46-68.ent.ppc", relates_to_product_reference: "3Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.46-68.ent.s390 as a component of Red Hat Desktop version 3", product_id: "3Desktop:httpd-0:2.0.46-68.ent.s390", }, product_reference: "httpd-0:2.0.46-68.ent.s390", relates_to_product_reference: "3Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.46-68.ent.s390x as a component of Red Hat Desktop version 3", product_id: "3Desktop:httpd-0:2.0.46-68.ent.s390x", }, product_reference: "httpd-0:2.0.46-68.ent.s390x", relates_to_product_reference: "3Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.46-68.ent.src as a component of Red Hat Desktop version 3", product_id: "3Desktop:httpd-0:2.0.46-68.ent.src", }, product_reference: "httpd-0:2.0.46-68.ent.src", relates_to_product_reference: "3Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.46-68.ent.x86_64 as a component of Red Hat Desktop version 3", product_id: "3Desktop:httpd-0:2.0.46-68.ent.x86_64", }, product_reference: "httpd-0:2.0.46-68.ent.x86_64", relates_to_product_reference: "3Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.46-68.ent.i386 as a component of Red Hat Desktop version 3", product_id: "3Desktop:httpd-debuginfo-0:2.0.46-68.ent.i386", }, product_reference: "httpd-debuginfo-0:2.0.46-68.ent.i386", relates_to_product_reference: "3Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.46-68.ent.ia64 as a component of Red Hat Desktop version 3", product_id: "3Desktop:httpd-debuginfo-0:2.0.46-68.ent.ia64", }, product_reference: "httpd-debuginfo-0:2.0.46-68.ent.ia64", relates_to_product_reference: "3Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.46-68.ent.ppc as a component of Red Hat Desktop version 3", product_id: "3Desktop:httpd-debuginfo-0:2.0.46-68.ent.ppc", }, product_reference: "httpd-debuginfo-0:2.0.46-68.ent.ppc", relates_to_product_reference: "3Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.46-68.ent.s390 as a component of Red Hat Desktop version 3", product_id: "3Desktop:httpd-debuginfo-0:2.0.46-68.ent.s390", }, product_reference: "httpd-debuginfo-0:2.0.46-68.ent.s390", relates_to_product_reference: "3Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.46-68.ent.s390x as a component of Red Hat Desktop version 3", product_id: "3Desktop:httpd-debuginfo-0:2.0.46-68.ent.s390x", }, product_reference: "httpd-debuginfo-0:2.0.46-68.ent.s390x", relates_to_product_reference: "3Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.46-68.ent.x86_64 as a component of Red Hat Desktop version 3", product_id: "3Desktop:httpd-debuginfo-0:2.0.46-68.ent.x86_64", }, product_reference: "httpd-debuginfo-0:2.0.46-68.ent.x86_64", relates_to_product_reference: "3Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.46-68.ent.i386 as a component of Red Hat Desktop version 3", product_id: "3Desktop:httpd-devel-0:2.0.46-68.ent.i386", }, product_reference: "httpd-devel-0:2.0.46-68.ent.i386", relates_to_product_reference: "3Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.46-68.ent.ia64 as a component of Red Hat Desktop version 3", product_id: "3Desktop:httpd-devel-0:2.0.46-68.ent.ia64", }, product_reference: "httpd-devel-0:2.0.46-68.ent.ia64", relates_to_product_reference: "3Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.46-68.ent.ppc as a component of Red Hat Desktop version 3", product_id: "3Desktop:httpd-devel-0:2.0.46-68.ent.ppc", }, product_reference: "httpd-devel-0:2.0.46-68.ent.ppc", relates_to_product_reference: "3Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.46-68.ent.s390 as a component of Red Hat Desktop version 3", product_id: "3Desktop:httpd-devel-0:2.0.46-68.ent.s390", }, product_reference: "httpd-devel-0:2.0.46-68.ent.s390", relates_to_product_reference: "3Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.46-68.ent.s390x as a component of Red Hat Desktop version 3", product_id: "3Desktop:httpd-devel-0:2.0.46-68.ent.s390x", }, product_reference: "httpd-devel-0:2.0.46-68.ent.s390x", relates_to_product_reference: "3Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.46-68.ent.x86_64 as a component of Red Hat Desktop version 3", product_id: "3Desktop:httpd-devel-0:2.0.46-68.ent.x86_64", }, product_reference: "httpd-devel-0:2.0.46-68.ent.x86_64", relates_to_product_reference: "3Desktop", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.46-68.ent.i386 as a component of Red Hat Desktop version 3", product_id: "3Desktop:mod_ssl-1:2.0.46-68.ent.i386", }, product_reference: "mod_ssl-1:2.0.46-68.ent.i386", relates_to_product_reference: "3Desktop", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.46-68.ent.ia64 as a component of Red Hat Desktop version 3", product_id: "3Desktop:mod_ssl-1:2.0.46-68.ent.ia64", }, product_reference: "mod_ssl-1:2.0.46-68.ent.ia64", relates_to_product_reference: "3Desktop", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.46-68.ent.ppc as a component of Red Hat Desktop version 3", product_id: "3Desktop:mod_ssl-1:2.0.46-68.ent.ppc", }, product_reference: "mod_ssl-1:2.0.46-68.ent.ppc", relates_to_product_reference: "3Desktop", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.46-68.ent.s390 as a component of Red Hat Desktop version 3", product_id: "3Desktop:mod_ssl-1:2.0.46-68.ent.s390", }, product_reference: "mod_ssl-1:2.0.46-68.ent.s390", relates_to_product_reference: "3Desktop", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.46-68.ent.s390x as a component of Red Hat Desktop version 3", product_id: "3Desktop:mod_ssl-1:2.0.46-68.ent.s390x", }, product_reference: "mod_ssl-1:2.0.46-68.ent.s390x", relates_to_product_reference: "3Desktop", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.46-68.ent.x86_64 as a component of Red Hat Desktop version 3", product_id: "3Desktop:mod_ssl-1:2.0.46-68.ent.x86_64", }, product_reference: "mod_ssl-1:2.0.46-68.ent.x86_64", relates_to_product_reference: "3Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.46-68.ent.i386 as a component of Red Hat Enterprise Linux ES version 3", product_id: "3ES:httpd-0:2.0.46-68.ent.i386", }, product_reference: "httpd-0:2.0.46-68.ent.i386", relates_to_product_reference: "3ES", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.46-68.ent.ia64 as a component of Red Hat Enterprise Linux ES version 3", product_id: "3ES:httpd-0:2.0.46-68.ent.ia64", }, product_reference: "httpd-0:2.0.46-68.ent.ia64", relates_to_product_reference: "3ES", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.46-68.ent.ppc as a component of Red Hat Enterprise Linux ES version 3", product_id: "3ES:httpd-0:2.0.46-68.ent.ppc", }, product_reference: "httpd-0:2.0.46-68.ent.ppc", relates_to_product_reference: "3ES", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.46-68.ent.s390 as a component of Red Hat Enterprise Linux ES version 3", product_id: "3ES:httpd-0:2.0.46-68.ent.s390", }, product_reference: "httpd-0:2.0.46-68.ent.s390", relates_to_product_reference: "3ES", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.46-68.ent.s390x as a component of Red Hat Enterprise Linux ES version 3", product_id: "3ES:httpd-0:2.0.46-68.ent.s390x", }, product_reference: "httpd-0:2.0.46-68.ent.s390x", relates_to_product_reference: "3ES", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.46-68.ent.src as a component of Red Hat Enterprise Linux ES version 3", product_id: "3ES:httpd-0:2.0.46-68.ent.src", }, product_reference: "httpd-0:2.0.46-68.ent.src", relates_to_product_reference: "3ES", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.46-68.ent.x86_64 as a component of Red Hat Enterprise Linux ES version 3", product_id: "3ES:httpd-0:2.0.46-68.ent.x86_64", }, product_reference: "httpd-0:2.0.46-68.ent.x86_64", relates_to_product_reference: "3ES", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.46-68.ent.i386 as a component of Red Hat Enterprise Linux ES version 3", product_id: "3ES:httpd-debuginfo-0:2.0.46-68.ent.i386", }, product_reference: "httpd-debuginfo-0:2.0.46-68.ent.i386", relates_to_product_reference: "3ES", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.46-68.ent.ia64 as a component of Red Hat Enterprise Linux ES version 3", product_id: "3ES:httpd-debuginfo-0:2.0.46-68.ent.ia64", }, product_reference: "httpd-debuginfo-0:2.0.46-68.ent.ia64", relates_to_product_reference: "3ES", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.46-68.ent.ppc as a component of Red Hat Enterprise Linux ES version 3", product_id: "3ES:httpd-debuginfo-0:2.0.46-68.ent.ppc", }, product_reference: "httpd-debuginfo-0:2.0.46-68.ent.ppc", relates_to_product_reference: "3ES", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.46-68.ent.s390 as a component of Red Hat Enterprise Linux ES version 3", product_id: "3ES:httpd-debuginfo-0:2.0.46-68.ent.s390", }, product_reference: "httpd-debuginfo-0:2.0.46-68.ent.s390", relates_to_product_reference: "3ES", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.46-68.ent.s390x as a component of Red Hat Enterprise Linux ES version 3", product_id: "3ES:httpd-debuginfo-0:2.0.46-68.ent.s390x", }, product_reference: "httpd-debuginfo-0:2.0.46-68.ent.s390x", relates_to_product_reference: "3ES", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.46-68.ent.x86_64 as a component of Red Hat Enterprise Linux ES version 3", product_id: "3ES:httpd-debuginfo-0:2.0.46-68.ent.x86_64", }, product_reference: "httpd-debuginfo-0:2.0.46-68.ent.x86_64", relates_to_product_reference: "3ES", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.46-68.ent.i386 as a component of Red Hat Enterprise Linux ES version 3", product_id: "3ES:httpd-devel-0:2.0.46-68.ent.i386", }, product_reference: "httpd-devel-0:2.0.46-68.ent.i386", relates_to_product_reference: "3ES", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.46-68.ent.ia64 as a component of Red Hat Enterprise Linux ES version 3", product_id: "3ES:httpd-devel-0:2.0.46-68.ent.ia64", }, product_reference: "httpd-devel-0:2.0.46-68.ent.ia64", relates_to_product_reference: "3ES", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.46-68.ent.ppc as a component of Red Hat Enterprise Linux ES version 3", product_id: "3ES:httpd-devel-0:2.0.46-68.ent.ppc", }, product_reference: "httpd-devel-0:2.0.46-68.ent.ppc", relates_to_product_reference: "3ES", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.46-68.ent.s390 as a component of Red Hat Enterprise Linux ES version 3", product_id: "3ES:httpd-devel-0:2.0.46-68.ent.s390", }, product_reference: "httpd-devel-0:2.0.46-68.ent.s390", relates_to_product_reference: "3ES", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.46-68.ent.s390x as a component of Red Hat Enterprise Linux ES version 3", product_id: "3ES:httpd-devel-0:2.0.46-68.ent.s390x", }, product_reference: "httpd-devel-0:2.0.46-68.ent.s390x", relates_to_product_reference: "3ES", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.46-68.ent.x86_64 as a component of Red Hat Enterprise Linux ES version 3", product_id: "3ES:httpd-devel-0:2.0.46-68.ent.x86_64", }, product_reference: "httpd-devel-0:2.0.46-68.ent.x86_64", relates_to_product_reference: "3ES", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.46-68.ent.i386 as a component of Red Hat Enterprise Linux ES version 3", product_id: "3ES:mod_ssl-1:2.0.46-68.ent.i386", }, product_reference: "mod_ssl-1:2.0.46-68.ent.i386", relates_to_product_reference: "3ES", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.46-68.ent.ia64 as a component of Red Hat Enterprise Linux ES version 3", product_id: "3ES:mod_ssl-1:2.0.46-68.ent.ia64", }, product_reference: "mod_ssl-1:2.0.46-68.ent.ia64", relates_to_product_reference: "3ES", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.46-68.ent.ppc as a component of Red Hat Enterprise Linux ES version 3", product_id: "3ES:mod_ssl-1:2.0.46-68.ent.ppc", }, product_reference: "mod_ssl-1:2.0.46-68.ent.ppc", relates_to_product_reference: "3ES", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.46-68.ent.s390 as a component of Red Hat Enterprise Linux ES version 3", product_id: "3ES:mod_ssl-1:2.0.46-68.ent.s390", }, product_reference: "mod_ssl-1:2.0.46-68.ent.s390", relates_to_product_reference: "3ES", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.46-68.ent.s390x as a component of Red Hat Enterprise Linux ES version 3", product_id: "3ES:mod_ssl-1:2.0.46-68.ent.s390x", }, product_reference: "mod_ssl-1:2.0.46-68.ent.s390x", relates_to_product_reference: "3ES", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.46-68.ent.x86_64 as a component of Red Hat Enterprise Linux ES version 3", product_id: "3ES:mod_ssl-1:2.0.46-68.ent.x86_64", }, product_reference: "mod_ssl-1:2.0.46-68.ent.x86_64", relates_to_product_reference: "3ES", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.46-68.ent.i386 as a component of Red Hat Enterprise Linux WS version 3", product_id: "3WS:httpd-0:2.0.46-68.ent.i386", }, product_reference: "httpd-0:2.0.46-68.ent.i386", relates_to_product_reference: "3WS", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.46-68.ent.ia64 as a component of Red Hat Enterprise Linux WS version 3", product_id: "3WS:httpd-0:2.0.46-68.ent.ia64", }, product_reference: "httpd-0:2.0.46-68.ent.ia64", relates_to_product_reference: "3WS", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.46-68.ent.ppc as a component of Red Hat Enterprise Linux WS version 3", product_id: "3WS:httpd-0:2.0.46-68.ent.ppc", }, product_reference: "httpd-0:2.0.46-68.ent.ppc", relates_to_product_reference: "3WS", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.46-68.ent.s390 as a component of Red Hat Enterprise Linux WS version 3", product_id: "3WS:httpd-0:2.0.46-68.ent.s390", }, product_reference: "httpd-0:2.0.46-68.ent.s390", relates_to_product_reference: "3WS", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.46-68.ent.s390x as a component of Red Hat Enterprise Linux WS version 3", product_id: "3WS:httpd-0:2.0.46-68.ent.s390x", }, product_reference: "httpd-0:2.0.46-68.ent.s390x", relates_to_product_reference: "3WS", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.46-68.ent.src as a component of Red Hat Enterprise Linux WS version 3", product_id: "3WS:httpd-0:2.0.46-68.ent.src", }, product_reference: "httpd-0:2.0.46-68.ent.src", relates_to_product_reference: "3WS", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.46-68.ent.x86_64 as a component of Red Hat Enterprise Linux WS version 3", product_id: "3WS:httpd-0:2.0.46-68.ent.x86_64", }, product_reference: "httpd-0:2.0.46-68.ent.x86_64", relates_to_product_reference: "3WS", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.46-68.ent.i386 as a component of Red Hat Enterprise Linux WS version 3", product_id: "3WS:httpd-debuginfo-0:2.0.46-68.ent.i386", }, product_reference: "httpd-debuginfo-0:2.0.46-68.ent.i386", relates_to_product_reference: "3WS", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.46-68.ent.ia64 as a component of Red Hat Enterprise Linux WS version 3", product_id: "3WS:httpd-debuginfo-0:2.0.46-68.ent.ia64", }, product_reference: "httpd-debuginfo-0:2.0.46-68.ent.ia64", relates_to_product_reference: "3WS", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.46-68.ent.ppc as a component of Red Hat Enterprise Linux WS version 3", product_id: "3WS:httpd-debuginfo-0:2.0.46-68.ent.ppc", }, product_reference: "httpd-debuginfo-0:2.0.46-68.ent.ppc", relates_to_product_reference: "3WS", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.46-68.ent.s390 as a component of Red Hat Enterprise Linux WS version 3", product_id: "3WS:httpd-debuginfo-0:2.0.46-68.ent.s390", }, product_reference: "httpd-debuginfo-0:2.0.46-68.ent.s390", relates_to_product_reference: "3WS", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.46-68.ent.s390x as a component of Red Hat Enterprise Linux WS version 3", product_id: "3WS:httpd-debuginfo-0:2.0.46-68.ent.s390x", }, product_reference: "httpd-debuginfo-0:2.0.46-68.ent.s390x", relates_to_product_reference: "3WS", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.46-68.ent.x86_64 as a component of Red Hat Enterprise Linux WS version 3", product_id: "3WS:httpd-debuginfo-0:2.0.46-68.ent.x86_64", }, product_reference: "httpd-debuginfo-0:2.0.46-68.ent.x86_64", relates_to_product_reference: "3WS", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.46-68.ent.i386 as a component of Red Hat Enterprise Linux WS version 3", product_id: "3WS:httpd-devel-0:2.0.46-68.ent.i386", }, product_reference: "httpd-devel-0:2.0.46-68.ent.i386", relates_to_product_reference: "3WS", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.46-68.ent.ia64 as a component of Red Hat Enterprise Linux WS version 3", product_id: "3WS:httpd-devel-0:2.0.46-68.ent.ia64", }, product_reference: "httpd-devel-0:2.0.46-68.ent.ia64", relates_to_product_reference: "3WS", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.46-68.ent.ppc as a component of Red Hat Enterprise Linux WS version 3", product_id: "3WS:httpd-devel-0:2.0.46-68.ent.ppc", }, product_reference: "httpd-devel-0:2.0.46-68.ent.ppc", relates_to_product_reference: "3WS", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.46-68.ent.s390 as a component of Red Hat Enterprise Linux WS version 3", product_id: "3WS:httpd-devel-0:2.0.46-68.ent.s390", }, product_reference: "httpd-devel-0:2.0.46-68.ent.s390", relates_to_product_reference: "3WS", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.46-68.ent.s390x as a component of Red Hat Enterprise Linux WS version 3", product_id: "3WS:httpd-devel-0:2.0.46-68.ent.s390x", }, product_reference: "httpd-devel-0:2.0.46-68.ent.s390x", relates_to_product_reference: "3WS", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.46-68.ent.x86_64 as a component of Red Hat Enterprise Linux WS version 3", product_id: "3WS:httpd-devel-0:2.0.46-68.ent.x86_64", }, product_reference: "httpd-devel-0:2.0.46-68.ent.x86_64", relates_to_product_reference: "3WS", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.46-68.ent.i386 as a component of Red Hat Enterprise Linux WS version 3", product_id: "3WS:mod_ssl-1:2.0.46-68.ent.i386", }, product_reference: "mod_ssl-1:2.0.46-68.ent.i386", relates_to_product_reference: "3WS", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.46-68.ent.ia64 as a component of Red Hat Enterprise Linux WS version 3", product_id: "3WS:mod_ssl-1:2.0.46-68.ent.ia64", }, product_reference: "mod_ssl-1:2.0.46-68.ent.ia64", relates_to_product_reference: "3WS", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.46-68.ent.ppc as a component of Red Hat Enterprise Linux WS version 3", product_id: "3WS:mod_ssl-1:2.0.46-68.ent.ppc", }, product_reference: "mod_ssl-1:2.0.46-68.ent.ppc", relates_to_product_reference: "3WS", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.46-68.ent.s390 as a component of Red Hat Enterprise Linux WS version 3", product_id: "3WS:mod_ssl-1:2.0.46-68.ent.s390", }, product_reference: "mod_ssl-1:2.0.46-68.ent.s390", relates_to_product_reference: "3WS", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.46-68.ent.s390x as a component of Red Hat Enterprise Linux WS version 3", product_id: "3WS:mod_ssl-1:2.0.46-68.ent.s390x", }, product_reference: "mod_ssl-1:2.0.46-68.ent.s390x", relates_to_product_reference: "3WS", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.46-68.ent.x86_64 as a component of Red Hat Enterprise Linux WS version 3", product_id: "3WS:mod_ssl-1:2.0.46-68.ent.x86_64", }, product_reference: "mod_ssl-1:2.0.46-68.ent.x86_64", relates_to_product_reference: "3WS", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.52-32.3.ent.i386 as a component of Red Hat Enterprise Linux AS version 4", product_id: "4AS:httpd-0:2.0.52-32.3.ent.i386", }, product_reference: "httpd-0:2.0.52-32.3.ent.i386", relates_to_product_reference: "4AS", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.52-32.3.ent.ia64 as a component of Red Hat Enterprise Linux AS version 4", product_id: "4AS:httpd-0:2.0.52-32.3.ent.ia64", }, product_reference: "httpd-0:2.0.52-32.3.ent.ia64", relates_to_product_reference: "4AS", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.52-32.3.ent.ppc as a component of Red Hat Enterprise Linux AS version 4", product_id: "4AS:httpd-0:2.0.52-32.3.ent.ppc", }, product_reference: "httpd-0:2.0.52-32.3.ent.ppc", relates_to_product_reference: "4AS", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.52-32.3.ent.s390 as a component of Red Hat Enterprise Linux AS version 4", product_id: "4AS:httpd-0:2.0.52-32.3.ent.s390", }, product_reference: "httpd-0:2.0.52-32.3.ent.s390", relates_to_product_reference: "4AS", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.52-32.3.ent.s390x as a component of Red Hat Enterprise Linux AS version 4", product_id: "4AS:httpd-0:2.0.52-32.3.ent.s390x", }, product_reference: "httpd-0:2.0.52-32.3.ent.s390x", relates_to_product_reference: "4AS", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.52-32.3.ent.src as a component of Red Hat Enterprise Linux AS version 4", product_id: "4AS:httpd-0:2.0.52-32.3.ent.src", }, product_reference: "httpd-0:2.0.52-32.3.ent.src", relates_to_product_reference: "4AS", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.52-32.3.ent.x86_64 as a component of Red Hat Enterprise Linux AS version 4", product_id: "4AS:httpd-0:2.0.52-32.3.ent.x86_64", }, product_reference: "httpd-0:2.0.52-32.3.ent.x86_64", relates_to_product_reference: "4AS", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.52-32.3.ent.i386 as a component of Red Hat Enterprise Linux AS version 4", product_id: "4AS:httpd-debuginfo-0:2.0.52-32.3.ent.i386", }, product_reference: "httpd-debuginfo-0:2.0.52-32.3.ent.i386", relates_to_product_reference: "4AS", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.52-32.3.ent.ia64 as a component of Red Hat Enterprise Linux AS version 4", product_id: "4AS:httpd-debuginfo-0:2.0.52-32.3.ent.ia64", }, product_reference: "httpd-debuginfo-0:2.0.52-32.3.ent.ia64", relates_to_product_reference: "4AS", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.52-32.3.ent.ppc as a component of Red Hat Enterprise Linux AS version 4", product_id: "4AS:httpd-debuginfo-0:2.0.52-32.3.ent.ppc", }, product_reference: "httpd-debuginfo-0:2.0.52-32.3.ent.ppc", relates_to_product_reference: "4AS", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.52-32.3.ent.s390 as a component of Red Hat Enterprise Linux AS version 4", product_id: "4AS:httpd-debuginfo-0:2.0.52-32.3.ent.s390", }, product_reference: "httpd-debuginfo-0:2.0.52-32.3.ent.s390", relates_to_product_reference: "4AS", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.52-32.3.ent.s390x as a component of Red Hat Enterprise Linux AS version 4", product_id: "4AS:httpd-debuginfo-0:2.0.52-32.3.ent.s390x", }, product_reference: "httpd-debuginfo-0:2.0.52-32.3.ent.s390x", relates_to_product_reference: "4AS", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.52-32.3.ent.x86_64 as a component of Red Hat Enterprise Linux AS version 4", product_id: "4AS:httpd-debuginfo-0:2.0.52-32.3.ent.x86_64", }, product_reference: "httpd-debuginfo-0:2.0.52-32.3.ent.x86_64", relates_to_product_reference: "4AS", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.52-32.3.ent.i386 as a component of Red Hat Enterprise Linux AS version 4", product_id: "4AS:httpd-devel-0:2.0.52-32.3.ent.i386", }, product_reference: "httpd-devel-0:2.0.52-32.3.ent.i386", relates_to_product_reference: "4AS", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.52-32.3.ent.ia64 as a component of Red Hat Enterprise Linux AS version 4", product_id: "4AS:httpd-devel-0:2.0.52-32.3.ent.ia64", }, product_reference: "httpd-devel-0:2.0.52-32.3.ent.ia64", relates_to_product_reference: "4AS", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.52-32.3.ent.ppc as a component of Red Hat Enterprise Linux AS version 4", product_id: "4AS:httpd-devel-0:2.0.52-32.3.ent.ppc", }, product_reference: "httpd-devel-0:2.0.52-32.3.ent.ppc", relates_to_product_reference: "4AS", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.52-32.3.ent.s390 as a component of Red Hat Enterprise Linux AS version 4", product_id: "4AS:httpd-devel-0:2.0.52-32.3.ent.s390", }, product_reference: "httpd-devel-0:2.0.52-32.3.ent.s390", relates_to_product_reference: "4AS", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.52-32.3.ent.s390x as a component of Red Hat Enterprise Linux AS version 4", product_id: "4AS:httpd-devel-0:2.0.52-32.3.ent.s390x", }, product_reference: "httpd-devel-0:2.0.52-32.3.ent.s390x", relates_to_product_reference: "4AS", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.52-32.3.ent.x86_64 as a component of Red Hat Enterprise Linux AS version 4", product_id: "4AS:httpd-devel-0:2.0.52-32.3.ent.x86_64", }, product_reference: "httpd-devel-0:2.0.52-32.3.ent.x86_64", relates_to_product_reference: "4AS", }, { category: "default_component_of", full_product_name: { name: "httpd-manual-0:2.0.52-32.3.ent.i386 as a component of Red Hat Enterprise Linux AS version 4", product_id: "4AS:httpd-manual-0:2.0.52-32.3.ent.i386", }, product_reference: "httpd-manual-0:2.0.52-32.3.ent.i386", relates_to_product_reference: "4AS", }, { category: "default_component_of", full_product_name: { name: "httpd-manual-0:2.0.52-32.3.ent.ia64 as a component of Red Hat Enterprise Linux AS version 4", product_id: "4AS:httpd-manual-0:2.0.52-32.3.ent.ia64", }, product_reference: "httpd-manual-0:2.0.52-32.3.ent.ia64", relates_to_product_reference: "4AS", }, { category: "default_component_of", full_product_name: { name: "httpd-manual-0:2.0.52-32.3.ent.ppc as a component of Red Hat Enterprise Linux AS version 4", product_id: "4AS:httpd-manual-0:2.0.52-32.3.ent.ppc", }, product_reference: "httpd-manual-0:2.0.52-32.3.ent.ppc", relates_to_product_reference: "4AS", }, { category: "default_component_of", full_product_name: { name: "httpd-manual-0:2.0.52-32.3.ent.s390 as a component of Red Hat Enterprise Linux AS version 4", product_id: "4AS:httpd-manual-0:2.0.52-32.3.ent.s390", }, product_reference: "httpd-manual-0:2.0.52-32.3.ent.s390", relates_to_product_reference: "4AS", }, { category: "default_component_of", full_product_name: { name: "httpd-manual-0:2.0.52-32.3.ent.s390x as a component of Red Hat Enterprise Linux AS version 4", product_id: "4AS:httpd-manual-0:2.0.52-32.3.ent.s390x", }, product_reference: "httpd-manual-0:2.0.52-32.3.ent.s390x", relates_to_product_reference: "4AS", }, { category: "default_component_of", full_product_name: { name: "httpd-manual-0:2.0.52-32.3.ent.x86_64 as a component of Red Hat Enterprise Linux AS version 4", product_id: "4AS:httpd-manual-0:2.0.52-32.3.ent.x86_64", }, product_reference: "httpd-manual-0:2.0.52-32.3.ent.x86_64", relates_to_product_reference: "4AS", }, { category: "default_component_of", full_product_name: { name: "httpd-suexec-0:2.0.52-32.3.ent.i386 as a component of Red Hat Enterprise Linux AS version 4", product_id: "4AS:httpd-suexec-0:2.0.52-32.3.ent.i386", }, product_reference: "httpd-suexec-0:2.0.52-32.3.ent.i386", relates_to_product_reference: "4AS", }, { category: "default_component_of", full_product_name: { name: "httpd-suexec-0:2.0.52-32.3.ent.ia64 as a component of Red Hat Enterprise Linux AS version 4", product_id: "4AS:httpd-suexec-0:2.0.52-32.3.ent.ia64", }, product_reference: "httpd-suexec-0:2.0.52-32.3.ent.ia64", relates_to_product_reference: "4AS", }, { category: "default_component_of", full_product_name: { name: "httpd-suexec-0:2.0.52-32.3.ent.ppc as a component of Red Hat Enterprise Linux AS version 4", product_id: "4AS:httpd-suexec-0:2.0.52-32.3.ent.ppc", }, product_reference: "httpd-suexec-0:2.0.52-32.3.ent.ppc", relates_to_product_reference: "4AS", }, { category: "default_component_of", full_product_name: { name: "httpd-suexec-0:2.0.52-32.3.ent.s390 as a component of Red Hat Enterprise Linux AS version 4", product_id: "4AS:httpd-suexec-0:2.0.52-32.3.ent.s390", }, product_reference: "httpd-suexec-0:2.0.52-32.3.ent.s390", relates_to_product_reference: "4AS", }, { category: "default_component_of", full_product_name: { name: "httpd-suexec-0:2.0.52-32.3.ent.s390x as a component of Red Hat Enterprise Linux AS version 4", product_id: "4AS:httpd-suexec-0:2.0.52-32.3.ent.s390x", }, product_reference: "httpd-suexec-0:2.0.52-32.3.ent.s390x", relates_to_product_reference: "4AS", }, { category: "default_component_of", full_product_name: { name: "httpd-suexec-0:2.0.52-32.3.ent.x86_64 as a component of Red Hat Enterprise Linux AS version 4", product_id: "4AS:httpd-suexec-0:2.0.52-32.3.ent.x86_64", }, product_reference: "httpd-suexec-0:2.0.52-32.3.ent.x86_64", relates_to_product_reference: "4AS", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.52-32.3.ent.i386 as a component of Red Hat Enterprise Linux AS version 4", product_id: "4AS:mod_ssl-1:2.0.52-32.3.ent.i386", }, product_reference: "mod_ssl-1:2.0.52-32.3.ent.i386", relates_to_product_reference: "4AS", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.52-32.3.ent.ia64 as a component of Red Hat Enterprise Linux AS version 4", product_id: "4AS:mod_ssl-1:2.0.52-32.3.ent.ia64", }, product_reference: "mod_ssl-1:2.0.52-32.3.ent.ia64", relates_to_product_reference: "4AS", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.52-32.3.ent.ppc as a component of Red Hat Enterprise Linux AS version 4", product_id: "4AS:mod_ssl-1:2.0.52-32.3.ent.ppc", }, product_reference: "mod_ssl-1:2.0.52-32.3.ent.ppc", relates_to_product_reference: "4AS", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.52-32.3.ent.s390 as a component of Red Hat Enterprise Linux AS version 4", product_id: "4AS:mod_ssl-1:2.0.52-32.3.ent.s390", }, product_reference: "mod_ssl-1:2.0.52-32.3.ent.s390", relates_to_product_reference: "4AS", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.52-32.3.ent.s390x as a component of Red Hat Enterprise Linux AS version 4", product_id: "4AS:mod_ssl-1:2.0.52-32.3.ent.s390x", }, product_reference: "mod_ssl-1:2.0.52-32.3.ent.s390x", relates_to_product_reference: "4AS", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.52-32.3.ent.x86_64 as a component of Red Hat Enterprise Linux AS version 4", product_id: "4AS:mod_ssl-1:2.0.52-32.3.ent.x86_64", }, product_reference: "mod_ssl-1:2.0.52-32.3.ent.x86_64", relates_to_product_reference: "4AS", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.52-32.3.ent.i386 as a component of Red Hat Enterprise Linux Desktop version 4", product_id: "4Desktop:httpd-0:2.0.52-32.3.ent.i386", }, product_reference: "httpd-0:2.0.52-32.3.ent.i386", relates_to_product_reference: "4Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.52-32.3.ent.ia64 as a component of Red Hat Enterprise Linux Desktop version 4", product_id: "4Desktop:httpd-0:2.0.52-32.3.ent.ia64", }, product_reference: "httpd-0:2.0.52-32.3.ent.ia64", relates_to_product_reference: "4Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.52-32.3.ent.ppc as a component of Red Hat Enterprise Linux Desktop version 4", product_id: "4Desktop:httpd-0:2.0.52-32.3.ent.ppc", }, product_reference: "httpd-0:2.0.52-32.3.ent.ppc", relates_to_product_reference: "4Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.52-32.3.ent.s390 as a component of Red Hat Enterprise Linux Desktop version 4", product_id: "4Desktop:httpd-0:2.0.52-32.3.ent.s390", }, product_reference: "httpd-0:2.0.52-32.3.ent.s390", relates_to_product_reference: "4Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.52-32.3.ent.s390x as a component of Red Hat Enterprise Linux Desktop version 4", product_id: "4Desktop:httpd-0:2.0.52-32.3.ent.s390x", }, product_reference: "httpd-0:2.0.52-32.3.ent.s390x", relates_to_product_reference: "4Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.52-32.3.ent.src as a component of Red Hat Enterprise Linux Desktop version 4", product_id: "4Desktop:httpd-0:2.0.52-32.3.ent.src", }, product_reference: "httpd-0:2.0.52-32.3.ent.src", relates_to_product_reference: "4Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.52-32.3.ent.x86_64 as a component of Red Hat Enterprise Linux Desktop version 4", product_id: "4Desktop:httpd-0:2.0.52-32.3.ent.x86_64", }, product_reference: "httpd-0:2.0.52-32.3.ent.x86_64", relates_to_product_reference: "4Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.52-32.3.ent.i386 as a component of Red Hat Enterprise Linux Desktop version 4", product_id: "4Desktop:httpd-debuginfo-0:2.0.52-32.3.ent.i386", }, product_reference: "httpd-debuginfo-0:2.0.52-32.3.ent.i386", relates_to_product_reference: "4Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.52-32.3.ent.ia64 as a component of Red Hat Enterprise Linux Desktop version 4", product_id: "4Desktop:httpd-debuginfo-0:2.0.52-32.3.ent.ia64", }, product_reference: "httpd-debuginfo-0:2.0.52-32.3.ent.ia64", relates_to_product_reference: "4Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.52-32.3.ent.ppc as a component of Red Hat Enterprise Linux Desktop version 4", product_id: "4Desktop:httpd-debuginfo-0:2.0.52-32.3.ent.ppc", }, product_reference: "httpd-debuginfo-0:2.0.52-32.3.ent.ppc", relates_to_product_reference: "4Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.52-32.3.ent.s390 as a component of Red Hat Enterprise Linux Desktop version 4", product_id: "4Desktop:httpd-debuginfo-0:2.0.52-32.3.ent.s390", }, product_reference: "httpd-debuginfo-0:2.0.52-32.3.ent.s390", relates_to_product_reference: "4Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.52-32.3.ent.s390x as a component of Red Hat Enterprise Linux Desktop version 4", product_id: "4Desktop:httpd-debuginfo-0:2.0.52-32.3.ent.s390x", }, product_reference: "httpd-debuginfo-0:2.0.52-32.3.ent.s390x", relates_to_product_reference: "4Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.52-32.3.ent.x86_64 as a component of Red Hat Enterprise Linux Desktop version 4", product_id: "4Desktop:httpd-debuginfo-0:2.0.52-32.3.ent.x86_64", }, product_reference: "httpd-debuginfo-0:2.0.52-32.3.ent.x86_64", relates_to_product_reference: "4Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.52-32.3.ent.i386 as a component of Red Hat Enterprise Linux Desktop version 4", product_id: "4Desktop:httpd-devel-0:2.0.52-32.3.ent.i386", }, product_reference: "httpd-devel-0:2.0.52-32.3.ent.i386", relates_to_product_reference: "4Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.52-32.3.ent.ia64 as a component of Red Hat Enterprise Linux Desktop version 4", product_id: "4Desktop:httpd-devel-0:2.0.52-32.3.ent.ia64", }, product_reference: "httpd-devel-0:2.0.52-32.3.ent.ia64", relates_to_product_reference: "4Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.52-32.3.ent.ppc as a component of Red Hat Enterprise Linux Desktop version 4", product_id: "4Desktop:httpd-devel-0:2.0.52-32.3.ent.ppc", }, product_reference: "httpd-devel-0:2.0.52-32.3.ent.ppc", relates_to_product_reference: "4Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.52-32.3.ent.s390 as a component of Red Hat Enterprise Linux Desktop version 4", product_id: "4Desktop:httpd-devel-0:2.0.52-32.3.ent.s390", }, product_reference: "httpd-devel-0:2.0.52-32.3.ent.s390", relates_to_product_reference: "4Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.52-32.3.ent.s390x as a component of Red Hat Enterprise Linux Desktop version 4", product_id: "4Desktop:httpd-devel-0:2.0.52-32.3.ent.s390x", }, product_reference: "httpd-devel-0:2.0.52-32.3.ent.s390x", relates_to_product_reference: "4Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.52-32.3.ent.x86_64 as a component of Red Hat Enterprise Linux Desktop version 4", product_id: "4Desktop:httpd-devel-0:2.0.52-32.3.ent.x86_64", }, product_reference: "httpd-devel-0:2.0.52-32.3.ent.x86_64", relates_to_product_reference: "4Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-manual-0:2.0.52-32.3.ent.i386 as a component of Red Hat Enterprise Linux Desktop version 4", product_id: "4Desktop:httpd-manual-0:2.0.52-32.3.ent.i386", }, product_reference: "httpd-manual-0:2.0.52-32.3.ent.i386", relates_to_product_reference: "4Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-manual-0:2.0.52-32.3.ent.ia64 as a component of Red Hat Enterprise Linux Desktop version 4", product_id: "4Desktop:httpd-manual-0:2.0.52-32.3.ent.ia64", }, product_reference: "httpd-manual-0:2.0.52-32.3.ent.ia64", relates_to_product_reference: "4Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-manual-0:2.0.52-32.3.ent.ppc as a component of Red Hat Enterprise Linux Desktop version 4", product_id: "4Desktop:httpd-manual-0:2.0.52-32.3.ent.ppc", }, product_reference: "httpd-manual-0:2.0.52-32.3.ent.ppc", relates_to_product_reference: "4Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-manual-0:2.0.52-32.3.ent.s390 as a component of Red Hat Enterprise Linux Desktop version 4", product_id: "4Desktop:httpd-manual-0:2.0.52-32.3.ent.s390", }, product_reference: "httpd-manual-0:2.0.52-32.3.ent.s390", relates_to_product_reference: "4Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-manual-0:2.0.52-32.3.ent.s390x as a component of Red Hat Enterprise Linux Desktop version 4", product_id: "4Desktop:httpd-manual-0:2.0.52-32.3.ent.s390x", }, product_reference: "httpd-manual-0:2.0.52-32.3.ent.s390x", relates_to_product_reference: "4Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-manual-0:2.0.52-32.3.ent.x86_64 as a component of Red Hat Enterprise Linux Desktop version 4", product_id: "4Desktop:httpd-manual-0:2.0.52-32.3.ent.x86_64", }, product_reference: "httpd-manual-0:2.0.52-32.3.ent.x86_64", relates_to_product_reference: "4Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-suexec-0:2.0.52-32.3.ent.i386 as a component of Red Hat Enterprise Linux Desktop version 4", product_id: "4Desktop:httpd-suexec-0:2.0.52-32.3.ent.i386", }, product_reference: "httpd-suexec-0:2.0.52-32.3.ent.i386", relates_to_product_reference: "4Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-suexec-0:2.0.52-32.3.ent.ia64 as a component of Red Hat Enterprise Linux Desktop version 4", product_id: "4Desktop:httpd-suexec-0:2.0.52-32.3.ent.ia64", }, product_reference: "httpd-suexec-0:2.0.52-32.3.ent.ia64", relates_to_product_reference: "4Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-suexec-0:2.0.52-32.3.ent.ppc as a component of Red Hat Enterprise Linux Desktop version 4", product_id: "4Desktop:httpd-suexec-0:2.0.52-32.3.ent.ppc", }, product_reference: "httpd-suexec-0:2.0.52-32.3.ent.ppc", relates_to_product_reference: "4Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-suexec-0:2.0.52-32.3.ent.s390 as a component of Red Hat Enterprise Linux Desktop version 4", product_id: "4Desktop:httpd-suexec-0:2.0.52-32.3.ent.s390", }, product_reference: "httpd-suexec-0:2.0.52-32.3.ent.s390", relates_to_product_reference: "4Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-suexec-0:2.0.52-32.3.ent.s390x as a component of Red Hat Enterprise Linux Desktop version 4", product_id: "4Desktop:httpd-suexec-0:2.0.52-32.3.ent.s390x", }, product_reference: "httpd-suexec-0:2.0.52-32.3.ent.s390x", relates_to_product_reference: "4Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-suexec-0:2.0.52-32.3.ent.x86_64 as a component of Red Hat Enterprise Linux Desktop version 4", product_id: "4Desktop:httpd-suexec-0:2.0.52-32.3.ent.x86_64", }, product_reference: "httpd-suexec-0:2.0.52-32.3.ent.x86_64", relates_to_product_reference: "4Desktop", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.52-32.3.ent.i386 as a component of Red Hat Enterprise Linux Desktop version 4", product_id: "4Desktop:mod_ssl-1:2.0.52-32.3.ent.i386", }, product_reference: "mod_ssl-1:2.0.52-32.3.ent.i386", relates_to_product_reference: "4Desktop", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.52-32.3.ent.ia64 as a component of Red Hat Enterprise Linux Desktop version 4", product_id: "4Desktop:mod_ssl-1:2.0.52-32.3.ent.ia64", }, product_reference: "mod_ssl-1:2.0.52-32.3.ent.ia64", relates_to_product_reference: "4Desktop", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.52-32.3.ent.ppc as a component of Red Hat Enterprise Linux Desktop version 4", product_id: "4Desktop:mod_ssl-1:2.0.52-32.3.ent.ppc", }, product_reference: "mod_ssl-1:2.0.52-32.3.ent.ppc", relates_to_product_reference: "4Desktop", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.52-32.3.ent.s390 as a component of Red Hat Enterprise Linux Desktop version 4", product_id: "4Desktop:mod_ssl-1:2.0.52-32.3.ent.s390", }, product_reference: "mod_ssl-1:2.0.52-32.3.ent.s390", relates_to_product_reference: "4Desktop", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.52-32.3.ent.s390x as a component of Red Hat Enterprise Linux Desktop version 4", product_id: "4Desktop:mod_ssl-1:2.0.52-32.3.ent.s390x", }, product_reference: "mod_ssl-1:2.0.52-32.3.ent.s390x", relates_to_product_reference: "4Desktop", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.52-32.3.ent.x86_64 as a component of Red Hat Enterprise Linux Desktop version 4", product_id: "4Desktop:mod_ssl-1:2.0.52-32.3.ent.x86_64", }, product_reference: "mod_ssl-1:2.0.52-32.3.ent.x86_64", relates_to_product_reference: "4Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.52-32.3.ent.i386 as a component of Red Hat Enterprise Linux ES version 4", product_id: "4ES:httpd-0:2.0.52-32.3.ent.i386", }, product_reference: "httpd-0:2.0.52-32.3.ent.i386", relates_to_product_reference: "4ES", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.52-32.3.ent.ia64 as a component of Red Hat Enterprise Linux ES version 4", product_id: "4ES:httpd-0:2.0.52-32.3.ent.ia64", }, product_reference: "httpd-0:2.0.52-32.3.ent.ia64", relates_to_product_reference: "4ES", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.52-32.3.ent.ppc as a component of Red Hat Enterprise Linux ES version 4", product_id: "4ES:httpd-0:2.0.52-32.3.ent.ppc", }, product_reference: "httpd-0:2.0.52-32.3.ent.ppc", relates_to_product_reference: "4ES", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.52-32.3.ent.s390 as a component of Red Hat Enterprise Linux ES version 4", product_id: "4ES:httpd-0:2.0.52-32.3.ent.s390", }, product_reference: "httpd-0:2.0.52-32.3.ent.s390", relates_to_product_reference: "4ES", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.52-32.3.ent.s390x as a component of Red Hat Enterprise Linux ES version 4", product_id: "4ES:httpd-0:2.0.52-32.3.ent.s390x", }, product_reference: "httpd-0:2.0.52-32.3.ent.s390x", relates_to_product_reference: "4ES", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.52-32.3.ent.src as a component of Red Hat Enterprise Linux ES version 4", product_id: "4ES:httpd-0:2.0.52-32.3.ent.src", }, product_reference: "httpd-0:2.0.52-32.3.ent.src", relates_to_product_reference: "4ES", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.52-32.3.ent.x86_64 as a component of Red Hat Enterprise Linux ES version 4", product_id: "4ES:httpd-0:2.0.52-32.3.ent.x86_64", }, product_reference: "httpd-0:2.0.52-32.3.ent.x86_64", relates_to_product_reference: "4ES", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.52-32.3.ent.i386 as a component of Red Hat Enterprise Linux ES version 4", product_id: "4ES:httpd-debuginfo-0:2.0.52-32.3.ent.i386", }, product_reference: "httpd-debuginfo-0:2.0.52-32.3.ent.i386", relates_to_product_reference: "4ES", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.52-32.3.ent.ia64 as a component of Red Hat Enterprise Linux ES version 4", product_id: "4ES:httpd-debuginfo-0:2.0.52-32.3.ent.ia64", }, product_reference: "httpd-debuginfo-0:2.0.52-32.3.ent.ia64", relates_to_product_reference: "4ES", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.52-32.3.ent.ppc as a component of Red Hat Enterprise Linux ES version 4", product_id: "4ES:httpd-debuginfo-0:2.0.52-32.3.ent.ppc", }, product_reference: "httpd-debuginfo-0:2.0.52-32.3.ent.ppc", relates_to_product_reference: "4ES", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.52-32.3.ent.s390 as a component of Red Hat Enterprise Linux ES version 4", product_id: "4ES:httpd-debuginfo-0:2.0.52-32.3.ent.s390", }, product_reference: "httpd-debuginfo-0:2.0.52-32.3.ent.s390", relates_to_product_reference: "4ES", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.52-32.3.ent.s390x as a component of Red Hat Enterprise Linux ES version 4", product_id: "4ES:httpd-debuginfo-0:2.0.52-32.3.ent.s390x", }, product_reference: "httpd-debuginfo-0:2.0.52-32.3.ent.s390x", relates_to_product_reference: "4ES", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.52-32.3.ent.x86_64 as a component of Red Hat Enterprise Linux ES version 4", product_id: "4ES:httpd-debuginfo-0:2.0.52-32.3.ent.x86_64", }, product_reference: "httpd-debuginfo-0:2.0.52-32.3.ent.x86_64", relates_to_product_reference: "4ES", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.52-32.3.ent.i386 as a component of Red Hat Enterprise Linux ES version 4", product_id: "4ES:httpd-devel-0:2.0.52-32.3.ent.i386", }, product_reference: "httpd-devel-0:2.0.52-32.3.ent.i386", relates_to_product_reference: "4ES", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.52-32.3.ent.ia64 as a component of Red Hat Enterprise Linux ES version 4", product_id: "4ES:httpd-devel-0:2.0.52-32.3.ent.ia64", }, product_reference: "httpd-devel-0:2.0.52-32.3.ent.ia64", relates_to_product_reference: "4ES", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.52-32.3.ent.ppc as a component of Red Hat Enterprise Linux ES version 4", product_id: "4ES:httpd-devel-0:2.0.52-32.3.ent.ppc", }, product_reference: "httpd-devel-0:2.0.52-32.3.ent.ppc", relates_to_product_reference: "4ES", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.52-32.3.ent.s390 as a component of Red Hat Enterprise Linux ES version 4", product_id: "4ES:httpd-devel-0:2.0.52-32.3.ent.s390", }, product_reference: "httpd-devel-0:2.0.52-32.3.ent.s390", relates_to_product_reference: "4ES", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.52-32.3.ent.s390x as a component of Red Hat Enterprise Linux ES version 4", product_id: "4ES:httpd-devel-0:2.0.52-32.3.ent.s390x", }, product_reference: "httpd-devel-0:2.0.52-32.3.ent.s390x", relates_to_product_reference: "4ES", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.52-32.3.ent.x86_64 as a component of Red Hat Enterprise Linux ES version 4", product_id: "4ES:httpd-devel-0:2.0.52-32.3.ent.x86_64", }, product_reference: "httpd-devel-0:2.0.52-32.3.ent.x86_64", relates_to_product_reference: "4ES", }, { category: "default_component_of", full_product_name: { name: "httpd-manual-0:2.0.52-32.3.ent.i386 as a component of Red Hat Enterprise Linux ES version 4", product_id: "4ES:httpd-manual-0:2.0.52-32.3.ent.i386", }, product_reference: "httpd-manual-0:2.0.52-32.3.ent.i386", relates_to_product_reference: "4ES", }, { category: "default_component_of", full_product_name: { name: "httpd-manual-0:2.0.52-32.3.ent.ia64 as a component of Red Hat Enterprise Linux ES version 4", product_id: "4ES:httpd-manual-0:2.0.52-32.3.ent.ia64", }, product_reference: "httpd-manual-0:2.0.52-32.3.ent.ia64", relates_to_product_reference: "4ES", }, { category: "default_component_of", full_product_name: { name: "httpd-manual-0:2.0.52-32.3.ent.ppc as a component of Red Hat Enterprise Linux ES version 4", product_id: "4ES:httpd-manual-0:2.0.52-32.3.ent.ppc", }, product_reference: "httpd-manual-0:2.0.52-32.3.ent.ppc", relates_to_product_reference: "4ES", }, { category: "default_component_of", full_product_name: { name: "httpd-manual-0:2.0.52-32.3.ent.s390 as a component of Red Hat Enterprise Linux ES version 4", product_id: "4ES:httpd-manual-0:2.0.52-32.3.ent.s390", }, product_reference: "httpd-manual-0:2.0.52-32.3.ent.s390", relates_to_product_reference: "4ES", }, { category: "default_component_of", full_product_name: { name: "httpd-manual-0:2.0.52-32.3.ent.s390x as a component of Red Hat Enterprise Linux ES version 4", product_id: "4ES:httpd-manual-0:2.0.52-32.3.ent.s390x", }, product_reference: "httpd-manual-0:2.0.52-32.3.ent.s390x", relates_to_product_reference: "4ES", }, { category: "default_component_of", full_product_name: { name: "httpd-manual-0:2.0.52-32.3.ent.x86_64 as a component of Red Hat Enterprise Linux ES version 4", product_id: "4ES:httpd-manual-0:2.0.52-32.3.ent.x86_64", }, product_reference: "httpd-manual-0:2.0.52-32.3.ent.x86_64", relates_to_product_reference: "4ES", }, { category: "default_component_of", full_product_name: { name: "httpd-suexec-0:2.0.52-32.3.ent.i386 as a component of Red Hat Enterprise Linux ES version 4", product_id: "4ES:httpd-suexec-0:2.0.52-32.3.ent.i386", }, product_reference: "httpd-suexec-0:2.0.52-32.3.ent.i386", relates_to_product_reference: "4ES", }, { category: "default_component_of", full_product_name: { name: "httpd-suexec-0:2.0.52-32.3.ent.ia64 as a component of Red Hat Enterprise Linux ES version 4", product_id: "4ES:httpd-suexec-0:2.0.52-32.3.ent.ia64", }, product_reference: "httpd-suexec-0:2.0.52-32.3.ent.ia64", relates_to_product_reference: "4ES", }, { category: "default_component_of", full_product_name: { name: "httpd-suexec-0:2.0.52-32.3.ent.ppc as a component of Red Hat Enterprise Linux ES version 4", product_id: "4ES:httpd-suexec-0:2.0.52-32.3.ent.ppc", }, product_reference: "httpd-suexec-0:2.0.52-32.3.ent.ppc", relates_to_product_reference: "4ES", }, { category: "default_component_of", full_product_name: { name: "httpd-suexec-0:2.0.52-32.3.ent.s390 as a component of Red Hat Enterprise Linux ES version 4", product_id: "4ES:httpd-suexec-0:2.0.52-32.3.ent.s390", }, product_reference: "httpd-suexec-0:2.0.52-32.3.ent.s390", relates_to_product_reference: "4ES", }, { category: "default_component_of", full_product_name: { name: "httpd-suexec-0:2.0.52-32.3.ent.s390x as a component of Red Hat Enterprise Linux ES version 4", product_id: "4ES:httpd-suexec-0:2.0.52-32.3.ent.s390x", }, product_reference: "httpd-suexec-0:2.0.52-32.3.ent.s390x", relates_to_product_reference: "4ES", }, { category: "default_component_of", full_product_name: { name: "httpd-suexec-0:2.0.52-32.3.ent.x86_64 as a component of Red Hat Enterprise Linux ES version 4", product_id: "4ES:httpd-suexec-0:2.0.52-32.3.ent.x86_64", }, product_reference: "httpd-suexec-0:2.0.52-32.3.ent.x86_64", relates_to_product_reference: "4ES", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.52-32.3.ent.i386 as a component of Red Hat Enterprise Linux ES version 4", product_id: "4ES:mod_ssl-1:2.0.52-32.3.ent.i386", }, product_reference: "mod_ssl-1:2.0.52-32.3.ent.i386", relates_to_product_reference: "4ES", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.52-32.3.ent.ia64 as a component of Red Hat Enterprise Linux ES version 4", product_id: "4ES:mod_ssl-1:2.0.52-32.3.ent.ia64", }, product_reference: "mod_ssl-1:2.0.52-32.3.ent.ia64", relates_to_product_reference: "4ES", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.52-32.3.ent.ppc as a component of Red Hat Enterprise Linux ES version 4", product_id: "4ES:mod_ssl-1:2.0.52-32.3.ent.ppc", }, product_reference: "mod_ssl-1:2.0.52-32.3.ent.ppc", relates_to_product_reference: "4ES", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.52-32.3.ent.s390 as a component of Red Hat Enterprise Linux ES version 4", product_id: "4ES:mod_ssl-1:2.0.52-32.3.ent.s390", }, product_reference: "mod_ssl-1:2.0.52-32.3.ent.s390", relates_to_product_reference: "4ES", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.52-32.3.ent.s390x as a component of Red Hat Enterprise Linux ES version 4", product_id: "4ES:mod_ssl-1:2.0.52-32.3.ent.s390x", }, product_reference: "mod_ssl-1:2.0.52-32.3.ent.s390x", relates_to_product_reference: "4ES", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.52-32.3.ent.x86_64 as a component of Red Hat Enterprise Linux ES version 4", product_id: "4ES:mod_ssl-1:2.0.52-32.3.ent.x86_64", }, product_reference: "mod_ssl-1:2.0.52-32.3.ent.x86_64", relates_to_product_reference: "4ES", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.52-32.3.ent.i386 as a component of Red Hat Enterprise Linux WS version 4", product_id: "4WS:httpd-0:2.0.52-32.3.ent.i386", }, product_reference: "httpd-0:2.0.52-32.3.ent.i386", relates_to_product_reference: "4WS", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.52-32.3.ent.ia64 as a component of Red Hat Enterprise Linux WS version 4", product_id: "4WS:httpd-0:2.0.52-32.3.ent.ia64", }, product_reference: "httpd-0:2.0.52-32.3.ent.ia64", relates_to_product_reference: "4WS", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.52-32.3.ent.ppc as a component of Red Hat Enterprise Linux WS version 4", product_id: "4WS:httpd-0:2.0.52-32.3.ent.ppc", }, product_reference: "httpd-0:2.0.52-32.3.ent.ppc", relates_to_product_reference: "4WS", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.52-32.3.ent.s390 as a component of Red Hat Enterprise Linux WS version 4", product_id: "4WS:httpd-0:2.0.52-32.3.ent.s390", }, product_reference: "httpd-0:2.0.52-32.3.ent.s390", relates_to_product_reference: "4WS", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.52-32.3.ent.s390x as a component of Red Hat Enterprise Linux WS version 4", product_id: "4WS:httpd-0:2.0.52-32.3.ent.s390x", }, product_reference: "httpd-0:2.0.52-32.3.ent.s390x", relates_to_product_reference: "4WS", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.52-32.3.ent.src as a component of Red Hat Enterprise Linux WS version 4", product_id: "4WS:httpd-0:2.0.52-32.3.ent.src", }, product_reference: "httpd-0:2.0.52-32.3.ent.src", relates_to_product_reference: "4WS", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.52-32.3.ent.x86_64 as a component of Red Hat Enterprise Linux WS version 4", product_id: "4WS:httpd-0:2.0.52-32.3.ent.x86_64", }, product_reference: "httpd-0:2.0.52-32.3.ent.x86_64", relates_to_product_reference: "4WS", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.52-32.3.ent.i386 as a component of Red Hat Enterprise Linux WS version 4", product_id: "4WS:httpd-debuginfo-0:2.0.52-32.3.ent.i386", }, product_reference: "httpd-debuginfo-0:2.0.52-32.3.ent.i386", relates_to_product_reference: "4WS", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.52-32.3.ent.ia64 as a component of Red Hat Enterprise Linux WS version 4", product_id: "4WS:httpd-debuginfo-0:2.0.52-32.3.ent.ia64", }, product_reference: "httpd-debuginfo-0:2.0.52-32.3.ent.ia64", relates_to_product_reference: "4WS", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.52-32.3.ent.ppc as a component of Red Hat Enterprise Linux WS version 4", product_id: "4WS:httpd-debuginfo-0:2.0.52-32.3.ent.ppc", }, product_reference: "httpd-debuginfo-0:2.0.52-32.3.ent.ppc", relates_to_product_reference: "4WS", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.52-32.3.ent.s390 as a component of Red Hat Enterprise Linux WS version 4", product_id: "4WS:httpd-debuginfo-0:2.0.52-32.3.ent.s390", }, product_reference: "httpd-debuginfo-0:2.0.52-32.3.ent.s390", relates_to_product_reference: "4WS", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.52-32.3.ent.s390x as a component of Red Hat Enterprise Linux WS version 4", product_id: "4WS:httpd-debuginfo-0:2.0.52-32.3.ent.s390x", }, product_reference: "httpd-debuginfo-0:2.0.52-32.3.ent.s390x", relates_to_product_reference: "4WS", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.52-32.3.ent.x86_64 as a component of Red Hat Enterprise Linux WS version 4", product_id: "4WS:httpd-debuginfo-0:2.0.52-32.3.ent.x86_64", }, product_reference: "httpd-debuginfo-0:2.0.52-32.3.ent.x86_64", relates_to_product_reference: "4WS", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.52-32.3.ent.i386 as a component of Red Hat Enterprise Linux WS version 4", product_id: "4WS:httpd-devel-0:2.0.52-32.3.ent.i386", }, product_reference: "httpd-devel-0:2.0.52-32.3.ent.i386", relates_to_product_reference: "4WS", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.52-32.3.ent.ia64 as a component of Red Hat Enterprise Linux WS version 4", product_id: "4WS:httpd-devel-0:2.0.52-32.3.ent.ia64", }, product_reference: "httpd-devel-0:2.0.52-32.3.ent.ia64", relates_to_product_reference: "4WS", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.52-32.3.ent.ppc as a component of Red Hat Enterprise Linux WS version 4", product_id: "4WS:httpd-devel-0:2.0.52-32.3.ent.ppc", }, product_reference: "httpd-devel-0:2.0.52-32.3.ent.ppc", relates_to_product_reference: "4WS", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.52-32.3.ent.s390 as a component of Red Hat Enterprise Linux WS version 4", product_id: "4WS:httpd-devel-0:2.0.52-32.3.ent.s390", }, product_reference: "httpd-devel-0:2.0.52-32.3.ent.s390", relates_to_product_reference: "4WS", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.52-32.3.ent.s390x as a component of Red Hat Enterprise Linux WS version 4", product_id: "4WS:httpd-devel-0:2.0.52-32.3.ent.s390x", }, product_reference: "httpd-devel-0:2.0.52-32.3.ent.s390x", relates_to_product_reference: "4WS", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.52-32.3.ent.x86_64 as a component of Red Hat Enterprise Linux WS version 4", product_id: "4WS:httpd-devel-0:2.0.52-32.3.ent.x86_64", }, product_reference: "httpd-devel-0:2.0.52-32.3.ent.x86_64", relates_to_product_reference: "4WS", }, { category: "default_component_of", full_product_name: { name: "httpd-manual-0:2.0.52-32.3.ent.i386 as a component of Red Hat Enterprise Linux WS version 4", product_id: "4WS:httpd-manual-0:2.0.52-32.3.ent.i386", }, product_reference: "httpd-manual-0:2.0.52-32.3.ent.i386", relates_to_product_reference: "4WS", }, { category: "default_component_of", full_product_name: { name: "httpd-manual-0:2.0.52-32.3.ent.ia64 as a component of Red Hat Enterprise Linux WS version 4", product_id: "4WS:httpd-manual-0:2.0.52-32.3.ent.ia64", }, product_reference: "httpd-manual-0:2.0.52-32.3.ent.ia64", relates_to_product_reference: "4WS", }, { category: "default_component_of", full_product_name: { name: "httpd-manual-0:2.0.52-32.3.ent.ppc as a component of Red Hat Enterprise Linux WS version 4", product_id: "4WS:httpd-manual-0:2.0.52-32.3.ent.ppc", }, product_reference: "httpd-manual-0:2.0.52-32.3.ent.ppc", relates_to_product_reference: "4WS", }, { category: "default_component_of", full_product_name: { name: "httpd-manual-0:2.0.52-32.3.ent.s390 as a component of Red Hat Enterprise Linux WS version 4", product_id: "4WS:httpd-manual-0:2.0.52-32.3.ent.s390", }, product_reference: "httpd-manual-0:2.0.52-32.3.ent.s390", relates_to_product_reference: "4WS", }, { category: "default_component_of", full_product_name: { name: "httpd-manual-0:2.0.52-32.3.ent.s390x as a component of Red Hat Enterprise Linux WS version 4", product_id: "4WS:httpd-manual-0:2.0.52-32.3.ent.s390x", }, product_reference: "httpd-manual-0:2.0.52-32.3.ent.s390x", relates_to_product_reference: "4WS", }, { category: "default_component_of", full_product_name: { name: "httpd-manual-0:2.0.52-32.3.ent.x86_64 as a component of Red Hat Enterprise Linux WS version 4", product_id: "4WS:httpd-manual-0:2.0.52-32.3.ent.x86_64", }, product_reference: "httpd-manual-0:2.0.52-32.3.ent.x86_64", relates_to_product_reference: "4WS", }, { category: "default_component_of", full_product_name: { name: "httpd-suexec-0:2.0.52-32.3.ent.i386 as a component of Red Hat Enterprise Linux WS version 4", product_id: "4WS:httpd-suexec-0:2.0.52-32.3.ent.i386", }, product_reference: "httpd-suexec-0:2.0.52-32.3.ent.i386", relates_to_product_reference: "4WS", }, { category: "default_component_of", full_product_name: { name: "httpd-suexec-0:2.0.52-32.3.ent.ia64 as a component of Red Hat Enterprise Linux WS version 4", product_id: "4WS:httpd-suexec-0:2.0.52-32.3.ent.ia64", }, product_reference: "httpd-suexec-0:2.0.52-32.3.ent.ia64", relates_to_product_reference: "4WS", }, { category: "default_component_of", full_product_name: { name: "httpd-suexec-0:2.0.52-32.3.ent.ppc as a component of Red Hat Enterprise Linux WS version 4", product_id: "4WS:httpd-suexec-0:2.0.52-32.3.ent.ppc", }, product_reference: "httpd-suexec-0:2.0.52-32.3.ent.ppc", relates_to_product_reference: "4WS", }, { category: "default_component_of", full_product_name: { name: "httpd-suexec-0:2.0.52-32.3.ent.s390 as a component of Red Hat Enterprise Linux WS version 4", product_id: "4WS:httpd-suexec-0:2.0.52-32.3.ent.s390", }, product_reference: "httpd-suexec-0:2.0.52-32.3.ent.s390", relates_to_product_reference: "4WS", }, { category: "default_component_of", full_product_name: { name: "httpd-suexec-0:2.0.52-32.3.ent.s390x as a component of Red Hat Enterprise Linux WS version 4", product_id: "4WS:httpd-suexec-0:2.0.52-32.3.ent.s390x", }, product_reference: "httpd-suexec-0:2.0.52-32.3.ent.s390x", relates_to_product_reference: "4WS", }, { category: "default_component_of", full_product_name: { name: "httpd-suexec-0:2.0.52-32.3.ent.x86_64 as a component of Red Hat Enterprise Linux WS version 4", product_id: "4WS:httpd-suexec-0:2.0.52-32.3.ent.x86_64", }, product_reference: "httpd-suexec-0:2.0.52-32.3.ent.x86_64", relates_to_product_reference: "4WS", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.52-32.3.ent.i386 as a component of Red Hat Enterprise Linux WS version 4", product_id: "4WS:mod_ssl-1:2.0.52-32.3.ent.i386", }, product_reference: "mod_ssl-1:2.0.52-32.3.ent.i386", relates_to_product_reference: "4WS", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.52-32.3.ent.ia64 as a component of Red Hat Enterprise Linux WS version 4", product_id: "4WS:mod_ssl-1:2.0.52-32.3.ent.ia64", }, product_reference: "mod_ssl-1:2.0.52-32.3.ent.ia64", relates_to_product_reference: "4WS", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.52-32.3.ent.ppc as a component of Red Hat Enterprise Linux WS version 4", product_id: "4WS:mod_ssl-1:2.0.52-32.3.ent.ppc", }, product_reference: "mod_ssl-1:2.0.52-32.3.ent.ppc", relates_to_product_reference: "4WS", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.52-32.3.ent.s390 as a component of Red Hat Enterprise Linux WS version 4", product_id: "4WS:mod_ssl-1:2.0.52-32.3.ent.s390", }, product_reference: "mod_ssl-1:2.0.52-32.3.ent.s390", relates_to_product_reference: "4WS", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.52-32.3.ent.s390x as a component of Red Hat Enterprise Linux WS version 4", product_id: "4WS:mod_ssl-1:2.0.52-32.3.ent.s390x", }, product_reference: "mod_ssl-1:2.0.52-32.3.ent.s390x", relates_to_product_reference: "4WS", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.52-32.3.ent.x86_64 as a component of Red Hat Enterprise Linux WS version 4", product_id: "4WS:mod_ssl-1:2.0.52-32.3.ent.x86_64", }, product_reference: "mod_ssl-1:2.0.52-32.3.ent.x86_64", relates_to_product_reference: "4WS", }, ], }, vulnerabilities: [ { cve: "CVE-2007-3304", discovery_date: "2007-06-19T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "245111", }, ], notes: [ { category: "description", text: "Apache httpd 1.3.37, 2.0.59, and 2.2.4 with the Prefork MPM module, allows local users to cause a denial of service by modifying the worker_score and process_score arrays to reference an arbitrary process ID, which is sent a SIGUSR1 signal from the master process, aka \"SIGUSR1 killer.\"", title: "Vulnerability description", }, { category: "summary", text: "httpd scoreboard lack of PID protection", title: "Vulnerability summary", }, ], product_status: { fixed: [ "3AS:httpd-0:2.0.46-68.ent.i386", "3AS:httpd-0:2.0.46-68.ent.ia64", "3AS:httpd-0:2.0.46-68.ent.ppc", "3AS:httpd-0:2.0.46-68.ent.s390", "3AS:httpd-0:2.0.46-68.ent.s390x", "3AS:httpd-0:2.0.46-68.ent.src", "3AS:httpd-0:2.0.46-68.ent.x86_64", "3AS:httpd-debuginfo-0:2.0.46-68.ent.i386", "3AS:httpd-debuginfo-0:2.0.46-68.ent.ia64", "3AS:httpd-debuginfo-0:2.0.46-68.ent.ppc", "3AS:httpd-debuginfo-0:2.0.46-68.ent.s390", "3AS:httpd-debuginfo-0:2.0.46-68.ent.s390x", "3AS:httpd-debuginfo-0:2.0.46-68.ent.x86_64", "3AS:httpd-devel-0:2.0.46-68.ent.i386", "3AS:httpd-devel-0:2.0.46-68.ent.ia64", "3AS:httpd-devel-0:2.0.46-68.ent.ppc", "3AS:httpd-devel-0:2.0.46-68.ent.s390", "3AS:httpd-devel-0:2.0.46-68.ent.s390x", "3AS:httpd-devel-0:2.0.46-68.ent.x86_64", "3AS:mod_ssl-1:2.0.46-68.ent.i386", "3AS:mod_ssl-1:2.0.46-68.ent.ia64", "3AS:mod_ssl-1:2.0.46-68.ent.ppc", "3AS:mod_ssl-1:2.0.46-68.ent.s390", "3AS:mod_ssl-1:2.0.46-68.ent.s390x", "3AS:mod_ssl-1:2.0.46-68.ent.x86_64", "3Desktop:httpd-0:2.0.46-68.ent.i386", "3Desktop:httpd-0:2.0.46-68.ent.ia64", "3Desktop:httpd-0:2.0.46-68.ent.ppc", "3Desktop:httpd-0:2.0.46-68.ent.s390", "3Desktop:httpd-0:2.0.46-68.ent.s390x", "3Desktop:httpd-0:2.0.46-68.ent.src", "3Desktop:httpd-0:2.0.46-68.ent.x86_64", "3Desktop:httpd-debuginfo-0:2.0.46-68.ent.i386", "3Desktop:httpd-debuginfo-0:2.0.46-68.ent.ia64", "3Desktop:httpd-debuginfo-0:2.0.46-68.ent.ppc", "3Desktop:httpd-debuginfo-0:2.0.46-68.ent.s390", "3Desktop:httpd-debuginfo-0:2.0.46-68.ent.s390x", "3Desktop:httpd-debuginfo-0:2.0.46-68.ent.x86_64", "3Desktop:httpd-devel-0:2.0.46-68.ent.i386", "3Desktop:httpd-devel-0:2.0.46-68.ent.ia64", "3Desktop:httpd-devel-0:2.0.46-68.ent.ppc", "3Desktop:httpd-devel-0:2.0.46-68.ent.s390", "3Desktop:httpd-devel-0:2.0.46-68.ent.s390x", "3Desktop:httpd-devel-0:2.0.46-68.ent.x86_64", "3Desktop:mod_ssl-1:2.0.46-68.ent.i386", "3Desktop:mod_ssl-1:2.0.46-68.ent.ia64", "3Desktop:mod_ssl-1:2.0.46-68.ent.ppc", "3Desktop:mod_ssl-1:2.0.46-68.ent.s390", "3Desktop:mod_ssl-1:2.0.46-68.ent.s390x", "3Desktop:mod_ssl-1:2.0.46-68.ent.x86_64", "3ES:httpd-0:2.0.46-68.ent.i386", "3ES:httpd-0:2.0.46-68.ent.ia64", "3ES:httpd-0:2.0.46-68.ent.ppc", "3ES:httpd-0:2.0.46-68.ent.s390", "3ES:httpd-0:2.0.46-68.ent.s390x", "3ES:httpd-0:2.0.46-68.ent.src", "3ES:httpd-0:2.0.46-68.ent.x86_64", "3ES:httpd-debuginfo-0:2.0.46-68.ent.i386", "3ES:httpd-debuginfo-0:2.0.46-68.ent.ia64", "3ES:httpd-debuginfo-0:2.0.46-68.ent.ppc", "3ES:httpd-debuginfo-0:2.0.46-68.ent.s390", "3ES:httpd-debuginfo-0:2.0.46-68.ent.s390x", "3ES:httpd-debuginfo-0:2.0.46-68.ent.x86_64", "3ES:httpd-devel-0:2.0.46-68.ent.i386", "3ES:httpd-devel-0:2.0.46-68.ent.ia64", "3ES:httpd-devel-0:2.0.46-68.ent.ppc", "3ES:httpd-devel-0:2.0.46-68.ent.s390", "3ES:httpd-devel-0:2.0.46-68.ent.s390x", "3ES:httpd-devel-0:2.0.46-68.ent.x86_64", "3ES:mod_ssl-1:2.0.46-68.ent.i386", "3ES:mod_ssl-1:2.0.46-68.ent.ia64", "3ES:mod_ssl-1:2.0.46-68.ent.ppc", "3ES:mod_ssl-1:2.0.46-68.ent.s390", "3ES:mod_ssl-1:2.0.46-68.ent.s390x", "3ES:mod_ssl-1:2.0.46-68.ent.x86_64", "3WS:httpd-0:2.0.46-68.ent.i386", "3WS:httpd-0:2.0.46-68.ent.ia64", "3WS:httpd-0:2.0.46-68.ent.ppc", "3WS:httpd-0:2.0.46-68.ent.s390", "3WS:httpd-0:2.0.46-68.ent.s390x", "3WS:httpd-0:2.0.46-68.ent.src", "3WS:httpd-0:2.0.46-68.ent.x86_64", "3WS:httpd-debuginfo-0:2.0.46-68.ent.i386", "3WS:httpd-debuginfo-0:2.0.46-68.ent.ia64", "3WS:httpd-debuginfo-0:2.0.46-68.ent.ppc", "3WS:httpd-debuginfo-0:2.0.46-68.ent.s390", "3WS:httpd-debuginfo-0:2.0.46-68.ent.s390x", "3WS:httpd-debuginfo-0:2.0.46-68.ent.x86_64", "3WS:httpd-devel-0:2.0.46-68.ent.i386", "3WS:httpd-devel-0:2.0.46-68.ent.ia64", "3WS:httpd-devel-0:2.0.46-68.ent.ppc", "3WS:httpd-devel-0:2.0.46-68.ent.s390", "3WS:httpd-devel-0:2.0.46-68.ent.s390x", "3WS:httpd-devel-0:2.0.46-68.ent.x86_64", "3WS:mod_ssl-1:2.0.46-68.ent.i386", "3WS:mod_ssl-1:2.0.46-68.ent.ia64", "3WS:mod_ssl-1:2.0.46-68.ent.ppc", "3WS:mod_ssl-1:2.0.46-68.ent.s390", "3WS:mod_ssl-1:2.0.46-68.ent.s390x", "3WS:mod_ssl-1:2.0.46-68.ent.x86_64", "4AS:httpd-0:2.0.52-32.3.ent.i386", "4AS:httpd-0:2.0.52-32.3.ent.ia64", "4AS:httpd-0:2.0.52-32.3.ent.ppc", "4AS:httpd-0:2.0.52-32.3.ent.s390", "4AS:httpd-0:2.0.52-32.3.ent.s390x", "4AS:httpd-0:2.0.52-32.3.ent.src", "4AS:httpd-0:2.0.52-32.3.ent.x86_64", "4AS:httpd-debuginfo-0:2.0.52-32.3.ent.i386", "4AS:httpd-debuginfo-0:2.0.52-32.3.ent.ia64", "4AS:httpd-debuginfo-0:2.0.52-32.3.ent.ppc", "4AS:httpd-debuginfo-0:2.0.52-32.3.ent.s390", "4AS:httpd-debuginfo-0:2.0.52-32.3.ent.s390x", "4AS:httpd-debuginfo-0:2.0.52-32.3.ent.x86_64", "4AS:httpd-devel-0:2.0.52-32.3.ent.i386", "4AS:httpd-devel-0:2.0.52-32.3.ent.ia64", "4AS:httpd-devel-0:2.0.52-32.3.ent.ppc", "4AS:httpd-devel-0:2.0.52-32.3.ent.s390", "4AS:httpd-devel-0:2.0.52-32.3.ent.s390x", "4AS:httpd-devel-0:2.0.52-32.3.ent.x86_64", "4AS:httpd-manual-0:2.0.52-32.3.ent.i386", "4AS:httpd-manual-0:2.0.52-32.3.ent.ia64", "4AS:httpd-manual-0:2.0.52-32.3.ent.ppc", "4AS:httpd-manual-0:2.0.52-32.3.ent.s390", "4AS:httpd-manual-0:2.0.52-32.3.ent.s390x", "4AS:httpd-manual-0:2.0.52-32.3.ent.x86_64", "4AS:httpd-suexec-0:2.0.52-32.3.ent.i386", "4AS:httpd-suexec-0:2.0.52-32.3.ent.ia64", "4AS:httpd-suexec-0:2.0.52-32.3.ent.ppc", "4AS:httpd-suexec-0:2.0.52-32.3.ent.s390", "4AS:httpd-suexec-0:2.0.52-32.3.ent.s390x", "4AS:httpd-suexec-0:2.0.52-32.3.ent.x86_64", "4AS:mod_ssl-1:2.0.52-32.3.ent.i386", "4AS:mod_ssl-1:2.0.52-32.3.ent.ia64", "4AS:mod_ssl-1:2.0.52-32.3.ent.ppc", "4AS:mod_ssl-1:2.0.52-32.3.ent.s390", "4AS:mod_ssl-1:2.0.52-32.3.ent.s390x", "4AS:mod_ssl-1:2.0.52-32.3.ent.x86_64", "4Desktop:httpd-0:2.0.52-32.3.ent.i386", "4Desktop:httpd-0:2.0.52-32.3.ent.ia64", "4Desktop:httpd-0:2.0.52-32.3.ent.ppc", "4Desktop:httpd-0:2.0.52-32.3.ent.s390", "4Desktop:httpd-0:2.0.52-32.3.ent.s390x", "4Desktop:httpd-0:2.0.52-32.3.ent.src", "4Desktop:httpd-0:2.0.52-32.3.ent.x86_64", "4Desktop:httpd-debuginfo-0:2.0.52-32.3.ent.i386", "4Desktop:httpd-debuginfo-0:2.0.52-32.3.ent.ia64", "4Desktop:httpd-debuginfo-0:2.0.52-32.3.ent.ppc", "4Desktop:httpd-debuginfo-0:2.0.52-32.3.ent.s390", "4Desktop:httpd-debuginfo-0:2.0.52-32.3.ent.s390x", "4Desktop:httpd-debuginfo-0:2.0.52-32.3.ent.x86_64", "4Desktop:httpd-devel-0:2.0.52-32.3.ent.i386", "4Desktop:httpd-devel-0:2.0.52-32.3.ent.ia64", "4Desktop:httpd-devel-0:2.0.52-32.3.ent.ppc", "4Desktop:httpd-devel-0:2.0.52-32.3.ent.s390", "4Desktop:httpd-devel-0:2.0.52-32.3.ent.s390x", "4Desktop:httpd-devel-0:2.0.52-32.3.ent.x86_64", "4Desktop:httpd-manual-0:2.0.52-32.3.ent.i386", "4Desktop:httpd-manual-0:2.0.52-32.3.ent.ia64", "4Desktop:httpd-manual-0:2.0.52-32.3.ent.ppc", "4Desktop:httpd-manual-0:2.0.52-32.3.ent.s390", "4Desktop:httpd-manual-0:2.0.52-32.3.ent.s390x", "4Desktop:httpd-manual-0:2.0.52-32.3.ent.x86_64", "4Desktop:httpd-suexec-0:2.0.52-32.3.ent.i386", "4Desktop:httpd-suexec-0:2.0.52-32.3.ent.ia64", "4Desktop:httpd-suexec-0:2.0.52-32.3.ent.ppc", "4Desktop:httpd-suexec-0:2.0.52-32.3.ent.s390", "4Desktop:httpd-suexec-0:2.0.52-32.3.ent.s390x", "4Desktop:httpd-suexec-0:2.0.52-32.3.ent.x86_64", "4Desktop:mod_ssl-1:2.0.52-32.3.ent.i386", "4Desktop:mod_ssl-1:2.0.52-32.3.ent.ia64", "4Desktop:mod_ssl-1:2.0.52-32.3.ent.ppc", "4Desktop:mod_ssl-1:2.0.52-32.3.ent.s390", "4Desktop:mod_ssl-1:2.0.52-32.3.ent.s390x", "4Desktop:mod_ssl-1:2.0.52-32.3.ent.x86_64", "4ES:httpd-0:2.0.52-32.3.ent.i386", "4ES:httpd-0:2.0.52-32.3.ent.ia64", "4ES:httpd-0:2.0.52-32.3.ent.ppc", "4ES:httpd-0:2.0.52-32.3.ent.s390", "4ES:httpd-0:2.0.52-32.3.ent.s390x", "4ES:httpd-0:2.0.52-32.3.ent.src", "4ES:httpd-0:2.0.52-32.3.ent.x86_64", "4ES:httpd-debuginfo-0:2.0.52-32.3.ent.i386", "4ES:httpd-debuginfo-0:2.0.52-32.3.ent.ia64", "4ES:httpd-debuginfo-0:2.0.52-32.3.ent.ppc", "4ES:httpd-debuginfo-0:2.0.52-32.3.ent.s390", "4ES:httpd-debuginfo-0:2.0.52-32.3.ent.s390x", "4ES:httpd-debuginfo-0:2.0.52-32.3.ent.x86_64", "4ES:httpd-devel-0:2.0.52-32.3.ent.i386", "4ES:httpd-devel-0:2.0.52-32.3.ent.ia64", "4ES:httpd-devel-0:2.0.52-32.3.ent.ppc", "4ES:httpd-devel-0:2.0.52-32.3.ent.s390", "4ES:httpd-devel-0:2.0.52-32.3.ent.s390x", "4ES:httpd-devel-0:2.0.52-32.3.ent.x86_64", "4ES:httpd-manual-0:2.0.52-32.3.ent.i386", "4ES:httpd-manual-0:2.0.52-32.3.ent.ia64", "4ES:httpd-manual-0:2.0.52-32.3.ent.ppc", "4ES:httpd-manual-0:2.0.52-32.3.ent.s390", "4ES:httpd-manual-0:2.0.52-32.3.ent.s390x", "4ES:httpd-manual-0:2.0.52-32.3.ent.x86_64", "4ES:httpd-suexec-0:2.0.52-32.3.ent.i386", "4ES:httpd-suexec-0:2.0.52-32.3.ent.ia64", "4ES:httpd-suexec-0:2.0.52-32.3.ent.ppc", "4ES:httpd-suexec-0:2.0.52-32.3.ent.s390", "4ES:httpd-suexec-0:2.0.52-32.3.ent.s390x", "4ES:httpd-suexec-0:2.0.52-32.3.ent.x86_64", "4ES:mod_ssl-1:2.0.52-32.3.ent.i386", "4ES:mod_ssl-1:2.0.52-32.3.ent.ia64", "4ES:mod_ssl-1:2.0.52-32.3.ent.ppc", "4ES:mod_ssl-1:2.0.52-32.3.ent.s390", "4ES:mod_ssl-1:2.0.52-32.3.ent.s390x", "4ES:mod_ssl-1:2.0.52-32.3.ent.x86_64", "4WS:httpd-0:2.0.52-32.3.ent.i386", "4WS:httpd-0:2.0.52-32.3.ent.ia64", "4WS:httpd-0:2.0.52-32.3.ent.ppc", "4WS:httpd-0:2.0.52-32.3.ent.s390", "4WS:httpd-0:2.0.52-32.3.ent.s390x", "4WS:httpd-0:2.0.52-32.3.ent.src", "4WS:httpd-0:2.0.52-32.3.ent.x86_64", "4WS:httpd-debuginfo-0:2.0.52-32.3.ent.i386", "4WS:httpd-debuginfo-0:2.0.52-32.3.ent.ia64", "4WS:httpd-debuginfo-0:2.0.52-32.3.ent.ppc", "4WS:httpd-debuginfo-0:2.0.52-32.3.ent.s390", "4WS:httpd-debuginfo-0:2.0.52-32.3.ent.s390x", "4WS:httpd-debuginfo-0:2.0.52-32.3.ent.x86_64", "4WS:httpd-devel-0:2.0.52-32.3.ent.i386", "4WS:httpd-devel-0:2.0.52-32.3.ent.ia64", "4WS:httpd-devel-0:2.0.52-32.3.ent.ppc", "4WS:httpd-devel-0:2.0.52-32.3.ent.s390", "4WS:httpd-devel-0:2.0.52-32.3.ent.s390x", "4WS:httpd-devel-0:2.0.52-32.3.ent.x86_64", "4WS:httpd-manual-0:2.0.52-32.3.ent.i386", "4WS:httpd-manual-0:2.0.52-32.3.ent.ia64", "4WS:httpd-manual-0:2.0.52-32.3.ent.ppc", "4WS:httpd-manual-0:2.0.52-32.3.ent.s390", "4WS:httpd-manual-0:2.0.52-32.3.ent.s390x", "4WS:httpd-manual-0:2.0.52-32.3.ent.x86_64", "4WS:httpd-suexec-0:2.0.52-32.3.ent.i386", "4WS:httpd-suexec-0:2.0.52-32.3.ent.ia64", "4WS:httpd-suexec-0:2.0.52-32.3.ent.ppc", "4WS:httpd-suexec-0:2.0.52-32.3.ent.s390", "4WS:httpd-suexec-0:2.0.52-32.3.ent.s390x", "4WS:httpd-suexec-0:2.0.52-32.3.ent.x86_64", "4WS:mod_ssl-1:2.0.52-32.3.ent.i386", "4WS:mod_ssl-1:2.0.52-32.3.ent.ia64", "4WS:mod_ssl-1:2.0.52-32.3.ent.ppc", "4WS:mod_ssl-1:2.0.52-32.3.ent.s390", "4WS:mod_ssl-1:2.0.52-32.3.ent.s390x", "4WS:mod_ssl-1:2.0.52-32.3.ent.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-3304", }, { category: "external", summary: "RHBZ#245111", url: "https://bugzilla.redhat.com/show_bug.cgi?id=245111", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-3304", url: "https://www.cve.org/CVERecord?id=CVE-2007-3304", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-3304", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-3304", }, ], release_date: "2007-06-19T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2007-07-13T07:48:00+00:00", details: "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied. \n\nThis update is available via Red Hat Network. Details on how to use \nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/FAQ_58_10188", product_ids: [ "3AS:httpd-0:2.0.46-68.ent.i386", "3AS:httpd-0:2.0.46-68.ent.ia64", "3AS:httpd-0:2.0.46-68.ent.ppc", "3AS:httpd-0:2.0.46-68.ent.s390", "3AS:httpd-0:2.0.46-68.ent.s390x", "3AS:httpd-0:2.0.46-68.ent.src", "3AS:httpd-0:2.0.46-68.ent.x86_64", "3AS:httpd-debuginfo-0:2.0.46-68.ent.i386", "3AS:httpd-debuginfo-0:2.0.46-68.ent.ia64", "3AS:httpd-debuginfo-0:2.0.46-68.ent.ppc", "3AS:httpd-debuginfo-0:2.0.46-68.ent.s390", "3AS:httpd-debuginfo-0:2.0.46-68.ent.s390x", "3AS:httpd-debuginfo-0:2.0.46-68.ent.x86_64", "3AS:httpd-devel-0:2.0.46-68.ent.i386", "3AS:httpd-devel-0:2.0.46-68.ent.ia64", "3AS:httpd-devel-0:2.0.46-68.ent.ppc", "3AS:httpd-devel-0:2.0.46-68.ent.s390", "3AS:httpd-devel-0:2.0.46-68.ent.s390x", "3AS:httpd-devel-0:2.0.46-68.ent.x86_64", "3AS:mod_ssl-1:2.0.46-68.ent.i386", "3AS:mod_ssl-1:2.0.46-68.ent.ia64", "3AS:mod_ssl-1:2.0.46-68.ent.ppc", "3AS:mod_ssl-1:2.0.46-68.ent.s390", "3AS:mod_ssl-1:2.0.46-68.ent.s390x", "3AS:mod_ssl-1:2.0.46-68.ent.x86_64", "3Desktop:httpd-0:2.0.46-68.ent.i386", "3Desktop:httpd-0:2.0.46-68.ent.ia64", "3Desktop:httpd-0:2.0.46-68.ent.ppc", "3Desktop:httpd-0:2.0.46-68.ent.s390", "3Desktop:httpd-0:2.0.46-68.ent.s390x", "3Desktop:httpd-0:2.0.46-68.ent.src", "3Desktop:httpd-0:2.0.46-68.ent.x86_64", "3Desktop:httpd-debuginfo-0:2.0.46-68.ent.i386", "3Desktop:httpd-debuginfo-0:2.0.46-68.ent.ia64", "3Desktop:httpd-debuginfo-0:2.0.46-68.ent.ppc", "3Desktop:httpd-debuginfo-0:2.0.46-68.ent.s390", "3Desktop:httpd-debuginfo-0:2.0.46-68.ent.s390x", "3Desktop:httpd-debuginfo-0:2.0.46-68.ent.x86_64", "3Desktop:httpd-devel-0:2.0.46-68.ent.i386", "3Desktop:httpd-devel-0:2.0.46-68.ent.ia64", "3Desktop:httpd-devel-0:2.0.46-68.ent.ppc", "3Desktop:httpd-devel-0:2.0.46-68.ent.s390", "3Desktop:httpd-devel-0:2.0.46-68.ent.s390x", "3Desktop:httpd-devel-0:2.0.46-68.ent.x86_64", "3Desktop:mod_ssl-1:2.0.46-68.ent.i386", "3Desktop:mod_ssl-1:2.0.46-68.ent.ia64", "3Desktop:mod_ssl-1:2.0.46-68.ent.ppc", "3Desktop:mod_ssl-1:2.0.46-68.ent.s390", "3Desktop:mod_ssl-1:2.0.46-68.ent.s390x", "3Desktop:mod_ssl-1:2.0.46-68.ent.x86_64", "3ES:httpd-0:2.0.46-68.ent.i386", "3ES:httpd-0:2.0.46-68.ent.ia64", "3ES:httpd-0:2.0.46-68.ent.ppc", "3ES:httpd-0:2.0.46-68.ent.s390", "3ES:httpd-0:2.0.46-68.ent.s390x", "3ES:httpd-0:2.0.46-68.ent.src", "3ES:httpd-0:2.0.46-68.ent.x86_64", "3ES:httpd-debuginfo-0:2.0.46-68.ent.i386", "3ES:httpd-debuginfo-0:2.0.46-68.ent.ia64", "3ES:httpd-debuginfo-0:2.0.46-68.ent.ppc", "3ES:httpd-debuginfo-0:2.0.46-68.ent.s390", "3ES:httpd-debuginfo-0:2.0.46-68.ent.s390x", "3ES:httpd-debuginfo-0:2.0.46-68.ent.x86_64", "3ES:httpd-devel-0:2.0.46-68.ent.i386", "3ES:httpd-devel-0:2.0.46-68.ent.ia64", "3ES:httpd-devel-0:2.0.46-68.ent.ppc", "3ES:httpd-devel-0:2.0.46-68.ent.s390", "3ES:httpd-devel-0:2.0.46-68.ent.s390x", "3ES:httpd-devel-0:2.0.46-68.ent.x86_64", "3ES:mod_ssl-1:2.0.46-68.ent.i386", "3ES:mod_ssl-1:2.0.46-68.ent.ia64", "3ES:mod_ssl-1:2.0.46-68.ent.ppc", "3ES:mod_ssl-1:2.0.46-68.ent.s390", "3ES:mod_ssl-1:2.0.46-68.ent.s390x", "3ES:mod_ssl-1:2.0.46-68.ent.x86_64", "3WS:httpd-0:2.0.46-68.ent.i386", "3WS:httpd-0:2.0.46-68.ent.ia64", "3WS:httpd-0:2.0.46-68.ent.ppc", "3WS:httpd-0:2.0.46-68.ent.s390", "3WS:httpd-0:2.0.46-68.ent.s390x", "3WS:httpd-0:2.0.46-68.ent.src", "3WS:httpd-0:2.0.46-68.ent.x86_64", "3WS:httpd-debuginfo-0:2.0.46-68.ent.i386", "3WS:httpd-debuginfo-0:2.0.46-68.ent.ia64", "3WS:httpd-debuginfo-0:2.0.46-68.ent.ppc", "3WS:httpd-debuginfo-0:2.0.46-68.ent.s390", "3WS:httpd-debuginfo-0:2.0.46-68.ent.s390x", "3WS:httpd-debuginfo-0:2.0.46-68.ent.x86_64", "3WS:httpd-devel-0:2.0.46-68.ent.i386", "3WS:httpd-devel-0:2.0.46-68.ent.ia64", "3WS:httpd-devel-0:2.0.46-68.ent.ppc", "3WS:httpd-devel-0:2.0.46-68.ent.s390", "3WS:httpd-devel-0:2.0.46-68.ent.s390x", "3WS:httpd-devel-0:2.0.46-68.ent.x86_64", "3WS:mod_ssl-1:2.0.46-68.ent.i386", "3WS:mod_ssl-1:2.0.46-68.ent.ia64", "3WS:mod_ssl-1:2.0.46-68.ent.ppc", "3WS:mod_ssl-1:2.0.46-68.ent.s390", "3WS:mod_ssl-1:2.0.46-68.ent.s390x", "3WS:mod_ssl-1:2.0.46-68.ent.x86_64", "4AS:httpd-0:2.0.52-32.3.ent.i386", "4AS:httpd-0:2.0.52-32.3.ent.ia64", "4AS:httpd-0:2.0.52-32.3.ent.ppc", "4AS:httpd-0:2.0.52-32.3.ent.s390", "4AS:httpd-0:2.0.52-32.3.ent.s390x", "4AS:httpd-0:2.0.52-32.3.ent.src", "4AS:httpd-0:2.0.52-32.3.ent.x86_64", "4AS:httpd-debuginfo-0:2.0.52-32.3.ent.i386", "4AS:httpd-debuginfo-0:2.0.52-32.3.ent.ia64", "4AS:httpd-debuginfo-0:2.0.52-32.3.ent.ppc", "4AS:httpd-debuginfo-0:2.0.52-32.3.ent.s390", "4AS:httpd-debuginfo-0:2.0.52-32.3.ent.s390x", "4AS:httpd-debuginfo-0:2.0.52-32.3.ent.x86_64", "4AS:httpd-devel-0:2.0.52-32.3.ent.i386", "4AS:httpd-devel-0:2.0.52-32.3.ent.ia64", "4AS:httpd-devel-0:2.0.52-32.3.ent.ppc", "4AS:httpd-devel-0:2.0.52-32.3.ent.s390", "4AS:httpd-devel-0:2.0.52-32.3.ent.s390x", "4AS:httpd-devel-0:2.0.52-32.3.ent.x86_64", "4AS:httpd-manual-0:2.0.52-32.3.ent.i386", "4AS:httpd-manual-0:2.0.52-32.3.ent.ia64", "4AS:httpd-manual-0:2.0.52-32.3.ent.ppc", "4AS:httpd-manual-0:2.0.52-32.3.ent.s390", "4AS:httpd-manual-0:2.0.52-32.3.ent.s390x", "4AS:httpd-manual-0:2.0.52-32.3.ent.x86_64", "4AS:httpd-suexec-0:2.0.52-32.3.ent.i386", "4AS:httpd-suexec-0:2.0.52-32.3.ent.ia64", "4AS:httpd-suexec-0:2.0.52-32.3.ent.ppc", "4AS:httpd-suexec-0:2.0.52-32.3.ent.s390", "4AS:httpd-suexec-0:2.0.52-32.3.ent.s390x", "4AS:httpd-suexec-0:2.0.52-32.3.ent.x86_64", "4AS:mod_ssl-1:2.0.52-32.3.ent.i386", "4AS:mod_ssl-1:2.0.52-32.3.ent.ia64", "4AS:mod_ssl-1:2.0.52-32.3.ent.ppc", "4AS:mod_ssl-1:2.0.52-32.3.ent.s390", "4AS:mod_ssl-1:2.0.52-32.3.ent.s390x", "4AS:mod_ssl-1:2.0.52-32.3.ent.x86_64", "4Desktop:httpd-0:2.0.52-32.3.ent.i386", "4Desktop:httpd-0:2.0.52-32.3.ent.ia64", "4Desktop:httpd-0:2.0.52-32.3.ent.ppc", "4Desktop:httpd-0:2.0.52-32.3.ent.s390", "4Desktop:httpd-0:2.0.52-32.3.ent.s390x", "4Desktop:httpd-0:2.0.52-32.3.ent.src", "4Desktop:httpd-0:2.0.52-32.3.ent.x86_64", "4Desktop:httpd-debuginfo-0:2.0.52-32.3.ent.i386", "4Desktop:httpd-debuginfo-0:2.0.52-32.3.ent.ia64", "4Desktop:httpd-debuginfo-0:2.0.52-32.3.ent.ppc", "4Desktop:httpd-debuginfo-0:2.0.52-32.3.ent.s390", "4Desktop:httpd-debuginfo-0:2.0.52-32.3.ent.s390x", "4Desktop:httpd-debuginfo-0:2.0.52-32.3.ent.x86_64", "4Desktop:httpd-devel-0:2.0.52-32.3.ent.i386", "4Desktop:httpd-devel-0:2.0.52-32.3.ent.ia64", "4Desktop:httpd-devel-0:2.0.52-32.3.ent.ppc", "4Desktop:httpd-devel-0:2.0.52-32.3.ent.s390", "4Desktop:httpd-devel-0:2.0.52-32.3.ent.s390x", "4Desktop:httpd-devel-0:2.0.52-32.3.ent.x86_64", "4Desktop:httpd-manual-0:2.0.52-32.3.ent.i386", "4Desktop:httpd-manual-0:2.0.52-32.3.ent.ia64", "4Desktop:httpd-manual-0:2.0.52-32.3.ent.ppc", "4Desktop:httpd-manual-0:2.0.52-32.3.ent.s390", "4Desktop:httpd-manual-0:2.0.52-32.3.ent.s390x", "4Desktop:httpd-manual-0:2.0.52-32.3.ent.x86_64", "4Desktop:httpd-suexec-0:2.0.52-32.3.ent.i386", "4Desktop:httpd-suexec-0:2.0.52-32.3.ent.ia64", "4Desktop:httpd-suexec-0:2.0.52-32.3.ent.ppc", "4Desktop:httpd-suexec-0:2.0.52-32.3.ent.s390", "4Desktop:httpd-suexec-0:2.0.52-32.3.ent.s390x", "4Desktop:httpd-suexec-0:2.0.52-32.3.ent.x86_64", "4Desktop:mod_ssl-1:2.0.52-32.3.ent.i386", "4Desktop:mod_ssl-1:2.0.52-32.3.ent.ia64", "4Desktop:mod_ssl-1:2.0.52-32.3.ent.ppc", "4Desktop:mod_ssl-1:2.0.52-32.3.ent.s390", "4Desktop:mod_ssl-1:2.0.52-32.3.ent.s390x", "4Desktop:mod_ssl-1:2.0.52-32.3.ent.x86_64", "4ES:httpd-0:2.0.52-32.3.ent.i386", "4ES:httpd-0:2.0.52-32.3.ent.ia64", "4ES:httpd-0:2.0.52-32.3.ent.ppc", "4ES:httpd-0:2.0.52-32.3.ent.s390", "4ES:httpd-0:2.0.52-32.3.ent.s390x", "4ES:httpd-0:2.0.52-32.3.ent.src", "4ES:httpd-0:2.0.52-32.3.ent.x86_64", "4ES:httpd-debuginfo-0:2.0.52-32.3.ent.i386", "4ES:httpd-debuginfo-0:2.0.52-32.3.ent.ia64", "4ES:httpd-debuginfo-0:2.0.52-32.3.ent.ppc", "4ES:httpd-debuginfo-0:2.0.52-32.3.ent.s390", "4ES:httpd-debuginfo-0:2.0.52-32.3.ent.s390x", "4ES:httpd-debuginfo-0:2.0.52-32.3.ent.x86_64", "4ES:httpd-devel-0:2.0.52-32.3.ent.i386", "4ES:httpd-devel-0:2.0.52-32.3.ent.ia64", "4ES:httpd-devel-0:2.0.52-32.3.ent.ppc", "4ES:httpd-devel-0:2.0.52-32.3.ent.s390", "4ES:httpd-devel-0:2.0.52-32.3.ent.s390x", "4ES:httpd-devel-0:2.0.52-32.3.ent.x86_64", "4ES:httpd-manual-0:2.0.52-32.3.ent.i386", "4ES:httpd-manual-0:2.0.52-32.3.ent.ia64", "4ES:httpd-manual-0:2.0.52-32.3.ent.ppc", "4ES:httpd-manual-0:2.0.52-32.3.ent.s390", "4ES:httpd-manual-0:2.0.52-32.3.ent.s390x", "4ES:httpd-manual-0:2.0.52-32.3.ent.x86_64", "4ES:httpd-suexec-0:2.0.52-32.3.ent.i386", "4ES:httpd-suexec-0:2.0.52-32.3.ent.ia64", "4ES:httpd-suexec-0:2.0.52-32.3.ent.ppc", "4ES:httpd-suexec-0:2.0.52-32.3.ent.s390", "4ES:httpd-suexec-0:2.0.52-32.3.ent.s390x", "4ES:httpd-suexec-0:2.0.52-32.3.ent.x86_64", "4ES:mod_ssl-1:2.0.52-32.3.ent.i386", "4ES:mod_ssl-1:2.0.52-32.3.ent.ia64", "4ES:mod_ssl-1:2.0.52-32.3.ent.ppc", "4ES:mod_ssl-1:2.0.52-32.3.ent.s390", "4ES:mod_ssl-1:2.0.52-32.3.ent.s390x", "4ES:mod_ssl-1:2.0.52-32.3.ent.x86_64", "4WS:httpd-0:2.0.52-32.3.ent.i386", "4WS:httpd-0:2.0.52-32.3.ent.ia64", "4WS:httpd-0:2.0.52-32.3.ent.ppc", "4WS:httpd-0:2.0.52-32.3.ent.s390", "4WS:httpd-0:2.0.52-32.3.ent.s390x", "4WS:httpd-0:2.0.52-32.3.ent.src", "4WS:httpd-0:2.0.52-32.3.ent.x86_64", "4WS:httpd-debuginfo-0:2.0.52-32.3.ent.i386", "4WS:httpd-debuginfo-0:2.0.52-32.3.ent.ia64", "4WS:httpd-debuginfo-0:2.0.52-32.3.ent.ppc", "4WS:httpd-debuginfo-0:2.0.52-32.3.ent.s390", "4WS:httpd-debuginfo-0:2.0.52-32.3.ent.s390x", "4WS:httpd-debuginfo-0:2.0.52-32.3.ent.x86_64", "4WS:httpd-devel-0:2.0.52-32.3.ent.i386", "4WS:httpd-devel-0:2.0.52-32.3.ent.ia64", "4WS:httpd-devel-0:2.0.52-32.3.ent.ppc", "4WS:httpd-devel-0:2.0.52-32.3.ent.s390", "4WS:httpd-devel-0:2.0.52-32.3.ent.s390x", "4WS:httpd-devel-0:2.0.52-32.3.ent.x86_64", "4WS:httpd-manual-0:2.0.52-32.3.ent.i386", "4WS:httpd-manual-0:2.0.52-32.3.ent.ia64", "4WS:httpd-manual-0:2.0.52-32.3.ent.ppc", "4WS:httpd-manual-0:2.0.52-32.3.ent.s390", "4WS:httpd-manual-0:2.0.52-32.3.ent.s390x", "4WS:httpd-manual-0:2.0.52-32.3.ent.x86_64", "4WS:httpd-suexec-0:2.0.52-32.3.ent.i386", "4WS:httpd-suexec-0:2.0.52-32.3.ent.ia64", "4WS:httpd-suexec-0:2.0.52-32.3.ent.ppc", "4WS:httpd-suexec-0:2.0.52-32.3.ent.s390", "4WS:httpd-suexec-0:2.0.52-32.3.ent.s390x", "4WS:httpd-suexec-0:2.0.52-32.3.ent.x86_64", "4WS:mod_ssl-1:2.0.52-32.3.ent.i386", "4WS:mod_ssl-1:2.0.52-32.3.ent.ia64", "4WS:mod_ssl-1:2.0.52-32.3.ent.ppc", "4WS:mod_ssl-1:2.0.52-32.3.ent.s390", "4WS:mod_ssl-1:2.0.52-32.3.ent.s390x", "4WS:mod_ssl-1:2.0.52-32.3.ent.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2007:0662", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "httpd scoreboard lack of PID protection", }, ], }
rhsa-2008_0524
Vulnerability from csaf_redhat
Published
2008-06-30 15:33
Modified
2024-12-08 10:33
Summary
Red Hat Security Advisory: Red Hat Network Satellite Server security update
Notes
Topic
Red Hat Network Satellite Server version 4.2.3 is now available. This
update includes fixes for a number of security issues in Red Hat Network
Satellite Server components.
This update has been rated as having low security impact by the Red Hat
Security Response Team.
Details
This release corrects several security vulnerabilities in various
components shipped as part of the Red Hat Network Satellite Server 4.2. In
a typical operating environment, these components are not exposed to users
of Satellite Server in a vulnerable manner. These security updates will
reduce risk in unique Satellite Server environments.
Multiple flaws were fixed in the Apache HTTPD server. These flaws could
result in a cross-site scripting, denial-of-service, or information
disclosure attacks. (CVE-2004-0885, CVE-2006-5752, CVE-2006-7197,
CVE-2007-1860, CVE-2007-3304, CVE-2007-4465, CVE-2007-5000, CVE-2007-6388)
A denial-of-service flaw was fixed in mod_perl. (CVE-2007-1349)
A denial-of-service flaw was fixed in the jabberd server. (CVE-2006-1329)
Multiple cross-site scripting flaws were fixed in the image map feature in
the JFreeChart package. (CVE-2007-6306)
Multiple flaws were fixed in the IBM Java 1.4.2 Runtime. (CVE-2007-0243,
CVE-2007-2435, CVE-2007-2788, CVE-2007-2789)
Multiple flaws were fixed in the OpenMotif package. (CVE-2004-0687,
CVE-2004-0688, CVE-2004-0914, CVE-2005-3964, CVE-2005-0605)
A flaw which could result in weak encryption was fixed in the
perl-Crypt-CBC package. (CVE-2006-0898)
Multiple flaws were fixed in the Tomcat package. (CVE-2008-0128,
CVE-2007-5461, CVE-2007-3385, CVE-2007-3382, CVE-2007-1358, CVE-2007-1355,
CVE-2007-2450, CVE-2007-2449, CVE-2007-0450, CVE-2006-7196, CVE-2006-7195,
CVE-2006-3835, CVE-2006-0254, CVE-2005-2090, CVE-2005-4838, CVE-2005-3510)
Users of Red Hat Network Satellite Server 4.2 are advised to upgrade to
4.2.3, which resolves these issues.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ document: { aggregate_severity: { namespace: "https://access.redhat.com/security/updates/classification/", text: "Low", }, category: "csaf_security_advisory", csaf_version: "2.0", distribution: { text: "Copyright © Red Hat, Inc. All rights reserved.", tlp: { label: "WHITE", url: "https://www.first.org/tlp/", }, }, lang: "en", notes: [ { category: "summary", text: "Red Hat Network Satellite Server version 4.2.3 is now available. This\nupdate includes fixes for a number of security issues in Red Hat Network\nSatellite Server components.\n\nThis update has been rated as having low security impact by the Red Hat\nSecurity Response Team.", title: "Topic", }, { category: "general", text: "This release corrects several security vulnerabilities in various\ncomponents shipped as part of the Red Hat Network Satellite Server 4.2. In\na typical operating environment, these components are not exposed to users\nof Satellite Server in a vulnerable manner. These security updates will\nreduce risk in unique Satellite Server environments.\n\nMultiple flaws were fixed in the Apache HTTPD server. These flaws could\nresult in a cross-site scripting, denial-of-service, or information\ndisclosure attacks. (CVE-2004-0885, CVE-2006-5752, CVE-2006-7197,\nCVE-2007-1860, CVE-2007-3304, CVE-2007-4465, CVE-2007-5000, CVE-2007-6388)\n\nA denial-of-service flaw was fixed in mod_perl. (CVE-2007-1349)\n\nA denial-of-service flaw was fixed in the jabberd server. (CVE-2006-1329)\n\nMultiple cross-site scripting flaws were fixed in the image map feature in\nthe JFreeChart package. (CVE-2007-6306)\n\nMultiple flaws were fixed in the IBM Java 1.4.2 Runtime. (CVE-2007-0243,\nCVE-2007-2435, CVE-2007-2788, CVE-2007-2789)\n\nMultiple flaws were fixed in the OpenMotif package. (CVE-2004-0687,\nCVE-2004-0688, CVE-2004-0914, CVE-2005-3964, CVE-2005-0605)\n\nA flaw which could result in weak encryption was fixed in the\nperl-Crypt-CBC package. (CVE-2006-0898)\n\nMultiple flaws were fixed in the Tomcat package. (CVE-2008-0128,\nCVE-2007-5461, CVE-2007-3385, CVE-2007-3382, CVE-2007-1358, CVE-2007-1355,\nCVE-2007-2450, CVE-2007-2449, CVE-2007-0450, CVE-2006-7196, CVE-2006-7195,\nCVE-2006-3835, CVE-2006-0254, CVE-2005-2090, CVE-2005-4838, CVE-2005-3510)\n\nUsers of Red Hat Network Satellite Server 4.2 are advised to upgrade to\n4.2.3, which resolves these issues.", title: "Details", }, { category: "legal_disclaimer", text: "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", title: "Terms of Use", }, ], publisher: { category: "vendor", contact_details: "https://access.redhat.com/security/team/contact/", issuing_authority: "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", name: "Red Hat Product Security", namespace: "https://www.redhat.com", }, references: [ { category: "self", summary: "https://access.redhat.com/errata/RHSA-2008:0524", url: "https://access.redhat.com/errata/RHSA-2008:0524", }, { category: "external", summary: "https://access.redhat.com/security/updates/classification/#low", url: "https://access.redhat.com/security/updates/classification/#low", }, { category: "external", summary: "449337", url: "https://bugzilla.redhat.com/show_bug.cgi?id=449337", }, { category: "self", summary: "Canonical URL", url: "https://security.access.redhat.com/data/csaf/v2/advisories/2008/rhsa-2008_0524.json", }, ], title: "Red Hat Security Advisory: Red Hat Network Satellite Server security update", tracking: { current_release_date: "2024-12-08T10:33:43+00:00", generator: { date: "2024-12-08T10:33:43+00:00", engine: { name: "Red Hat SDEngine", version: "4.2.3", }, }, id: "RHSA-2008:0524", initial_release_date: "2008-06-30T15:33:00+00:00", revision_history: [ { date: "2008-06-30T15:33:00+00:00", number: "1", summary: "Initial version", }, { date: "2008-06-30T11:33:26+00:00", number: "2", summary: "Last updated version", }, { date: "2024-12-08T10:33:43+00:00", number: "3", summary: "Last generated version", }, ], status: "final", version: "3", }, }, product_tree: { branches: [ { branches: [ { branches: [ { category: "product_name", name: "Red Hat Satellite v 4.2 (RHEL v.3 AS)", product: { name: "Red Hat Satellite v 4.2 (RHEL v.3 AS)", product_id: "3AS-RHNSAT4.2", product_identification_helper: { cpe: "cpe:/a:redhat:network_satellite:4.2::el3", }, }, }, { category: "product_name", name: "Red Hat Satellite v 4.2 (RHEL v.4 AS)", product: { name: "Red Hat Satellite v 4.2 (RHEL v.4 AS)", product_id: "4AS-RHNSAT4.2", product_identification_helper: { cpe: "cpe:/a:redhat:network_satellite:4.2::el4", }, }, }, ], category: "product_family", name: "Red Hat Satellite", }, { branches: [ { category: "product_version", name: "jabberd-0:2.0s10-3.37.rhn.i386", product: { name: "jabberd-0:2.0s10-3.37.rhn.i386", product_id: "jabberd-0:2.0s10-3.37.rhn.i386", product_identification_helper: { purl: "pkg:rpm/redhat/jabberd@2.0s10-3.37.rhn?arch=i386", }, }, }, { category: "product_version", name: "java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", product: { name: "java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", product_id: "java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", product_identification_helper: { purl: "pkg:rpm/redhat/java-1.4.2-ibm-devel@1.4.2.10-1jpp.2.el3?arch=i386", }, }, }, { category: "product_version", name: "java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", product: { name: "java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", product_id: "java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", product_identification_helper: { purl: "pkg:rpm/redhat/java-1.4.2-ibm@1.4.2.10-1jpp.2.el3?arch=i386", }, }, }, { category: "product_version", name: "rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", product: { name: "rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", product_id: "rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", product_identification_helper: { purl: "pkg:rpm/redhat/rhn-modjk-ap13@1.2.23-2rhn.rhel3?arch=i386", }, }, }, { category: "product_version", name: "openmotif21-0:2.1.30-9.RHEL3.8.i386", product: { name: "openmotif21-0:2.1.30-9.RHEL3.8.i386", product_id: "openmotif21-0:2.1.30-9.RHEL3.8.i386", product_identification_helper: { purl: "pkg:rpm/redhat/openmotif21@2.1.30-9.RHEL3.8?arch=i386", }, }, }, { category: "product_version", name: "openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", product: { name: "openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", product_id: "openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", product_identification_helper: { purl: "pkg:rpm/redhat/openmotif21-debuginfo@2.1.30-9.RHEL3.8?arch=i386", }, }, }, { category: "product_version", name: "rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", product: { name: "rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", product_id: "rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", product_identification_helper: { purl: "pkg:rpm/redhat/rhn-modssl@2.8.12-8.rhn.10.rhel3?arch=i386", }, }, }, { category: "product_version", name: "rhn-apache-0:1.3.27-36.rhn.rhel3.i386", product: { name: "rhn-apache-0:1.3.27-36.rhn.rhel3.i386", product_id: "rhn-apache-0:1.3.27-36.rhn.rhel3.i386", product_identification_helper: { purl: "pkg:rpm/redhat/rhn-apache@1.3.27-36.rhn.rhel3?arch=i386", }, }, }, { category: "product_version", name: "rhn-modperl-0:1.29-16.rhel3.i386", product: { name: "rhn-modperl-0:1.29-16.rhel3.i386", product_id: "rhn-modperl-0:1.29-16.rhel3.i386", product_identification_helper: { purl: "pkg:rpm/redhat/rhn-modperl@1.29-16.rhel3?arch=i386", }, }, }, { category: "product_version", name: "rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", product: { name: "rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", product_id: "rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", product_identification_helper: { purl: "pkg:rpm/redhat/rhn-modssl@2.8.12-8.rhn.10.rhel4?arch=i386", }, }, }, { category: "product_version", name: "jabberd-0:2.0s10-3.38.rhn.i386", product: { name: "jabberd-0:2.0s10-3.38.rhn.i386", product_id: "jabberd-0:2.0s10-3.38.rhn.i386", product_identification_helper: { purl: "pkg:rpm/redhat/jabberd@2.0s10-3.38.rhn?arch=i386", }, }, }, { category: "product_version", name: "openmotif21-0:2.1.30-11.RHEL4.6.i386", product: { name: "openmotif21-0:2.1.30-11.RHEL4.6.i386", product_id: "openmotif21-0:2.1.30-11.RHEL4.6.i386", product_identification_helper: { purl: "pkg:rpm/redhat/openmotif21@2.1.30-11.RHEL4.6?arch=i386", }, }, }, { category: "product_version", name: "openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", product: { name: "openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", product_id: "openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", product_identification_helper: { purl: "pkg:rpm/redhat/openmotif21-debuginfo@2.1.30-11.RHEL4.6?arch=i386", }, }, }, { category: "product_version", name: "rhn-apache-0:1.3.27-36.rhn.rhel4.i386", product: { name: "rhn-apache-0:1.3.27-36.rhn.rhel4.i386", product_id: "rhn-apache-0:1.3.27-36.rhn.rhel4.i386", product_identification_helper: { purl: "pkg:rpm/redhat/rhn-apache@1.3.27-36.rhn.rhel4?arch=i386", }, }, }, { category: "product_version", name: "java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", product: { name: "java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", product_id: "java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", product_identification_helper: { purl: "pkg:rpm/redhat/java-1.4.2-ibm@1.4.2.10-1jpp.2.el4?arch=i386", }, }, }, { category: "product_version", name: "java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", product: { name: "java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", product_id: "java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", product_identification_helper: { purl: "pkg:rpm/redhat/java-1.4.2-ibm-devel@1.4.2.10-1jpp.2.el4?arch=i386", }, }, }, { category: "product_version", name: "rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", product: { name: "rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", product_id: "rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", product_identification_helper: { purl: "pkg:rpm/redhat/rhn-modjk-ap13@1.2.23-2rhn.rhel4?arch=i386", }, }, }, { category: "product_version", name: "rhn-modperl-0:1.29-16.rhel4.i386", product: { name: "rhn-modperl-0:1.29-16.rhel4.i386", product_id: "rhn-modperl-0:1.29-16.rhel4.i386", product_identification_helper: { purl: "pkg:rpm/redhat/rhn-modperl@1.29-16.rhel4?arch=i386", }, }, }, ], category: "architecture", name: "i386", }, { branches: [ { category: "product_version", name: "jfreechart-0:0.9.20-3.rhn.noarch", product: { name: "jfreechart-0:0.9.20-3.rhn.noarch", product_id: "jfreechart-0:0.9.20-3.rhn.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/jfreechart@0.9.20-3.rhn?arch=noarch", }, }, }, { category: "product_version", name: "tomcat5-0:5.0.30-0jpp_10rh.noarch", product: { name: "tomcat5-0:5.0.30-0jpp_10rh.noarch", product_id: "tomcat5-0:5.0.30-0jpp_10rh.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/tomcat5@5.0.30-0jpp_10rh?arch=noarch", }, }, }, { category: "product_version", name: "perl-Crypt-CBC-0:2.24-1.el3.noarch", product: { name: "perl-Crypt-CBC-0:2.24-1.el3.noarch", product_id: "perl-Crypt-CBC-0:2.24-1.el3.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/perl-Crypt-CBC@2.24-1.el3?arch=noarch", }, }, }, { category: "product_version", name: "perl-Crypt-CBC-0:2.24-1.el4.noarch", product: { name: "perl-Crypt-CBC-0:2.24-1.el4.noarch", product_id: "perl-Crypt-CBC-0:2.24-1.el4.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/perl-Crypt-CBC@2.24-1.el4?arch=noarch", }, }, }, ], category: "architecture", name: "noarch", }, ], category: "vendor", name: "Red Hat", }, ], relationships: [ { category: "default_component_of", full_product_name: { name: "jabberd-0:2.0s10-3.37.rhn.i386 as a component of Red Hat Satellite v 4.2 (RHEL v.3 AS)", product_id: "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", }, product_reference: "jabberd-0:2.0s10-3.37.rhn.i386", relates_to_product_reference: "3AS-RHNSAT4.2", }, { category: "default_component_of", full_product_name: { name: "java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386 as a component of Red Hat Satellite v 4.2 (RHEL v.3 AS)", product_id: "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", }, product_reference: "java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", relates_to_product_reference: "3AS-RHNSAT4.2", }, { category: "default_component_of", full_product_name: { name: "java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386 as a component of Red Hat Satellite v 4.2 (RHEL v.3 AS)", product_id: "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", }, product_reference: "java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", relates_to_product_reference: "3AS-RHNSAT4.2", }, { category: "default_component_of", full_product_name: { name: "jfreechart-0:0.9.20-3.rhn.noarch as a component of Red Hat Satellite v 4.2 (RHEL v.3 AS)", product_id: "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", }, product_reference: "jfreechart-0:0.9.20-3.rhn.noarch", relates_to_product_reference: "3AS-RHNSAT4.2", }, { category: "default_component_of", full_product_name: { name: "openmotif21-0:2.1.30-9.RHEL3.8.i386 as a component of Red Hat Satellite v 4.2 (RHEL v.3 AS)", product_id: "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", }, product_reference: "openmotif21-0:2.1.30-9.RHEL3.8.i386", relates_to_product_reference: "3AS-RHNSAT4.2", }, { category: "default_component_of", full_product_name: { name: "openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386 as a component of Red Hat Satellite v 4.2 (RHEL v.3 AS)", product_id: "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", }, product_reference: "openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", relates_to_product_reference: "3AS-RHNSAT4.2", }, { category: "default_component_of", full_product_name: { name: "perl-Crypt-CBC-0:2.24-1.el3.noarch as a component of Red Hat Satellite v 4.2 (RHEL v.3 AS)", product_id: "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", }, product_reference: "perl-Crypt-CBC-0:2.24-1.el3.noarch", relates_to_product_reference: "3AS-RHNSAT4.2", }, { category: "default_component_of", full_product_name: { name: "rhn-apache-0:1.3.27-36.rhn.rhel3.i386 as a component of Red Hat Satellite v 4.2 (RHEL v.3 AS)", product_id: "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", }, product_reference: "rhn-apache-0:1.3.27-36.rhn.rhel3.i386", relates_to_product_reference: "3AS-RHNSAT4.2", }, { category: "default_component_of", full_product_name: { name: "rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386 as a component of Red Hat Satellite v 4.2 (RHEL v.3 AS)", product_id: "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", }, product_reference: "rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", relates_to_product_reference: "3AS-RHNSAT4.2", }, { category: "default_component_of", full_product_name: { name: "rhn-modperl-0:1.29-16.rhel3.i386 as a component of Red Hat Satellite v 4.2 (RHEL v.3 AS)", product_id: "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", }, product_reference: "rhn-modperl-0:1.29-16.rhel3.i386", relates_to_product_reference: "3AS-RHNSAT4.2", }, { category: "default_component_of", full_product_name: { name: "rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386 as a component of Red Hat Satellite v 4.2 (RHEL v.3 AS)", product_id: "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", }, product_reference: "rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", relates_to_product_reference: "3AS-RHNSAT4.2", }, { category: "default_component_of", full_product_name: { name: "tomcat5-0:5.0.30-0jpp_10rh.noarch as a component of Red Hat Satellite v 4.2 (RHEL v.3 AS)", product_id: "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", }, product_reference: "tomcat5-0:5.0.30-0jpp_10rh.noarch", relates_to_product_reference: "3AS-RHNSAT4.2", }, { category: "default_component_of", full_product_name: { name: "jabberd-0:2.0s10-3.38.rhn.i386 as a component of Red Hat Satellite v 4.2 (RHEL v.4 AS)", product_id: "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", }, product_reference: "jabberd-0:2.0s10-3.38.rhn.i386", relates_to_product_reference: "4AS-RHNSAT4.2", }, { category: "default_component_of", full_product_name: { name: "java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386 as a component of Red Hat Satellite v 4.2 (RHEL v.4 AS)", product_id: "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", }, product_reference: "java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", relates_to_product_reference: "4AS-RHNSAT4.2", }, { category: "default_component_of", full_product_name: { name: "java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386 as a component of Red Hat Satellite v 4.2 (RHEL v.4 AS)", product_id: "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", }, product_reference: "java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", relates_to_product_reference: "4AS-RHNSAT4.2", }, { category: "default_component_of", full_product_name: { name: "jfreechart-0:0.9.20-3.rhn.noarch as a component of Red Hat Satellite v 4.2 (RHEL v.4 AS)", product_id: "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", }, product_reference: "jfreechart-0:0.9.20-3.rhn.noarch", relates_to_product_reference: "4AS-RHNSAT4.2", }, { category: "default_component_of", full_product_name: { name: "openmotif21-0:2.1.30-11.RHEL4.6.i386 as a component of Red Hat Satellite v 4.2 (RHEL v.4 AS)", product_id: "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", }, product_reference: "openmotif21-0:2.1.30-11.RHEL4.6.i386", relates_to_product_reference: "4AS-RHNSAT4.2", }, { category: "default_component_of", full_product_name: { name: "openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386 as a component of Red Hat Satellite v 4.2 (RHEL v.4 AS)", product_id: "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", }, product_reference: "openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", relates_to_product_reference: "4AS-RHNSAT4.2", }, { category: "default_component_of", full_product_name: { name: "perl-Crypt-CBC-0:2.24-1.el4.noarch as a component of Red Hat Satellite v 4.2 (RHEL v.4 AS)", product_id: "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", }, product_reference: "perl-Crypt-CBC-0:2.24-1.el4.noarch", relates_to_product_reference: "4AS-RHNSAT4.2", }, { category: "default_component_of", full_product_name: { name: "rhn-apache-0:1.3.27-36.rhn.rhel4.i386 as a component of Red Hat Satellite v 4.2 (RHEL v.4 AS)", product_id: "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", }, product_reference: "rhn-apache-0:1.3.27-36.rhn.rhel4.i386", relates_to_product_reference: "4AS-RHNSAT4.2", }, { category: "default_component_of", full_product_name: { name: "rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386 as a component of Red Hat Satellite v 4.2 (RHEL v.4 AS)", product_id: "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", }, product_reference: "rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", relates_to_product_reference: "4AS-RHNSAT4.2", }, { category: "default_component_of", full_product_name: { name: "rhn-modperl-0:1.29-16.rhel4.i386 as a component of Red Hat Satellite v 4.2 (RHEL v.4 AS)", product_id: "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", }, product_reference: "rhn-modperl-0:1.29-16.rhel4.i386", relates_to_product_reference: "4AS-RHNSAT4.2", }, { category: "default_component_of", full_product_name: { name: "rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386 as a component of Red Hat Satellite v 4.2 (RHEL v.4 AS)", product_id: "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", }, product_reference: "rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", relates_to_product_reference: "4AS-RHNSAT4.2", }, { category: "default_component_of", full_product_name: { name: "tomcat5-0:5.0.30-0jpp_10rh.noarch as a component of Red Hat Satellite v 4.2 (RHEL v.4 AS)", product_id: "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", }, product_reference: "tomcat5-0:5.0.30-0jpp_10rh.noarch", relates_to_product_reference: "4AS-RHNSAT4.2", }, ], }, vulnerabilities: [ { cve: "CVE-2004-0687", ids: [ { system_name: "Red Hat Bugzilla ID", text: "430513", }, ], notes: [ { category: "description", text: "Multiple stack-based buffer overflows in (1) xpmParseColors in parse.c, (2) ParseAndPutPixels in create.c, and (3) ParsePixels in parse.c for libXpm before 6.8.1 allow remote attackers to execute arbitrary code via a malformed XPM image file.", title: "Vulnerability description", }, { category: "summary", text: "openmotif21 stack overflows in libxpm", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Enterprise Linux 5 is not vulnerable to this issue as it contains a backported patch.", title: "Statement", }, ], product_status: { fixed: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2004-0687", }, { category: "external", summary: "RHBZ#430513", url: "https://bugzilla.redhat.com/show_bug.cgi?id=430513", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2004-0687", url: "https://www.cve.org/CVERecord?id=CVE-2004-0687", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2004-0687", url: "https://nvd.nist.gov/vuln/detail/CVE-2004-0687", }, ], release_date: "2004-10-07T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-06-30T15:33:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0524", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "openmotif21 stack overflows in libxpm", }, { cve: "CVE-2004-0688", ids: [ { system_name: "Red Hat Bugzilla ID", text: "430515", }, ], notes: [ { category: "description", text: "Multiple integer overflows in (1) the xpmParseColors function in parse.c, (2) XpmCreateImageFromXpmImage, (3) CreateXImage, (4) ParsePixels, and (5) ParseAndPutPixels for libXpm before 6.8.1 may allow remote attackers to execute arbitrary code via a malformed XPM image file.", title: "Vulnerability description", }, { category: "summary", text: "openmotif21 stack overflows in libxpm", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Enterprise Linux 5 is not vulnerable to this issue as it contains a backported patch.", title: "Statement", }, ], product_status: { fixed: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2004-0688", }, { category: "external", summary: "RHBZ#430515", url: "https://bugzilla.redhat.com/show_bug.cgi?id=430515", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2004-0688", url: "https://www.cve.org/CVERecord?id=CVE-2004-0688", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2004-0688", url: "https://nvd.nist.gov/vuln/detail/CVE-2004-0688", }, ], release_date: "2004-09-15T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-06-30T15:33:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0524", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "openmotif21 stack overflows in libxpm", }, { cve: "CVE-2004-0885", ids: [ { system_name: "Red Hat Bugzilla ID", text: "430637", }, ], notes: [ { category: "description", text: "The mod_ssl module in Apache 2.0.35 through 2.0.52, when using the \"SSLCipherSuite\" directive in directory or location context, allows remote clients to bypass intended restrictions by using any cipher suite that is allowed by the virtual host configuration.", title: "Vulnerability description", }, { category: "summary", text: "mod_ssl SSLCipherSuite bypass", title: "Vulnerability summary", }, ], product_status: { fixed: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2004-0885", }, { category: "external", summary: "RHBZ#430637", url: "https://bugzilla.redhat.com/show_bug.cgi?id=430637", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2004-0885", url: "https://www.cve.org/CVERecord?id=CVE-2004-0885", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2004-0885", url: "https://nvd.nist.gov/vuln/detail/CVE-2004-0885", }, ], release_date: "2004-10-05T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-06-30T15:33:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0524", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "mod_ssl SSLCipherSuite bypass", }, { cve: "CVE-2004-0914", ids: [ { system_name: "Red Hat Bugzilla ID", text: "430516", }, ], notes: [ { category: "description", text: "Multiple vulnerabilities in libXpm for 6.8.1 and earlier, as used in XFree86 and other packages, include (1) multiple integer overflows, (2) out-of-bounds memory accesses, (3) directory traversal, (4) shell metacharacter, (5) endless loops, and (6) memory leaks, which could allow remote attackers to obtain sensitive information, cause a denial of service (application crash), or execute arbitrary code via a certain XPM image file. NOTE: it is highly likely that this candidate will be SPLIT into other candidates in the future, per CVE's content decisions.", title: "Vulnerability description", }, { category: "summary", text: "openmotif21 stack overflows in libxpm", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Enterprise Linux 5 is not vulnerable to this issue as it contains a backported patch.", title: "Statement", }, ], product_status: { fixed: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2004-0914", }, { category: "external", summary: "RHBZ#430516", url: "https://bugzilla.redhat.com/show_bug.cgi?id=430516", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2004-0914", url: "https://www.cve.org/CVERecord?id=CVE-2004-0914", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2004-0914", url: "https://nvd.nist.gov/vuln/detail/CVE-2004-0914", }, ], release_date: "2004-09-15T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-06-30T15:33:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0524", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "openmotif21 stack overflows in libxpm", }, { cve: "CVE-2005-0605", discovery_date: "2005-02-28T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "430520", }, ], notes: [ { category: "description", text: "scan.c for LibXPM may allow attackers to execute arbitrary code via a negative bitmap_unit value that leads to a buffer overflow.", title: "Vulnerability description", }, { category: "summary", text: "libxpm buffer overflow", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Enterprise Linux 5 is not vulnerable to this issue as it contains a backported patch.", title: "Statement", }, ], product_status: { fixed: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2005-0605", }, { category: "external", summary: "RHBZ#430520", url: "https://bugzilla.redhat.com/show_bug.cgi?id=430520", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2005-0605", url: "https://www.cve.org/CVERecord?id=CVE-2005-0605", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2005-0605", url: "https://nvd.nist.gov/vuln/detail/CVE-2005-0605", }, ], release_date: "2005-03-01T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-06-30T15:33:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0524", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "libxpm buffer overflow", }, { cve: "CVE-2005-2090", discovery_date: "2005-06-06T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "237079", }, ], notes: [ { category: "description", text: "Jakarta Tomcat 5.0.19 (Coyote/1.1) and Tomcat 4.1.24 (Coyote/1.0) allows remote attackers to poison the web cache, bypass web application firewall protection, and conduct XSS attacks via an HTTP request with both a \"Transfer-Encoding: chunked\" header and a Content-Length header, which causes Tomcat to incorrectly handle and forward the body of the request in a way that causes the receiving server to process it as a separate HTTP request, aka \"HTTP Request Smuggling.\"", title: "Vulnerability description", }, { category: "summary", text: "tomcat multiple content-length header poisioning", title: "Vulnerability summary", }, ], product_status: { fixed: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2005-2090", }, { category: "external", summary: "RHBZ#237079", url: "https://bugzilla.redhat.com/show_bug.cgi?id=237079", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2005-2090", url: "https://www.cve.org/CVERecord?id=CVE-2005-2090", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2005-2090", url: "https://nvd.nist.gov/vuln/detail/CVE-2005-2090", }, ], release_date: "2005-06-06T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-06-30T15:33:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0524", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "tomcat multiple content-length header poisioning", }, { cve: "CVE-2005-3510", discovery_date: "2005-11-07T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "237085", }, ], notes: [ { category: "description", text: "Apache Tomcat 5.5.0 to 5.5.11 allows remote attackers to cause a denial of service (CPU consumption) via a large number of simultaneous requests to list a web directory that has a large number of files.", title: "Vulnerability description", }, { category: "summary", text: "tomcat DoS", title: "Vulnerability summary", }, ], product_status: { fixed: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2005-3510", }, { category: "external", summary: "RHBZ#237085", url: "https://bugzilla.redhat.com/show_bug.cgi?id=237085", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2005-3510", url: "https://www.cve.org/CVERecord?id=CVE-2005-3510", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2005-3510", url: "https://nvd.nist.gov/vuln/detail/CVE-2005-3510", }, ], release_date: "2005-11-03T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-06-30T15:33:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0524", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "tomcat DoS", }, { cve: "CVE-2005-3964", discovery_date: "2005-12-02T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "430519", }, ], notes: [ { category: "description", text: "Multiple buffer overflows in libUil (libUil.so) in OpenMotif 2.2.3, and possibly other versions, allows attackers to execute arbitrary code via the (1) diag_issue_diagnostic function in UilDiags.c and (2) open_source_file function in UilSrcSrc.c.", title: "Vulnerability description", }, { category: "summary", text: "openmotif libUil buffer overflows", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Enterprise Linux 5 is not vulnerable to this issue as it contains a backported patch.", title: "Statement", }, ], product_status: { fixed: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2005-3964", }, { category: "external", summary: "RHBZ#430519", url: "https://bugzilla.redhat.com/show_bug.cgi?id=430519", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2005-3964", url: "https://www.cve.org/CVERecord?id=CVE-2005-3964", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2005-3964", url: "https://nvd.nist.gov/vuln/detail/CVE-2005-3964", }, ], release_date: "2005-12-02T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-06-30T15:33:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0524", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "openmotif libUil buffer overflows", }, { cve: "CVE-2005-4838", discovery_date: "2005-01-03T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "238401", }, ], notes: [ { category: "description", text: "Multiple cross-site scripting (XSS) vulnerabilities in the example web applications for Jakarta Tomcat 5.5.6 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) el/functions.jsp, (2) el/implicit-objects.jsp, and (3) jspx/textRotate.jspx in examples/jsp2/, as demonstrated via script in a request to snp/snoop.jsp. NOTE: other XSS issues in the manager were simultaneously reported, but these require admin access and do not cross privilege boundaries.", title: "Vulnerability description", }, { category: "summary", text: "tomcat manager example DoS", title: "Vulnerability summary", }, ], product_status: { fixed: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2005-4838", }, { category: "external", summary: "RHBZ#238401", url: "https://bugzilla.redhat.com/show_bug.cgi?id=238401", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2005-4838", url: "https://www.cve.org/CVERecord?id=CVE-2005-4838", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2005-4838", url: "https://nvd.nist.gov/vuln/detail/CVE-2005-4838", }, ], release_date: "2005-01-03T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-06-30T15:33:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0524", }, ], threats: [ { category: "impact", details: "Low", }, ], title: "tomcat manager example DoS", }, { cve: "CVE-2006-0254", cwe: { id: "CWE-79", name: "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", }, discovery_date: "2006-01-17T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "430646", }, ], notes: [ { category: "description", text: "Multiple cross-site scripting (XSS) vulnerabilities in Apache Geronimo 1.0 allow remote attackers to inject arbitrary web script or HTML via the (1) time parameter to cal2.jsp and (2) any invalid parameter, which causes an XSS when the log file is viewed by the Web-Access-Log viewer.", title: "Vulnerability description", }, { category: "summary", text: "tomcat examples XSS", title: "Vulnerability summary", }, ], product_status: { fixed: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2006-0254", }, { category: "external", summary: "RHBZ#430646", url: "https://bugzilla.redhat.com/show_bug.cgi?id=430646", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2006-0254", url: "https://www.cve.org/CVERecord?id=CVE-2006-0254", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2006-0254", url: "https://nvd.nist.gov/vuln/detail/CVE-2006-0254", }, ], release_date: "2006-01-15T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-06-30T15:33:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0524", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "tomcat examples XSS", }, { cve: "CVE-2006-0898", ids: [ { system_name: "Red Hat Bugzilla ID", text: "430522", }, ], notes: [ { category: "description", text: "Crypt::CBC Perl module 2.16 and earlier, when running in RandomIV mode, uses an initialization vector (IV) of 8 bytes, which results in weaker encryption when used with a cipher that requires a larger block size than 8 bytes, such as Rijndael.", title: "Vulnerability description", }, { category: "summary", text: "perl-Crypt-CBC weaker encryption with some ciphers", title: "Vulnerability summary", }, ], product_status: { fixed: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2006-0898", }, { category: "external", summary: "RHBZ#430522", url: "https://bugzilla.redhat.com/show_bug.cgi?id=430522", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2006-0898", url: "https://www.cve.org/CVERecord?id=CVE-2006-0898", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2006-0898", url: "https://nvd.nist.gov/vuln/detail/CVE-2006-0898", }, ], release_date: "2006-02-23T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-06-30T15:33:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0524", }, ], threats: [ { category: "impact", details: "Low", }, ], title: "perl-Crypt-CBC weaker encryption with some ciphers", }, { cve: "CVE-2006-1329", ids: [ { system_name: "Red Hat Bugzilla ID", text: "429254", }, ], notes: [ { category: "description", text: "The SASL negotiation in Jabber Studio jabberd before 2.0s11 allows remote attackers to cause a denial of service (\"c2s segfault\") by sending a \"response stanza before an auth stanza\".", title: "Vulnerability description", }, { category: "summary", text: "jabberd SASL DoS", title: "Vulnerability summary", }, ], product_status: { fixed: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2006-1329", }, { category: "external", summary: "RHBZ#429254", url: "https://bugzilla.redhat.com/show_bug.cgi?id=429254", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2006-1329", url: "https://www.cve.org/CVERecord?id=CVE-2006-1329", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2006-1329", url: "https://nvd.nist.gov/vuln/detail/CVE-2006-1329", }, ], release_date: "2006-03-09T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-06-30T15:33:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0524", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "jabberd SASL DoS", }, { cve: "CVE-2006-3835", discovery_date: "2006-07-21T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "237084", }, ], notes: [ { category: "description", text: "Apache Tomcat 5 before 5.5.17 allows remote attackers to list directories via a semicolon (;) preceding a filename with a mapped extension, as demonstrated by URLs ending with /;index.jsp and /;help.do.", title: "Vulnerability description", }, { category: "summary", text: "tomcat directory listing issue", title: "Vulnerability summary", }, { category: "other", text: "This issue is not a security issue in Tomcat itself, but is caused when directory listings are enabled.\n\nDetails on how to disable directory listings are available at: http://tomcat.apache.org/faq/misc.html#listing", title: "Statement", }, ], product_status: { fixed: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2006-3835", }, { category: "external", summary: "RHBZ#237084", url: "https://bugzilla.redhat.com/show_bug.cgi?id=237084", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2006-3835", url: "https://www.cve.org/CVERecord?id=CVE-2006-3835", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2006-3835", url: "https://nvd.nist.gov/vuln/detail/CVE-2006-3835", }, ], release_date: "2006-07-21T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-06-30T15:33:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0524", }, ], threats: [ { category: "impact", details: "Low", }, ], title: "tomcat directory listing issue", }, { cve: "CVE-2006-5752", cwe: { id: "CWE-79", name: "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", }, discovery_date: "2007-06-20T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "245112", }, ], notes: [ { category: "description", text: "Cross-site scripting (XSS) vulnerability in mod_status.c in the mod_status module in Apache HTTP Server (httpd), when ExtendedStatus is enabled and a public server-status page is used, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors involving charsets with browsers that perform \"charset detection\" when the content-type is not specified.", title: "Vulnerability description", }, { category: "summary", text: "httpd mod_status XSS", title: "Vulnerability summary", }, ], product_status: { fixed: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2006-5752", }, { category: "external", summary: "RHBZ#245112", url: "https://bugzilla.redhat.com/show_bug.cgi?id=245112", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2006-5752", url: "https://www.cve.org/CVERecord?id=CVE-2006-5752", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2006-5752", url: "https://nvd.nist.gov/vuln/detail/CVE-2006-5752", }, ], release_date: "2007-06-20T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-06-30T15:33:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0524", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "httpd mod_status XSS", }, { cve: "CVE-2006-7195", cwe: { id: "CWE-79", name: "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", }, discovery_date: "2007-04-19T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "237081", }, ], notes: [ { category: "description", text: "Cross-site scripting (XSS) vulnerability in implicit-objects.jsp in Apache Tomcat 5.0.0 through 5.0.30 and 5.5.0 through 5.5.17 allows remote attackers to inject arbitrary web script or HTML via certain header values.", title: "Vulnerability description", }, { category: "summary", text: "tomcat XSS in example webapps", title: "Vulnerability summary", }, ], product_status: { fixed: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2006-7195", }, { category: "external", summary: "RHBZ#237081", url: "https://bugzilla.redhat.com/show_bug.cgi?id=237081", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2006-7195", url: "https://www.cve.org/CVERecord?id=CVE-2006-7195", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2006-7195", url: "https://nvd.nist.gov/vuln/detail/CVE-2006-7195", }, ], release_date: "2007-04-19T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-06-30T15:33:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0524", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "tomcat XSS in example webapps", }, { cve: "CVE-2006-7196", cwe: { id: "CWE-79", name: "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", }, discovery_date: "2007-04-26T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "238131", }, ], notes: [ { category: "description", text: "Cross-site scripting (XSS) vulnerability in the calendar application example in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0 through 4.1.31, 5.0.0 through 5.0.30, and 5.5.0 through 5.5.15 allows remote attackers to inject arbitrary web script or HTML via the time parameter to cal2.jsp and possibly unspecified other vectors. NOTE: this may be related to CVE-2006-0254.1.", title: "Vulnerability description", }, { category: "summary", text: "tomcat XSS in example webapps", title: "Vulnerability summary", }, ], product_status: { fixed: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2006-7196", }, { category: "external", summary: "RHBZ#238131", url: "https://bugzilla.redhat.com/show_bug.cgi?id=238131", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2006-7196", url: "https://www.cve.org/CVERecord?id=CVE-2006-7196", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2006-7196", url: "https://nvd.nist.gov/vuln/detail/CVE-2006-7196", }, ], release_date: "2007-04-26T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-06-30T15:33:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0524", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "tomcat XSS in example webapps", }, { cve: "CVE-2006-7197", ids: [ { system_name: "Red Hat Bugzilla ID", text: "430642", }, ], notes: [ { category: "description", text: "The AJP connector in Apache Tomcat 5.5.15 uses an incorrect length for chunks, which can cause a buffer over-read in the ajp_process_callback in mod_jk, which allows remote attackers to read portions of sensitive memory.", title: "Vulnerability description", }, { category: "summary", text: "mod_jk chunk too long", title: "Vulnerability summary", }, ], product_status: { fixed: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2006-7197", }, { category: "external", summary: "RHBZ#430642", url: "https://bugzilla.redhat.com/show_bug.cgi?id=430642", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2006-7197", url: "https://www.cve.org/CVERecord?id=CVE-2006-7197", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2006-7197", url: "https://nvd.nist.gov/vuln/detail/CVE-2006-7197", }, ], release_date: "2006-03-05T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-06-30T15:33:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0524", }, ], threats: [ { category: "impact", details: "Important", }, ], title: "mod_jk chunk too long", }, { cve: "CVE-2007-0243", discovery_date: "2007-04-17T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "325941", }, ], notes: [ { category: "description", text: "Buffer overflow in Sun JDK and Java Runtime Environment (JRE) 5.0 Update 9 and earlier, SDK and JRE 1.4.2_12 and earlier, and SDK and JRE 1.3.1_18 and earlier allows applets to gain privileges via a GIF image with a block with a 0 width field, which triggers memory corruption.", title: "Vulnerability description", }, { category: "summary", text: "java-jre: GIF buffer overflow", title: "Vulnerability summary", }, ], product_status: { fixed: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-0243", }, { category: "external", summary: "RHBZ#325941", url: "https://bugzilla.redhat.com/show_bug.cgi?id=325941", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-0243", url: "https://www.cve.org/CVERecord?id=CVE-2007-0243", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-0243", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-0243", }, ], release_date: "2007-01-17T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-06-30T15:33:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0524", }, ], threats: [ { category: "impact", details: "Important", }, ], title: "java-jre: GIF buffer overflow", }, { cve: "CVE-2007-0450", discovery_date: "2007-03-14T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "237080", }, ], notes: [ { category: "description", text: "Directory traversal vulnerability in Apache HTTP Server and Tomcat 5.x before 5.5.22 and 6.x before 6.0.10, when using certain proxy modules (mod_proxy, mod_rewrite, mod_jk), allows remote attackers to read arbitrary files via a .. (dot dot) sequence with combinations of (1) \"/\" (slash), (2) \"\\\" (backslash), and (3) URL-encoded backslash (%5C) characters in the URL, which are valid separators in Tomcat but not in Apache.", title: "Vulnerability description", }, { category: "summary", text: "tomcat directory traversal", title: "Vulnerability summary", }, ], product_status: { fixed: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-0450", }, { category: "external", summary: "RHBZ#237080", url: "https://bugzilla.redhat.com/show_bug.cgi?id=237080", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-0450", url: "https://www.cve.org/CVERecord?id=CVE-2007-0450", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-0450", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-0450", }, ], release_date: "2007-03-14T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-06-30T15:33:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0524", }, ], threats: [ { category: "impact", details: "Important", }, ], title: "tomcat directory traversal", }, { cve: "CVE-2007-1349", discovery_date: "2007-05-17T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "240423", }, ], notes: [ { category: "description", text: "PerlRun.pm in Apache mod_perl before 1.30, and RegistryCooker.pm in mod_perl 2.x, does not properly escape PATH_INFO before use in a regular expression, which allows remote attackers to cause a denial of service (resource consumption) via a crafted URI.", title: "Vulnerability description", }, { category: "summary", text: "mod_perl PerlRun denial of service", title: "Vulnerability summary", }, ], product_status: { fixed: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-1349", }, { category: "external", summary: "RHBZ#240423", url: "https://bugzilla.redhat.com/show_bug.cgi?id=240423", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-1349", url: "https://www.cve.org/CVERecord?id=CVE-2007-1349", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-1349", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-1349", }, ], release_date: "2007-03-22T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-06-30T15:33:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0524", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "mod_perl PerlRun denial of service", }, { cve: "CVE-2007-1355", cwe: { id: "CWE-79", name: "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", }, discovery_date: "2007-05-19T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "253166", }, ], notes: [ { category: "description", text: "Multiple cross-site scripting (XSS) vulnerabilities in the appdev/sample/web/hello.jsp example application in Tomcat 4.0.0 through 4.0.6, 4.1.0 through 4.1.36, 5.0.0 through 5.0.30, 5.5.0 through 5.5.23, and 6.0.0 through 6.0.10 allow remote attackers to inject arbitrary web script or HTML via the test parameter and unspecified vectors.", title: "Vulnerability description", }, { category: "summary", text: "tomcat XSS in samples", title: "Vulnerability summary", }, ], product_status: { fixed: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-1355", }, { category: "external", summary: "RHBZ#253166", url: "https://bugzilla.redhat.com/show_bug.cgi?id=253166", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-1355", url: "https://www.cve.org/CVERecord?id=CVE-2007-1355", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-1355", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-1355", }, ], release_date: "2007-05-19T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-06-30T15:33:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0524", }, ], threats: [ { category: "impact", details: "Low", }, ], title: "tomcat XSS in samples", }, { cve: "CVE-2007-1358", cwe: { id: "CWE-79", name: "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", }, discovery_date: "2007-04-10T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "244803", }, ], notes: [ { category: "description", text: "Cross-site scripting (XSS) vulnerability in certain applications using Apache Tomcat 4.0.0 through 4.0.6 and 4.1.0 through 4.1.34 allows remote attackers to inject arbitrary web script or HTML via crafted \"Accept-Language headers that do not conform to RFC 2616\".", title: "Vulnerability description", }, { category: "summary", text: "tomcat accept-language xss flaw", title: "Vulnerability summary", }, ], product_status: { fixed: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-1358", }, { category: "external", summary: "RHBZ#244803", url: "https://bugzilla.redhat.com/show_bug.cgi?id=244803", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-1358", url: "https://www.cve.org/CVERecord?id=CVE-2007-1358", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-1358", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-1358", }, ], release_date: "2007-06-06T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-06-30T15:33:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0524", }, ], threats: [ { category: "impact", details: "Low", }, ], title: "tomcat accept-language xss flaw", }, { cve: "CVE-2007-1860", discovery_date: "2007-04-20T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "237656", }, ], notes: [ { category: "description", text: "mod_jk in Apache Tomcat JK Web Server Connector 1.2.x before 1.2.23 decodes request URLs within the Apache HTTP Server before passing the URL to Tomcat, which allows remote attackers to access protected pages via a crafted prefix JkMount, possibly involving double-encoded .. (dot dot) sequences and directory traversal, a related issue to CVE-2007-0450.", title: "Vulnerability description", }, { category: "summary", text: "mod_jk sends decoded URL to tomcat", title: "Vulnerability summary", }, ], product_status: { fixed: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-1860", }, { category: "external", summary: "RHBZ#237656", url: "https://bugzilla.redhat.com/show_bug.cgi?id=237656", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-1860", url: "https://www.cve.org/CVERecord?id=CVE-2007-1860", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-1860", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-1860", }, ], release_date: "2007-05-21T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-06-30T15:33:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0524", }, ], threats: [ { category: "impact", details: "Important", }, ], title: "mod_jk sends decoded URL to tomcat", }, { cve: "CVE-2007-2435", discovery_date: "2007-05-01T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "239660", }, ], notes: [ { category: "description", text: "Sun Java Web Start in JDK and JRE 5.0 Update 10 and earlier, and Java Web Start in SDK and JRE 1.4.2_13 and earlier, allows remote attackers to perform unauthorized actions via an application that grants privileges to itself, related to \"Incorrect Use of System Classes\" and probably related to support for JNLP files.", title: "Vulnerability description", }, { category: "summary", text: "javaws vulnerabilities", title: "Vulnerability summary", }, ], product_status: { fixed: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-2435", }, { category: "external", summary: "RHBZ#239660", url: "https://bugzilla.redhat.com/show_bug.cgi?id=239660", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-2435", url: "https://www.cve.org/CVERecord?id=CVE-2007-2435", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-2435", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-2435", }, ], release_date: "2007-04-30T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-06-30T15:33:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0524", }, ], threats: [ { category: "impact", details: "Critical", }, ], title: "javaws vulnerabilities", }, { cve: "CVE-2007-2449", cwe: { id: "CWE-79", name: "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", }, discovery_date: "2007-05-24T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "244804", }, ], notes: [ { category: "description", text: "Multiple cross-site scripting (XSS) vulnerabilities in certain JSP files in the examples web application in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0 through 4.1.36, 5.0.0 through 5.0.30, 5.5.0 through 5.5.24, and 6.0.0 through 6.0.13 allow remote attackers to inject arbitrary web script or HTML via the portion of the URI after the ';' character, as demonstrated by a URI containing a \"snp/snoop.jsp;\" sequence.", title: "Vulnerability description", }, { category: "summary", text: "tomcat examples jsp XSS", title: "Vulnerability summary", }, ], product_status: { fixed: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-2449", }, { category: "external", summary: "RHBZ#244804", url: "https://bugzilla.redhat.com/show_bug.cgi?id=244804", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-2449", url: "https://www.cve.org/CVERecord?id=CVE-2007-2449", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-2449", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-2449", }, ], release_date: "2007-06-13T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-06-30T15:33:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0524", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "tomcat examples jsp XSS", }, { cve: "CVE-2007-2450", cwe: { id: "CWE-79", name: "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", }, discovery_date: "2007-05-24T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "244808", }, ], notes: [ { category: "description", text: "Multiple cross-site scripting (XSS) vulnerabilities in the (1) Manager and (2) Host Manager web applications in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0 through 4.1.36, 5.0.0 through 5.0.30, 5.5.0 through 5.5.24, and 6.0.0 through 6.0.13 allow remote authenticated users to inject arbitrary web script or HTML via a parameter name to manager/html/upload, and other unspecified vectors.", title: "Vulnerability description", }, { category: "summary", text: "tomcat host manager XSS", title: "Vulnerability summary", }, ], product_status: { fixed: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-2450", }, { category: "external", summary: "RHBZ#244808", url: "https://bugzilla.redhat.com/show_bug.cgi?id=244808", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-2450", url: "https://www.cve.org/CVERecord?id=CVE-2007-2450", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-2450", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-2450", }, ], release_date: "2007-06-13T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-06-30T15:33:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0524", }, ], threats: [ { category: "impact", details: "Low", }, ], title: "tomcat host manager XSS", }, { cve: "CVE-2007-2788", cwe: { id: "CWE-190", name: "Integer Overflow or Wraparound", }, discovery_date: "2007-05-21T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "250725", }, ], notes: [ { category: "description", text: "Integer overflow in the embedded ICC profile image parser in Sun Java Development Kit (JDK) before 1.5.0_11-b03 and 1.6.x before 1.6.0_01-b06, and Sun Java Runtime Environment in JDK and JRE 6, JDK and JRE 5.0 Update 10 and earlier, SDK and JRE 1.4.2_14 and earlier, and SDK and JRE 1.3.1_20 and earlier, allows remote attackers to execute arbitrary code or cause a denial of service (JVM crash) via a crafted JPEG or BMP file that triggers a buffer overflow.", title: "Vulnerability description", }, { category: "summary", text: "Integer overflow in the embedded ICC profile image parser in Sun Java Development Kit", title: "Vulnerability summary", }, ], product_status: { fixed: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-2788", }, { category: "external", summary: "RHBZ#250725", url: "https://bugzilla.redhat.com/show_bug.cgi?id=250725", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-2788", url: "https://www.cve.org/CVERecord?id=CVE-2007-2788", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-2788", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-2788", }, ], release_date: "2007-05-21T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-06-30T15:33:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0524", }, ], threats: [ { category: "impact", details: "Critical", }, ], title: "Integer overflow in the embedded ICC profile image parser in Sun Java Development Kit", }, { cve: "CVE-2007-2789", discovery_date: "2007-05-21T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "250729", }, ], notes: [ { category: "description", text: "The BMP image parser in Sun Java Development Kit (JDK) before 1.5.0_11-b03 and 1.6.x before 1.6.0_01-b06, and Sun Java Runtime Environment in JDK and JRE 6, JDK and JRE 5.0 Update 10 and earlier, SDK and JRE 1.4.2_14 and earlier, and SDK and JRE 1.3.1_19 and earlier, when running on Unix/Linux systems, allows remote attackers to cause a denial of service (JVM hang) via untrusted applets or applications that open arbitrary local files via a crafted BMP file, such as /dev/tty.", title: "Vulnerability description", }, { category: "summary", text: "BMP image parser vulnerability", title: "Vulnerability summary", }, ], product_status: { fixed: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-2789", }, { category: "external", summary: "RHBZ#250729", url: "https://bugzilla.redhat.com/show_bug.cgi?id=250729", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-2789", url: "https://www.cve.org/CVERecord?id=CVE-2007-2789", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-2789", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-2789", }, ], release_date: "2007-05-21T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-06-30T15:33:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0524", }, ], threats: [ { category: "impact", details: "Critical", }, ], title: "BMP image parser vulnerability", }, { cve: "CVE-2007-3304", discovery_date: "2007-06-19T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "245111", }, ], notes: [ { category: "description", text: "Apache httpd 1.3.37, 2.0.59, and 2.2.4 with the Prefork MPM module, allows local users to cause a denial of service by modifying the worker_score and process_score arrays to reference an arbitrary process ID, which is sent a SIGUSR1 signal from the master process, aka \"SIGUSR1 killer.\"", title: "Vulnerability description", }, { category: "summary", text: "httpd scoreboard lack of PID protection", title: "Vulnerability summary", }, ], product_status: { fixed: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-3304", }, { category: "external", summary: "RHBZ#245111", url: "https://bugzilla.redhat.com/show_bug.cgi?id=245111", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-3304", url: "https://www.cve.org/CVERecord?id=CVE-2007-3304", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-3304", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-3304", }, ], release_date: "2007-06-19T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-06-30T15:33:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0524", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "httpd scoreboard lack of PID protection", }, { cve: "CVE-2007-3382", discovery_date: "2007-07-12T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "247972", }, ], notes: [ { category: "description", text: "Apache Tomcat 6.0.0 to 6.0.13, 5.5.0 to 5.5.24, 5.0.0 to 5.0.30, 4.1.0 to 4.1.36, and 3.3 to 3.3.2 treats single quotes (\"'\") as delimiters in cookies, which might cause sensitive information such as session IDs to be leaked and allow remote attackers to conduct session hijacking attacks.", title: "Vulnerability description", }, { category: "summary", text: "tomcat handling of cookies", title: "Vulnerability summary", }, ], product_status: { fixed: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-3382", }, { category: "external", summary: "RHBZ#247972", url: "https://bugzilla.redhat.com/show_bug.cgi?id=247972", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-3382", url: "https://www.cve.org/CVERecord?id=CVE-2007-3382", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-3382", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-3382", }, ], release_date: "2007-08-14T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-06-30T15:33:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0524", }, ], threats: [ { category: "impact", details: "Low", }, ], title: "tomcat handling of cookies", }, { cve: "CVE-2007-3385", discovery_date: "2007-07-12T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "247976", }, ], notes: [ { category: "description", text: "Apache Tomcat 6.0.0 to 6.0.13, 5.5.0 to 5.5.24, 5.0.0 to 5.0.30, 4.1.0 to 4.1.36, and 3.3 to 3.3.2 does not properly handle the \\\" character sequence in a cookie value, which might cause sensitive information such as session IDs to be leaked to remote attackers and enable session hijacking attacks.", title: "Vulnerability description", }, { category: "summary", text: "tomcat handling of cookie values", title: "Vulnerability summary", }, ], product_status: { fixed: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-3385", }, { category: "external", summary: "RHBZ#247976", url: "https://bugzilla.redhat.com/show_bug.cgi?id=247976", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-3385", url: "https://www.cve.org/CVERecord?id=CVE-2007-3385", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-3385", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-3385", }, ], release_date: "2007-08-14T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-06-30T15:33:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0524", }, ], threats: [ { category: "impact", details: "Low", }, ], title: "tomcat handling of cookie values", }, { cve: "CVE-2007-4465", cwe: { id: "CWE-79", name: "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", }, discovery_date: "2007-09-13T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "289511", }, ], notes: [ { category: "description", text: "Cross-site scripting (XSS) vulnerability in mod_autoindex.c in the Apache HTTP Server before 2.2.6, when the charset on a server-generated page is not defined, allows remote attackers to inject arbitrary web script or HTML via the P parameter using the UTF-7 charset. NOTE: it could be argued that this issue is due to a design limitation of browsers that attempt to perform automatic content type detection.", title: "Vulnerability description", }, { category: "summary", text: "mod_autoindex XSS", title: "Vulnerability summary", }, { category: "other", text: "This is actually a flaw in browsers that do not derive the response character set as required by RFC 2616. This does not affect the default configuration of Apache httpd in Red Hat products and will only affect customers who have removed the \"AddDefaultCharset\" directive and are using directory indexes. The Red Hat Product Security has rated this issue as having low security impact, a future update may address this flaw.", title: "Statement", }, ], product_status: { fixed: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-4465", }, { category: "external", summary: "RHBZ#289511", url: "https://bugzilla.redhat.com/show_bug.cgi?id=289511", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-4465", url: "https://www.cve.org/CVERecord?id=CVE-2007-4465", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-4465", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-4465", }, ], release_date: "2007-09-13T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-06-30T15:33:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0524", }, ], threats: [ { category: "impact", details: "Low", }, ], title: "mod_autoindex XSS", }, { cve: "CVE-2007-5000", cwe: { id: "CWE-79", name: "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", }, discovery_date: "2007-12-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "419931", }, ], notes: [ { category: "description", text: "Cross-site scripting (XSS) vulnerability in the (1) mod_imap module in the Apache HTTP Server 1.3.0 through 1.3.39 and 2.0.35 through 2.0.61 and the (2) mod_imagemap module in the Apache HTTP Server 2.2.0 through 2.2.6 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.", title: "Vulnerability description", }, { category: "summary", text: "httpd: mod_imagemap XSS", title: "Vulnerability summary", }, ], product_status: { fixed: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-5000", }, { category: "external", summary: "RHBZ#419931", url: "https://bugzilla.redhat.com/show_bug.cgi?id=419931", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-5000", url: "https://www.cve.org/CVERecord?id=CVE-2007-5000", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-5000", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-5000", }, ], release_date: "2007-12-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-06-30T15:33:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0524", }, ], threats: [ { category: "impact", details: "Low", }, ], title: "httpd: mod_imagemap XSS", }, { cve: "CVE-2007-5461", discovery_date: "2007-10-14T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "333791", }, ], notes: [ { category: "description", text: "Absolute path traversal vulnerability in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0, 5.0.0, 5.5.0 through 5.5.25, and 6.0.0 through 6.0.14, under certain configurations, allows remote authenticated users to read arbitrary files via a WebDAV write request that specifies an entity with a SYSTEM tag.", title: "Vulnerability description", }, { category: "summary", text: "Absolute path traversal Apache Tomcat WEBDAV", title: "Vulnerability summary", }, ], product_status: { fixed: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-5461", }, { category: "external", summary: "RHBZ#333791", url: "https://bugzilla.redhat.com/show_bug.cgi?id=333791", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-5461", url: "https://www.cve.org/CVERecord?id=CVE-2007-5461", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-5461", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-5461", }, ], release_date: "2007-10-14T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-06-30T15:33:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0524", }, ], threats: [ { category: "impact", details: "Important", }, ], title: "Absolute path traversal Apache Tomcat WEBDAV", }, { cve: "CVE-2007-6306", cwe: { id: "CWE-79", name: "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", }, discovery_date: "2007-12-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "421081", }, ], notes: [ { category: "description", text: "Multiple cross-site scripting (XSS) vulnerabilities in the image map feature in JFreeChart 1.0.8 allow remote attackers to inject arbitrary web script or HTML via the (1) chart name or (2) chart tool tip text; or the (3) href, (4) shape, or (5) coords attribute of a chart area.", title: "Vulnerability description", }, { category: "summary", text: "JFreeChart: XSS vulnerabilities in the image map feature", title: "Vulnerability summary", }, ], product_status: { fixed: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-6306", }, { category: "external", summary: "RHBZ#421081", url: "https://bugzilla.redhat.com/show_bug.cgi?id=421081", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-6306", url: "https://www.cve.org/CVERecord?id=CVE-2007-6306", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-6306", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-6306", }, ], release_date: "2007-12-06T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-06-30T15:33:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0524", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "JFreeChart: XSS vulnerabilities in the image map feature", }, { cve: "CVE-2007-6388", cwe: { id: "CWE-79", name: "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", }, discovery_date: "2008-01-02T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "427228", }, ], notes: [ { category: "description", text: "Cross-site scripting (XSS) vulnerability in mod_status in the Apache HTTP Server 2.2.0 through 2.2.6, 2.0.35 through 2.0.61, and 1.3.2 through 1.3.39, when the server-status page is enabled, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.", title: "Vulnerability description", }, { category: "summary", text: "apache mod_status cross-site scripting", title: "Vulnerability summary", }, ], product_status: { fixed: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-6388", }, { category: "external", summary: "RHBZ#427228", url: "https://bugzilla.redhat.com/show_bug.cgi?id=427228", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-6388", url: "https://www.cve.org/CVERecord?id=CVE-2007-6388", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-6388", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-6388", }, ], release_date: "2007-12-29T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-06-30T15:33:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0524", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "apache mod_status cross-site scripting", }, { cve: "CVE-2008-0128", discovery_date: "2008-01-23T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "429821", }, ], notes: [ { category: "description", text: "The SingleSignOn Valve (org.apache.catalina.authenticator.SingleSignOn) in Apache Tomcat before 5.5.21 does not set the secure flag for the JSESSIONIDSSO cookie in an https session, which can cause the cookie to be sent in http requests and make it easier for remote attackers to capture this cookie.", title: "Vulnerability description", }, { category: "summary", text: "tomcat5 SSO cookie login information disclosure", title: "Vulnerability summary", }, ], product_status: { fixed: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2008-0128", }, { category: "external", summary: "RHBZ#429821", url: "https://bugzilla.redhat.com/show_bug.cgi?id=429821", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2008-0128", url: "https://www.cve.org/CVERecord?id=CVE-2008-0128", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2008-0128", url: "https://nvd.nist.gov/vuln/detail/CVE-2008-0128", }, ], release_date: "2006-12-20T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-06-30T15:33:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0524", }, ], threats: [ { category: "impact", details: "Low", }, ], title: "tomcat5 SSO cookie login information disclosure", }, ], }
rhsa-2007_0557
Vulnerability from csaf_redhat
Published
2007-07-13 07:38
Modified
2024-12-01 11:53
Summary
Red Hat Security Advisory: httpd security update
Notes
Topic
Updated Apache httpd packages that correct two security issues are now
available for Red Hat Application Stack.
This update has been rated as having moderate security impact by the Red
Hat Security Response Team.
Details
The Apache HTTP Server is a popular Web server.
A flaw was found in the Apache HTTP Server mod_status module. On sites
where the server-status page is publicly accessible and ExtendedStatus is
enabled, this flaw could lead to a cross-site scripting attack. On Red Hat
Enterprise Linux, the server-status page is not enabled by default and it
is best practice to not make this publicly available. (CVE-2006-5752)
A bug was found in the Apache HTTP Server mod_cache module. On sites where
caching is enabled, a remote attacker could send a carefully crafted
request that would cause the Apache child process handling that request to
crash. This could lead to a denial of service if using a threaded
Multi-Processing Module. (CVE-2007-1863)
The Apache HTTP Server did not verify that a process was an Apache child
process before sending it signals. A local attacker with the ability to run
scripts on the Apache HTTP Server could manipulate the scoreboard and cause
arbitrary processes to be terminated which could lead to a denial of
service. (CVE-2007-3304).
Users of httpd should upgrade to these updated packages, which contain
backported patches to correct these issues. Users should restart Apache
after installing this update.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ document: { aggregate_severity: { namespace: "https://access.redhat.com/security/updates/classification/", text: "Moderate", }, category: "csaf_security_advisory", csaf_version: "2.0", distribution: { text: "Copyright © Red Hat, Inc. All rights reserved.", tlp: { label: "WHITE", url: "https://www.first.org/tlp/", }, }, lang: "en", notes: [ { category: "summary", text: "Updated Apache httpd packages that correct two security issues are now\navailable for Red Hat Application Stack.\n\nThis update has been rated as having moderate security impact by the Red\nHat Security Response Team.", title: "Topic", }, { category: "general", text: "The Apache HTTP Server is a popular Web server.\n\nA flaw was found in the Apache HTTP Server mod_status module. On sites\nwhere the server-status page is publicly accessible and ExtendedStatus is\nenabled, this flaw could lead to a cross-site scripting attack. On Red Hat\nEnterprise Linux, the server-status page is not enabled by default and it\nis best practice to not make this publicly available. (CVE-2006-5752)\n\nA bug was found in the Apache HTTP Server mod_cache module. On sites where\ncaching is enabled, a remote attacker could send a carefully crafted\nrequest that would cause the Apache child process handling that request to\ncrash. This could lead to a denial of service if using a threaded\nMulti-Processing Module. (CVE-2007-1863)\n\nThe Apache HTTP Server did not verify that a process was an Apache child\nprocess before sending it signals. A local attacker with the ability to run\nscripts on the Apache HTTP Server could manipulate the scoreboard and cause\narbitrary processes to be terminated which could lead to a denial of\nservice. (CVE-2007-3304).\n\nUsers of httpd should upgrade to these updated packages, which contain\nbackported patches to correct these issues. Users should restart Apache\nafter installing this update.", title: "Details", }, { category: "legal_disclaimer", text: "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", title: "Terms of Use", }, ], publisher: { category: "vendor", contact_details: "https://access.redhat.com/security/team/contact/", issuing_authority: "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", name: "Red Hat Product Security", namespace: "https://www.redhat.com", }, references: [ { category: "self", summary: "https://access.redhat.com/errata/RHSA-2007:0557", url: "https://access.redhat.com/errata/RHSA-2007:0557", }, { category: "external", summary: "http://www.redhat.com/security/updates/classification/#moderate", url: "http://www.redhat.com/security/updates/classification/#moderate", }, { category: "external", summary: "244658", url: "https://bugzilla.redhat.com/show_bug.cgi?id=244658", }, { category: "external", summary: "245112", url: "https://bugzilla.redhat.com/show_bug.cgi?id=245112", }, { category: "self", summary: "Canonical URL", url: "https://security.access.redhat.com/data/csaf/v2/advisories/2007/rhsa-2007_0557.json", }, ], title: "Red Hat Security Advisory: httpd security update", tracking: { current_release_date: "2024-12-01T11:53:21+00:00", generator: { date: "2024-12-01T11:53:21+00:00", engine: { name: "Red Hat SDEngine", version: "4.2.1", }, }, id: "RHSA-2007:0557", initial_release_date: "2007-07-13T07:38:00+00:00", revision_history: [ { date: "2007-07-13T07:38:00+00:00", number: "1", summary: "Initial version", }, { date: "2007-07-13T03:38:23+00:00", number: "2", summary: "Last updated version", }, { date: "2024-12-01T11:53:21+00:00", number: "3", summary: "Last generated version", }, ], status: "final", version: "3", }, }, product_tree: { branches: [ { branches: [ { branches: [ { category: "product_name", name: "Red Hat Application Stack v1 for Enterprise Linux AS (v.4)", product: { name: "Red Hat Application Stack v1 for Enterprise Linux AS (v.4)", product_id: "4AS-RHWAS", product_identification_helper: { cpe: "cpe:/a:redhat:rhel_application_stack:1", }, }, }, { category: "product_name", name: "Red Hat Application Stack v1 for Enterprise Linux ES (v.4)", product: { name: "Red Hat Application Stack v1 for Enterprise Linux ES (v.4)", product_id: "4ES-RHWAS", product_identification_helper: { cpe: "cpe:/a:redhat:rhel_application_stack:1", }, }, }, ], category: "product_family", name: "Red Hat Application Stack", }, { branches: [ { category: "product_version", name: "httpd-manual-0:2.0.59-1.el4s1.7.x86_64", product: { name: "httpd-manual-0:2.0.59-1.el4s1.7.x86_64", product_id: "httpd-manual-0:2.0.59-1.el4s1.7.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-manual@2.0.59-1.el4s1.7?arch=x86_64", }, }, }, { category: "product_version", name: "httpd-0:2.0.59-1.el4s1.7.x86_64", product: { name: "httpd-0:2.0.59-1.el4s1.7.x86_64", product_id: "httpd-0:2.0.59-1.el4s1.7.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/httpd@2.0.59-1.el4s1.7?arch=x86_64", }, }, }, { category: "product_version", name: "httpd-debuginfo-0:2.0.59-1.el4s1.7.x86_64", product: { name: "httpd-debuginfo-0:2.0.59-1.el4s1.7.x86_64", product_id: "httpd-debuginfo-0:2.0.59-1.el4s1.7.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-debuginfo@2.0.59-1.el4s1.7?arch=x86_64", }, }, }, { category: "product_version", name: "mod_ssl-1:2.0.59-1.el4s1.7.x86_64", product: { name: "mod_ssl-1:2.0.59-1.el4s1.7.x86_64", product_id: "mod_ssl-1:2.0.59-1.el4s1.7.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/mod_ssl@2.0.59-1.el4s1.7?arch=x86_64&epoch=1", }, }, }, { category: "product_version", name: "httpd-devel-0:2.0.59-1.el4s1.7.x86_64", product: { name: "httpd-devel-0:2.0.59-1.el4s1.7.x86_64", product_id: "httpd-devel-0:2.0.59-1.el4s1.7.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-devel@2.0.59-1.el4s1.7?arch=x86_64", }, }, }, ], category: "architecture", name: "x86_64", }, { branches: [ { category: "product_version", name: "httpd-manual-0:2.0.59-1.el4s1.7.i386", product: { name: "httpd-manual-0:2.0.59-1.el4s1.7.i386", product_id: "httpd-manual-0:2.0.59-1.el4s1.7.i386", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-manual@2.0.59-1.el4s1.7?arch=i386", }, }, }, { category: "product_version", name: "httpd-0:2.0.59-1.el4s1.7.i386", product: { name: "httpd-0:2.0.59-1.el4s1.7.i386", product_id: "httpd-0:2.0.59-1.el4s1.7.i386", product_identification_helper: { purl: "pkg:rpm/redhat/httpd@2.0.59-1.el4s1.7?arch=i386", }, }, }, { category: "product_version", name: "httpd-debuginfo-0:2.0.59-1.el4s1.7.i386", product: { name: "httpd-debuginfo-0:2.0.59-1.el4s1.7.i386", product_id: "httpd-debuginfo-0:2.0.59-1.el4s1.7.i386", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-debuginfo@2.0.59-1.el4s1.7?arch=i386", }, }, }, { category: "product_version", name: "mod_ssl-1:2.0.59-1.el4s1.7.i386", product: { name: "mod_ssl-1:2.0.59-1.el4s1.7.i386", product_id: "mod_ssl-1:2.0.59-1.el4s1.7.i386", product_identification_helper: { purl: "pkg:rpm/redhat/mod_ssl@2.0.59-1.el4s1.7?arch=i386&epoch=1", }, }, }, { category: "product_version", name: "httpd-devel-0:2.0.59-1.el4s1.7.i386", product: { name: "httpd-devel-0:2.0.59-1.el4s1.7.i386", product_id: "httpd-devel-0:2.0.59-1.el4s1.7.i386", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-devel@2.0.59-1.el4s1.7?arch=i386", }, }, }, ], category: "architecture", name: "i386", }, { branches: [ { category: "product_version", name: "httpd-0:2.0.59-1.el4s1.7.src", product: { name: "httpd-0:2.0.59-1.el4s1.7.src", product_id: "httpd-0:2.0.59-1.el4s1.7.src", product_identification_helper: { purl: "pkg:rpm/redhat/httpd@2.0.59-1.el4s1.7?arch=src", }, }, }, ], category: "architecture", name: "src", }, ], category: "vendor", name: "Red Hat", }, ], relationships: [ { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.59-1.el4s1.7.i386 as a component of Red Hat Application Stack v1 for Enterprise Linux AS (v.4)", product_id: "4AS-RHWAS:httpd-0:2.0.59-1.el4s1.7.i386", }, product_reference: "httpd-0:2.0.59-1.el4s1.7.i386", relates_to_product_reference: "4AS-RHWAS", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.59-1.el4s1.7.src as a component of Red Hat Application Stack v1 for Enterprise Linux AS (v.4)", product_id: "4AS-RHWAS:httpd-0:2.0.59-1.el4s1.7.src", }, product_reference: "httpd-0:2.0.59-1.el4s1.7.src", relates_to_product_reference: "4AS-RHWAS", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.59-1.el4s1.7.x86_64 as a component of Red Hat Application Stack v1 for Enterprise Linux AS (v.4)", product_id: "4AS-RHWAS:httpd-0:2.0.59-1.el4s1.7.x86_64", }, product_reference: "httpd-0:2.0.59-1.el4s1.7.x86_64", relates_to_product_reference: "4AS-RHWAS", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.59-1.el4s1.7.i386 as a component of Red Hat Application Stack v1 for Enterprise Linux AS (v.4)", product_id: "4AS-RHWAS:httpd-debuginfo-0:2.0.59-1.el4s1.7.i386", }, product_reference: "httpd-debuginfo-0:2.0.59-1.el4s1.7.i386", relates_to_product_reference: "4AS-RHWAS", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.59-1.el4s1.7.x86_64 as a component of Red Hat Application Stack v1 for Enterprise Linux AS (v.4)", product_id: "4AS-RHWAS:httpd-debuginfo-0:2.0.59-1.el4s1.7.x86_64", }, product_reference: "httpd-debuginfo-0:2.0.59-1.el4s1.7.x86_64", relates_to_product_reference: "4AS-RHWAS", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.59-1.el4s1.7.i386 as a component of Red Hat Application Stack v1 for Enterprise Linux AS (v.4)", product_id: "4AS-RHWAS:httpd-devel-0:2.0.59-1.el4s1.7.i386", }, product_reference: "httpd-devel-0:2.0.59-1.el4s1.7.i386", relates_to_product_reference: "4AS-RHWAS", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.59-1.el4s1.7.x86_64 as a component of Red Hat Application Stack v1 for Enterprise Linux AS (v.4)", product_id: "4AS-RHWAS:httpd-devel-0:2.0.59-1.el4s1.7.x86_64", }, product_reference: "httpd-devel-0:2.0.59-1.el4s1.7.x86_64", relates_to_product_reference: "4AS-RHWAS", }, { category: "default_component_of", full_product_name: { name: "httpd-manual-0:2.0.59-1.el4s1.7.i386 as a component of Red Hat Application Stack v1 for Enterprise Linux AS (v.4)", product_id: "4AS-RHWAS:httpd-manual-0:2.0.59-1.el4s1.7.i386", }, product_reference: "httpd-manual-0:2.0.59-1.el4s1.7.i386", relates_to_product_reference: "4AS-RHWAS", }, { category: "default_component_of", full_product_name: { name: "httpd-manual-0:2.0.59-1.el4s1.7.x86_64 as a component of Red Hat Application Stack v1 for Enterprise Linux AS (v.4)", product_id: "4AS-RHWAS:httpd-manual-0:2.0.59-1.el4s1.7.x86_64", }, product_reference: "httpd-manual-0:2.0.59-1.el4s1.7.x86_64", relates_to_product_reference: "4AS-RHWAS", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.59-1.el4s1.7.i386 as a component of Red Hat Application Stack v1 for Enterprise Linux AS (v.4)", product_id: "4AS-RHWAS:mod_ssl-1:2.0.59-1.el4s1.7.i386", }, product_reference: "mod_ssl-1:2.0.59-1.el4s1.7.i386", relates_to_product_reference: "4AS-RHWAS", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.59-1.el4s1.7.x86_64 as a component of Red Hat Application Stack v1 for Enterprise Linux AS (v.4)", product_id: "4AS-RHWAS:mod_ssl-1:2.0.59-1.el4s1.7.x86_64", }, product_reference: "mod_ssl-1:2.0.59-1.el4s1.7.x86_64", relates_to_product_reference: "4AS-RHWAS", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.59-1.el4s1.7.i386 as a component of Red Hat Application Stack v1 for Enterprise Linux ES (v.4)", product_id: "4ES-RHWAS:httpd-0:2.0.59-1.el4s1.7.i386", }, product_reference: "httpd-0:2.0.59-1.el4s1.7.i386", relates_to_product_reference: "4ES-RHWAS", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.59-1.el4s1.7.src as a component of Red Hat Application Stack v1 for Enterprise Linux ES (v.4)", product_id: "4ES-RHWAS:httpd-0:2.0.59-1.el4s1.7.src", }, product_reference: "httpd-0:2.0.59-1.el4s1.7.src", relates_to_product_reference: "4ES-RHWAS", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.59-1.el4s1.7.x86_64 as a component of Red Hat Application Stack v1 for Enterprise Linux ES (v.4)", product_id: "4ES-RHWAS:httpd-0:2.0.59-1.el4s1.7.x86_64", }, product_reference: "httpd-0:2.0.59-1.el4s1.7.x86_64", relates_to_product_reference: "4ES-RHWAS", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.59-1.el4s1.7.i386 as a component of Red Hat Application Stack v1 for Enterprise Linux ES (v.4)", product_id: "4ES-RHWAS:httpd-debuginfo-0:2.0.59-1.el4s1.7.i386", }, product_reference: "httpd-debuginfo-0:2.0.59-1.el4s1.7.i386", relates_to_product_reference: "4ES-RHWAS", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.59-1.el4s1.7.x86_64 as a component of Red Hat Application Stack v1 for Enterprise Linux ES (v.4)", product_id: "4ES-RHWAS:httpd-debuginfo-0:2.0.59-1.el4s1.7.x86_64", }, product_reference: "httpd-debuginfo-0:2.0.59-1.el4s1.7.x86_64", relates_to_product_reference: "4ES-RHWAS", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.59-1.el4s1.7.i386 as a component of Red Hat Application Stack v1 for Enterprise Linux ES (v.4)", product_id: "4ES-RHWAS:httpd-devel-0:2.0.59-1.el4s1.7.i386", }, product_reference: "httpd-devel-0:2.0.59-1.el4s1.7.i386", relates_to_product_reference: "4ES-RHWAS", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.59-1.el4s1.7.x86_64 as a component of Red Hat Application Stack v1 for Enterprise Linux ES (v.4)", product_id: "4ES-RHWAS:httpd-devel-0:2.0.59-1.el4s1.7.x86_64", }, product_reference: "httpd-devel-0:2.0.59-1.el4s1.7.x86_64", relates_to_product_reference: "4ES-RHWAS", }, { category: "default_component_of", full_product_name: { name: "httpd-manual-0:2.0.59-1.el4s1.7.i386 as a component of Red Hat Application Stack v1 for Enterprise Linux ES (v.4)", product_id: "4ES-RHWAS:httpd-manual-0:2.0.59-1.el4s1.7.i386", }, product_reference: "httpd-manual-0:2.0.59-1.el4s1.7.i386", relates_to_product_reference: "4ES-RHWAS", }, { category: "default_component_of", full_product_name: { name: "httpd-manual-0:2.0.59-1.el4s1.7.x86_64 as a component of Red Hat Application Stack v1 for Enterprise Linux ES (v.4)", product_id: "4ES-RHWAS:httpd-manual-0:2.0.59-1.el4s1.7.x86_64", }, product_reference: "httpd-manual-0:2.0.59-1.el4s1.7.x86_64", relates_to_product_reference: "4ES-RHWAS", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.59-1.el4s1.7.i386 as a component of Red Hat Application Stack v1 for Enterprise Linux ES (v.4)", product_id: "4ES-RHWAS:mod_ssl-1:2.0.59-1.el4s1.7.i386", }, product_reference: "mod_ssl-1:2.0.59-1.el4s1.7.i386", relates_to_product_reference: "4ES-RHWAS", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.59-1.el4s1.7.x86_64 as a component of Red Hat Application Stack v1 for Enterprise Linux ES (v.4)", product_id: "4ES-RHWAS:mod_ssl-1:2.0.59-1.el4s1.7.x86_64", }, product_reference: "mod_ssl-1:2.0.59-1.el4s1.7.x86_64", relates_to_product_reference: "4ES-RHWAS", }, ], }, vulnerabilities: [ { cve: "CVE-2006-5752", cwe: { id: "CWE-79", name: "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", }, discovery_date: "2007-06-20T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "245112", }, ], notes: [ { category: "description", text: "Cross-site scripting (XSS) vulnerability in mod_status.c in the mod_status module in Apache HTTP Server (httpd), when ExtendedStatus is enabled and a public server-status page is used, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors involving charsets with browsers that perform \"charset detection\" when the content-type is not specified.", title: "Vulnerability description", }, { category: "summary", text: "httpd mod_status XSS", title: "Vulnerability summary", }, ], product_status: { fixed: [ "4AS-RHWAS:httpd-0:2.0.59-1.el4s1.7.i386", "4AS-RHWAS:httpd-0:2.0.59-1.el4s1.7.src", "4AS-RHWAS:httpd-0:2.0.59-1.el4s1.7.x86_64", "4AS-RHWAS:httpd-debuginfo-0:2.0.59-1.el4s1.7.i386", "4AS-RHWAS:httpd-debuginfo-0:2.0.59-1.el4s1.7.x86_64", "4AS-RHWAS:httpd-devel-0:2.0.59-1.el4s1.7.i386", "4AS-RHWAS:httpd-devel-0:2.0.59-1.el4s1.7.x86_64", "4AS-RHWAS:httpd-manual-0:2.0.59-1.el4s1.7.i386", "4AS-RHWAS:httpd-manual-0:2.0.59-1.el4s1.7.x86_64", "4AS-RHWAS:mod_ssl-1:2.0.59-1.el4s1.7.i386", "4AS-RHWAS:mod_ssl-1:2.0.59-1.el4s1.7.x86_64", "4ES-RHWAS:httpd-0:2.0.59-1.el4s1.7.i386", "4ES-RHWAS:httpd-0:2.0.59-1.el4s1.7.src", "4ES-RHWAS:httpd-0:2.0.59-1.el4s1.7.x86_64", "4ES-RHWAS:httpd-debuginfo-0:2.0.59-1.el4s1.7.i386", "4ES-RHWAS:httpd-debuginfo-0:2.0.59-1.el4s1.7.x86_64", "4ES-RHWAS:httpd-devel-0:2.0.59-1.el4s1.7.i386", "4ES-RHWAS:httpd-devel-0:2.0.59-1.el4s1.7.x86_64", "4ES-RHWAS:httpd-manual-0:2.0.59-1.el4s1.7.i386", "4ES-RHWAS:httpd-manual-0:2.0.59-1.el4s1.7.x86_64", "4ES-RHWAS:mod_ssl-1:2.0.59-1.el4s1.7.i386", "4ES-RHWAS:mod_ssl-1:2.0.59-1.el4s1.7.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2006-5752", }, { category: "external", summary: "RHBZ#245112", url: "https://bugzilla.redhat.com/show_bug.cgi?id=245112", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2006-5752", url: "https://www.cve.org/CVERecord?id=CVE-2006-5752", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2006-5752", url: "https://nvd.nist.gov/vuln/detail/CVE-2006-5752", }, ], release_date: "2007-06-20T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2007-07-13T07:38:00+00:00", details: "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied. \n\nThis update is available via Red Hat Network. Details on how to use \nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/FAQ_58_10188", product_ids: [ "4AS-RHWAS:httpd-0:2.0.59-1.el4s1.7.i386", "4AS-RHWAS:httpd-0:2.0.59-1.el4s1.7.src", "4AS-RHWAS:httpd-0:2.0.59-1.el4s1.7.x86_64", "4AS-RHWAS:httpd-debuginfo-0:2.0.59-1.el4s1.7.i386", "4AS-RHWAS:httpd-debuginfo-0:2.0.59-1.el4s1.7.x86_64", "4AS-RHWAS:httpd-devel-0:2.0.59-1.el4s1.7.i386", "4AS-RHWAS:httpd-devel-0:2.0.59-1.el4s1.7.x86_64", "4AS-RHWAS:httpd-manual-0:2.0.59-1.el4s1.7.i386", "4AS-RHWAS:httpd-manual-0:2.0.59-1.el4s1.7.x86_64", "4AS-RHWAS:mod_ssl-1:2.0.59-1.el4s1.7.i386", "4AS-RHWAS:mod_ssl-1:2.0.59-1.el4s1.7.x86_64", "4ES-RHWAS:httpd-0:2.0.59-1.el4s1.7.i386", "4ES-RHWAS:httpd-0:2.0.59-1.el4s1.7.src", "4ES-RHWAS:httpd-0:2.0.59-1.el4s1.7.x86_64", "4ES-RHWAS:httpd-debuginfo-0:2.0.59-1.el4s1.7.i386", "4ES-RHWAS:httpd-debuginfo-0:2.0.59-1.el4s1.7.x86_64", "4ES-RHWAS:httpd-devel-0:2.0.59-1.el4s1.7.i386", "4ES-RHWAS:httpd-devel-0:2.0.59-1.el4s1.7.x86_64", "4ES-RHWAS:httpd-manual-0:2.0.59-1.el4s1.7.i386", "4ES-RHWAS:httpd-manual-0:2.0.59-1.el4s1.7.x86_64", "4ES-RHWAS:mod_ssl-1:2.0.59-1.el4s1.7.i386", "4ES-RHWAS:mod_ssl-1:2.0.59-1.el4s1.7.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2007:0557", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "httpd mod_status XSS", }, { cve: "CVE-2007-1863", discovery_date: "2007-05-02T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "244658", }, ], notes: [ { category: "description", text: "cache_util.c in the mod_cache module in Apache HTTP Server (httpd), when caching is enabled and a threaded Multi-Processing Module (MPM) is used, allows remote attackers to cause a denial of service (child processing handler crash) via a request with the (1) s-maxage, (2) max-age, (3) min-fresh, or (4) max-stale Cache-Control headers without a value.", title: "Vulnerability description", }, { category: "summary", text: "httpd mod_cache segfault", title: "Vulnerability summary", }, ], product_status: { fixed: [ "4AS-RHWAS:httpd-0:2.0.59-1.el4s1.7.i386", "4AS-RHWAS:httpd-0:2.0.59-1.el4s1.7.src", "4AS-RHWAS:httpd-0:2.0.59-1.el4s1.7.x86_64", "4AS-RHWAS:httpd-debuginfo-0:2.0.59-1.el4s1.7.i386", "4AS-RHWAS:httpd-debuginfo-0:2.0.59-1.el4s1.7.x86_64", "4AS-RHWAS:httpd-devel-0:2.0.59-1.el4s1.7.i386", "4AS-RHWAS:httpd-devel-0:2.0.59-1.el4s1.7.x86_64", "4AS-RHWAS:httpd-manual-0:2.0.59-1.el4s1.7.i386", "4AS-RHWAS:httpd-manual-0:2.0.59-1.el4s1.7.x86_64", "4AS-RHWAS:mod_ssl-1:2.0.59-1.el4s1.7.i386", "4AS-RHWAS:mod_ssl-1:2.0.59-1.el4s1.7.x86_64", "4ES-RHWAS:httpd-0:2.0.59-1.el4s1.7.i386", "4ES-RHWAS:httpd-0:2.0.59-1.el4s1.7.src", "4ES-RHWAS:httpd-0:2.0.59-1.el4s1.7.x86_64", "4ES-RHWAS:httpd-debuginfo-0:2.0.59-1.el4s1.7.i386", "4ES-RHWAS:httpd-debuginfo-0:2.0.59-1.el4s1.7.x86_64", "4ES-RHWAS:httpd-devel-0:2.0.59-1.el4s1.7.i386", "4ES-RHWAS:httpd-devel-0:2.0.59-1.el4s1.7.x86_64", "4ES-RHWAS:httpd-manual-0:2.0.59-1.el4s1.7.i386", "4ES-RHWAS:httpd-manual-0:2.0.59-1.el4s1.7.x86_64", "4ES-RHWAS:mod_ssl-1:2.0.59-1.el4s1.7.i386", "4ES-RHWAS:mod_ssl-1:2.0.59-1.el4s1.7.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-1863", }, { category: "external", summary: "RHBZ#244658", url: "https://bugzilla.redhat.com/show_bug.cgi?id=244658", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-1863", url: "https://www.cve.org/CVERecord?id=CVE-2007-1863", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-1863", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-1863", }, ], release_date: "2007-05-02T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2007-07-13T07:38:00+00:00", details: "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied. \n\nThis update is available via Red Hat Network. Details on how to use \nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/FAQ_58_10188", product_ids: [ "4AS-RHWAS:httpd-0:2.0.59-1.el4s1.7.i386", "4AS-RHWAS:httpd-0:2.0.59-1.el4s1.7.src", "4AS-RHWAS:httpd-0:2.0.59-1.el4s1.7.x86_64", "4AS-RHWAS:httpd-debuginfo-0:2.0.59-1.el4s1.7.i386", "4AS-RHWAS:httpd-debuginfo-0:2.0.59-1.el4s1.7.x86_64", "4AS-RHWAS:httpd-devel-0:2.0.59-1.el4s1.7.i386", "4AS-RHWAS:httpd-devel-0:2.0.59-1.el4s1.7.x86_64", "4AS-RHWAS:httpd-manual-0:2.0.59-1.el4s1.7.i386", "4AS-RHWAS:httpd-manual-0:2.0.59-1.el4s1.7.x86_64", "4AS-RHWAS:mod_ssl-1:2.0.59-1.el4s1.7.i386", "4AS-RHWAS:mod_ssl-1:2.0.59-1.el4s1.7.x86_64", "4ES-RHWAS:httpd-0:2.0.59-1.el4s1.7.i386", "4ES-RHWAS:httpd-0:2.0.59-1.el4s1.7.src", "4ES-RHWAS:httpd-0:2.0.59-1.el4s1.7.x86_64", "4ES-RHWAS:httpd-debuginfo-0:2.0.59-1.el4s1.7.i386", "4ES-RHWAS:httpd-debuginfo-0:2.0.59-1.el4s1.7.x86_64", "4ES-RHWAS:httpd-devel-0:2.0.59-1.el4s1.7.i386", "4ES-RHWAS:httpd-devel-0:2.0.59-1.el4s1.7.x86_64", "4ES-RHWAS:httpd-manual-0:2.0.59-1.el4s1.7.i386", "4ES-RHWAS:httpd-manual-0:2.0.59-1.el4s1.7.x86_64", "4ES-RHWAS:mod_ssl-1:2.0.59-1.el4s1.7.i386", "4ES-RHWAS:mod_ssl-1:2.0.59-1.el4s1.7.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2007:0557", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "httpd mod_cache segfault", }, { cve: "CVE-2007-3304", discovery_date: "2007-06-19T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "245111", }, ], notes: [ { category: "description", text: "Apache httpd 1.3.37, 2.0.59, and 2.2.4 with the Prefork MPM module, allows local users to cause a denial of service by modifying the worker_score and process_score arrays to reference an arbitrary process ID, which is sent a SIGUSR1 signal from the master process, aka \"SIGUSR1 killer.\"", title: "Vulnerability description", }, { category: "summary", text: "httpd scoreboard lack of PID protection", title: "Vulnerability summary", }, ], product_status: { fixed: [ "4AS-RHWAS:httpd-0:2.0.59-1.el4s1.7.i386", "4AS-RHWAS:httpd-0:2.0.59-1.el4s1.7.src", "4AS-RHWAS:httpd-0:2.0.59-1.el4s1.7.x86_64", "4AS-RHWAS:httpd-debuginfo-0:2.0.59-1.el4s1.7.i386", "4AS-RHWAS:httpd-debuginfo-0:2.0.59-1.el4s1.7.x86_64", "4AS-RHWAS:httpd-devel-0:2.0.59-1.el4s1.7.i386", "4AS-RHWAS:httpd-devel-0:2.0.59-1.el4s1.7.x86_64", "4AS-RHWAS:httpd-manual-0:2.0.59-1.el4s1.7.i386", "4AS-RHWAS:httpd-manual-0:2.0.59-1.el4s1.7.x86_64", "4AS-RHWAS:mod_ssl-1:2.0.59-1.el4s1.7.i386", "4AS-RHWAS:mod_ssl-1:2.0.59-1.el4s1.7.x86_64", "4ES-RHWAS:httpd-0:2.0.59-1.el4s1.7.i386", "4ES-RHWAS:httpd-0:2.0.59-1.el4s1.7.src", "4ES-RHWAS:httpd-0:2.0.59-1.el4s1.7.x86_64", "4ES-RHWAS:httpd-debuginfo-0:2.0.59-1.el4s1.7.i386", "4ES-RHWAS:httpd-debuginfo-0:2.0.59-1.el4s1.7.x86_64", "4ES-RHWAS:httpd-devel-0:2.0.59-1.el4s1.7.i386", "4ES-RHWAS:httpd-devel-0:2.0.59-1.el4s1.7.x86_64", "4ES-RHWAS:httpd-manual-0:2.0.59-1.el4s1.7.i386", "4ES-RHWAS:httpd-manual-0:2.0.59-1.el4s1.7.x86_64", "4ES-RHWAS:mod_ssl-1:2.0.59-1.el4s1.7.i386", "4ES-RHWAS:mod_ssl-1:2.0.59-1.el4s1.7.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-3304", }, { category: "external", summary: "RHBZ#245111", url: "https://bugzilla.redhat.com/show_bug.cgi?id=245111", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-3304", url: "https://www.cve.org/CVERecord?id=CVE-2007-3304", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-3304", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-3304", }, ], release_date: "2007-06-19T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2007-07-13T07:38:00+00:00", details: "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied. \n\nThis update is available via Red Hat Network. Details on how to use \nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/FAQ_58_10188", product_ids: [ "4AS-RHWAS:httpd-0:2.0.59-1.el4s1.7.i386", "4AS-RHWAS:httpd-0:2.0.59-1.el4s1.7.src", "4AS-RHWAS:httpd-0:2.0.59-1.el4s1.7.x86_64", "4AS-RHWAS:httpd-debuginfo-0:2.0.59-1.el4s1.7.i386", "4AS-RHWAS:httpd-debuginfo-0:2.0.59-1.el4s1.7.x86_64", "4AS-RHWAS:httpd-devel-0:2.0.59-1.el4s1.7.i386", "4AS-RHWAS:httpd-devel-0:2.0.59-1.el4s1.7.x86_64", "4AS-RHWAS:httpd-manual-0:2.0.59-1.el4s1.7.i386", "4AS-RHWAS:httpd-manual-0:2.0.59-1.el4s1.7.x86_64", "4AS-RHWAS:mod_ssl-1:2.0.59-1.el4s1.7.i386", "4AS-RHWAS:mod_ssl-1:2.0.59-1.el4s1.7.x86_64", "4ES-RHWAS:httpd-0:2.0.59-1.el4s1.7.i386", "4ES-RHWAS:httpd-0:2.0.59-1.el4s1.7.src", "4ES-RHWAS:httpd-0:2.0.59-1.el4s1.7.x86_64", "4ES-RHWAS:httpd-debuginfo-0:2.0.59-1.el4s1.7.i386", "4ES-RHWAS:httpd-debuginfo-0:2.0.59-1.el4s1.7.x86_64", "4ES-RHWAS:httpd-devel-0:2.0.59-1.el4s1.7.i386", "4ES-RHWAS:httpd-devel-0:2.0.59-1.el4s1.7.x86_64", "4ES-RHWAS:httpd-manual-0:2.0.59-1.el4s1.7.i386", "4ES-RHWAS:httpd-manual-0:2.0.59-1.el4s1.7.x86_64", "4ES-RHWAS:mod_ssl-1:2.0.59-1.el4s1.7.i386", "4ES-RHWAS:mod_ssl-1:2.0.59-1.el4s1.7.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2007:0557", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "httpd scoreboard lack of PID protection", }, ], }
RHSA-2008:0524
Vulnerability from csaf_redhat
Published
2008-06-30 15:33
Modified
2025-01-26 19:36
Summary
Red Hat Security Advisory: Red Hat Network Satellite Server security update
Notes
Topic
Red Hat Network Satellite Server version 4.2.3 is now available. This
update includes fixes for a number of security issues in Red Hat Network
Satellite Server components.
This update has been rated as having low security impact by the Red Hat
Security Response Team.
Details
This release corrects several security vulnerabilities in various
components shipped as part of the Red Hat Network Satellite Server 4.2. In
a typical operating environment, these components are not exposed to users
of Satellite Server in a vulnerable manner. These security updates will
reduce risk in unique Satellite Server environments.
Multiple flaws were fixed in the Apache HTTPD server. These flaws could
result in a cross-site scripting, denial-of-service, or information
disclosure attacks. (CVE-2004-0885, CVE-2006-5752, CVE-2006-7197,
CVE-2007-1860, CVE-2007-3304, CVE-2007-4465, CVE-2007-5000, CVE-2007-6388)
A denial-of-service flaw was fixed in mod_perl. (CVE-2007-1349)
A denial-of-service flaw was fixed in the jabberd server. (CVE-2006-1329)
Multiple cross-site scripting flaws were fixed in the image map feature in
the JFreeChart package. (CVE-2007-6306)
Multiple flaws were fixed in the IBM Java 1.4.2 Runtime. (CVE-2007-0243,
CVE-2007-2435, CVE-2007-2788, CVE-2007-2789)
Multiple flaws were fixed in the OpenMotif package. (CVE-2004-0687,
CVE-2004-0688, CVE-2004-0914, CVE-2005-3964, CVE-2005-0605)
A flaw which could result in weak encryption was fixed in the
perl-Crypt-CBC package. (CVE-2006-0898)
Multiple flaws were fixed in the Tomcat package. (CVE-2008-0128,
CVE-2007-5461, CVE-2007-3385, CVE-2007-3382, CVE-2007-1358, CVE-2007-1355,
CVE-2007-2450, CVE-2007-2449, CVE-2007-0450, CVE-2006-7196, CVE-2006-7195,
CVE-2006-3835, CVE-2006-0254, CVE-2005-2090, CVE-2005-4838, CVE-2005-3510)
Users of Red Hat Network Satellite Server 4.2 are advised to upgrade to
4.2.3, which resolves these issues.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ document: { aggregate_severity: { namespace: "https://access.redhat.com/security/updates/classification/", text: "Low", }, category: "csaf_security_advisory", csaf_version: "2.0", distribution: { text: "Copyright © Red Hat, Inc. All rights reserved.", tlp: { label: "WHITE", url: "https://www.first.org/tlp/", }, }, lang: "en", notes: [ { category: "summary", text: "Red Hat Network Satellite Server version 4.2.3 is now available. This\nupdate includes fixes for a number of security issues in Red Hat Network\nSatellite Server components.\n\nThis update has been rated as having low security impact by the Red Hat\nSecurity Response Team.", title: "Topic", }, { category: "general", text: "This release corrects several security vulnerabilities in various\ncomponents shipped as part of the Red Hat Network Satellite Server 4.2. In\na typical operating environment, these components are not exposed to users\nof Satellite Server in a vulnerable manner. These security updates will\nreduce risk in unique Satellite Server environments.\n\nMultiple flaws were fixed in the Apache HTTPD server. These flaws could\nresult in a cross-site scripting, denial-of-service, or information\ndisclosure attacks. (CVE-2004-0885, CVE-2006-5752, CVE-2006-7197,\nCVE-2007-1860, CVE-2007-3304, CVE-2007-4465, CVE-2007-5000, CVE-2007-6388)\n\nA denial-of-service flaw was fixed in mod_perl. (CVE-2007-1349)\n\nA denial-of-service flaw was fixed in the jabberd server. (CVE-2006-1329)\n\nMultiple cross-site scripting flaws were fixed in the image map feature in\nthe JFreeChart package. (CVE-2007-6306)\n\nMultiple flaws were fixed in the IBM Java 1.4.2 Runtime. (CVE-2007-0243,\nCVE-2007-2435, CVE-2007-2788, CVE-2007-2789)\n\nMultiple flaws were fixed in the OpenMotif package. (CVE-2004-0687,\nCVE-2004-0688, CVE-2004-0914, CVE-2005-3964, CVE-2005-0605)\n\nA flaw which could result in weak encryption was fixed in the\nperl-Crypt-CBC package. (CVE-2006-0898)\n\nMultiple flaws were fixed in the Tomcat package. (CVE-2008-0128,\nCVE-2007-5461, CVE-2007-3385, CVE-2007-3382, CVE-2007-1358, CVE-2007-1355,\nCVE-2007-2450, CVE-2007-2449, CVE-2007-0450, CVE-2006-7196, CVE-2006-7195,\nCVE-2006-3835, CVE-2006-0254, CVE-2005-2090, CVE-2005-4838, CVE-2005-3510)\n\nUsers of Red Hat Network Satellite Server 4.2 are advised to upgrade to\n4.2.3, which resolves these issues.", title: "Details", }, { category: "legal_disclaimer", text: "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", title: "Terms of Use", }, ], publisher: { category: "vendor", contact_details: "https://access.redhat.com/security/team/contact/", issuing_authority: "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", name: "Red Hat Product Security", namespace: "https://www.redhat.com", }, references: [ { category: "self", summary: "https://access.redhat.com/errata/RHSA-2008:0524", url: "https://access.redhat.com/errata/RHSA-2008:0524", }, { category: "external", summary: "https://access.redhat.com/security/updates/classification/#low", url: "https://access.redhat.com/security/updates/classification/#low", }, { category: "external", summary: "449337", url: "https://bugzilla.redhat.com/show_bug.cgi?id=449337", }, { category: "self", summary: "Canonical URL", url: "https://security.access.redhat.com/data/csaf/v2/advisories/2008/rhsa-2008_0524.json", }, ], title: "Red Hat Security Advisory: Red Hat Network Satellite Server security update", tracking: { current_release_date: "2025-01-26T19:36:01+00:00", generator: { date: "2025-01-26T19:36:01+00:00", engine: { name: "Red Hat SDEngine", version: "4.2.6", }, }, id: "RHSA-2008:0524", initial_release_date: "2008-06-30T15:33:00+00:00", revision_history: [ { date: "2008-06-30T15:33:00+00:00", number: "1", summary: "Initial version", }, { date: "2008-06-30T11:33:26+00:00", number: "2", summary: "Last updated version", }, { date: "2025-01-26T19:36:01+00:00", number: "3", summary: "Last generated version", }, ], status: "final", version: "3", }, }, product_tree: { branches: [ { branches: [ { branches: [ { category: "product_name", name: "Red Hat Satellite v 4.2 (RHEL v.3 AS)", product: { name: "Red Hat Satellite v 4.2 (RHEL v.3 AS)", product_id: "3AS-RHNSAT4.2", product_identification_helper: { cpe: "cpe:/a:redhat:network_satellite:4.2::el3", }, }, }, { category: "product_name", name: "Red Hat Satellite v 4.2 (RHEL v.4 AS)", product: { name: "Red Hat Satellite v 4.2 (RHEL v.4 AS)", product_id: "4AS-RHNSAT4.2", product_identification_helper: { cpe: "cpe:/a:redhat:network_satellite:4.2::el4", }, }, }, ], category: "product_family", name: "Red Hat Satellite", }, { branches: [ { category: "product_version", name: "jabberd-0:2.0s10-3.37.rhn.i386", product: { name: "jabberd-0:2.0s10-3.37.rhn.i386", product_id: "jabberd-0:2.0s10-3.37.rhn.i386", product_identification_helper: { purl: "pkg:rpm/redhat/jabberd@2.0s10-3.37.rhn?arch=i386", }, }, }, { category: "product_version", name: "java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", product: { name: "java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", product_id: "java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", product_identification_helper: { purl: "pkg:rpm/redhat/java-1.4.2-ibm-devel@1.4.2.10-1jpp.2.el3?arch=i386", }, }, }, { category: "product_version", name: "java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", product: { name: "java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", product_id: "java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", product_identification_helper: { purl: "pkg:rpm/redhat/java-1.4.2-ibm@1.4.2.10-1jpp.2.el3?arch=i386", }, }, }, { category: "product_version", name: "rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", product: { name: "rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", product_id: "rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", product_identification_helper: { purl: "pkg:rpm/redhat/rhn-modjk-ap13@1.2.23-2rhn.rhel3?arch=i386", }, }, }, { category: "product_version", name: "openmotif21-0:2.1.30-9.RHEL3.8.i386", product: { name: "openmotif21-0:2.1.30-9.RHEL3.8.i386", product_id: "openmotif21-0:2.1.30-9.RHEL3.8.i386", product_identification_helper: { purl: "pkg:rpm/redhat/openmotif21@2.1.30-9.RHEL3.8?arch=i386", }, }, }, { category: "product_version", name: "openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", product: { name: "openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", product_id: "openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", product_identification_helper: { purl: "pkg:rpm/redhat/openmotif21-debuginfo@2.1.30-9.RHEL3.8?arch=i386", }, }, }, { category: "product_version", name: "rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", product: { name: "rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", product_id: "rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", product_identification_helper: { purl: "pkg:rpm/redhat/rhn-modssl@2.8.12-8.rhn.10.rhel3?arch=i386", }, }, }, { category: "product_version", name: "rhn-apache-0:1.3.27-36.rhn.rhel3.i386", product: { name: "rhn-apache-0:1.3.27-36.rhn.rhel3.i386", product_id: "rhn-apache-0:1.3.27-36.rhn.rhel3.i386", product_identification_helper: { purl: "pkg:rpm/redhat/rhn-apache@1.3.27-36.rhn.rhel3?arch=i386", }, }, }, { category: "product_version", name: "rhn-modperl-0:1.29-16.rhel3.i386", product: { name: "rhn-modperl-0:1.29-16.rhel3.i386", product_id: "rhn-modperl-0:1.29-16.rhel3.i386", product_identification_helper: { purl: "pkg:rpm/redhat/rhn-modperl@1.29-16.rhel3?arch=i386", }, }, }, { category: "product_version", name: "rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", product: { name: "rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", product_id: "rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", product_identification_helper: { purl: "pkg:rpm/redhat/rhn-modssl@2.8.12-8.rhn.10.rhel4?arch=i386", }, }, }, { category: "product_version", name: "jabberd-0:2.0s10-3.38.rhn.i386", product: { name: "jabberd-0:2.0s10-3.38.rhn.i386", product_id: "jabberd-0:2.0s10-3.38.rhn.i386", product_identification_helper: { purl: "pkg:rpm/redhat/jabberd@2.0s10-3.38.rhn?arch=i386", }, }, }, { category: "product_version", name: "openmotif21-0:2.1.30-11.RHEL4.6.i386", product: { name: "openmotif21-0:2.1.30-11.RHEL4.6.i386", product_id: "openmotif21-0:2.1.30-11.RHEL4.6.i386", product_identification_helper: { purl: "pkg:rpm/redhat/openmotif21@2.1.30-11.RHEL4.6?arch=i386", }, }, }, { category: "product_version", name: "openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", product: { name: "openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", product_id: "openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", product_identification_helper: { purl: "pkg:rpm/redhat/openmotif21-debuginfo@2.1.30-11.RHEL4.6?arch=i386", }, }, }, { category: "product_version", name: "rhn-apache-0:1.3.27-36.rhn.rhel4.i386", product: { name: "rhn-apache-0:1.3.27-36.rhn.rhel4.i386", product_id: "rhn-apache-0:1.3.27-36.rhn.rhel4.i386", product_identification_helper: { purl: "pkg:rpm/redhat/rhn-apache@1.3.27-36.rhn.rhel4?arch=i386", }, }, }, { category: "product_version", name: "java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", product: { name: "java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", product_id: "java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", product_identification_helper: { purl: "pkg:rpm/redhat/java-1.4.2-ibm@1.4.2.10-1jpp.2.el4?arch=i386", }, }, }, { category: "product_version", name: "java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", product: { name: "java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", product_id: "java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", product_identification_helper: { purl: "pkg:rpm/redhat/java-1.4.2-ibm-devel@1.4.2.10-1jpp.2.el4?arch=i386", }, }, }, { category: "product_version", name: "rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", product: { name: "rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", product_id: "rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", product_identification_helper: { purl: "pkg:rpm/redhat/rhn-modjk-ap13@1.2.23-2rhn.rhel4?arch=i386", }, }, }, { category: "product_version", name: "rhn-modperl-0:1.29-16.rhel4.i386", product: { name: "rhn-modperl-0:1.29-16.rhel4.i386", product_id: "rhn-modperl-0:1.29-16.rhel4.i386", product_identification_helper: { purl: "pkg:rpm/redhat/rhn-modperl@1.29-16.rhel4?arch=i386", }, }, }, ], category: "architecture", name: "i386", }, { branches: [ { category: "product_version", name: "jfreechart-0:0.9.20-3.rhn.noarch", product: { name: "jfreechart-0:0.9.20-3.rhn.noarch", product_id: "jfreechart-0:0.9.20-3.rhn.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/jfreechart@0.9.20-3.rhn?arch=noarch", }, }, }, { category: "product_version", name: "tomcat5-0:5.0.30-0jpp_10rh.noarch", product: { name: "tomcat5-0:5.0.30-0jpp_10rh.noarch", product_id: "tomcat5-0:5.0.30-0jpp_10rh.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/tomcat5@5.0.30-0jpp_10rh?arch=noarch", }, }, }, { category: "product_version", name: "perl-Crypt-CBC-0:2.24-1.el3.noarch", product: { name: "perl-Crypt-CBC-0:2.24-1.el3.noarch", product_id: "perl-Crypt-CBC-0:2.24-1.el3.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/perl-Crypt-CBC@2.24-1.el3?arch=noarch", }, }, }, { category: "product_version", name: "perl-Crypt-CBC-0:2.24-1.el4.noarch", product: { name: "perl-Crypt-CBC-0:2.24-1.el4.noarch", product_id: "perl-Crypt-CBC-0:2.24-1.el4.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/perl-Crypt-CBC@2.24-1.el4?arch=noarch", }, }, }, ], category: "architecture", name: "noarch", }, ], category: "vendor", name: "Red Hat", }, ], relationships: [ { category: "default_component_of", full_product_name: { name: "jabberd-0:2.0s10-3.37.rhn.i386 as a component of Red Hat Satellite v 4.2 (RHEL v.3 AS)", product_id: "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", }, product_reference: "jabberd-0:2.0s10-3.37.rhn.i386", relates_to_product_reference: "3AS-RHNSAT4.2", }, { category: "default_component_of", full_product_name: { name: "java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386 as a component of Red Hat Satellite v 4.2 (RHEL v.3 AS)", product_id: "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", }, product_reference: "java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", relates_to_product_reference: "3AS-RHNSAT4.2", }, { category: "default_component_of", full_product_name: { name: "java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386 as a component of Red Hat Satellite v 4.2 (RHEL v.3 AS)", product_id: "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", }, product_reference: "java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", relates_to_product_reference: "3AS-RHNSAT4.2", }, { category: "default_component_of", full_product_name: { name: "jfreechart-0:0.9.20-3.rhn.noarch as a component of Red Hat Satellite v 4.2 (RHEL v.3 AS)", product_id: "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", }, product_reference: "jfreechart-0:0.9.20-3.rhn.noarch", relates_to_product_reference: "3AS-RHNSAT4.2", }, { category: "default_component_of", full_product_name: { name: "openmotif21-0:2.1.30-9.RHEL3.8.i386 as a component of Red Hat Satellite v 4.2 (RHEL v.3 AS)", product_id: "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", }, product_reference: "openmotif21-0:2.1.30-9.RHEL3.8.i386", relates_to_product_reference: "3AS-RHNSAT4.2", }, { category: "default_component_of", full_product_name: { name: "openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386 as a component of Red Hat Satellite v 4.2 (RHEL v.3 AS)", product_id: "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", }, product_reference: "openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", relates_to_product_reference: "3AS-RHNSAT4.2", }, { category: "default_component_of", full_product_name: { name: "perl-Crypt-CBC-0:2.24-1.el3.noarch as a component of Red Hat Satellite v 4.2 (RHEL v.3 AS)", product_id: "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", }, product_reference: "perl-Crypt-CBC-0:2.24-1.el3.noarch", relates_to_product_reference: "3AS-RHNSAT4.2", }, { category: "default_component_of", full_product_name: { name: "rhn-apache-0:1.3.27-36.rhn.rhel3.i386 as a component of Red Hat Satellite v 4.2 (RHEL v.3 AS)", product_id: "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", }, product_reference: "rhn-apache-0:1.3.27-36.rhn.rhel3.i386", relates_to_product_reference: "3AS-RHNSAT4.2", }, { category: "default_component_of", full_product_name: { name: "rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386 as a component of Red Hat Satellite v 4.2 (RHEL v.3 AS)", product_id: "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", }, product_reference: "rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", relates_to_product_reference: "3AS-RHNSAT4.2", }, { category: "default_component_of", full_product_name: { name: "rhn-modperl-0:1.29-16.rhel3.i386 as a component of Red Hat Satellite v 4.2 (RHEL v.3 AS)", product_id: "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", }, product_reference: "rhn-modperl-0:1.29-16.rhel3.i386", relates_to_product_reference: "3AS-RHNSAT4.2", }, { category: "default_component_of", full_product_name: { name: "rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386 as a component of Red Hat Satellite v 4.2 (RHEL v.3 AS)", product_id: "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", }, product_reference: "rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", relates_to_product_reference: "3AS-RHNSAT4.2", }, { category: "default_component_of", full_product_name: { name: "tomcat5-0:5.0.30-0jpp_10rh.noarch as a component of Red Hat Satellite v 4.2 (RHEL v.3 AS)", product_id: "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", }, product_reference: "tomcat5-0:5.0.30-0jpp_10rh.noarch", relates_to_product_reference: "3AS-RHNSAT4.2", }, { category: "default_component_of", full_product_name: { name: "jabberd-0:2.0s10-3.38.rhn.i386 as a component of Red Hat Satellite v 4.2 (RHEL v.4 AS)", product_id: "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", }, product_reference: "jabberd-0:2.0s10-3.38.rhn.i386", relates_to_product_reference: "4AS-RHNSAT4.2", }, { category: "default_component_of", full_product_name: { name: "java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386 as a component of Red Hat Satellite v 4.2 (RHEL v.4 AS)", product_id: "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", }, product_reference: "java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", relates_to_product_reference: "4AS-RHNSAT4.2", }, { category: "default_component_of", full_product_name: { name: "java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386 as a component of Red Hat Satellite v 4.2 (RHEL v.4 AS)", product_id: "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", }, product_reference: "java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", relates_to_product_reference: "4AS-RHNSAT4.2", }, { category: "default_component_of", full_product_name: { name: "jfreechart-0:0.9.20-3.rhn.noarch as a component of Red Hat Satellite v 4.2 (RHEL v.4 AS)", product_id: "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", }, product_reference: "jfreechart-0:0.9.20-3.rhn.noarch", relates_to_product_reference: "4AS-RHNSAT4.2", }, { category: "default_component_of", full_product_name: { name: "openmotif21-0:2.1.30-11.RHEL4.6.i386 as a component of Red Hat Satellite v 4.2 (RHEL v.4 AS)", product_id: "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", }, product_reference: "openmotif21-0:2.1.30-11.RHEL4.6.i386", relates_to_product_reference: "4AS-RHNSAT4.2", }, { category: "default_component_of", full_product_name: { name: "openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386 as a component of Red Hat Satellite v 4.2 (RHEL v.4 AS)", product_id: "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", }, product_reference: "openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", relates_to_product_reference: "4AS-RHNSAT4.2", }, { category: "default_component_of", full_product_name: { name: "perl-Crypt-CBC-0:2.24-1.el4.noarch as a component of Red Hat Satellite v 4.2 (RHEL v.4 AS)", product_id: "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", }, product_reference: "perl-Crypt-CBC-0:2.24-1.el4.noarch", relates_to_product_reference: "4AS-RHNSAT4.2", }, { category: "default_component_of", full_product_name: { name: "rhn-apache-0:1.3.27-36.rhn.rhel4.i386 as a component of Red Hat Satellite v 4.2 (RHEL v.4 AS)", product_id: "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", }, product_reference: "rhn-apache-0:1.3.27-36.rhn.rhel4.i386", relates_to_product_reference: "4AS-RHNSAT4.2", }, { category: "default_component_of", full_product_name: { name: "rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386 as a component of Red Hat Satellite v 4.2 (RHEL v.4 AS)", product_id: "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", }, product_reference: "rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", relates_to_product_reference: "4AS-RHNSAT4.2", }, { category: "default_component_of", full_product_name: { name: "rhn-modperl-0:1.29-16.rhel4.i386 as a component of Red Hat Satellite v 4.2 (RHEL v.4 AS)", product_id: "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", }, product_reference: "rhn-modperl-0:1.29-16.rhel4.i386", relates_to_product_reference: "4AS-RHNSAT4.2", }, { category: "default_component_of", full_product_name: { name: "rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386 as a component of Red Hat Satellite v 4.2 (RHEL v.4 AS)", product_id: "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", }, product_reference: "rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", relates_to_product_reference: "4AS-RHNSAT4.2", }, { category: "default_component_of", full_product_name: { name: "tomcat5-0:5.0.30-0jpp_10rh.noarch as a component of Red Hat Satellite v 4.2 (RHEL v.4 AS)", product_id: "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", }, product_reference: "tomcat5-0:5.0.30-0jpp_10rh.noarch", relates_to_product_reference: "4AS-RHNSAT4.2", }, ], }, vulnerabilities: [ { cve: "CVE-2004-0687", ids: [ { system_name: "Red Hat Bugzilla ID", text: "430513", }, ], notes: [ { category: "description", text: "Multiple stack-based buffer overflows in (1) xpmParseColors in parse.c, (2) ParseAndPutPixels in create.c, and (3) ParsePixels in parse.c for libXpm before 6.8.1 allow remote attackers to execute arbitrary code via a malformed XPM image file.", title: "Vulnerability description", }, { category: "summary", text: "openmotif21 stack overflows in libxpm", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Enterprise Linux 5 is not vulnerable to this issue as it contains a backported patch.", title: "Statement", }, ], product_status: { fixed: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2004-0687", }, { category: "external", summary: "RHBZ#430513", url: "https://bugzilla.redhat.com/show_bug.cgi?id=430513", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2004-0687", url: "https://www.cve.org/CVERecord?id=CVE-2004-0687", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2004-0687", url: "https://nvd.nist.gov/vuln/detail/CVE-2004-0687", }, ], release_date: "2004-10-07T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-06-30T15:33:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0524", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "openmotif21 stack overflows in libxpm", }, { cve: "CVE-2004-0688", ids: [ { system_name: "Red Hat Bugzilla ID", text: "430515", }, ], notes: [ { category: "description", text: "Multiple integer overflows in (1) the xpmParseColors function in parse.c, (2) XpmCreateImageFromXpmImage, (3) CreateXImage, (4) ParsePixels, and (5) ParseAndPutPixels for libXpm before 6.8.1 may allow remote attackers to execute arbitrary code via a malformed XPM image file.", title: "Vulnerability description", }, { category: "summary", text: "openmotif21 stack overflows in libxpm", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Enterprise Linux 5 is not vulnerable to this issue as it contains a backported patch.", title: "Statement", }, ], product_status: { fixed: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2004-0688", }, { category: "external", summary: "RHBZ#430515", url: "https://bugzilla.redhat.com/show_bug.cgi?id=430515", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2004-0688", url: "https://www.cve.org/CVERecord?id=CVE-2004-0688", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2004-0688", url: "https://nvd.nist.gov/vuln/detail/CVE-2004-0688", }, ], release_date: "2004-09-15T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-06-30T15:33:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0524", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "openmotif21 stack overflows in libxpm", }, { cve: "CVE-2004-0885", ids: [ { system_name: "Red Hat Bugzilla ID", text: "430637", }, ], notes: [ { category: "description", text: "The mod_ssl module in Apache 2.0.35 through 2.0.52, when using the \"SSLCipherSuite\" directive in directory or location context, allows remote clients to bypass intended restrictions by using any cipher suite that is allowed by the virtual host configuration.", title: "Vulnerability description", }, { category: "summary", text: "mod_ssl SSLCipherSuite bypass", title: "Vulnerability summary", }, ], product_status: { fixed: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2004-0885", }, { category: "external", summary: "RHBZ#430637", url: "https://bugzilla.redhat.com/show_bug.cgi?id=430637", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2004-0885", url: "https://www.cve.org/CVERecord?id=CVE-2004-0885", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2004-0885", url: "https://nvd.nist.gov/vuln/detail/CVE-2004-0885", }, ], release_date: "2004-10-05T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-06-30T15:33:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0524", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "mod_ssl SSLCipherSuite bypass", }, { cve: "CVE-2004-0914", ids: [ { system_name: "Red Hat Bugzilla ID", text: "430516", }, ], notes: [ { category: "description", text: "Multiple vulnerabilities in libXpm for 6.8.1 and earlier, as used in XFree86 and other packages, include (1) multiple integer overflows, (2) out-of-bounds memory accesses, (3) directory traversal, (4) shell metacharacter, (5) endless loops, and (6) memory leaks, which could allow remote attackers to obtain sensitive information, cause a denial of service (application crash), or execute arbitrary code via a certain XPM image file. NOTE: it is highly likely that this candidate will be SPLIT into other candidates in the future, per CVE's content decisions.", title: "Vulnerability description", }, { category: "summary", text: "openmotif21 stack overflows in libxpm", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Enterprise Linux 5 is not vulnerable to this issue as it contains a backported patch.", title: "Statement", }, ], product_status: { fixed: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2004-0914", }, { category: "external", summary: "RHBZ#430516", url: "https://bugzilla.redhat.com/show_bug.cgi?id=430516", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2004-0914", url: "https://www.cve.org/CVERecord?id=CVE-2004-0914", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2004-0914", url: "https://nvd.nist.gov/vuln/detail/CVE-2004-0914", }, ], release_date: "2004-09-15T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-06-30T15:33:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0524", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "openmotif21 stack overflows in libxpm", }, { cve: "CVE-2005-0605", discovery_date: "2005-02-28T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "430520", }, ], notes: [ { category: "description", text: "scan.c for LibXPM may allow attackers to execute arbitrary code via a negative bitmap_unit value that leads to a buffer overflow.", title: "Vulnerability description", }, { category: "summary", text: "libxpm buffer overflow", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Enterprise Linux 5 is not vulnerable to this issue as it contains a backported patch.", title: "Statement", }, ], product_status: { fixed: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2005-0605", }, { category: "external", summary: "RHBZ#430520", url: "https://bugzilla.redhat.com/show_bug.cgi?id=430520", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2005-0605", url: "https://www.cve.org/CVERecord?id=CVE-2005-0605", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2005-0605", url: "https://nvd.nist.gov/vuln/detail/CVE-2005-0605", }, ], release_date: "2005-03-01T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-06-30T15:33:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0524", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "libxpm buffer overflow", }, { cve: "CVE-2005-2090", discovery_date: "2005-06-06T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "237079", }, ], notes: [ { category: "description", text: "Jakarta Tomcat 5.0.19 (Coyote/1.1) and Tomcat 4.1.24 (Coyote/1.0) allows remote attackers to poison the web cache, bypass web application firewall protection, and conduct XSS attacks via an HTTP request with both a \"Transfer-Encoding: chunked\" header and a Content-Length header, which causes Tomcat to incorrectly handle and forward the body of the request in a way that causes the receiving server to process it as a separate HTTP request, aka \"HTTP Request Smuggling.\"", title: "Vulnerability description", }, { category: "summary", text: "tomcat multiple content-length header poisioning", title: "Vulnerability summary", }, ], product_status: { fixed: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2005-2090", }, { category: "external", summary: "RHBZ#237079", url: "https://bugzilla.redhat.com/show_bug.cgi?id=237079", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2005-2090", url: "https://www.cve.org/CVERecord?id=CVE-2005-2090", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2005-2090", url: "https://nvd.nist.gov/vuln/detail/CVE-2005-2090", }, ], release_date: "2005-06-06T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-06-30T15:33:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0524", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "tomcat multiple content-length header poisioning", }, { cve: "CVE-2005-3510", discovery_date: "2005-11-07T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "237085", }, ], notes: [ { category: "description", text: "Apache Tomcat 5.5.0 to 5.5.11 allows remote attackers to cause a denial of service (CPU consumption) via a large number of simultaneous requests to list a web directory that has a large number of files.", title: "Vulnerability description", }, { category: "summary", text: "tomcat DoS", title: "Vulnerability summary", }, ], product_status: { fixed: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2005-3510", }, { category: "external", summary: "RHBZ#237085", url: "https://bugzilla.redhat.com/show_bug.cgi?id=237085", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2005-3510", url: "https://www.cve.org/CVERecord?id=CVE-2005-3510", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2005-3510", url: "https://nvd.nist.gov/vuln/detail/CVE-2005-3510", }, ], release_date: "2005-11-03T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-06-30T15:33:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0524", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "tomcat DoS", }, { cve: "CVE-2005-3964", discovery_date: "2005-12-02T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "430519", }, ], notes: [ { category: "description", text: "Multiple buffer overflows in libUil (libUil.so) in OpenMotif 2.2.3, and possibly other versions, allows attackers to execute arbitrary code via the (1) diag_issue_diagnostic function in UilDiags.c and (2) open_source_file function in UilSrcSrc.c.", title: "Vulnerability description", }, { category: "summary", text: "openmotif libUil buffer overflows", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Enterprise Linux 5 is not vulnerable to this issue as it contains a backported patch.", title: "Statement", }, ], product_status: { fixed: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2005-3964", }, { category: "external", summary: "RHBZ#430519", url: "https://bugzilla.redhat.com/show_bug.cgi?id=430519", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2005-3964", url: "https://www.cve.org/CVERecord?id=CVE-2005-3964", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2005-3964", url: "https://nvd.nist.gov/vuln/detail/CVE-2005-3964", }, ], release_date: "2005-12-02T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-06-30T15:33:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0524", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "openmotif libUil buffer overflows", }, { cve: "CVE-2005-4838", discovery_date: "2005-01-03T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "238401", }, ], notes: [ { category: "description", text: "Multiple cross-site scripting (XSS) vulnerabilities in the example web applications for Jakarta Tomcat 5.5.6 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) el/functions.jsp, (2) el/implicit-objects.jsp, and (3) jspx/textRotate.jspx in examples/jsp2/, as demonstrated via script in a request to snp/snoop.jsp. NOTE: other XSS issues in the manager were simultaneously reported, but these require admin access and do not cross privilege boundaries.", title: "Vulnerability description", }, { category: "summary", text: "tomcat manager example DoS", title: "Vulnerability summary", }, ], product_status: { fixed: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2005-4838", }, { category: "external", summary: "RHBZ#238401", url: "https://bugzilla.redhat.com/show_bug.cgi?id=238401", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2005-4838", url: "https://www.cve.org/CVERecord?id=CVE-2005-4838", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2005-4838", url: "https://nvd.nist.gov/vuln/detail/CVE-2005-4838", }, ], release_date: "2005-01-03T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-06-30T15:33:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0524", }, ], threats: [ { category: "impact", details: "Low", }, ], title: "tomcat manager example DoS", }, { cve: "CVE-2006-0254", cwe: { id: "CWE-79", name: "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", }, discovery_date: "2006-01-17T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "430646", }, ], notes: [ { category: "description", text: "Multiple cross-site scripting (XSS) vulnerabilities in Apache Geronimo 1.0 allow remote attackers to inject arbitrary web script or HTML via the (1) time parameter to cal2.jsp and (2) any invalid parameter, which causes an XSS when the log file is viewed by the Web-Access-Log viewer.", title: "Vulnerability description", }, { category: "summary", text: "tomcat examples XSS", title: "Vulnerability summary", }, ], product_status: { fixed: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2006-0254", }, { category: "external", summary: "RHBZ#430646", url: "https://bugzilla.redhat.com/show_bug.cgi?id=430646", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2006-0254", url: "https://www.cve.org/CVERecord?id=CVE-2006-0254", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2006-0254", url: "https://nvd.nist.gov/vuln/detail/CVE-2006-0254", }, ], release_date: "2006-01-15T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-06-30T15:33:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0524", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "tomcat examples XSS", }, { cve: "CVE-2006-0898", ids: [ { system_name: "Red Hat Bugzilla ID", text: "430522", }, ], notes: [ { category: "description", text: "Crypt::CBC Perl module 2.16 and earlier, when running in RandomIV mode, uses an initialization vector (IV) of 8 bytes, which results in weaker encryption when used with a cipher that requires a larger block size than 8 bytes, such as Rijndael.", title: "Vulnerability description", }, { category: "summary", text: "perl-Crypt-CBC weaker encryption with some ciphers", title: "Vulnerability summary", }, ], product_status: { fixed: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2006-0898", }, { category: "external", summary: "RHBZ#430522", url: "https://bugzilla.redhat.com/show_bug.cgi?id=430522", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2006-0898", url: "https://www.cve.org/CVERecord?id=CVE-2006-0898", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2006-0898", url: "https://nvd.nist.gov/vuln/detail/CVE-2006-0898", }, ], release_date: "2006-02-23T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-06-30T15:33:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0524", }, ], threats: [ { category: "impact", details: "Low", }, ], title: "perl-Crypt-CBC weaker encryption with some ciphers", }, { cve: "CVE-2006-1329", ids: [ { system_name: "Red Hat Bugzilla ID", text: "429254", }, ], notes: [ { category: "description", text: "The SASL negotiation in Jabber Studio jabberd before 2.0s11 allows remote attackers to cause a denial of service (\"c2s segfault\") by sending a \"response stanza before an auth stanza\".", title: "Vulnerability description", }, { category: "summary", text: "jabberd SASL DoS", title: "Vulnerability summary", }, ], product_status: { fixed: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2006-1329", }, { category: "external", summary: "RHBZ#429254", url: "https://bugzilla.redhat.com/show_bug.cgi?id=429254", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2006-1329", url: "https://www.cve.org/CVERecord?id=CVE-2006-1329", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2006-1329", url: "https://nvd.nist.gov/vuln/detail/CVE-2006-1329", }, ], release_date: "2006-03-09T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-06-30T15:33:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0524", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "jabberd SASL DoS", }, { cve: "CVE-2006-3835", discovery_date: "2006-07-21T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "237084", }, ], notes: [ { category: "description", text: "Apache Tomcat 5 before 5.5.17 allows remote attackers to list directories via a semicolon (;) preceding a filename with a mapped extension, as demonstrated by URLs ending with /;index.jsp and /;help.do.", title: "Vulnerability description", }, { category: "summary", text: "tomcat directory listing issue", title: "Vulnerability summary", }, { category: "other", text: "This issue is not a security issue in Tomcat itself, but is caused when directory listings are enabled.\n\nDetails on how to disable directory listings are available at: http://tomcat.apache.org/faq/misc.html#listing", title: "Statement", }, ], product_status: { fixed: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2006-3835", }, { category: "external", summary: "RHBZ#237084", url: "https://bugzilla.redhat.com/show_bug.cgi?id=237084", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2006-3835", url: "https://www.cve.org/CVERecord?id=CVE-2006-3835", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2006-3835", url: "https://nvd.nist.gov/vuln/detail/CVE-2006-3835", }, ], release_date: "2006-07-21T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-06-30T15:33:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0524", }, ], threats: [ { category: "impact", details: "Low", }, ], title: "tomcat directory listing issue", }, { cve: "CVE-2006-5752", cwe: { id: "CWE-79", name: "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", }, discovery_date: "2007-06-20T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "245112", }, ], notes: [ { category: "description", text: "Cross-site scripting (XSS) vulnerability in mod_status.c in the mod_status module in Apache HTTP Server (httpd), when ExtendedStatus is enabled and a public server-status page is used, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors involving charsets with browsers that perform \"charset detection\" when the content-type is not specified.", title: "Vulnerability description", }, { category: "summary", text: "httpd mod_status XSS", title: "Vulnerability summary", }, ], product_status: { fixed: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2006-5752", }, { category: "external", summary: "RHBZ#245112", url: "https://bugzilla.redhat.com/show_bug.cgi?id=245112", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2006-5752", url: "https://www.cve.org/CVERecord?id=CVE-2006-5752", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2006-5752", url: "https://nvd.nist.gov/vuln/detail/CVE-2006-5752", }, ], release_date: "2007-06-20T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-06-30T15:33:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0524", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "httpd mod_status XSS", }, { cve: "CVE-2006-7195", cwe: { id: "CWE-79", name: "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", }, discovery_date: "2007-04-19T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "237081", }, ], notes: [ { category: "description", text: "Cross-site scripting (XSS) vulnerability in implicit-objects.jsp in Apache Tomcat 5.0.0 through 5.0.30 and 5.5.0 through 5.5.17 allows remote attackers to inject arbitrary web script or HTML via certain header values.", title: "Vulnerability description", }, { category: "summary", text: "tomcat XSS in example webapps", title: "Vulnerability summary", }, ], product_status: { fixed: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2006-7195", }, { category: "external", summary: "RHBZ#237081", url: "https://bugzilla.redhat.com/show_bug.cgi?id=237081", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2006-7195", url: "https://www.cve.org/CVERecord?id=CVE-2006-7195", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2006-7195", url: "https://nvd.nist.gov/vuln/detail/CVE-2006-7195", }, ], release_date: "2007-04-19T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-06-30T15:33:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0524", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "tomcat XSS in example webapps", }, { cve: "CVE-2006-7196", cwe: { id: "CWE-79", name: "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", }, discovery_date: "2007-04-26T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "238131", }, ], notes: [ { category: "description", text: "Cross-site scripting (XSS) vulnerability in the calendar application example in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0 through 4.1.31, 5.0.0 through 5.0.30, and 5.5.0 through 5.5.15 allows remote attackers to inject arbitrary web script or HTML via the time parameter to cal2.jsp and possibly unspecified other vectors. NOTE: this may be related to CVE-2006-0254.1.", title: "Vulnerability description", }, { category: "summary", text: "tomcat XSS in example webapps", title: "Vulnerability summary", }, ], product_status: { fixed: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2006-7196", }, { category: "external", summary: "RHBZ#238131", url: "https://bugzilla.redhat.com/show_bug.cgi?id=238131", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2006-7196", url: "https://www.cve.org/CVERecord?id=CVE-2006-7196", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2006-7196", url: "https://nvd.nist.gov/vuln/detail/CVE-2006-7196", }, ], release_date: "2007-04-26T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-06-30T15:33:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0524", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "tomcat XSS in example webapps", }, { cve: "CVE-2006-7197", ids: [ { system_name: "Red Hat Bugzilla ID", text: "430642", }, ], notes: [ { category: "description", text: "The AJP connector in Apache Tomcat 5.5.15 uses an incorrect length for chunks, which can cause a buffer over-read in the ajp_process_callback in mod_jk, which allows remote attackers to read portions of sensitive memory.", title: "Vulnerability description", }, { category: "summary", text: "mod_jk chunk too long", title: "Vulnerability summary", }, ], product_status: { fixed: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2006-7197", }, { category: "external", summary: "RHBZ#430642", url: "https://bugzilla.redhat.com/show_bug.cgi?id=430642", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2006-7197", url: "https://www.cve.org/CVERecord?id=CVE-2006-7197", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2006-7197", url: "https://nvd.nist.gov/vuln/detail/CVE-2006-7197", }, ], release_date: "2006-03-05T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-06-30T15:33:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0524", }, ], threats: [ { category: "impact", details: "Important", }, ], title: "mod_jk chunk too long", }, { cve: "CVE-2007-0243", discovery_date: "2007-04-17T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "325941", }, ], notes: [ { category: "description", text: "Buffer overflow in Sun JDK and Java Runtime Environment (JRE) 5.0 Update 9 and earlier, SDK and JRE 1.4.2_12 and earlier, and SDK and JRE 1.3.1_18 and earlier allows applets to gain privileges via a GIF image with a block with a 0 width field, which triggers memory corruption.", title: "Vulnerability description", }, { category: "summary", text: "java-jre: GIF buffer overflow", title: "Vulnerability summary", }, ], product_status: { fixed: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-0243", }, { category: "external", summary: "RHBZ#325941", url: "https://bugzilla.redhat.com/show_bug.cgi?id=325941", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-0243", url: "https://www.cve.org/CVERecord?id=CVE-2007-0243", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-0243", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-0243", }, ], release_date: "2007-01-17T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-06-30T15:33:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0524", }, ], threats: [ { category: "impact", details: "Important", }, ], title: "java-jre: GIF buffer overflow", }, { cve: "CVE-2007-0450", discovery_date: "2007-03-14T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "237080", }, ], notes: [ { category: "description", text: "Directory traversal vulnerability in Apache HTTP Server and Tomcat 5.x before 5.5.22 and 6.x before 6.0.10, when using certain proxy modules (mod_proxy, mod_rewrite, mod_jk), allows remote attackers to read arbitrary files via a .. (dot dot) sequence with combinations of (1) \"/\" (slash), (2) \"\\\" (backslash), and (3) URL-encoded backslash (%5C) characters in the URL, which are valid separators in Tomcat but not in Apache.", title: "Vulnerability description", }, { category: "summary", text: "tomcat directory traversal", title: "Vulnerability summary", }, ], product_status: { fixed: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-0450", }, { category: "external", summary: "RHBZ#237080", url: "https://bugzilla.redhat.com/show_bug.cgi?id=237080", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-0450", url: "https://www.cve.org/CVERecord?id=CVE-2007-0450", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-0450", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-0450", }, ], release_date: "2007-03-14T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-06-30T15:33:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0524", }, ], threats: [ { category: "impact", details: "Important", }, ], title: "tomcat directory traversal", }, { cve: "CVE-2007-1349", discovery_date: "2007-05-17T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "240423", }, ], notes: [ { category: "description", text: "PerlRun.pm in Apache mod_perl before 1.30, and RegistryCooker.pm in mod_perl 2.x, does not properly escape PATH_INFO before use in a regular expression, which allows remote attackers to cause a denial of service (resource consumption) via a crafted URI.", title: "Vulnerability description", }, { category: "summary", text: "mod_perl PerlRun denial of service", title: "Vulnerability summary", }, ], product_status: { fixed: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-1349", }, { category: "external", summary: "RHBZ#240423", url: "https://bugzilla.redhat.com/show_bug.cgi?id=240423", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-1349", url: "https://www.cve.org/CVERecord?id=CVE-2007-1349", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-1349", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-1349", }, ], release_date: "2007-03-22T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-06-30T15:33:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0524", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "mod_perl PerlRun denial of service", }, { cve: "CVE-2007-1355", cwe: { id: "CWE-79", name: "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", }, discovery_date: "2007-05-19T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "253166", }, ], notes: [ { category: "description", text: "Multiple cross-site scripting (XSS) vulnerabilities in the appdev/sample/web/hello.jsp example application in Tomcat 4.0.0 through 4.0.6, 4.1.0 through 4.1.36, 5.0.0 through 5.0.30, 5.5.0 through 5.5.23, and 6.0.0 through 6.0.10 allow remote attackers to inject arbitrary web script or HTML via the test parameter and unspecified vectors.", title: "Vulnerability description", }, { category: "summary", text: "tomcat XSS in samples", title: "Vulnerability summary", }, ], product_status: { fixed: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-1355", }, { category: "external", summary: "RHBZ#253166", url: "https://bugzilla.redhat.com/show_bug.cgi?id=253166", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-1355", url: "https://www.cve.org/CVERecord?id=CVE-2007-1355", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-1355", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-1355", }, ], release_date: "2007-05-19T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-06-30T15:33:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0524", }, ], threats: [ { category: "impact", details: "Low", }, ], title: "tomcat XSS in samples", }, { cve: "CVE-2007-1358", cwe: { id: "CWE-79", name: "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", }, discovery_date: "2007-04-10T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "244803", }, ], notes: [ { category: "description", text: "Cross-site scripting (XSS) vulnerability in certain applications using Apache Tomcat 4.0.0 through 4.0.6 and 4.1.0 through 4.1.34 allows remote attackers to inject arbitrary web script or HTML via crafted \"Accept-Language headers that do not conform to RFC 2616\".", title: "Vulnerability description", }, { category: "summary", text: "tomcat accept-language xss flaw", title: "Vulnerability summary", }, ], product_status: { fixed: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-1358", }, { category: "external", summary: "RHBZ#244803", url: "https://bugzilla.redhat.com/show_bug.cgi?id=244803", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-1358", url: "https://www.cve.org/CVERecord?id=CVE-2007-1358", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-1358", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-1358", }, ], release_date: "2007-06-06T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-06-30T15:33:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0524", }, ], threats: [ { category: "impact", details: "Low", }, ], title: "tomcat accept-language xss flaw", }, { cve: "CVE-2007-1860", discovery_date: "2007-04-20T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "237656", }, ], notes: [ { category: "description", text: "mod_jk in Apache Tomcat JK Web Server Connector 1.2.x before 1.2.23 decodes request URLs within the Apache HTTP Server before passing the URL to Tomcat, which allows remote attackers to access protected pages via a crafted prefix JkMount, possibly involving double-encoded .. (dot dot) sequences and directory traversal, a related issue to CVE-2007-0450.", title: "Vulnerability description", }, { category: "summary", text: "mod_jk sends decoded URL to tomcat", title: "Vulnerability summary", }, ], product_status: { fixed: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-1860", }, { category: "external", summary: "RHBZ#237656", url: "https://bugzilla.redhat.com/show_bug.cgi?id=237656", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-1860", url: "https://www.cve.org/CVERecord?id=CVE-2007-1860", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-1860", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-1860", }, ], release_date: "2007-05-21T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-06-30T15:33:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0524", }, ], threats: [ { category: "impact", details: "Important", }, ], title: "mod_jk sends decoded URL to tomcat", }, { cve: "CVE-2007-2435", discovery_date: "2007-05-01T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "239660", }, ], notes: [ { category: "description", text: "Sun Java Web Start in JDK and JRE 5.0 Update 10 and earlier, and Java Web Start in SDK and JRE 1.4.2_13 and earlier, allows remote attackers to perform unauthorized actions via an application that grants privileges to itself, related to \"Incorrect Use of System Classes\" and probably related to support for JNLP files.", title: "Vulnerability description", }, { category: "summary", text: "javaws vulnerabilities", title: "Vulnerability summary", }, ], product_status: { fixed: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-2435", }, { category: "external", summary: "RHBZ#239660", url: "https://bugzilla.redhat.com/show_bug.cgi?id=239660", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-2435", url: "https://www.cve.org/CVERecord?id=CVE-2007-2435", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-2435", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-2435", }, ], release_date: "2007-04-30T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-06-30T15:33:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0524", }, ], threats: [ { category: "impact", details: "Critical", }, ], title: "javaws vulnerabilities", }, { cve: "CVE-2007-2449", cwe: { id: "CWE-79", name: "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", }, discovery_date: "2007-05-24T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "244804", }, ], notes: [ { category: "description", text: "Multiple cross-site scripting (XSS) vulnerabilities in certain JSP files in the examples web application in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0 through 4.1.36, 5.0.0 through 5.0.30, 5.5.0 through 5.5.24, and 6.0.0 through 6.0.13 allow remote attackers to inject arbitrary web script or HTML via the portion of the URI after the ';' character, as demonstrated by a URI containing a \"snp/snoop.jsp;\" sequence.", title: "Vulnerability description", }, { category: "summary", text: "tomcat examples jsp XSS", title: "Vulnerability summary", }, ], product_status: { fixed: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-2449", }, { category: "external", summary: "RHBZ#244804", url: "https://bugzilla.redhat.com/show_bug.cgi?id=244804", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-2449", url: "https://www.cve.org/CVERecord?id=CVE-2007-2449", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-2449", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-2449", }, ], release_date: "2007-06-13T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-06-30T15:33:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0524", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "tomcat examples jsp XSS", }, { cve: "CVE-2007-2450", cwe: { id: "CWE-79", name: "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", }, discovery_date: "2007-05-24T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "244808", }, ], notes: [ { category: "description", text: "Multiple cross-site scripting (XSS) vulnerabilities in the (1) Manager and (2) Host Manager web applications in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0 through 4.1.36, 5.0.0 through 5.0.30, 5.5.0 through 5.5.24, and 6.0.0 through 6.0.13 allow remote authenticated users to inject arbitrary web script or HTML via a parameter name to manager/html/upload, and other unspecified vectors.", title: "Vulnerability description", }, { category: "summary", text: "tomcat host manager XSS", title: "Vulnerability summary", }, ], product_status: { fixed: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-2450", }, { category: "external", summary: "RHBZ#244808", url: "https://bugzilla.redhat.com/show_bug.cgi?id=244808", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-2450", url: "https://www.cve.org/CVERecord?id=CVE-2007-2450", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-2450", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-2450", }, ], release_date: "2007-06-13T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-06-30T15:33:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0524", }, ], threats: [ { category: "impact", details: "Low", }, ], title: "tomcat host manager XSS", }, { cve: "CVE-2007-2788", cwe: { id: "CWE-190", name: "Integer Overflow or Wraparound", }, discovery_date: "2007-05-21T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "250725", }, ], notes: [ { category: "description", text: "Integer overflow in the embedded ICC profile image parser in Sun Java Development Kit (JDK) before 1.5.0_11-b03 and 1.6.x before 1.6.0_01-b06, and Sun Java Runtime Environment in JDK and JRE 6, JDK and JRE 5.0 Update 10 and earlier, SDK and JRE 1.4.2_14 and earlier, and SDK and JRE 1.3.1_20 and earlier, allows remote attackers to execute arbitrary code or cause a denial of service (JVM crash) via a crafted JPEG or BMP file that triggers a buffer overflow.", title: "Vulnerability description", }, { category: "summary", text: "Integer overflow in the embedded ICC profile image parser in Sun Java Development Kit", title: "Vulnerability summary", }, ], product_status: { fixed: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-2788", }, { category: "external", summary: "RHBZ#250725", url: "https://bugzilla.redhat.com/show_bug.cgi?id=250725", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-2788", url: "https://www.cve.org/CVERecord?id=CVE-2007-2788", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-2788", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-2788", }, ], release_date: "2007-05-21T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-06-30T15:33:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0524", }, ], threats: [ { category: "impact", details: "Critical", }, ], title: "Integer overflow in the embedded ICC profile image parser in Sun Java Development Kit", }, { cve: "CVE-2007-2789", discovery_date: "2007-05-21T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "250729", }, ], notes: [ { category: "description", text: "The BMP image parser in Sun Java Development Kit (JDK) before 1.5.0_11-b03 and 1.6.x before 1.6.0_01-b06, and Sun Java Runtime Environment in JDK and JRE 6, JDK and JRE 5.0 Update 10 and earlier, SDK and JRE 1.4.2_14 and earlier, and SDK and JRE 1.3.1_19 and earlier, when running on Unix/Linux systems, allows remote attackers to cause a denial of service (JVM hang) via untrusted applets or applications that open arbitrary local files via a crafted BMP file, such as /dev/tty.", title: "Vulnerability description", }, { category: "summary", text: "BMP image parser vulnerability", title: "Vulnerability summary", }, ], product_status: { fixed: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-2789", }, { category: "external", summary: "RHBZ#250729", url: "https://bugzilla.redhat.com/show_bug.cgi?id=250729", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-2789", url: "https://www.cve.org/CVERecord?id=CVE-2007-2789", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-2789", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-2789", }, ], release_date: "2007-05-21T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-06-30T15:33:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0524", }, ], threats: [ { category: "impact", details: "Critical", }, ], title: "BMP image parser vulnerability", }, { cve: "CVE-2007-3304", discovery_date: "2007-06-19T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "245111", }, ], notes: [ { category: "description", text: "Apache httpd 1.3.37, 2.0.59, and 2.2.4 with the Prefork MPM module, allows local users to cause a denial of service by modifying the worker_score and process_score arrays to reference an arbitrary process ID, which is sent a SIGUSR1 signal from the master process, aka \"SIGUSR1 killer.\"", title: "Vulnerability description", }, { category: "summary", text: "httpd scoreboard lack of PID protection", title: "Vulnerability summary", }, ], product_status: { fixed: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-3304", }, { category: "external", summary: "RHBZ#245111", url: "https://bugzilla.redhat.com/show_bug.cgi?id=245111", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-3304", url: "https://www.cve.org/CVERecord?id=CVE-2007-3304", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-3304", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-3304", }, ], release_date: "2007-06-19T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-06-30T15:33:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0524", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "httpd scoreboard lack of PID protection", }, { cve: "CVE-2007-3382", discovery_date: "2007-07-12T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "247972", }, ], notes: [ { category: "description", text: "Apache Tomcat 6.0.0 to 6.0.13, 5.5.0 to 5.5.24, 5.0.0 to 5.0.30, 4.1.0 to 4.1.36, and 3.3 to 3.3.2 treats single quotes (\"'\") as delimiters in cookies, which might cause sensitive information such as session IDs to be leaked and allow remote attackers to conduct session hijacking attacks.", title: "Vulnerability description", }, { category: "summary", text: "tomcat handling of cookies", title: "Vulnerability summary", }, ], product_status: { fixed: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-3382", }, { category: "external", summary: "RHBZ#247972", url: "https://bugzilla.redhat.com/show_bug.cgi?id=247972", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-3382", url: "https://www.cve.org/CVERecord?id=CVE-2007-3382", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-3382", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-3382", }, ], release_date: "2007-08-14T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-06-30T15:33:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0524", }, ], threats: [ { category: "impact", details: "Low", }, ], title: "tomcat handling of cookies", }, { cve: "CVE-2007-3385", discovery_date: "2007-07-12T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "247976", }, ], notes: [ { category: "description", text: "Apache Tomcat 6.0.0 to 6.0.13, 5.5.0 to 5.5.24, 5.0.0 to 5.0.30, 4.1.0 to 4.1.36, and 3.3 to 3.3.2 does not properly handle the \\\" character sequence in a cookie value, which might cause sensitive information such as session IDs to be leaked to remote attackers and enable session hijacking attacks.", title: "Vulnerability description", }, { category: "summary", text: "tomcat handling of cookie values", title: "Vulnerability summary", }, ], product_status: { fixed: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-3385", }, { category: "external", summary: "RHBZ#247976", url: "https://bugzilla.redhat.com/show_bug.cgi?id=247976", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-3385", url: "https://www.cve.org/CVERecord?id=CVE-2007-3385", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-3385", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-3385", }, ], release_date: "2007-08-14T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-06-30T15:33:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0524", }, ], threats: [ { category: "impact", details: "Low", }, ], title: "tomcat handling of cookie values", }, { cve: "CVE-2007-4465", cwe: { id: "CWE-79", name: "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", }, discovery_date: "2007-09-13T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "289511", }, ], notes: [ { category: "description", text: "Cross-site scripting (XSS) vulnerability in mod_autoindex.c in the Apache HTTP Server before 2.2.6, when the charset on a server-generated page is not defined, allows remote attackers to inject arbitrary web script or HTML via the P parameter using the UTF-7 charset. NOTE: it could be argued that this issue is due to a design limitation of browsers that attempt to perform automatic content type detection.", title: "Vulnerability description", }, { category: "summary", text: "mod_autoindex XSS", title: "Vulnerability summary", }, { category: "other", text: "This is actually a flaw in browsers that do not derive the response character set as required by RFC 2616. This does not affect the default configuration of Apache httpd in Red Hat products and will only affect customers who have removed the \"AddDefaultCharset\" directive and are using directory indexes. The Red Hat Product Security has rated this issue as having low security impact, a future update may address this flaw.", title: "Statement", }, ], product_status: { fixed: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-4465", }, { category: "external", summary: "RHBZ#289511", url: "https://bugzilla.redhat.com/show_bug.cgi?id=289511", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-4465", url: "https://www.cve.org/CVERecord?id=CVE-2007-4465", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-4465", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-4465", }, ], release_date: "2007-09-13T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-06-30T15:33:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0524", }, ], threats: [ { category: "impact", details: "Low", }, ], title: "mod_autoindex XSS", }, { cve: "CVE-2007-5000", cwe: { id: "CWE-79", name: "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", }, discovery_date: "2007-12-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "419931", }, ], notes: [ { category: "description", text: "Cross-site scripting (XSS) vulnerability in the (1) mod_imap module in the Apache HTTP Server 1.3.0 through 1.3.39 and 2.0.35 through 2.0.61 and the (2) mod_imagemap module in the Apache HTTP Server 2.2.0 through 2.2.6 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.", title: "Vulnerability description", }, { category: "summary", text: "httpd: mod_imagemap XSS", title: "Vulnerability summary", }, ], product_status: { fixed: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-5000", }, { category: "external", summary: "RHBZ#419931", url: "https://bugzilla.redhat.com/show_bug.cgi?id=419931", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-5000", url: "https://www.cve.org/CVERecord?id=CVE-2007-5000", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-5000", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-5000", }, ], release_date: "2007-12-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-06-30T15:33:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0524", }, ], threats: [ { category: "impact", details: "Low", }, ], title: "httpd: mod_imagemap XSS", }, { cve: "CVE-2007-5461", discovery_date: "2007-10-14T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "333791", }, ], notes: [ { category: "description", text: "Absolute path traversal vulnerability in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0, 5.0.0, 5.5.0 through 5.5.25, and 6.0.0 through 6.0.14, under certain configurations, allows remote authenticated users to read arbitrary files via a WebDAV write request that specifies an entity with a SYSTEM tag.", title: "Vulnerability description", }, { category: "summary", text: "Absolute path traversal Apache Tomcat WEBDAV", title: "Vulnerability summary", }, ], product_status: { fixed: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-5461", }, { category: "external", summary: "RHBZ#333791", url: "https://bugzilla.redhat.com/show_bug.cgi?id=333791", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-5461", url: "https://www.cve.org/CVERecord?id=CVE-2007-5461", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-5461", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-5461", }, ], release_date: "2007-10-14T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-06-30T15:33:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0524", }, ], threats: [ { category: "impact", details: "Important", }, ], title: "Absolute path traversal Apache Tomcat WEBDAV", }, { cve: "CVE-2007-6306", cwe: { id: "CWE-79", name: "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", }, discovery_date: "2007-12-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "421081", }, ], notes: [ { category: "description", text: "Multiple cross-site scripting (XSS) vulnerabilities in the image map feature in JFreeChart 1.0.8 allow remote attackers to inject arbitrary web script or HTML via the (1) chart name or (2) chart tool tip text; or the (3) href, (4) shape, or (5) coords attribute of a chart area.", title: "Vulnerability description", }, { category: "summary", text: "JFreeChart: XSS vulnerabilities in the image map feature", title: "Vulnerability summary", }, ], product_status: { fixed: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-6306", }, { category: "external", summary: "RHBZ#421081", url: "https://bugzilla.redhat.com/show_bug.cgi?id=421081", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-6306", url: "https://www.cve.org/CVERecord?id=CVE-2007-6306", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-6306", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-6306", }, ], release_date: "2007-12-06T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-06-30T15:33:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0524", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "JFreeChart: XSS vulnerabilities in the image map feature", }, { cve: "CVE-2007-6388", cwe: { id: "CWE-79", name: "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", }, discovery_date: "2008-01-02T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "427228", }, ], notes: [ { category: "description", text: "Cross-site scripting (XSS) vulnerability in mod_status in the Apache HTTP Server 2.2.0 through 2.2.6, 2.0.35 through 2.0.61, and 1.3.2 through 1.3.39, when the server-status page is enabled, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.", title: "Vulnerability description", }, { category: "summary", text: "apache mod_status cross-site scripting", title: "Vulnerability summary", }, ], product_status: { fixed: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-6388", }, { category: "external", summary: "RHBZ#427228", url: "https://bugzilla.redhat.com/show_bug.cgi?id=427228", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-6388", url: "https://www.cve.org/CVERecord?id=CVE-2007-6388", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-6388", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-6388", }, ], release_date: "2007-12-29T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-06-30T15:33:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0524", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "apache mod_status cross-site scripting", }, { cve: "CVE-2008-0128", discovery_date: "2008-01-23T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "429821", }, ], notes: [ { category: "description", text: "The SingleSignOn Valve (org.apache.catalina.authenticator.SingleSignOn) in Apache Tomcat before 5.5.21 does not set the secure flag for the JSESSIONIDSSO cookie in an https session, which can cause the cookie to be sent in http requests and make it easier for remote attackers to capture this cookie.", title: "Vulnerability description", }, { category: "summary", text: "tomcat5 SSO cookie login information disclosure", title: "Vulnerability summary", }, ], product_status: { fixed: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2008-0128", }, { category: "external", summary: "RHBZ#429821", url: "https://bugzilla.redhat.com/show_bug.cgi?id=429821", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2008-0128", url: "https://www.cve.org/CVERecord?id=CVE-2008-0128", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2008-0128", url: "https://nvd.nist.gov/vuln/detail/CVE-2008-0128", }, ], release_date: "2006-12-20T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-06-30T15:33:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0524", }, ], threats: [ { category: "impact", details: "Low", }, ], title: "tomcat5 SSO cookie login information disclosure", }, ], }
rhsa-2008_0263
Vulnerability from csaf_redhat
Published
2008-05-20 14:14
Modified
2024-12-01 11:53
Summary
Red Hat Security Advisory: Red Hat Network Proxy Server security update
Notes
Topic
Red Hat Network Proxy Server version 5.0.2 is now available. This update
includes fixes for a number of security issues in Red Hat Network Proxy
Server components.
This update has been rated as having low security impact by the Red
Hat Security Response Team.
Details
The Red Hat Network Proxy Server 5.0.2 release corrects several security
vulnerabilities in several shipped components. In a typical operating
environment, these components are not exposed to users of Proxy Server in a
vulnerable manner. These security updates will reduce risk in unique Proxy
Server environments.
Multiple flaws were fixed in the Apache HTTPD server. These flaws could
result in a cross-site scripting or denial-of-service attack.
(CVE-2007-6388, CVE-2007-5000, CVE-2007-3304, CVE-2006-5752)
A denial-of-service flaw was fixed in mod_perl. (CVE-2007-1349)
A denial-of-service flaw was fixed in the jabberd server. (CVE-2006-1329)
Users of Red Hat Network Proxy Server 5.0 are advised to upgrade to 5.0.2,
which resolves these issues.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ document: { aggregate_severity: { namespace: "https://access.redhat.com/security/updates/classification/", text: "Low", }, category: "csaf_security_advisory", csaf_version: "2.0", distribution: { text: "Copyright © Red Hat, Inc. All rights reserved.", tlp: { label: "WHITE", url: "https://www.first.org/tlp/", }, }, lang: "en", notes: [ { category: "summary", text: "Red Hat Network Proxy Server version 5.0.2 is now available. This update\nincludes fixes for a number of security issues in Red Hat Network Proxy\nServer components.\n\nThis update has been rated as having low security impact by the Red\nHat Security Response Team.", title: "Topic", }, { category: "general", text: "The Red Hat Network Proxy Server 5.0.2 release corrects several security\nvulnerabilities in several shipped components. In a typical operating\nenvironment, these components are not exposed to users of Proxy Server in a\nvulnerable manner. These security updates will reduce risk in unique Proxy\nServer environments.\n\nMultiple flaws were fixed in the Apache HTTPD server. These flaws could\nresult in a cross-site scripting or denial-of-service attack.\n(CVE-2007-6388, CVE-2007-5000, CVE-2007-3304, CVE-2006-5752)\n\nA denial-of-service flaw was fixed in mod_perl. (CVE-2007-1349)\n\nA denial-of-service flaw was fixed in the jabberd server. (CVE-2006-1329)\n\nUsers of Red Hat Network Proxy Server 5.0 are advised to upgrade to 5.0.2,\nwhich resolves these issues.", title: "Details", }, { category: "legal_disclaimer", text: "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", title: "Terms of Use", }, ], publisher: { category: "vendor", contact_details: "https://access.redhat.com/security/team/contact/", issuing_authority: "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", name: "Red Hat Product Security", namespace: "https://www.redhat.com", }, references: [ { category: "self", summary: "https://access.redhat.com/errata/RHSA-2008:0263", url: "https://access.redhat.com/errata/RHSA-2008:0263", }, { category: "external", summary: "https://access.redhat.com/security/updates/classification/#low", url: "https://access.redhat.com/security/updates/classification/#low", }, { category: "external", summary: "240423", url: "https://bugzilla.redhat.com/show_bug.cgi?id=240423", }, { category: "external", summary: "245111", url: "https://bugzilla.redhat.com/show_bug.cgi?id=245111", }, { category: "external", summary: "245112", url: "https://bugzilla.redhat.com/show_bug.cgi?id=245112", }, { category: "external", summary: "419931", url: "https://bugzilla.redhat.com/show_bug.cgi?id=419931", }, { category: "external", summary: "427228", url: "https://bugzilla.redhat.com/show_bug.cgi?id=427228", }, { category: "external", summary: "429254", url: "https://bugzilla.redhat.com/show_bug.cgi?id=429254", }, { category: "self", summary: "Canonical URL", url: "https://security.access.redhat.com/data/csaf/v2/advisories/2008/rhsa-2008_0263.json", }, ], title: "Red Hat Security Advisory: Red Hat Network Proxy Server security update", tracking: { current_release_date: "2024-12-01T11:53:30+00:00", generator: { date: "2024-12-01T11:53:30+00:00", engine: { name: "Red Hat SDEngine", version: "4.2.1", }, }, id: "RHSA-2008:0263", initial_release_date: "2008-05-20T14:14:00+00:00", revision_history: [ { date: "2008-05-20T14:14:00+00:00", number: "1", summary: "Initial version", }, { date: "2008-05-20T10:14:27+00:00", number: "2", summary: "Last updated version", }, { date: "2024-12-01T11:53:30+00:00", number: "3", summary: "Last generated version", }, ], status: "final", version: "3", }, }, product_tree: { branches: [ { branches: [ { branches: [ { category: "product_name", name: "Red Hat Satellite Proxy v 5.0 (RHEL v.4 AS)", product: { name: "Red Hat Satellite Proxy v 5.0 (RHEL v.4 AS)", product_id: "4AS-RHNPROXY5.0", product_identification_helper: { cpe: "cpe:/a:redhat:network_proxy:5.0::el4", }, }, }, ], category: "product_family", name: "Red Hat Satellite Proxy", }, { branches: [ { category: "product_version", name: "jabberd-0:2.0s10-3.38.rhn.i386", product: { name: "jabberd-0:2.0s10-3.38.rhn.i386", product_id: "jabberd-0:2.0s10-3.38.rhn.i386", product_identification_helper: { purl: "pkg:rpm/redhat/jabberd@2.0s10-3.38.rhn?arch=i386", }, }, }, { category: "product_version", name: "rhn-apache-0:1.3.27-36.rhn.rhel4.i386", product: { name: "rhn-apache-0:1.3.27-36.rhn.rhel4.i386", product_id: "rhn-apache-0:1.3.27-36.rhn.rhel4.i386", product_identification_helper: { purl: "pkg:rpm/redhat/rhn-apache@1.3.27-36.rhn.rhel4?arch=i386", }, }, }, { category: "product_version", name: "rhn-modperl-0:1.29-16.rhel4.i386", product: { name: "rhn-modperl-0:1.29-16.rhel4.i386", product_id: "rhn-modperl-0:1.29-16.rhel4.i386", product_identification_helper: { purl: "pkg:rpm/redhat/rhn-modperl@1.29-16.rhel4?arch=i386", }, }, }, ], category: "architecture", name: "i386", }, ], category: "vendor", name: "Red Hat", }, ], relationships: [ { category: "default_component_of", full_product_name: { name: "jabberd-0:2.0s10-3.38.rhn.i386 as a component of Red Hat Satellite Proxy v 5.0 (RHEL v.4 AS)", product_id: "4AS-RHNPROXY5.0:jabberd-0:2.0s10-3.38.rhn.i386", }, product_reference: "jabberd-0:2.0s10-3.38.rhn.i386", relates_to_product_reference: "4AS-RHNPROXY5.0", }, { category: "default_component_of", full_product_name: { name: "rhn-apache-0:1.3.27-36.rhn.rhel4.i386 as a component of Red Hat Satellite Proxy v 5.0 (RHEL v.4 AS)", product_id: "4AS-RHNPROXY5.0:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", }, product_reference: "rhn-apache-0:1.3.27-36.rhn.rhel4.i386", relates_to_product_reference: "4AS-RHNPROXY5.0", }, { category: "default_component_of", full_product_name: { name: "rhn-modperl-0:1.29-16.rhel4.i386 as a component of Red Hat Satellite Proxy v 5.0 (RHEL v.4 AS)", product_id: "4AS-RHNPROXY5.0:rhn-modperl-0:1.29-16.rhel4.i386", }, product_reference: "rhn-modperl-0:1.29-16.rhel4.i386", relates_to_product_reference: "4AS-RHNPROXY5.0", }, ], }, vulnerabilities: [ { cve: "CVE-2006-1329", ids: [ { system_name: "Red Hat Bugzilla ID", text: "429254", }, ], notes: [ { category: "description", text: "The SASL negotiation in Jabber Studio jabberd before 2.0s11 allows remote attackers to cause a denial of service (\"c2s segfault\") by sending a \"response stanza before an auth stanza\".", title: "Vulnerability description", }, { category: "summary", text: "jabberd SASL DoS", title: "Vulnerability summary", }, ], product_status: { fixed: [ "4AS-RHNPROXY5.0:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNPROXY5.0:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNPROXY5.0:rhn-modperl-0:1.29-16.rhel4.i386", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2006-1329", }, { category: "external", summary: "RHBZ#429254", url: "https://bugzilla.redhat.com/show_bug.cgi?id=429254", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2006-1329", url: "https://www.cve.org/CVERecord?id=CVE-2006-1329", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2006-1329", url: "https://nvd.nist.gov/vuln/detail/CVE-2006-1329", }, ], release_date: "2006-03-09T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-05-20T14:14:00+00:00", details: "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.\n\nThis update is available via Red Hat Network. Details on how to use \nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/FAQ_58_10188", product_ids: [ "4AS-RHNPROXY5.0:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNPROXY5.0:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNPROXY5.0:rhn-modperl-0:1.29-16.rhel4.i386", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0263", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "jabberd SASL DoS", }, { cve: "CVE-2006-5752", cwe: { id: "CWE-79", name: "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", }, discovery_date: "2007-06-20T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "245112", }, ], notes: [ { category: "description", text: "Cross-site scripting (XSS) vulnerability in mod_status.c in the mod_status module in Apache HTTP Server (httpd), when ExtendedStatus is enabled and a public server-status page is used, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors involving charsets with browsers that perform \"charset detection\" when the content-type is not specified.", title: "Vulnerability description", }, { category: "summary", text: "httpd mod_status XSS", title: "Vulnerability summary", }, ], product_status: { fixed: [ "4AS-RHNPROXY5.0:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNPROXY5.0:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNPROXY5.0:rhn-modperl-0:1.29-16.rhel4.i386", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2006-5752", }, { category: "external", summary: "RHBZ#245112", url: "https://bugzilla.redhat.com/show_bug.cgi?id=245112", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2006-5752", url: "https://www.cve.org/CVERecord?id=CVE-2006-5752", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2006-5752", url: "https://nvd.nist.gov/vuln/detail/CVE-2006-5752", }, ], release_date: "2007-06-20T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-05-20T14:14:00+00:00", details: "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.\n\nThis update is available via Red Hat Network. Details on how to use \nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/FAQ_58_10188", product_ids: [ "4AS-RHNPROXY5.0:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNPROXY5.0:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNPROXY5.0:rhn-modperl-0:1.29-16.rhel4.i386", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0263", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "httpd mod_status XSS", }, { cve: "CVE-2007-1349", discovery_date: "2007-05-17T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "240423", }, ], notes: [ { category: "description", text: "PerlRun.pm in Apache mod_perl before 1.30, and RegistryCooker.pm in mod_perl 2.x, does not properly escape PATH_INFO before use in a regular expression, which allows remote attackers to cause a denial of service (resource consumption) via a crafted URI.", title: "Vulnerability description", }, { category: "summary", text: "mod_perl PerlRun denial of service", title: "Vulnerability summary", }, ], product_status: { fixed: [ "4AS-RHNPROXY5.0:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNPROXY5.0:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNPROXY5.0:rhn-modperl-0:1.29-16.rhel4.i386", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-1349", }, { category: "external", summary: "RHBZ#240423", url: "https://bugzilla.redhat.com/show_bug.cgi?id=240423", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-1349", url: "https://www.cve.org/CVERecord?id=CVE-2007-1349", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-1349", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-1349", }, ], release_date: "2007-03-22T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-05-20T14:14:00+00:00", details: "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.\n\nThis update is available via Red Hat Network. Details on how to use \nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/FAQ_58_10188", product_ids: [ "4AS-RHNPROXY5.0:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNPROXY5.0:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNPROXY5.0:rhn-modperl-0:1.29-16.rhel4.i386", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0263", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "mod_perl PerlRun denial of service", }, { cve: "CVE-2007-3304", discovery_date: "2007-06-19T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "245111", }, ], notes: [ { category: "description", text: "Apache httpd 1.3.37, 2.0.59, and 2.2.4 with the Prefork MPM module, allows local users to cause a denial of service by modifying the worker_score and process_score arrays to reference an arbitrary process ID, which is sent a SIGUSR1 signal from the master process, aka \"SIGUSR1 killer.\"", title: "Vulnerability description", }, { category: "summary", text: "httpd scoreboard lack of PID protection", title: "Vulnerability summary", }, ], product_status: { fixed: [ "4AS-RHNPROXY5.0:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNPROXY5.0:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNPROXY5.0:rhn-modperl-0:1.29-16.rhel4.i386", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-3304", }, { category: "external", summary: "RHBZ#245111", url: "https://bugzilla.redhat.com/show_bug.cgi?id=245111", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-3304", url: "https://www.cve.org/CVERecord?id=CVE-2007-3304", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-3304", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-3304", }, ], release_date: "2007-06-19T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-05-20T14:14:00+00:00", details: "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.\n\nThis update is available via Red Hat Network. Details on how to use \nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/FAQ_58_10188", product_ids: [ "4AS-RHNPROXY5.0:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNPROXY5.0:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNPROXY5.0:rhn-modperl-0:1.29-16.rhel4.i386", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0263", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "httpd scoreboard lack of PID protection", }, { cve: "CVE-2007-5000", cwe: { id: "CWE-79", name: "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", }, discovery_date: "2007-12-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "419931", }, ], notes: [ { category: "description", text: "Cross-site scripting (XSS) vulnerability in the (1) mod_imap module in the Apache HTTP Server 1.3.0 through 1.3.39 and 2.0.35 through 2.0.61 and the (2) mod_imagemap module in the Apache HTTP Server 2.2.0 through 2.2.6 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.", title: "Vulnerability description", }, { category: "summary", text: "httpd: mod_imagemap XSS", title: "Vulnerability summary", }, ], product_status: { fixed: [ "4AS-RHNPROXY5.0:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNPROXY5.0:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNPROXY5.0:rhn-modperl-0:1.29-16.rhel4.i386", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-5000", }, { category: "external", summary: "RHBZ#419931", url: "https://bugzilla.redhat.com/show_bug.cgi?id=419931", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-5000", url: "https://www.cve.org/CVERecord?id=CVE-2007-5000", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-5000", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-5000", }, ], release_date: "2007-12-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-05-20T14:14:00+00:00", details: "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.\n\nThis update is available via Red Hat Network. Details on how to use \nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/FAQ_58_10188", product_ids: [ "4AS-RHNPROXY5.0:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNPROXY5.0:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNPROXY5.0:rhn-modperl-0:1.29-16.rhel4.i386", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0263", }, ], threats: [ { category: "impact", details: "Low", }, ], title: "httpd: mod_imagemap XSS", }, { cve: "CVE-2007-6388", cwe: { id: "CWE-79", name: "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", }, discovery_date: "2008-01-02T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "427228", }, ], notes: [ { category: "description", text: "Cross-site scripting (XSS) vulnerability in mod_status in the Apache HTTP Server 2.2.0 through 2.2.6, 2.0.35 through 2.0.61, and 1.3.2 through 1.3.39, when the server-status page is enabled, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.", title: "Vulnerability description", }, { category: "summary", text: "apache mod_status cross-site scripting", title: "Vulnerability summary", }, ], product_status: { fixed: [ "4AS-RHNPROXY5.0:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNPROXY5.0:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNPROXY5.0:rhn-modperl-0:1.29-16.rhel4.i386", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-6388", }, { category: "external", summary: "RHBZ#427228", url: "https://bugzilla.redhat.com/show_bug.cgi?id=427228", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-6388", url: "https://www.cve.org/CVERecord?id=CVE-2007-6388", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-6388", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-6388", }, ], release_date: "2007-12-29T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-05-20T14:14:00+00:00", details: "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.\n\nThis update is available via Red Hat Network. Details on how to use \nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/FAQ_58_10188", product_ids: [ "4AS-RHNPROXY5.0:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNPROXY5.0:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNPROXY5.0:rhn-modperl-0:1.29-16.rhel4.i386", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0263", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "apache mod_status cross-site scripting", }, ], }
rhsa-2007:0557
Vulnerability from csaf_redhat
Published
2007-07-13 07:38
Modified
2024-12-01 11:53
Summary
Red Hat Security Advisory: httpd security update
Notes
Topic
Updated Apache httpd packages that correct two security issues are now
available for Red Hat Application Stack.
This update has been rated as having moderate security impact by the Red
Hat Security Response Team.
Details
The Apache HTTP Server is a popular Web server.
A flaw was found in the Apache HTTP Server mod_status module. On sites
where the server-status page is publicly accessible and ExtendedStatus is
enabled, this flaw could lead to a cross-site scripting attack. On Red Hat
Enterprise Linux, the server-status page is not enabled by default and it
is best practice to not make this publicly available. (CVE-2006-5752)
A bug was found in the Apache HTTP Server mod_cache module. On sites where
caching is enabled, a remote attacker could send a carefully crafted
request that would cause the Apache child process handling that request to
crash. This could lead to a denial of service if using a threaded
Multi-Processing Module. (CVE-2007-1863)
The Apache HTTP Server did not verify that a process was an Apache child
process before sending it signals. A local attacker with the ability to run
scripts on the Apache HTTP Server could manipulate the scoreboard and cause
arbitrary processes to be terminated which could lead to a denial of
service. (CVE-2007-3304).
Users of httpd should upgrade to these updated packages, which contain
backported patches to correct these issues. Users should restart Apache
after installing this update.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ document: { aggregate_severity: { namespace: "https://access.redhat.com/security/updates/classification/", text: "Moderate", }, category: "csaf_security_advisory", csaf_version: "2.0", distribution: { text: "Copyright © Red Hat, Inc. All rights reserved.", tlp: { label: "WHITE", url: "https://www.first.org/tlp/", }, }, lang: "en", notes: [ { category: "summary", text: "Updated Apache httpd packages that correct two security issues are now\navailable for Red Hat Application Stack.\n\nThis update has been rated as having moderate security impact by the Red\nHat Security Response Team.", title: "Topic", }, { category: "general", text: "The Apache HTTP Server is a popular Web server.\n\nA flaw was found in the Apache HTTP Server mod_status module. On sites\nwhere the server-status page is publicly accessible and ExtendedStatus is\nenabled, this flaw could lead to a cross-site scripting attack. On Red Hat\nEnterprise Linux, the server-status page is not enabled by default and it\nis best practice to not make this publicly available. (CVE-2006-5752)\n\nA bug was found in the Apache HTTP Server mod_cache module. On sites where\ncaching is enabled, a remote attacker could send a carefully crafted\nrequest that would cause the Apache child process handling that request to\ncrash. This could lead to a denial of service if using a threaded\nMulti-Processing Module. (CVE-2007-1863)\n\nThe Apache HTTP Server did not verify that a process was an Apache child\nprocess before sending it signals. A local attacker with the ability to run\nscripts on the Apache HTTP Server could manipulate the scoreboard and cause\narbitrary processes to be terminated which could lead to a denial of\nservice. (CVE-2007-3304).\n\nUsers of httpd should upgrade to these updated packages, which contain\nbackported patches to correct these issues. Users should restart Apache\nafter installing this update.", title: "Details", }, { category: "legal_disclaimer", text: "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", title: "Terms of Use", }, ], publisher: { category: "vendor", contact_details: "https://access.redhat.com/security/team/contact/", issuing_authority: "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", name: "Red Hat Product Security", namespace: "https://www.redhat.com", }, references: [ { category: "self", summary: "https://access.redhat.com/errata/RHSA-2007:0557", url: "https://access.redhat.com/errata/RHSA-2007:0557", }, { category: "external", summary: "http://www.redhat.com/security/updates/classification/#moderate", url: "http://www.redhat.com/security/updates/classification/#moderate", }, { category: "external", summary: "244658", url: "https://bugzilla.redhat.com/show_bug.cgi?id=244658", }, { category: "external", summary: "245112", url: "https://bugzilla.redhat.com/show_bug.cgi?id=245112", }, { category: "self", summary: "Canonical URL", url: "https://security.access.redhat.com/data/csaf/v2/advisories/2007/rhsa-2007_0557.json", }, ], title: "Red Hat Security Advisory: httpd security update", tracking: { current_release_date: "2024-12-01T11:53:21+00:00", generator: { date: "2024-12-01T11:53:21+00:00", engine: { name: "Red Hat SDEngine", version: "4.2.1", }, }, id: "RHSA-2007:0557", initial_release_date: "2007-07-13T07:38:00+00:00", revision_history: [ { date: "2007-07-13T07:38:00+00:00", number: "1", summary: "Initial version", }, { date: "2007-07-13T03:38:23+00:00", number: "2", summary: "Last updated version", }, { date: "2024-12-01T11:53:21+00:00", number: "3", summary: "Last generated version", }, ], status: "final", version: "3", }, }, product_tree: { branches: [ { branches: [ { branches: [ { category: "product_name", name: "Red Hat Application Stack v1 for Enterprise Linux AS (v.4)", product: { name: "Red Hat Application Stack v1 for Enterprise Linux AS (v.4)", product_id: "4AS-RHWAS", product_identification_helper: { cpe: "cpe:/a:redhat:rhel_application_stack:1", }, }, }, { category: "product_name", name: "Red Hat Application Stack v1 for Enterprise Linux ES (v.4)", product: { name: "Red Hat Application Stack v1 for Enterprise Linux ES (v.4)", product_id: "4ES-RHWAS", product_identification_helper: { cpe: "cpe:/a:redhat:rhel_application_stack:1", }, }, }, ], category: "product_family", name: "Red Hat Application Stack", }, { branches: [ { category: "product_version", name: "httpd-manual-0:2.0.59-1.el4s1.7.x86_64", product: { name: "httpd-manual-0:2.0.59-1.el4s1.7.x86_64", product_id: "httpd-manual-0:2.0.59-1.el4s1.7.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-manual@2.0.59-1.el4s1.7?arch=x86_64", }, }, }, { category: "product_version", name: "httpd-0:2.0.59-1.el4s1.7.x86_64", product: { name: "httpd-0:2.0.59-1.el4s1.7.x86_64", product_id: "httpd-0:2.0.59-1.el4s1.7.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/httpd@2.0.59-1.el4s1.7?arch=x86_64", }, }, }, { category: "product_version", name: "httpd-debuginfo-0:2.0.59-1.el4s1.7.x86_64", product: { name: "httpd-debuginfo-0:2.0.59-1.el4s1.7.x86_64", product_id: "httpd-debuginfo-0:2.0.59-1.el4s1.7.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-debuginfo@2.0.59-1.el4s1.7?arch=x86_64", }, }, }, { category: "product_version", name: "mod_ssl-1:2.0.59-1.el4s1.7.x86_64", product: { name: "mod_ssl-1:2.0.59-1.el4s1.7.x86_64", product_id: "mod_ssl-1:2.0.59-1.el4s1.7.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/mod_ssl@2.0.59-1.el4s1.7?arch=x86_64&epoch=1", }, }, }, { category: "product_version", name: "httpd-devel-0:2.0.59-1.el4s1.7.x86_64", product: { name: "httpd-devel-0:2.0.59-1.el4s1.7.x86_64", product_id: "httpd-devel-0:2.0.59-1.el4s1.7.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-devel@2.0.59-1.el4s1.7?arch=x86_64", }, }, }, ], category: "architecture", name: "x86_64", }, { branches: [ { category: "product_version", name: "httpd-manual-0:2.0.59-1.el4s1.7.i386", product: { name: "httpd-manual-0:2.0.59-1.el4s1.7.i386", product_id: "httpd-manual-0:2.0.59-1.el4s1.7.i386", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-manual@2.0.59-1.el4s1.7?arch=i386", }, }, }, { category: "product_version", name: "httpd-0:2.0.59-1.el4s1.7.i386", product: { name: "httpd-0:2.0.59-1.el4s1.7.i386", product_id: "httpd-0:2.0.59-1.el4s1.7.i386", product_identification_helper: { purl: "pkg:rpm/redhat/httpd@2.0.59-1.el4s1.7?arch=i386", }, }, }, { category: "product_version", name: "httpd-debuginfo-0:2.0.59-1.el4s1.7.i386", product: { name: "httpd-debuginfo-0:2.0.59-1.el4s1.7.i386", product_id: "httpd-debuginfo-0:2.0.59-1.el4s1.7.i386", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-debuginfo@2.0.59-1.el4s1.7?arch=i386", }, }, }, { category: "product_version", name: "mod_ssl-1:2.0.59-1.el4s1.7.i386", product: { name: "mod_ssl-1:2.0.59-1.el4s1.7.i386", product_id: "mod_ssl-1:2.0.59-1.el4s1.7.i386", product_identification_helper: { purl: "pkg:rpm/redhat/mod_ssl@2.0.59-1.el4s1.7?arch=i386&epoch=1", }, }, }, { category: "product_version", name: "httpd-devel-0:2.0.59-1.el4s1.7.i386", product: { name: "httpd-devel-0:2.0.59-1.el4s1.7.i386", product_id: "httpd-devel-0:2.0.59-1.el4s1.7.i386", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-devel@2.0.59-1.el4s1.7?arch=i386", }, }, }, ], category: "architecture", name: "i386", }, { branches: [ { category: "product_version", name: "httpd-0:2.0.59-1.el4s1.7.src", product: { name: "httpd-0:2.0.59-1.el4s1.7.src", product_id: "httpd-0:2.0.59-1.el4s1.7.src", product_identification_helper: { purl: "pkg:rpm/redhat/httpd@2.0.59-1.el4s1.7?arch=src", }, }, }, ], category: "architecture", name: "src", }, ], category: "vendor", name: "Red Hat", }, ], relationships: [ { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.59-1.el4s1.7.i386 as a component of Red Hat Application Stack v1 for Enterprise Linux AS (v.4)", product_id: "4AS-RHWAS:httpd-0:2.0.59-1.el4s1.7.i386", }, product_reference: "httpd-0:2.0.59-1.el4s1.7.i386", relates_to_product_reference: "4AS-RHWAS", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.59-1.el4s1.7.src as a component of Red Hat Application Stack v1 for Enterprise Linux AS (v.4)", product_id: "4AS-RHWAS:httpd-0:2.0.59-1.el4s1.7.src", }, product_reference: "httpd-0:2.0.59-1.el4s1.7.src", relates_to_product_reference: "4AS-RHWAS", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.59-1.el4s1.7.x86_64 as a component of Red Hat Application Stack v1 for Enterprise Linux AS (v.4)", product_id: "4AS-RHWAS:httpd-0:2.0.59-1.el4s1.7.x86_64", }, product_reference: "httpd-0:2.0.59-1.el4s1.7.x86_64", relates_to_product_reference: "4AS-RHWAS", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.59-1.el4s1.7.i386 as a component of Red Hat Application Stack v1 for Enterprise Linux AS (v.4)", product_id: "4AS-RHWAS:httpd-debuginfo-0:2.0.59-1.el4s1.7.i386", }, product_reference: "httpd-debuginfo-0:2.0.59-1.el4s1.7.i386", relates_to_product_reference: "4AS-RHWAS", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.59-1.el4s1.7.x86_64 as a component of Red Hat Application Stack v1 for Enterprise Linux AS (v.4)", product_id: "4AS-RHWAS:httpd-debuginfo-0:2.0.59-1.el4s1.7.x86_64", }, product_reference: "httpd-debuginfo-0:2.0.59-1.el4s1.7.x86_64", relates_to_product_reference: "4AS-RHWAS", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.59-1.el4s1.7.i386 as a component of Red Hat Application Stack v1 for Enterprise Linux AS (v.4)", product_id: "4AS-RHWAS:httpd-devel-0:2.0.59-1.el4s1.7.i386", }, product_reference: "httpd-devel-0:2.0.59-1.el4s1.7.i386", relates_to_product_reference: "4AS-RHWAS", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.59-1.el4s1.7.x86_64 as a component of Red Hat Application Stack v1 for Enterprise Linux AS (v.4)", product_id: "4AS-RHWAS:httpd-devel-0:2.0.59-1.el4s1.7.x86_64", }, product_reference: "httpd-devel-0:2.0.59-1.el4s1.7.x86_64", relates_to_product_reference: "4AS-RHWAS", }, { category: "default_component_of", full_product_name: { name: "httpd-manual-0:2.0.59-1.el4s1.7.i386 as a component of Red Hat Application Stack v1 for Enterprise Linux AS (v.4)", product_id: "4AS-RHWAS:httpd-manual-0:2.0.59-1.el4s1.7.i386", }, product_reference: "httpd-manual-0:2.0.59-1.el4s1.7.i386", relates_to_product_reference: "4AS-RHWAS", }, { category: "default_component_of", full_product_name: { name: "httpd-manual-0:2.0.59-1.el4s1.7.x86_64 as a component of Red Hat Application Stack v1 for Enterprise Linux AS (v.4)", product_id: "4AS-RHWAS:httpd-manual-0:2.0.59-1.el4s1.7.x86_64", }, product_reference: "httpd-manual-0:2.0.59-1.el4s1.7.x86_64", relates_to_product_reference: "4AS-RHWAS", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.59-1.el4s1.7.i386 as a component of Red Hat Application Stack v1 for Enterprise Linux AS (v.4)", product_id: "4AS-RHWAS:mod_ssl-1:2.0.59-1.el4s1.7.i386", }, product_reference: "mod_ssl-1:2.0.59-1.el4s1.7.i386", relates_to_product_reference: "4AS-RHWAS", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.59-1.el4s1.7.x86_64 as a component of Red Hat Application Stack v1 for Enterprise Linux AS (v.4)", product_id: "4AS-RHWAS:mod_ssl-1:2.0.59-1.el4s1.7.x86_64", }, product_reference: "mod_ssl-1:2.0.59-1.el4s1.7.x86_64", relates_to_product_reference: "4AS-RHWAS", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.59-1.el4s1.7.i386 as a component of Red Hat Application Stack v1 for Enterprise Linux ES (v.4)", product_id: "4ES-RHWAS:httpd-0:2.0.59-1.el4s1.7.i386", }, product_reference: "httpd-0:2.0.59-1.el4s1.7.i386", relates_to_product_reference: "4ES-RHWAS", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.59-1.el4s1.7.src as a component of Red Hat Application Stack v1 for Enterprise Linux ES (v.4)", product_id: "4ES-RHWAS:httpd-0:2.0.59-1.el4s1.7.src", }, product_reference: "httpd-0:2.0.59-1.el4s1.7.src", relates_to_product_reference: "4ES-RHWAS", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.59-1.el4s1.7.x86_64 as a component of Red Hat Application Stack v1 for Enterprise Linux ES (v.4)", product_id: "4ES-RHWAS:httpd-0:2.0.59-1.el4s1.7.x86_64", }, product_reference: "httpd-0:2.0.59-1.el4s1.7.x86_64", relates_to_product_reference: "4ES-RHWAS", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.59-1.el4s1.7.i386 as a component of Red Hat Application Stack v1 for Enterprise Linux ES (v.4)", product_id: "4ES-RHWAS:httpd-debuginfo-0:2.0.59-1.el4s1.7.i386", }, product_reference: "httpd-debuginfo-0:2.0.59-1.el4s1.7.i386", relates_to_product_reference: "4ES-RHWAS", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.59-1.el4s1.7.x86_64 as a component of Red Hat Application Stack v1 for Enterprise Linux ES (v.4)", product_id: "4ES-RHWAS:httpd-debuginfo-0:2.0.59-1.el4s1.7.x86_64", }, product_reference: "httpd-debuginfo-0:2.0.59-1.el4s1.7.x86_64", relates_to_product_reference: "4ES-RHWAS", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.59-1.el4s1.7.i386 as a component of Red Hat Application Stack v1 for Enterprise Linux ES (v.4)", product_id: "4ES-RHWAS:httpd-devel-0:2.0.59-1.el4s1.7.i386", }, product_reference: "httpd-devel-0:2.0.59-1.el4s1.7.i386", relates_to_product_reference: "4ES-RHWAS", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.59-1.el4s1.7.x86_64 as a component of Red Hat Application Stack v1 for Enterprise Linux ES (v.4)", product_id: "4ES-RHWAS:httpd-devel-0:2.0.59-1.el4s1.7.x86_64", }, product_reference: "httpd-devel-0:2.0.59-1.el4s1.7.x86_64", relates_to_product_reference: "4ES-RHWAS", }, { category: "default_component_of", full_product_name: { name: "httpd-manual-0:2.0.59-1.el4s1.7.i386 as a component of Red Hat Application Stack v1 for Enterprise Linux ES (v.4)", product_id: "4ES-RHWAS:httpd-manual-0:2.0.59-1.el4s1.7.i386", }, product_reference: "httpd-manual-0:2.0.59-1.el4s1.7.i386", relates_to_product_reference: "4ES-RHWAS", }, { category: "default_component_of", full_product_name: { name: "httpd-manual-0:2.0.59-1.el4s1.7.x86_64 as a component of Red Hat Application Stack v1 for Enterprise Linux ES (v.4)", product_id: "4ES-RHWAS:httpd-manual-0:2.0.59-1.el4s1.7.x86_64", }, product_reference: "httpd-manual-0:2.0.59-1.el4s1.7.x86_64", relates_to_product_reference: "4ES-RHWAS", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.59-1.el4s1.7.i386 as a component of Red Hat Application Stack v1 for Enterprise Linux ES (v.4)", product_id: "4ES-RHWAS:mod_ssl-1:2.0.59-1.el4s1.7.i386", }, product_reference: "mod_ssl-1:2.0.59-1.el4s1.7.i386", relates_to_product_reference: "4ES-RHWAS", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.59-1.el4s1.7.x86_64 as a component of Red Hat Application Stack v1 for Enterprise Linux ES (v.4)", product_id: "4ES-RHWAS:mod_ssl-1:2.0.59-1.el4s1.7.x86_64", }, product_reference: "mod_ssl-1:2.0.59-1.el4s1.7.x86_64", relates_to_product_reference: "4ES-RHWAS", }, ], }, vulnerabilities: [ { cve: "CVE-2006-5752", cwe: { id: "CWE-79", name: "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", }, discovery_date: "2007-06-20T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "245112", }, ], notes: [ { category: "description", text: "Cross-site scripting (XSS) vulnerability in mod_status.c in the mod_status module in Apache HTTP Server (httpd), when ExtendedStatus is enabled and a public server-status page is used, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors involving charsets with browsers that perform \"charset detection\" when the content-type is not specified.", title: "Vulnerability description", }, { category: "summary", text: "httpd mod_status XSS", title: "Vulnerability summary", }, ], product_status: { fixed: [ "4AS-RHWAS:httpd-0:2.0.59-1.el4s1.7.i386", "4AS-RHWAS:httpd-0:2.0.59-1.el4s1.7.src", "4AS-RHWAS:httpd-0:2.0.59-1.el4s1.7.x86_64", "4AS-RHWAS:httpd-debuginfo-0:2.0.59-1.el4s1.7.i386", "4AS-RHWAS:httpd-debuginfo-0:2.0.59-1.el4s1.7.x86_64", "4AS-RHWAS:httpd-devel-0:2.0.59-1.el4s1.7.i386", "4AS-RHWAS:httpd-devel-0:2.0.59-1.el4s1.7.x86_64", "4AS-RHWAS:httpd-manual-0:2.0.59-1.el4s1.7.i386", "4AS-RHWAS:httpd-manual-0:2.0.59-1.el4s1.7.x86_64", "4AS-RHWAS:mod_ssl-1:2.0.59-1.el4s1.7.i386", "4AS-RHWAS:mod_ssl-1:2.0.59-1.el4s1.7.x86_64", "4ES-RHWAS:httpd-0:2.0.59-1.el4s1.7.i386", "4ES-RHWAS:httpd-0:2.0.59-1.el4s1.7.src", "4ES-RHWAS:httpd-0:2.0.59-1.el4s1.7.x86_64", "4ES-RHWAS:httpd-debuginfo-0:2.0.59-1.el4s1.7.i386", "4ES-RHWAS:httpd-debuginfo-0:2.0.59-1.el4s1.7.x86_64", "4ES-RHWAS:httpd-devel-0:2.0.59-1.el4s1.7.i386", "4ES-RHWAS:httpd-devel-0:2.0.59-1.el4s1.7.x86_64", "4ES-RHWAS:httpd-manual-0:2.0.59-1.el4s1.7.i386", "4ES-RHWAS:httpd-manual-0:2.0.59-1.el4s1.7.x86_64", "4ES-RHWAS:mod_ssl-1:2.0.59-1.el4s1.7.i386", "4ES-RHWAS:mod_ssl-1:2.0.59-1.el4s1.7.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2006-5752", }, { category: "external", summary: "RHBZ#245112", url: "https://bugzilla.redhat.com/show_bug.cgi?id=245112", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2006-5752", url: "https://www.cve.org/CVERecord?id=CVE-2006-5752", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2006-5752", url: "https://nvd.nist.gov/vuln/detail/CVE-2006-5752", }, ], release_date: "2007-06-20T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2007-07-13T07:38:00+00:00", details: "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied. \n\nThis update is available via Red Hat Network. Details on how to use \nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/FAQ_58_10188", product_ids: [ "4AS-RHWAS:httpd-0:2.0.59-1.el4s1.7.i386", "4AS-RHWAS:httpd-0:2.0.59-1.el4s1.7.src", "4AS-RHWAS:httpd-0:2.0.59-1.el4s1.7.x86_64", "4AS-RHWAS:httpd-debuginfo-0:2.0.59-1.el4s1.7.i386", "4AS-RHWAS:httpd-debuginfo-0:2.0.59-1.el4s1.7.x86_64", "4AS-RHWAS:httpd-devel-0:2.0.59-1.el4s1.7.i386", "4AS-RHWAS:httpd-devel-0:2.0.59-1.el4s1.7.x86_64", "4AS-RHWAS:httpd-manual-0:2.0.59-1.el4s1.7.i386", "4AS-RHWAS:httpd-manual-0:2.0.59-1.el4s1.7.x86_64", "4AS-RHWAS:mod_ssl-1:2.0.59-1.el4s1.7.i386", "4AS-RHWAS:mod_ssl-1:2.0.59-1.el4s1.7.x86_64", "4ES-RHWAS:httpd-0:2.0.59-1.el4s1.7.i386", "4ES-RHWAS:httpd-0:2.0.59-1.el4s1.7.src", "4ES-RHWAS:httpd-0:2.0.59-1.el4s1.7.x86_64", "4ES-RHWAS:httpd-debuginfo-0:2.0.59-1.el4s1.7.i386", "4ES-RHWAS:httpd-debuginfo-0:2.0.59-1.el4s1.7.x86_64", "4ES-RHWAS:httpd-devel-0:2.0.59-1.el4s1.7.i386", "4ES-RHWAS:httpd-devel-0:2.0.59-1.el4s1.7.x86_64", "4ES-RHWAS:httpd-manual-0:2.0.59-1.el4s1.7.i386", "4ES-RHWAS:httpd-manual-0:2.0.59-1.el4s1.7.x86_64", "4ES-RHWAS:mod_ssl-1:2.0.59-1.el4s1.7.i386", "4ES-RHWAS:mod_ssl-1:2.0.59-1.el4s1.7.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2007:0557", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "httpd mod_status XSS", }, { cve: "CVE-2007-1863", discovery_date: "2007-05-02T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "244658", }, ], notes: [ { category: "description", text: "cache_util.c in the mod_cache module in Apache HTTP Server (httpd), when caching is enabled and a threaded Multi-Processing Module (MPM) is used, allows remote attackers to cause a denial of service (child processing handler crash) via a request with the (1) s-maxage, (2) max-age, (3) min-fresh, or (4) max-stale Cache-Control headers without a value.", title: "Vulnerability description", }, { category: "summary", text: "httpd mod_cache segfault", title: "Vulnerability summary", }, ], product_status: { fixed: [ "4AS-RHWAS:httpd-0:2.0.59-1.el4s1.7.i386", "4AS-RHWAS:httpd-0:2.0.59-1.el4s1.7.src", "4AS-RHWAS:httpd-0:2.0.59-1.el4s1.7.x86_64", "4AS-RHWAS:httpd-debuginfo-0:2.0.59-1.el4s1.7.i386", "4AS-RHWAS:httpd-debuginfo-0:2.0.59-1.el4s1.7.x86_64", "4AS-RHWAS:httpd-devel-0:2.0.59-1.el4s1.7.i386", "4AS-RHWAS:httpd-devel-0:2.0.59-1.el4s1.7.x86_64", "4AS-RHWAS:httpd-manual-0:2.0.59-1.el4s1.7.i386", "4AS-RHWAS:httpd-manual-0:2.0.59-1.el4s1.7.x86_64", "4AS-RHWAS:mod_ssl-1:2.0.59-1.el4s1.7.i386", "4AS-RHWAS:mod_ssl-1:2.0.59-1.el4s1.7.x86_64", "4ES-RHWAS:httpd-0:2.0.59-1.el4s1.7.i386", "4ES-RHWAS:httpd-0:2.0.59-1.el4s1.7.src", "4ES-RHWAS:httpd-0:2.0.59-1.el4s1.7.x86_64", "4ES-RHWAS:httpd-debuginfo-0:2.0.59-1.el4s1.7.i386", "4ES-RHWAS:httpd-debuginfo-0:2.0.59-1.el4s1.7.x86_64", "4ES-RHWAS:httpd-devel-0:2.0.59-1.el4s1.7.i386", "4ES-RHWAS:httpd-devel-0:2.0.59-1.el4s1.7.x86_64", "4ES-RHWAS:httpd-manual-0:2.0.59-1.el4s1.7.i386", "4ES-RHWAS:httpd-manual-0:2.0.59-1.el4s1.7.x86_64", "4ES-RHWAS:mod_ssl-1:2.0.59-1.el4s1.7.i386", "4ES-RHWAS:mod_ssl-1:2.0.59-1.el4s1.7.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-1863", }, { category: "external", summary: "RHBZ#244658", url: "https://bugzilla.redhat.com/show_bug.cgi?id=244658", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-1863", url: "https://www.cve.org/CVERecord?id=CVE-2007-1863", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-1863", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-1863", }, ], release_date: "2007-05-02T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2007-07-13T07:38:00+00:00", details: "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied. \n\nThis update is available via Red Hat Network. Details on how to use \nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/FAQ_58_10188", product_ids: [ "4AS-RHWAS:httpd-0:2.0.59-1.el4s1.7.i386", "4AS-RHWAS:httpd-0:2.0.59-1.el4s1.7.src", "4AS-RHWAS:httpd-0:2.0.59-1.el4s1.7.x86_64", "4AS-RHWAS:httpd-debuginfo-0:2.0.59-1.el4s1.7.i386", "4AS-RHWAS:httpd-debuginfo-0:2.0.59-1.el4s1.7.x86_64", "4AS-RHWAS:httpd-devel-0:2.0.59-1.el4s1.7.i386", "4AS-RHWAS:httpd-devel-0:2.0.59-1.el4s1.7.x86_64", "4AS-RHWAS:httpd-manual-0:2.0.59-1.el4s1.7.i386", "4AS-RHWAS:httpd-manual-0:2.0.59-1.el4s1.7.x86_64", "4AS-RHWAS:mod_ssl-1:2.0.59-1.el4s1.7.i386", "4AS-RHWAS:mod_ssl-1:2.0.59-1.el4s1.7.x86_64", "4ES-RHWAS:httpd-0:2.0.59-1.el4s1.7.i386", "4ES-RHWAS:httpd-0:2.0.59-1.el4s1.7.src", "4ES-RHWAS:httpd-0:2.0.59-1.el4s1.7.x86_64", "4ES-RHWAS:httpd-debuginfo-0:2.0.59-1.el4s1.7.i386", "4ES-RHWAS:httpd-debuginfo-0:2.0.59-1.el4s1.7.x86_64", "4ES-RHWAS:httpd-devel-0:2.0.59-1.el4s1.7.i386", "4ES-RHWAS:httpd-devel-0:2.0.59-1.el4s1.7.x86_64", "4ES-RHWAS:httpd-manual-0:2.0.59-1.el4s1.7.i386", "4ES-RHWAS:httpd-manual-0:2.0.59-1.el4s1.7.x86_64", "4ES-RHWAS:mod_ssl-1:2.0.59-1.el4s1.7.i386", "4ES-RHWAS:mod_ssl-1:2.0.59-1.el4s1.7.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2007:0557", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "httpd mod_cache segfault", }, { cve: "CVE-2007-3304", discovery_date: "2007-06-19T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "245111", }, ], notes: [ { category: "description", text: "Apache httpd 1.3.37, 2.0.59, and 2.2.4 with the Prefork MPM module, allows local users to cause a denial of service by modifying the worker_score and process_score arrays to reference an arbitrary process ID, which is sent a SIGUSR1 signal from the master process, aka \"SIGUSR1 killer.\"", title: "Vulnerability description", }, { category: "summary", text: "httpd scoreboard lack of PID protection", title: "Vulnerability summary", }, ], product_status: { fixed: [ "4AS-RHWAS:httpd-0:2.0.59-1.el4s1.7.i386", "4AS-RHWAS:httpd-0:2.0.59-1.el4s1.7.src", "4AS-RHWAS:httpd-0:2.0.59-1.el4s1.7.x86_64", "4AS-RHWAS:httpd-debuginfo-0:2.0.59-1.el4s1.7.i386", "4AS-RHWAS:httpd-debuginfo-0:2.0.59-1.el4s1.7.x86_64", "4AS-RHWAS:httpd-devel-0:2.0.59-1.el4s1.7.i386", "4AS-RHWAS:httpd-devel-0:2.0.59-1.el4s1.7.x86_64", "4AS-RHWAS:httpd-manual-0:2.0.59-1.el4s1.7.i386", "4AS-RHWAS:httpd-manual-0:2.0.59-1.el4s1.7.x86_64", "4AS-RHWAS:mod_ssl-1:2.0.59-1.el4s1.7.i386", "4AS-RHWAS:mod_ssl-1:2.0.59-1.el4s1.7.x86_64", "4ES-RHWAS:httpd-0:2.0.59-1.el4s1.7.i386", "4ES-RHWAS:httpd-0:2.0.59-1.el4s1.7.src", "4ES-RHWAS:httpd-0:2.0.59-1.el4s1.7.x86_64", "4ES-RHWAS:httpd-debuginfo-0:2.0.59-1.el4s1.7.i386", "4ES-RHWAS:httpd-debuginfo-0:2.0.59-1.el4s1.7.x86_64", "4ES-RHWAS:httpd-devel-0:2.0.59-1.el4s1.7.i386", "4ES-RHWAS:httpd-devel-0:2.0.59-1.el4s1.7.x86_64", "4ES-RHWAS:httpd-manual-0:2.0.59-1.el4s1.7.i386", "4ES-RHWAS:httpd-manual-0:2.0.59-1.el4s1.7.x86_64", "4ES-RHWAS:mod_ssl-1:2.0.59-1.el4s1.7.i386", "4ES-RHWAS:mod_ssl-1:2.0.59-1.el4s1.7.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-3304", }, { category: "external", summary: "RHBZ#245111", url: "https://bugzilla.redhat.com/show_bug.cgi?id=245111", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-3304", url: "https://www.cve.org/CVERecord?id=CVE-2007-3304", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-3304", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-3304", }, ], release_date: "2007-06-19T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2007-07-13T07:38:00+00:00", details: "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied. \n\nThis update is available via Red Hat Network. Details on how to use \nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/FAQ_58_10188", product_ids: [ "4AS-RHWAS:httpd-0:2.0.59-1.el4s1.7.i386", "4AS-RHWAS:httpd-0:2.0.59-1.el4s1.7.src", "4AS-RHWAS:httpd-0:2.0.59-1.el4s1.7.x86_64", "4AS-RHWAS:httpd-debuginfo-0:2.0.59-1.el4s1.7.i386", "4AS-RHWAS:httpd-debuginfo-0:2.0.59-1.el4s1.7.x86_64", "4AS-RHWAS:httpd-devel-0:2.0.59-1.el4s1.7.i386", "4AS-RHWAS:httpd-devel-0:2.0.59-1.el4s1.7.x86_64", "4AS-RHWAS:httpd-manual-0:2.0.59-1.el4s1.7.i386", "4AS-RHWAS:httpd-manual-0:2.0.59-1.el4s1.7.x86_64", "4AS-RHWAS:mod_ssl-1:2.0.59-1.el4s1.7.i386", "4AS-RHWAS:mod_ssl-1:2.0.59-1.el4s1.7.x86_64", "4ES-RHWAS:httpd-0:2.0.59-1.el4s1.7.i386", "4ES-RHWAS:httpd-0:2.0.59-1.el4s1.7.src", "4ES-RHWAS:httpd-0:2.0.59-1.el4s1.7.x86_64", "4ES-RHWAS:httpd-debuginfo-0:2.0.59-1.el4s1.7.i386", "4ES-RHWAS:httpd-debuginfo-0:2.0.59-1.el4s1.7.x86_64", "4ES-RHWAS:httpd-devel-0:2.0.59-1.el4s1.7.i386", "4ES-RHWAS:httpd-devel-0:2.0.59-1.el4s1.7.x86_64", "4ES-RHWAS:httpd-manual-0:2.0.59-1.el4s1.7.i386", "4ES-RHWAS:httpd-manual-0:2.0.59-1.el4s1.7.x86_64", "4ES-RHWAS:mod_ssl-1:2.0.59-1.el4s1.7.i386", "4ES-RHWAS:mod_ssl-1:2.0.59-1.el4s1.7.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2007:0557", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "httpd scoreboard lack of PID protection", }, ], }
RHSA-2008:0523
Vulnerability from csaf_redhat
Published
2008-06-30 15:29
Modified
2025-01-26 19:35
Summary
Red Hat Security Advisory: Red Hat Network Proxy Server security update
Notes
Topic
Red Hat Network Proxy Server version 4.2.3 is now available. This update
includes fixes for a number of security issues in Red Hat Network Proxy
Server components.
This update has been rated as having low security impact by the Red
Hat Security Response Team.
Details
The Red Hat Network Proxy Server 4.2.3 release corrects several security
vulnerabilities in several shipped components. In a typical operating
environment, these components are not exposed to users of Proxy Server in a
vulnerable manner. These security updates will reduce risk in unique Proxy
Server environments.
Multiple flaws were fixed in the Apache HTTPD server. These flaws could
result in a cross-site scripting or denial-of-service attack.
(CVE-2007-6388, CVE-2007-5000, CVE-2007-4465, CVE-2007-3304, CVE-2006-5752,
CVE-2006-3918, CVE-2005-3352)
A denial-of-service flaw was fixed in mod_perl. (CVE-2007-1349)
Multiple flaws in mod_ssl. (CVE-2004-0488, CVE-2004-0700, CVE-2004-0885)
A denial-of-service flaw was fixed in the jabberd server. (CVE-2006-1329)
Users of Red Hat Network Proxy Server 4.2 are advised to upgrade to 4.2.3,
which resolves these issues.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ document: { aggregate_severity: { namespace: "https://access.redhat.com/security/updates/classification/", text: "Low", }, category: "csaf_security_advisory", csaf_version: "2.0", distribution: { text: "Copyright © Red Hat, Inc. All rights reserved.", tlp: { label: "WHITE", url: "https://www.first.org/tlp/", }, }, lang: "en", notes: [ { category: "summary", text: "Red Hat Network Proxy Server version 4.2.3 is now available. This update\nincludes fixes for a number of security issues in Red Hat Network Proxy\nServer components.\n\nThis update has been rated as having low security impact by the Red\nHat Security Response Team.", title: "Topic", }, { category: "general", text: "The Red Hat Network Proxy Server 4.2.3 release corrects several security\nvulnerabilities in several shipped components. In a typical operating\nenvironment, these components are not exposed to users of Proxy Server in a\nvulnerable manner. These security updates will reduce risk in unique Proxy\nServer environments.\n\nMultiple flaws were fixed in the Apache HTTPD server. These flaws could\nresult in a cross-site scripting or denial-of-service attack.\n(CVE-2007-6388, CVE-2007-5000, CVE-2007-4465, CVE-2007-3304, CVE-2006-5752,\nCVE-2006-3918, CVE-2005-3352)\n\nA denial-of-service flaw was fixed in mod_perl. (CVE-2007-1349)\n\nMultiple flaws in mod_ssl. (CVE-2004-0488, CVE-2004-0700, CVE-2004-0885)\n\nA denial-of-service flaw was fixed in the jabberd server. (CVE-2006-1329)\n\nUsers of Red Hat Network Proxy Server 4.2 are advised to upgrade to 4.2.3,\nwhich resolves these issues.", title: "Details", }, { category: "legal_disclaimer", text: "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", title: "Terms of Use", }, ], publisher: { category: "vendor", contact_details: "https://access.redhat.com/security/team/contact/", issuing_authority: "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", name: "Red Hat Product Security", namespace: "https://www.redhat.com", }, references: [ { category: "self", summary: "https://access.redhat.com/errata/RHSA-2008:0523", url: "https://access.redhat.com/errata/RHSA-2008:0523", }, { category: "external", summary: "https://access.redhat.com/security/updates/classification/#low", url: "https://access.redhat.com/security/updates/classification/#low", }, { category: "external", summary: "449336", url: "https://bugzilla.redhat.com/show_bug.cgi?id=449336", }, { category: "self", summary: "Canonical URL", url: "https://security.access.redhat.com/data/csaf/v2/advisories/2008/rhsa-2008_0523.json", }, ], title: "Red Hat Security Advisory: Red Hat Network Proxy Server security update", tracking: { current_release_date: "2025-01-26T19:35:55+00:00", generator: { date: "2025-01-26T19:35:55+00:00", engine: { name: "Red Hat SDEngine", version: "4.2.6", }, }, id: "RHSA-2008:0523", initial_release_date: "2008-06-30T15:29:00+00:00", revision_history: [ { date: "2008-06-30T15:29:00+00:00", number: "1", summary: "Initial version", }, { date: "2008-06-30T11:32:56+00:00", number: "2", summary: "Last updated version", }, { date: "2025-01-26T19:35:55+00:00", number: "3", summary: "Last generated version", }, ], status: "final", version: "3", }, }, product_tree: { branches: [ { branches: [ { branches: [ { category: "product_name", name: "Red Hat Satellite Proxy v 4.2 (RHEL v.3 AS)", product: { name: "Red Hat Satellite Proxy v 4.2 (RHEL v.3 AS)", product_id: "3AS-RHNPROXY4.2", product_identification_helper: { cpe: "cpe:/a:redhat:network_proxy:4.2::el3", }, }, }, { category: "product_name", name: "Red Hat Satellite Proxy v 4.2 (RHEL v.4 AS)", product: { name: "Red Hat Satellite Proxy v 4.2 (RHEL v.4 AS)", product_id: "4AS-RHNPROXY4.2", product_identification_helper: { cpe: "cpe:/a:redhat:network_proxy:4.2::el4", }, }, }, ], category: "product_family", name: "Red Hat Satellite Proxy", }, { branches: [ { category: "product_version", name: "jabberd-0:2.0s10-3.37.rhn.i386", product: { name: "jabberd-0:2.0s10-3.37.rhn.i386", product_id: "jabberd-0:2.0s10-3.37.rhn.i386", product_identification_helper: { purl: "pkg:rpm/redhat/jabberd@2.0s10-3.37.rhn?arch=i386", }, }, }, { category: "product_version", name: "rhn-apache-0:1.3.27-36.rhn.rhel3.i386", product: { name: "rhn-apache-0:1.3.27-36.rhn.rhel3.i386", product_id: "rhn-apache-0:1.3.27-36.rhn.rhel3.i386", product_identification_helper: { purl: "pkg:rpm/redhat/rhn-apache@1.3.27-36.rhn.rhel3?arch=i386", }, }, }, { category: "product_version", name: "rhn-modperl-0:1.29-16.rhel3.i386", product: { name: "rhn-modperl-0:1.29-16.rhel3.i386", product_id: "rhn-modperl-0:1.29-16.rhel3.i386", product_identification_helper: { purl: "pkg:rpm/redhat/rhn-modperl@1.29-16.rhel3?arch=i386", }, }, }, { category: "product_version", name: "jabberd-0:2.0s10-3.38.rhn.i386", product: { name: "jabberd-0:2.0s10-3.38.rhn.i386", product_id: "jabberd-0:2.0s10-3.38.rhn.i386", product_identification_helper: { purl: "pkg:rpm/redhat/jabberd@2.0s10-3.38.rhn?arch=i386", }, }, }, { category: "product_version", name: "rhn-apache-0:1.3.27-36.rhn.rhel4.i386", product: { name: "rhn-apache-0:1.3.27-36.rhn.rhel4.i386", product_id: "rhn-apache-0:1.3.27-36.rhn.rhel4.i386", product_identification_helper: { purl: "pkg:rpm/redhat/rhn-apache@1.3.27-36.rhn.rhel4?arch=i386", }, }, }, { category: "product_version", name: "rhn-modperl-0:1.29-16.rhel4.i386", product: { name: "rhn-modperl-0:1.29-16.rhel4.i386", product_id: "rhn-modperl-0:1.29-16.rhel4.i386", product_identification_helper: { purl: "pkg:rpm/redhat/rhn-modperl@1.29-16.rhel4?arch=i386", }, }, }, ], category: "architecture", name: "i386", }, ], category: "vendor", name: "Red Hat", }, ], relationships: [ { category: "default_component_of", full_product_name: { name: "jabberd-0:2.0s10-3.37.rhn.i386 as a component of Red Hat Satellite Proxy v 4.2 (RHEL v.3 AS)", product_id: "3AS-RHNPROXY4.2:jabberd-0:2.0s10-3.37.rhn.i386", }, product_reference: "jabberd-0:2.0s10-3.37.rhn.i386", relates_to_product_reference: "3AS-RHNPROXY4.2", }, { category: "default_component_of", full_product_name: { name: "rhn-apache-0:1.3.27-36.rhn.rhel3.i386 as a component of Red Hat Satellite Proxy v 4.2 (RHEL v.3 AS)", product_id: "3AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", }, product_reference: "rhn-apache-0:1.3.27-36.rhn.rhel3.i386", relates_to_product_reference: "3AS-RHNPROXY4.2", }, { category: "default_component_of", full_product_name: { name: "rhn-modperl-0:1.29-16.rhel3.i386 as a component of Red Hat Satellite Proxy v 4.2 (RHEL v.3 AS)", product_id: "3AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel3.i386", }, product_reference: "rhn-modperl-0:1.29-16.rhel3.i386", relates_to_product_reference: "3AS-RHNPROXY4.2", }, { category: "default_component_of", full_product_name: { name: "jabberd-0:2.0s10-3.38.rhn.i386 as a component of Red Hat Satellite Proxy v 4.2 (RHEL v.4 AS)", product_id: "4AS-RHNPROXY4.2:jabberd-0:2.0s10-3.38.rhn.i386", }, product_reference: "jabberd-0:2.0s10-3.38.rhn.i386", relates_to_product_reference: "4AS-RHNPROXY4.2", }, { category: "default_component_of", full_product_name: { name: "rhn-apache-0:1.3.27-36.rhn.rhel4.i386 as a component of Red Hat Satellite Proxy v 4.2 (RHEL v.4 AS)", product_id: "4AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", }, product_reference: "rhn-apache-0:1.3.27-36.rhn.rhel4.i386", relates_to_product_reference: "4AS-RHNPROXY4.2", }, { category: "default_component_of", full_product_name: { name: "rhn-modperl-0:1.29-16.rhel4.i386 as a component of Red Hat Satellite Proxy v 4.2 (RHEL v.4 AS)", product_id: "4AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel4.i386", }, product_reference: "rhn-modperl-0:1.29-16.rhel4.i386", relates_to_product_reference: "4AS-RHNPROXY4.2", }, ], }, vulnerabilities: [ { cve: "CVE-2004-0488", ids: [ { system_name: "Red Hat Bugzilla ID", text: "430867", }, ], notes: [ { category: "description", text: "Stack-based buffer overflow in the ssl_util_uuencode_binary function in ssl_util.c for Apache mod_ssl, when mod_ssl is configured to trust the issuing CA, may allow remote attackers to execute arbitrary code via a client certificate with a long subject DN.", title: "Vulnerability description", }, { category: "summary", text: "mod_ssl ssl_util_uuencode_binary CA issue", title: "Vulnerability summary", }, ], product_status: { fixed: [ "3AS-RHNPROXY4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel3.i386", "4AS-RHNPROXY4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel4.i386", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2004-0488", }, { category: "external", summary: "RHBZ#430867", url: "https://bugzilla.redhat.com/show_bug.cgi?id=430867", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2004-0488", url: "https://www.cve.org/CVERecord?id=CVE-2004-0488", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2004-0488", url: "https://nvd.nist.gov/vuln/detail/CVE-2004-0488", }, ], release_date: "2004-05-17T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-06-30T15:29:00+00:00", details: "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.\n\nThis update is available via Red Hat Network. Details on how to use \nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/FAQ_58_10188", product_ids: [ "3AS-RHNPROXY4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel3.i386", "4AS-RHNPROXY4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel4.i386", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0523", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "mod_ssl ssl_util_uuencode_binary CA issue", }, { cve: "CVE-2004-0700", ids: [ { system_name: "Red Hat Bugzilla ID", text: "430866", }, ], notes: [ { category: "description", text: "Format string vulnerability in the mod_proxy hook functions function in ssl_engine_log.c in mod_ssl before 2.8.19 for Apache before 1.3.31 may allow remote attackers to execute arbitrary messages via format string specifiers in certain log messages for HTTPS that are handled by the ssl_log function.", title: "Vulnerability description", }, { category: "summary", text: "mod_proxy hook format string", title: "Vulnerability summary", }, ], product_status: { fixed: [ "3AS-RHNPROXY4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel3.i386", "4AS-RHNPROXY4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel4.i386", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2004-0700", }, { category: "external", summary: "RHBZ#430866", url: "https://bugzilla.redhat.com/show_bug.cgi?id=430866", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2004-0700", url: "https://www.cve.org/CVERecord?id=CVE-2004-0700", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2004-0700", url: "https://nvd.nist.gov/vuln/detail/CVE-2004-0700", }, ], release_date: "2004-07-16T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-06-30T15:29:00+00:00", details: "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.\n\nThis update is available via Red Hat Network. Details on how to use \nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/FAQ_58_10188", product_ids: [ "3AS-RHNPROXY4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel3.i386", "4AS-RHNPROXY4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel4.i386", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0523", }, ], threats: [ { category: "impact", details: "Important", }, ], title: "mod_proxy hook format string", }, { cve: "CVE-2004-0885", ids: [ { system_name: "Red Hat Bugzilla ID", text: "430637", }, ], notes: [ { category: "description", text: "The mod_ssl module in Apache 2.0.35 through 2.0.52, when using the \"SSLCipherSuite\" directive in directory or location context, allows remote clients to bypass intended restrictions by using any cipher suite that is allowed by the virtual host configuration.", title: "Vulnerability description", }, { category: "summary", text: "mod_ssl SSLCipherSuite bypass", title: "Vulnerability summary", }, ], product_status: { fixed: [ "3AS-RHNPROXY4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel3.i386", "4AS-RHNPROXY4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel4.i386", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2004-0885", }, { category: "external", summary: "RHBZ#430637", url: "https://bugzilla.redhat.com/show_bug.cgi?id=430637", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2004-0885", url: "https://www.cve.org/CVERecord?id=CVE-2004-0885", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2004-0885", url: "https://nvd.nist.gov/vuln/detail/CVE-2004-0885", }, ], release_date: "2004-10-05T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-06-30T15:29:00+00:00", details: "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.\n\nThis update is available via Red Hat Network. Details on how to use \nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/FAQ_58_10188", product_ids: [ "3AS-RHNPROXY4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel3.i386", "4AS-RHNPROXY4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel4.i386", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0523", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "mod_ssl SSLCipherSuite bypass", }, { cve: "CVE-2005-3352", cwe: { id: "CWE-79", name: "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", }, discovery_date: "2005-12-12T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "430524", }, ], notes: [ { category: "description", text: "Cross-site scripting (XSS) vulnerability in the mod_imap module of Apache httpd before 1.3.35-dev and Apache httpd 2.0.x before 2.0.56-dev allows remote attackers to inject arbitrary web script or HTML via the Referer when using image maps.", title: "Vulnerability description", }, { category: "summary", text: "httpd cross-site scripting flaw in mod_imap", title: "Vulnerability summary", }, ], product_status: { fixed: [ "3AS-RHNPROXY4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel3.i386", "4AS-RHNPROXY4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel4.i386", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2005-3352", }, { category: "external", summary: "RHBZ#430524", url: "https://bugzilla.redhat.com/show_bug.cgi?id=430524", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2005-3352", url: "https://www.cve.org/CVERecord?id=CVE-2005-3352", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2005-3352", url: "https://nvd.nist.gov/vuln/detail/CVE-2005-3352", }, ], release_date: "2005-12-12T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-06-30T15:29:00+00:00", details: "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.\n\nThis update is available via Red Hat Network. Details on how to use \nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/FAQ_58_10188", product_ids: [ "3AS-RHNPROXY4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel3.i386", "4AS-RHNPROXY4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel4.i386", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0523", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "httpd cross-site scripting flaw in mod_imap", }, { cve: "CVE-2006-1329", ids: [ { system_name: "Red Hat Bugzilla ID", text: "429254", }, ], notes: [ { category: "description", text: "The SASL negotiation in Jabber Studio jabberd before 2.0s11 allows remote attackers to cause a denial of service (\"c2s segfault\") by sending a \"response stanza before an auth stanza\".", title: "Vulnerability description", }, { category: "summary", text: "jabberd SASL DoS", title: "Vulnerability summary", }, ], product_status: { fixed: [ "3AS-RHNPROXY4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel3.i386", "4AS-RHNPROXY4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel4.i386", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2006-1329", }, { category: "external", summary: "RHBZ#429254", url: "https://bugzilla.redhat.com/show_bug.cgi?id=429254", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2006-1329", url: "https://www.cve.org/CVERecord?id=CVE-2006-1329", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2006-1329", url: "https://nvd.nist.gov/vuln/detail/CVE-2006-1329", }, ], release_date: "2006-03-09T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-06-30T15:29:00+00:00", details: "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.\n\nThis update is available via Red Hat Network. Details on how to use \nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/FAQ_58_10188", product_ids: [ "3AS-RHNPROXY4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel3.i386", "4AS-RHNPROXY4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel4.i386", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0523", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "jabberd SASL DoS", }, { cve: "CVE-2006-3918", cwe: { id: "CWE-79", name: "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", }, discovery_date: "2006-07-31T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "200732", }, ], notes: [ { category: "description", text: "http_protocol.c in (1) IBM HTTP Server 6.0 before 6.0.2.13 and 6.1 before 6.1.0.1, and (2) Apache HTTP Server 1.3 before 1.3.35, 2.0 before 2.0.58, and 2.2 before 2.2.2, does not sanitize the Expect header from an HTTP request when it is reflected back in an error message, which might allow cross-site scripting (XSS) style attacks using web client components that can send arbitrary headers in requests, as demonstrated using a Flash SWF file.", title: "Vulnerability description", }, { category: "summary", text: "httpd: Expect header XSS", title: "Vulnerability summary", }, ], product_status: { fixed: [ "3AS-RHNPROXY4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel3.i386", "4AS-RHNPROXY4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel4.i386", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2006-3918", }, { category: "external", summary: "RHBZ#200732", url: "https://bugzilla.redhat.com/show_bug.cgi?id=200732", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2006-3918", url: "https://www.cve.org/CVERecord?id=CVE-2006-3918", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2006-3918", url: "https://nvd.nist.gov/vuln/detail/CVE-2006-3918", }, ], release_date: "2006-05-08T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-06-30T15:29:00+00:00", details: "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.\n\nThis update is available via Red Hat Network. Details on how to use \nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/FAQ_58_10188", product_ids: [ "3AS-RHNPROXY4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel3.i386", "4AS-RHNPROXY4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel4.i386", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0523", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "httpd: Expect header XSS", }, { cve: "CVE-2006-5752", cwe: { id: "CWE-79", name: "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", }, discovery_date: "2007-06-20T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "245112", }, ], notes: [ { category: "description", text: "Cross-site scripting (XSS) vulnerability in mod_status.c in the mod_status module in Apache HTTP Server (httpd), when ExtendedStatus is enabled and a public server-status page is used, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors involving charsets with browsers that perform \"charset detection\" when the content-type is not specified.", title: "Vulnerability description", }, { category: "summary", text: "httpd mod_status XSS", title: "Vulnerability summary", }, ], product_status: { fixed: [ "3AS-RHNPROXY4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel3.i386", "4AS-RHNPROXY4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel4.i386", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2006-5752", }, { category: "external", summary: "RHBZ#245112", url: "https://bugzilla.redhat.com/show_bug.cgi?id=245112", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2006-5752", url: "https://www.cve.org/CVERecord?id=CVE-2006-5752", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2006-5752", url: "https://nvd.nist.gov/vuln/detail/CVE-2006-5752", }, ], release_date: "2007-06-20T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-06-30T15:29:00+00:00", details: "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.\n\nThis update is available via Red Hat Network. Details on how to use \nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/FAQ_58_10188", product_ids: [ "3AS-RHNPROXY4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel3.i386", "4AS-RHNPROXY4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel4.i386", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0523", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "httpd mod_status XSS", }, { cve: "CVE-2007-1349", discovery_date: "2007-05-17T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "240423", }, ], notes: [ { category: "description", text: "PerlRun.pm in Apache mod_perl before 1.30, and RegistryCooker.pm in mod_perl 2.x, does not properly escape PATH_INFO before use in a regular expression, which allows remote attackers to cause a denial of service (resource consumption) via a crafted URI.", title: "Vulnerability description", }, { category: "summary", text: "mod_perl PerlRun denial of service", title: "Vulnerability summary", }, ], product_status: { fixed: [ "3AS-RHNPROXY4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel3.i386", "4AS-RHNPROXY4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel4.i386", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-1349", }, { category: "external", summary: "RHBZ#240423", url: "https://bugzilla.redhat.com/show_bug.cgi?id=240423", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-1349", url: "https://www.cve.org/CVERecord?id=CVE-2007-1349", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-1349", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-1349", }, ], release_date: "2007-03-22T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-06-30T15:29:00+00:00", details: "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.\n\nThis update is available via Red Hat Network. Details on how to use \nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/FAQ_58_10188", product_ids: [ "3AS-RHNPROXY4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel3.i386", "4AS-RHNPROXY4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel4.i386", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0523", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "mod_perl PerlRun denial of service", }, { cve: "CVE-2007-3304", discovery_date: "2007-06-19T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "245111", }, ], notes: [ { category: "description", text: "Apache httpd 1.3.37, 2.0.59, and 2.2.4 with the Prefork MPM module, allows local users to cause a denial of service by modifying the worker_score and process_score arrays to reference an arbitrary process ID, which is sent a SIGUSR1 signal from the master process, aka \"SIGUSR1 killer.\"", title: "Vulnerability description", }, { category: "summary", text: "httpd scoreboard lack of PID protection", title: "Vulnerability summary", }, ], product_status: { fixed: [ "3AS-RHNPROXY4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel3.i386", "4AS-RHNPROXY4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel4.i386", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-3304", }, { category: "external", summary: "RHBZ#245111", url: "https://bugzilla.redhat.com/show_bug.cgi?id=245111", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-3304", url: "https://www.cve.org/CVERecord?id=CVE-2007-3304", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-3304", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-3304", }, ], release_date: "2007-06-19T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-06-30T15:29:00+00:00", details: "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.\n\nThis update is available via Red Hat Network. Details on how to use \nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/FAQ_58_10188", product_ids: [ "3AS-RHNPROXY4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel3.i386", "4AS-RHNPROXY4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel4.i386", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0523", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "httpd scoreboard lack of PID protection", }, { cve: "CVE-2007-4465", cwe: { id: "CWE-79", name: "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", }, discovery_date: "2007-09-13T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "289511", }, ], notes: [ { category: "description", text: "Cross-site scripting (XSS) vulnerability in mod_autoindex.c in the Apache HTTP Server before 2.2.6, when the charset on a server-generated page is not defined, allows remote attackers to inject arbitrary web script or HTML via the P parameter using the UTF-7 charset. NOTE: it could be argued that this issue is due to a design limitation of browsers that attempt to perform automatic content type detection.", title: "Vulnerability description", }, { category: "summary", text: "mod_autoindex XSS", title: "Vulnerability summary", }, { category: "other", text: "This is actually a flaw in browsers that do not derive the response character set as required by RFC 2616. This does not affect the default configuration of Apache httpd in Red Hat products and will only affect customers who have removed the \"AddDefaultCharset\" directive and are using directory indexes. The Red Hat Product Security has rated this issue as having low security impact, a future update may address this flaw.", title: "Statement", }, ], product_status: { fixed: [ "3AS-RHNPROXY4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel3.i386", "4AS-RHNPROXY4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel4.i386", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-4465", }, { category: "external", summary: "RHBZ#289511", url: "https://bugzilla.redhat.com/show_bug.cgi?id=289511", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-4465", url: "https://www.cve.org/CVERecord?id=CVE-2007-4465", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-4465", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-4465", }, ], release_date: "2007-09-13T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-06-30T15:29:00+00:00", details: "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.\n\nThis update is available via Red Hat Network. Details on how to use \nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/FAQ_58_10188", product_ids: [ "3AS-RHNPROXY4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel3.i386", "4AS-RHNPROXY4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel4.i386", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0523", }, ], threats: [ { category: "impact", details: "Low", }, ], title: "mod_autoindex XSS", }, { cve: "CVE-2007-5000", cwe: { id: "CWE-79", name: "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", }, discovery_date: "2007-12-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "419931", }, ], notes: [ { category: "description", text: "Cross-site scripting (XSS) vulnerability in the (1) mod_imap module in the Apache HTTP Server 1.3.0 through 1.3.39 and 2.0.35 through 2.0.61 and the (2) mod_imagemap module in the Apache HTTP Server 2.2.0 through 2.2.6 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.", title: "Vulnerability description", }, { category: "summary", text: "httpd: mod_imagemap XSS", title: "Vulnerability summary", }, ], product_status: { fixed: [ "3AS-RHNPROXY4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel3.i386", "4AS-RHNPROXY4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel4.i386", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-5000", }, { category: "external", summary: "RHBZ#419931", url: "https://bugzilla.redhat.com/show_bug.cgi?id=419931", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-5000", url: "https://www.cve.org/CVERecord?id=CVE-2007-5000", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-5000", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-5000", }, ], release_date: "2007-12-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-06-30T15:29:00+00:00", details: "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.\n\nThis update is available via Red Hat Network. Details on how to use \nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/FAQ_58_10188", product_ids: [ "3AS-RHNPROXY4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel3.i386", "4AS-RHNPROXY4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel4.i386", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0523", }, ], threats: [ { category: "impact", details: "Low", }, ], title: "httpd: mod_imagemap XSS", }, { cve: "CVE-2007-6388", cwe: { id: "CWE-79", name: "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", }, discovery_date: "2008-01-02T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "427228", }, ], notes: [ { category: "description", text: "Cross-site scripting (XSS) vulnerability in mod_status in the Apache HTTP Server 2.2.0 through 2.2.6, 2.0.35 through 2.0.61, and 1.3.2 through 1.3.39, when the server-status page is enabled, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.", title: "Vulnerability description", }, { category: "summary", text: "apache mod_status cross-site scripting", title: "Vulnerability summary", }, ], product_status: { fixed: [ "3AS-RHNPROXY4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel3.i386", "4AS-RHNPROXY4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel4.i386", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-6388", }, { category: "external", summary: "RHBZ#427228", url: "https://bugzilla.redhat.com/show_bug.cgi?id=427228", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-6388", url: "https://www.cve.org/CVERecord?id=CVE-2007-6388", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-6388", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-6388", }, ], release_date: "2007-12-29T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-06-30T15:29:00+00:00", details: "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.\n\nThis update is available via Red Hat Network. Details on how to use \nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/FAQ_58_10188", product_ids: [ "3AS-RHNPROXY4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel3.i386", "4AS-RHNPROXY4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel4.i386", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0523", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "apache mod_status cross-site scripting", }, ], }
rhsa-2007:0662
Vulnerability from csaf_redhat
Published
2007-07-13 07:48
Modified
2024-11-22 02:04
Summary
Red Hat Security Advisory: httpd security update
Notes
Topic
Updated Apache httpd packages that correct a security issue are now
available for Red Hat Enterprise Linux 3 and 4.
This update has been rated as having moderate security impact by the Red
Hat Security Response Team.
Details
The Apache HTTP Server is a popular Web server.
The Apache HTTP Server did not verify that a process was an Apache child
process before sending it signals. A local attacker with the ability to run
scripts on the Apache HTTP Server could manipulate the scoreboard and cause
arbitrary processes to be terminated which could lead to a denial of
service. (CVE-2007-3304).
Users of httpd should upgrade to these updated packages, which contain
backported patches to correct this issue. Users should restart Apache
after installing this update.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ document: { aggregate_severity: { namespace: "https://access.redhat.com/security/updates/classification/", text: "Moderate", }, category: "csaf_security_advisory", csaf_version: "2.0", distribution: { text: "Copyright © Red Hat, Inc. All rights reserved.", tlp: { label: "WHITE", url: "https://www.first.org/tlp/", }, }, lang: "en", notes: [ { category: "summary", text: "Updated Apache httpd packages that correct a security issue are now\navailable for Red Hat Enterprise Linux 3 and 4.\n\nThis update has been rated as having moderate security impact by the Red\nHat Security Response Team.", title: "Topic", }, { category: "general", text: "The Apache HTTP Server is a popular Web server. \n\nThe Apache HTTP Server did not verify that a process was an Apache child\nprocess before sending it signals. A local attacker with the ability to run\nscripts on the Apache HTTP Server could manipulate the scoreboard and cause\narbitrary processes to be terminated which could lead to a denial of\nservice. (CVE-2007-3304).\n\nUsers of httpd should upgrade to these updated packages, which contain\nbackported patches to correct this issue. Users should restart Apache\nafter installing this update.", title: "Details", }, { category: "legal_disclaimer", text: "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", title: "Terms of Use", }, ], publisher: { category: "vendor", contact_details: "https://access.redhat.com/security/team/contact/", issuing_authority: "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", name: "Red Hat Product Security", namespace: "https://www.redhat.com", }, references: [ { category: "self", summary: "https://access.redhat.com/errata/RHSA-2007:0662", url: "https://access.redhat.com/errata/RHSA-2007:0662", }, { category: "external", summary: "https://access.redhat.com/security/updates/classification/#moderate", url: "https://access.redhat.com/security/updates/classification/#moderate", }, { category: "external", summary: "245111", url: "https://bugzilla.redhat.com/show_bug.cgi?id=245111", }, { category: "self", summary: "Canonical URL", url: "https://security.access.redhat.com/data/csaf/v2/advisories/2007/rhsa-2007_0662.json", }, ], title: "Red Hat Security Advisory: httpd security update", tracking: { current_release_date: "2024-11-22T02:04:26+00:00", generator: { date: "2024-11-22T02:04:26+00:00", engine: { name: "Red Hat SDEngine", version: "4.2.1", }, }, id: "RHSA-2007:0662", initial_release_date: "2007-07-13T07:48:00+00:00", revision_history: [ { date: "2007-07-13T07:48:00+00:00", number: "1", summary: "Initial version", }, { date: "2008-01-07T17:32:33+00:00", number: "2", summary: "Last updated version", }, { date: "2024-11-22T02:04:26+00:00", number: "3", summary: "Last generated version", }, ], status: "final", version: "3", }, }, product_tree: { branches: [ { branches: [ { branches: [ { category: "product_name", name: "Red Hat Enterprise Linux AS version 4", product: { name: "Red Hat Enterprise Linux AS version 4", product_id: "4AS", product_identification_helper: { cpe: "cpe:/o:redhat:enterprise_linux:4::as", }, }, }, { category: "product_name", name: "Red Hat Enterprise Linux Desktop version 4", product: { name: "Red Hat Enterprise Linux Desktop version 4", product_id: "4Desktop", product_identification_helper: { cpe: "cpe:/o:redhat:enterprise_linux:4::desktop", }, }, }, { category: "product_name", name: "Red Hat Enterprise Linux ES version 4", product: { name: "Red Hat Enterprise Linux ES version 4", product_id: "4ES", product_identification_helper: { cpe: "cpe:/o:redhat:enterprise_linux:4::es", }, }, }, { category: "product_name", name: "Red Hat Enterprise Linux WS version 4", product: { name: "Red Hat Enterprise Linux WS version 4", product_id: "4WS", product_identification_helper: { cpe: "cpe:/o:redhat:enterprise_linux:4::ws", }, }, }, { category: "product_name", name: "Red Hat Enterprise Linux AS version 3", product: { name: "Red Hat Enterprise Linux AS version 3", product_id: "3AS", product_identification_helper: { cpe: "cpe:/o:redhat:enterprise_linux:3::as", }, }, }, { category: "product_name", name: "Red Hat Desktop version 3", product: { name: "Red Hat Desktop version 3", product_id: "3Desktop", product_identification_helper: { cpe: "cpe:/o:redhat:enterprise_linux:3::desktop", }, }, }, { category: "product_name", name: "Red Hat Enterprise Linux ES version 3", product: { name: "Red Hat Enterprise Linux ES version 3", product_id: "3ES", product_identification_helper: { cpe: "cpe:/o:redhat:enterprise_linux:3::es", }, }, }, { category: "product_name", name: "Red Hat Enterprise Linux WS version 3", product: { name: "Red Hat Enterprise Linux WS version 3", product_id: "3WS", product_identification_helper: { cpe: "cpe:/o:redhat:enterprise_linux:3::ws", }, }, }, ], category: "product_family", name: "Red Hat Enterprise Linux", }, { branches: [ { category: "product_version", name: "httpd-manual-0:2.0.52-32.3.ent.ia64", product: { name: "httpd-manual-0:2.0.52-32.3.ent.ia64", product_id: "httpd-manual-0:2.0.52-32.3.ent.ia64", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-manual@2.0.52-32.3.ent?arch=ia64", }, }, }, { category: "product_version", name: "mod_ssl-1:2.0.52-32.3.ent.ia64", product: { name: "mod_ssl-1:2.0.52-32.3.ent.ia64", product_id: "mod_ssl-1:2.0.52-32.3.ent.ia64", product_identification_helper: { purl: "pkg:rpm/redhat/mod_ssl@2.0.52-32.3.ent?arch=ia64&epoch=1", }, }, }, { category: "product_version", name: "httpd-suexec-0:2.0.52-32.3.ent.ia64", product: { name: "httpd-suexec-0:2.0.52-32.3.ent.ia64", product_id: "httpd-suexec-0:2.0.52-32.3.ent.ia64", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-suexec@2.0.52-32.3.ent?arch=ia64", }, }, }, { category: "product_version", name: "httpd-debuginfo-0:2.0.52-32.3.ent.ia64", product: { name: "httpd-debuginfo-0:2.0.52-32.3.ent.ia64", product_id: "httpd-debuginfo-0:2.0.52-32.3.ent.ia64", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-debuginfo@2.0.52-32.3.ent?arch=ia64", }, }, }, { category: "product_version", name: "httpd-devel-0:2.0.52-32.3.ent.ia64", product: { name: "httpd-devel-0:2.0.52-32.3.ent.ia64", product_id: "httpd-devel-0:2.0.52-32.3.ent.ia64", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-devel@2.0.52-32.3.ent?arch=ia64", }, }, }, { category: "product_version", name: "httpd-0:2.0.52-32.3.ent.ia64", product: { name: "httpd-0:2.0.52-32.3.ent.ia64", product_id: "httpd-0:2.0.52-32.3.ent.ia64", product_identification_helper: { purl: "pkg:rpm/redhat/httpd@2.0.52-32.3.ent?arch=ia64", }, }, }, { category: "product_version", name: "httpd-0:2.0.46-68.ent.ia64", product: { name: "httpd-0:2.0.46-68.ent.ia64", product_id: "httpd-0:2.0.46-68.ent.ia64", product_identification_helper: { purl: "pkg:rpm/redhat/httpd@2.0.46-68.ent?arch=ia64", }, }, }, { category: "product_version", name: "mod_ssl-1:2.0.46-68.ent.ia64", product: { name: "mod_ssl-1:2.0.46-68.ent.ia64", product_id: "mod_ssl-1:2.0.46-68.ent.ia64", product_identification_helper: { purl: "pkg:rpm/redhat/mod_ssl@2.0.46-68.ent?arch=ia64&epoch=1", }, }, }, { category: "product_version", name: "httpd-devel-0:2.0.46-68.ent.ia64", product: { name: "httpd-devel-0:2.0.46-68.ent.ia64", product_id: "httpd-devel-0:2.0.46-68.ent.ia64", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-devel@2.0.46-68.ent?arch=ia64", }, }, }, { category: "product_version", name: "httpd-debuginfo-0:2.0.46-68.ent.ia64", product: { name: "httpd-debuginfo-0:2.0.46-68.ent.ia64", product_id: "httpd-debuginfo-0:2.0.46-68.ent.ia64", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-debuginfo@2.0.46-68.ent?arch=ia64", }, }, }, ], category: "architecture", name: "ia64", }, { branches: [ { category: "product_version", name: "httpd-manual-0:2.0.52-32.3.ent.x86_64", product: { name: "httpd-manual-0:2.0.52-32.3.ent.x86_64", product_id: "httpd-manual-0:2.0.52-32.3.ent.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-manual@2.0.52-32.3.ent?arch=x86_64", }, }, }, { category: "product_version", name: "mod_ssl-1:2.0.52-32.3.ent.x86_64", product: { name: "mod_ssl-1:2.0.52-32.3.ent.x86_64", product_id: "mod_ssl-1:2.0.52-32.3.ent.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/mod_ssl@2.0.52-32.3.ent?arch=x86_64&epoch=1", }, }, }, { category: "product_version", name: "httpd-suexec-0:2.0.52-32.3.ent.x86_64", product: { name: "httpd-suexec-0:2.0.52-32.3.ent.x86_64", product_id: "httpd-suexec-0:2.0.52-32.3.ent.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-suexec@2.0.52-32.3.ent?arch=x86_64", }, }, }, { category: "product_version", name: "httpd-debuginfo-0:2.0.52-32.3.ent.x86_64", product: { name: "httpd-debuginfo-0:2.0.52-32.3.ent.x86_64", product_id: "httpd-debuginfo-0:2.0.52-32.3.ent.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-debuginfo@2.0.52-32.3.ent?arch=x86_64", }, }, }, { category: "product_version", name: "httpd-devel-0:2.0.52-32.3.ent.x86_64", product: { name: "httpd-devel-0:2.0.52-32.3.ent.x86_64", product_id: "httpd-devel-0:2.0.52-32.3.ent.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-devel@2.0.52-32.3.ent?arch=x86_64", }, }, }, { category: "product_version", name: "httpd-0:2.0.52-32.3.ent.x86_64", product: { name: "httpd-0:2.0.52-32.3.ent.x86_64", product_id: "httpd-0:2.0.52-32.3.ent.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/httpd@2.0.52-32.3.ent?arch=x86_64", }, }, }, { category: "product_version", name: "httpd-0:2.0.46-68.ent.x86_64", product: { name: "httpd-0:2.0.46-68.ent.x86_64", product_id: "httpd-0:2.0.46-68.ent.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/httpd@2.0.46-68.ent?arch=x86_64", }, }, }, { category: "product_version", name: "mod_ssl-1:2.0.46-68.ent.x86_64", product: { name: "mod_ssl-1:2.0.46-68.ent.x86_64", product_id: "mod_ssl-1:2.0.46-68.ent.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/mod_ssl@2.0.46-68.ent?arch=x86_64&epoch=1", }, }, }, { category: "product_version", name: "httpd-devel-0:2.0.46-68.ent.x86_64", product: { name: "httpd-devel-0:2.0.46-68.ent.x86_64", product_id: "httpd-devel-0:2.0.46-68.ent.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-devel@2.0.46-68.ent?arch=x86_64", }, }, }, { category: "product_version", name: "httpd-debuginfo-0:2.0.46-68.ent.x86_64", product: { name: "httpd-debuginfo-0:2.0.46-68.ent.x86_64", product_id: "httpd-debuginfo-0:2.0.46-68.ent.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-debuginfo@2.0.46-68.ent?arch=x86_64", }, }, }, ], category: "architecture", name: "x86_64", }, { branches: [ { category: "product_version", name: "httpd-manual-0:2.0.52-32.3.ent.i386", product: { name: "httpd-manual-0:2.0.52-32.3.ent.i386", product_id: "httpd-manual-0:2.0.52-32.3.ent.i386", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-manual@2.0.52-32.3.ent?arch=i386", }, }, }, { category: "product_version", name: "mod_ssl-1:2.0.52-32.3.ent.i386", product: { name: "mod_ssl-1:2.0.52-32.3.ent.i386", product_id: "mod_ssl-1:2.0.52-32.3.ent.i386", product_identification_helper: { purl: "pkg:rpm/redhat/mod_ssl@2.0.52-32.3.ent?arch=i386&epoch=1", }, }, }, { category: "product_version", name: "httpd-suexec-0:2.0.52-32.3.ent.i386", product: { name: "httpd-suexec-0:2.0.52-32.3.ent.i386", product_id: "httpd-suexec-0:2.0.52-32.3.ent.i386", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-suexec@2.0.52-32.3.ent?arch=i386", }, }, }, { category: "product_version", name: "httpd-debuginfo-0:2.0.52-32.3.ent.i386", product: { name: "httpd-debuginfo-0:2.0.52-32.3.ent.i386", product_id: "httpd-debuginfo-0:2.0.52-32.3.ent.i386", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-debuginfo@2.0.52-32.3.ent?arch=i386", }, }, }, { category: "product_version", name: "httpd-devel-0:2.0.52-32.3.ent.i386", product: { name: "httpd-devel-0:2.0.52-32.3.ent.i386", product_id: "httpd-devel-0:2.0.52-32.3.ent.i386", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-devel@2.0.52-32.3.ent?arch=i386", }, }, }, { category: "product_version", name: "httpd-0:2.0.52-32.3.ent.i386", product: { name: "httpd-0:2.0.52-32.3.ent.i386", product_id: "httpd-0:2.0.52-32.3.ent.i386", product_identification_helper: { purl: "pkg:rpm/redhat/httpd@2.0.52-32.3.ent?arch=i386", }, }, }, { category: "product_version", name: "httpd-0:2.0.46-68.ent.i386", product: { name: "httpd-0:2.0.46-68.ent.i386", product_id: "httpd-0:2.0.46-68.ent.i386", product_identification_helper: { purl: "pkg:rpm/redhat/httpd@2.0.46-68.ent?arch=i386", }, }, }, { category: "product_version", name: "mod_ssl-1:2.0.46-68.ent.i386", product: { name: "mod_ssl-1:2.0.46-68.ent.i386", product_id: "mod_ssl-1:2.0.46-68.ent.i386", product_identification_helper: { purl: "pkg:rpm/redhat/mod_ssl@2.0.46-68.ent?arch=i386&epoch=1", }, }, }, { category: "product_version", name: "httpd-devel-0:2.0.46-68.ent.i386", product: { name: "httpd-devel-0:2.0.46-68.ent.i386", product_id: "httpd-devel-0:2.0.46-68.ent.i386", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-devel@2.0.46-68.ent?arch=i386", }, }, }, { category: "product_version", name: "httpd-debuginfo-0:2.0.46-68.ent.i386", product: { name: "httpd-debuginfo-0:2.0.46-68.ent.i386", product_id: "httpd-debuginfo-0:2.0.46-68.ent.i386", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-debuginfo@2.0.46-68.ent?arch=i386", }, }, }, ], category: "architecture", name: "i386", }, { branches: [ { category: "product_version", name: "httpd-0:2.0.52-32.3.ent.src", product: { name: "httpd-0:2.0.52-32.3.ent.src", product_id: "httpd-0:2.0.52-32.3.ent.src", product_identification_helper: { purl: "pkg:rpm/redhat/httpd@2.0.52-32.3.ent?arch=src", }, }, }, { category: "product_version", name: "httpd-0:2.0.46-68.ent.src", product: { name: "httpd-0:2.0.46-68.ent.src", product_id: "httpd-0:2.0.46-68.ent.src", product_identification_helper: { purl: "pkg:rpm/redhat/httpd@2.0.46-68.ent?arch=src", }, }, }, ], category: "architecture", name: "src", }, { branches: [ { category: "product_version", name: "httpd-manual-0:2.0.52-32.3.ent.ppc", product: { name: "httpd-manual-0:2.0.52-32.3.ent.ppc", product_id: "httpd-manual-0:2.0.52-32.3.ent.ppc", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-manual@2.0.52-32.3.ent?arch=ppc", }, }, }, { category: "product_version", name: "mod_ssl-1:2.0.52-32.3.ent.ppc", product: { name: "mod_ssl-1:2.0.52-32.3.ent.ppc", product_id: "mod_ssl-1:2.0.52-32.3.ent.ppc", product_identification_helper: { purl: "pkg:rpm/redhat/mod_ssl@2.0.52-32.3.ent?arch=ppc&epoch=1", }, }, }, { category: "product_version", name: "httpd-suexec-0:2.0.52-32.3.ent.ppc", product: { name: "httpd-suexec-0:2.0.52-32.3.ent.ppc", product_id: "httpd-suexec-0:2.0.52-32.3.ent.ppc", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-suexec@2.0.52-32.3.ent?arch=ppc", }, }, }, { category: "product_version", name: "httpd-debuginfo-0:2.0.52-32.3.ent.ppc", product: { name: "httpd-debuginfo-0:2.0.52-32.3.ent.ppc", product_id: "httpd-debuginfo-0:2.0.52-32.3.ent.ppc", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-debuginfo@2.0.52-32.3.ent?arch=ppc", }, }, }, { category: "product_version", name: "httpd-devel-0:2.0.52-32.3.ent.ppc", product: { name: "httpd-devel-0:2.0.52-32.3.ent.ppc", product_id: "httpd-devel-0:2.0.52-32.3.ent.ppc", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-devel@2.0.52-32.3.ent?arch=ppc", }, }, }, { category: "product_version", name: "httpd-0:2.0.52-32.3.ent.ppc", product: { name: "httpd-0:2.0.52-32.3.ent.ppc", product_id: "httpd-0:2.0.52-32.3.ent.ppc", product_identification_helper: { purl: "pkg:rpm/redhat/httpd@2.0.52-32.3.ent?arch=ppc", }, }, }, { category: "product_version", name: "httpd-0:2.0.46-68.ent.ppc", product: { name: "httpd-0:2.0.46-68.ent.ppc", product_id: "httpd-0:2.0.46-68.ent.ppc", product_identification_helper: { purl: "pkg:rpm/redhat/httpd@2.0.46-68.ent?arch=ppc", }, }, }, { category: "product_version", name: "mod_ssl-1:2.0.46-68.ent.ppc", product: { name: "mod_ssl-1:2.0.46-68.ent.ppc", product_id: "mod_ssl-1:2.0.46-68.ent.ppc", product_identification_helper: { purl: "pkg:rpm/redhat/mod_ssl@2.0.46-68.ent?arch=ppc&epoch=1", }, }, }, { category: "product_version", name: "httpd-devel-0:2.0.46-68.ent.ppc", product: { name: "httpd-devel-0:2.0.46-68.ent.ppc", product_id: "httpd-devel-0:2.0.46-68.ent.ppc", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-devel@2.0.46-68.ent?arch=ppc", }, }, }, { category: "product_version", name: "httpd-debuginfo-0:2.0.46-68.ent.ppc", product: { name: "httpd-debuginfo-0:2.0.46-68.ent.ppc", product_id: "httpd-debuginfo-0:2.0.46-68.ent.ppc", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-debuginfo@2.0.46-68.ent?arch=ppc", }, }, }, ], category: "architecture", name: "ppc", }, { branches: [ { category: "product_version", name: "httpd-manual-0:2.0.52-32.3.ent.s390x", product: { name: "httpd-manual-0:2.0.52-32.3.ent.s390x", product_id: "httpd-manual-0:2.0.52-32.3.ent.s390x", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-manual@2.0.52-32.3.ent?arch=s390x", }, }, }, { category: "product_version", name: "mod_ssl-1:2.0.52-32.3.ent.s390x", product: { name: "mod_ssl-1:2.0.52-32.3.ent.s390x", product_id: "mod_ssl-1:2.0.52-32.3.ent.s390x", product_identification_helper: { purl: "pkg:rpm/redhat/mod_ssl@2.0.52-32.3.ent?arch=s390x&epoch=1", }, }, }, { category: "product_version", name: "httpd-suexec-0:2.0.52-32.3.ent.s390x", product: { name: "httpd-suexec-0:2.0.52-32.3.ent.s390x", product_id: "httpd-suexec-0:2.0.52-32.3.ent.s390x", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-suexec@2.0.52-32.3.ent?arch=s390x", }, }, }, { category: "product_version", name: "httpd-debuginfo-0:2.0.52-32.3.ent.s390x", product: { name: "httpd-debuginfo-0:2.0.52-32.3.ent.s390x", product_id: "httpd-debuginfo-0:2.0.52-32.3.ent.s390x", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-debuginfo@2.0.52-32.3.ent?arch=s390x", }, }, }, { category: "product_version", name: "httpd-devel-0:2.0.52-32.3.ent.s390x", product: { name: "httpd-devel-0:2.0.52-32.3.ent.s390x", product_id: "httpd-devel-0:2.0.52-32.3.ent.s390x", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-devel@2.0.52-32.3.ent?arch=s390x", }, }, }, { category: "product_version", name: "httpd-0:2.0.52-32.3.ent.s390x", product: { name: "httpd-0:2.0.52-32.3.ent.s390x", product_id: "httpd-0:2.0.52-32.3.ent.s390x", product_identification_helper: { purl: "pkg:rpm/redhat/httpd@2.0.52-32.3.ent?arch=s390x", }, }, }, { category: "product_version", name: "httpd-0:2.0.46-68.ent.s390x", product: { name: "httpd-0:2.0.46-68.ent.s390x", product_id: "httpd-0:2.0.46-68.ent.s390x", product_identification_helper: { purl: "pkg:rpm/redhat/httpd@2.0.46-68.ent?arch=s390x", }, }, }, { category: "product_version", name: "mod_ssl-1:2.0.46-68.ent.s390x", product: { name: "mod_ssl-1:2.0.46-68.ent.s390x", product_id: "mod_ssl-1:2.0.46-68.ent.s390x", product_identification_helper: { purl: "pkg:rpm/redhat/mod_ssl@2.0.46-68.ent?arch=s390x&epoch=1", }, }, }, { category: "product_version", name: "httpd-devel-0:2.0.46-68.ent.s390x", product: { name: "httpd-devel-0:2.0.46-68.ent.s390x", product_id: "httpd-devel-0:2.0.46-68.ent.s390x", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-devel@2.0.46-68.ent?arch=s390x", }, }, }, { category: "product_version", name: "httpd-debuginfo-0:2.0.46-68.ent.s390x", product: { name: "httpd-debuginfo-0:2.0.46-68.ent.s390x", product_id: "httpd-debuginfo-0:2.0.46-68.ent.s390x", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-debuginfo@2.0.46-68.ent?arch=s390x", }, }, }, ], category: "architecture", name: "s390x", }, { branches: [ { category: "product_version", name: "httpd-manual-0:2.0.52-32.3.ent.s390", product: { name: "httpd-manual-0:2.0.52-32.3.ent.s390", product_id: "httpd-manual-0:2.0.52-32.3.ent.s390", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-manual@2.0.52-32.3.ent?arch=s390", }, }, }, { category: "product_version", name: "mod_ssl-1:2.0.52-32.3.ent.s390", product: { name: "mod_ssl-1:2.0.52-32.3.ent.s390", product_id: "mod_ssl-1:2.0.52-32.3.ent.s390", product_identification_helper: { purl: "pkg:rpm/redhat/mod_ssl@2.0.52-32.3.ent?arch=s390&epoch=1", }, }, }, { category: "product_version", name: "httpd-suexec-0:2.0.52-32.3.ent.s390", product: { name: "httpd-suexec-0:2.0.52-32.3.ent.s390", product_id: "httpd-suexec-0:2.0.52-32.3.ent.s390", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-suexec@2.0.52-32.3.ent?arch=s390", }, }, }, { category: "product_version", name: "httpd-debuginfo-0:2.0.52-32.3.ent.s390", product: { name: "httpd-debuginfo-0:2.0.52-32.3.ent.s390", product_id: "httpd-debuginfo-0:2.0.52-32.3.ent.s390", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-debuginfo@2.0.52-32.3.ent?arch=s390", }, }, }, { category: "product_version", name: "httpd-devel-0:2.0.52-32.3.ent.s390", product: { name: "httpd-devel-0:2.0.52-32.3.ent.s390", product_id: "httpd-devel-0:2.0.52-32.3.ent.s390", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-devel@2.0.52-32.3.ent?arch=s390", }, }, }, { category: "product_version", name: "httpd-0:2.0.52-32.3.ent.s390", product: { name: "httpd-0:2.0.52-32.3.ent.s390", product_id: "httpd-0:2.0.52-32.3.ent.s390", product_identification_helper: { purl: "pkg:rpm/redhat/httpd@2.0.52-32.3.ent?arch=s390", }, }, }, { category: "product_version", name: "httpd-0:2.0.46-68.ent.s390", product: { name: "httpd-0:2.0.46-68.ent.s390", product_id: "httpd-0:2.0.46-68.ent.s390", product_identification_helper: { purl: "pkg:rpm/redhat/httpd@2.0.46-68.ent?arch=s390", }, }, }, { category: "product_version", name: "mod_ssl-1:2.0.46-68.ent.s390", product: { name: "mod_ssl-1:2.0.46-68.ent.s390", product_id: "mod_ssl-1:2.0.46-68.ent.s390", product_identification_helper: { purl: "pkg:rpm/redhat/mod_ssl@2.0.46-68.ent?arch=s390&epoch=1", }, }, }, { category: "product_version", name: "httpd-devel-0:2.0.46-68.ent.s390", product: { name: "httpd-devel-0:2.0.46-68.ent.s390", product_id: "httpd-devel-0:2.0.46-68.ent.s390", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-devel@2.0.46-68.ent?arch=s390", }, }, }, { category: "product_version", name: "httpd-debuginfo-0:2.0.46-68.ent.s390", product: { name: "httpd-debuginfo-0:2.0.46-68.ent.s390", product_id: "httpd-debuginfo-0:2.0.46-68.ent.s390", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-debuginfo@2.0.46-68.ent?arch=s390", }, }, }, ], category: "architecture", name: "s390", }, ], category: "vendor", name: "Red Hat", }, ], relationships: [ { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.46-68.ent.i386 as a component of Red Hat Enterprise Linux AS version 3", product_id: "3AS:httpd-0:2.0.46-68.ent.i386", }, product_reference: "httpd-0:2.0.46-68.ent.i386", relates_to_product_reference: "3AS", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.46-68.ent.ia64 as a component of Red Hat Enterprise Linux AS version 3", product_id: "3AS:httpd-0:2.0.46-68.ent.ia64", }, product_reference: "httpd-0:2.0.46-68.ent.ia64", relates_to_product_reference: "3AS", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.46-68.ent.ppc as a component of Red Hat Enterprise Linux AS version 3", product_id: "3AS:httpd-0:2.0.46-68.ent.ppc", }, product_reference: "httpd-0:2.0.46-68.ent.ppc", relates_to_product_reference: "3AS", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.46-68.ent.s390 as a component of Red Hat Enterprise Linux AS version 3", product_id: "3AS:httpd-0:2.0.46-68.ent.s390", }, product_reference: "httpd-0:2.0.46-68.ent.s390", relates_to_product_reference: "3AS", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.46-68.ent.s390x as a component of Red Hat Enterprise Linux AS version 3", product_id: "3AS:httpd-0:2.0.46-68.ent.s390x", }, product_reference: "httpd-0:2.0.46-68.ent.s390x", relates_to_product_reference: "3AS", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.46-68.ent.src as a component of Red Hat Enterprise Linux AS version 3", product_id: "3AS:httpd-0:2.0.46-68.ent.src", }, product_reference: "httpd-0:2.0.46-68.ent.src", relates_to_product_reference: "3AS", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.46-68.ent.x86_64 as a component of Red Hat Enterprise Linux AS version 3", product_id: "3AS:httpd-0:2.0.46-68.ent.x86_64", }, product_reference: "httpd-0:2.0.46-68.ent.x86_64", relates_to_product_reference: "3AS", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.46-68.ent.i386 as a component of Red Hat Enterprise Linux AS version 3", product_id: "3AS:httpd-debuginfo-0:2.0.46-68.ent.i386", }, product_reference: "httpd-debuginfo-0:2.0.46-68.ent.i386", relates_to_product_reference: "3AS", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.46-68.ent.ia64 as a component of Red Hat Enterprise Linux AS version 3", product_id: "3AS:httpd-debuginfo-0:2.0.46-68.ent.ia64", }, product_reference: "httpd-debuginfo-0:2.0.46-68.ent.ia64", relates_to_product_reference: "3AS", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.46-68.ent.ppc as a component of Red Hat Enterprise Linux AS version 3", product_id: "3AS:httpd-debuginfo-0:2.0.46-68.ent.ppc", }, product_reference: "httpd-debuginfo-0:2.0.46-68.ent.ppc", relates_to_product_reference: "3AS", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.46-68.ent.s390 as a component of Red Hat Enterprise Linux AS version 3", product_id: "3AS:httpd-debuginfo-0:2.0.46-68.ent.s390", }, product_reference: "httpd-debuginfo-0:2.0.46-68.ent.s390", relates_to_product_reference: "3AS", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.46-68.ent.s390x as a component of Red Hat Enterprise Linux AS version 3", product_id: "3AS:httpd-debuginfo-0:2.0.46-68.ent.s390x", }, product_reference: "httpd-debuginfo-0:2.0.46-68.ent.s390x", relates_to_product_reference: "3AS", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.46-68.ent.x86_64 as a component of Red Hat Enterprise Linux AS version 3", product_id: "3AS:httpd-debuginfo-0:2.0.46-68.ent.x86_64", }, product_reference: "httpd-debuginfo-0:2.0.46-68.ent.x86_64", relates_to_product_reference: "3AS", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.46-68.ent.i386 as a component of Red Hat Enterprise Linux AS version 3", product_id: "3AS:httpd-devel-0:2.0.46-68.ent.i386", }, product_reference: "httpd-devel-0:2.0.46-68.ent.i386", relates_to_product_reference: "3AS", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.46-68.ent.ia64 as a component of Red Hat Enterprise Linux AS version 3", product_id: "3AS:httpd-devel-0:2.0.46-68.ent.ia64", }, product_reference: "httpd-devel-0:2.0.46-68.ent.ia64", relates_to_product_reference: "3AS", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.46-68.ent.ppc as a component of Red Hat Enterprise Linux AS version 3", product_id: "3AS:httpd-devel-0:2.0.46-68.ent.ppc", }, product_reference: "httpd-devel-0:2.0.46-68.ent.ppc", relates_to_product_reference: "3AS", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.46-68.ent.s390 as a component of Red Hat Enterprise Linux AS version 3", product_id: "3AS:httpd-devel-0:2.0.46-68.ent.s390", }, product_reference: "httpd-devel-0:2.0.46-68.ent.s390", relates_to_product_reference: "3AS", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.46-68.ent.s390x as a component of Red Hat Enterprise Linux AS version 3", product_id: "3AS:httpd-devel-0:2.0.46-68.ent.s390x", }, product_reference: "httpd-devel-0:2.0.46-68.ent.s390x", relates_to_product_reference: "3AS", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.46-68.ent.x86_64 as a component of Red Hat Enterprise Linux AS version 3", product_id: "3AS:httpd-devel-0:2.0.46-68.ent.x86_64", }, product_reference: "httpd-devel-0:2.0.46-68.ent.x86_64", relates_to_product_reference: "3AS", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.46-68.ent.i386 as a component of Red Hat Enterprise Linux AS version 3", product_id: "3AS:mod_ssl-1:2.0.46-68.ent.i386", }, product_reference: "mod_ssl-1:2.0.46-68.ent.i386", relates_to_product_reference: "3AS", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.46-68.ent.ia64 as a component of Red Hat Enterprise Linux AS version 3", product_id: "3AS:mod_ssl-1:2.0.46-68.ent.ia64", }, product_reference: "mod_ssl-1:2.0.46-68.ent.ia64", relates_to_product_reference: "3AS", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.46-68.ent.ppc as a component of Red Hat Enterprise Linux AS version 3", product_id: "3AS:mod_ssl-1:2.0.46-68.ent.ppc", }, product_reference: "mod_ssl-1:2.0.46-68.ent.ppc", relates_to_product_reference: "3AS", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.46-68.ent.s390 as a component of Red Hat Enterprise Linux AS version 3", product_id: "3AS:mod_ssl-1:2.0.46-68.ent.s390", }, product_reference: "mod_ssl-1:2.0.46-68.ent.s390", relates_to_product_reference: "3AS", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.46-68.ent.s390x as a component of Red Hat Enterprise Linux AS version 3", product_id: "3AS:mod_ssl-1:2.0.46-68.ent.s390x", }, product_reference: "mod_ssl-1:2.0.46-68.ent.s390x", relates_to_product_reference: "3AS", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.46-68.ent.x86_64 as a component of Red Hat Enterprise Linux AS version 3", product_id: "3AS:mod_ssl-1:2.0.46-68.ent.x86_64", }, product_reference: "mod_ssl-1:2.0.46-68.ent.x86_64", relates_to_product_reference: "3AS", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.46-68.ent.i386 as a component of Red Hat Desktop version 3", product_id: "3Desktop:httpd-0:2.0.46-68.ent.i386", }, product_reference: "httpd-0:2.0.46-68.ent.i386", relates_to_product_reference: "3Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.46-68.ent.ia64 as a component of Red Hat Desktop version 3", product_id: "3Desktop:httpd-0:2.0.46-68.ent.ia64", }, product_reference: "httpd-0:2.0.46-68.ent.ia64", relates_to_product_reference: "3Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.46-68.ent.ppc as a component of Red Hat Desktop version 3", product_id: "3Desktop:httpd-0:2.0.46-68.ent.ppc", }, product_reference: "httpd-0:2.0.46-68.ent.ppc", relates_to_product_reference: "3Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.46-68.ent.s390 as a component of Red Hat Desktop version 3", product_id: "3Desktop:httpd-0:2.0.46-68.ent.s390", }, product_reference: "httpd-0:2.0.46-68.ent.s390", relates_to_product_reference: "3Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.46-68.ent.s390x as a component of Red Hat Desktop version 3", product_id: "3Desktop:httpd-0:2.0.46-68.ent.s390x", }, product_reference: "httpd-0:2.0.46-68.ent.s390x", relates_to_product_reference: "3Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.46-68.ent.src as a component of Red Hat Desktop version 3", product_id: "3Desktop:httpd-0:2.0.46-68.ent.src", }, product_reference: "httpd-0:2.0.46-68.ent.src", relates_to_product_reference: "3Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.46-68.ent.x86_64 as a component of Red Hat Desktop version 3", product_id: "3Desktop:httpd-0:2.0.46-68.ent.x86_64", }, product_reference: "httpd-0:2.0.46-68.ent.x86_64", relates_to_product_reference: "3Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.46-68.ent.i386 as a component of Red Hat Desktop version 3", product_id: "3Desktop:httpd-debuginfo-0:2.0.46-68.ent.i386", }, product_reference: "httpd-debuginfo-0:2.0.46-68.ent.i386", relates_to_product_reference: "3Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.46-68.ent.ia64 as a component of Red Hat Desktop version 3", product_id: "3Desktop:httpd-debuginfo-0:2.0.46-68.ent.ia64", }, product_reference: "httpd-debuginfo-0:2.0.46-68.ent.ia64", relates_to_product_reference: "3Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.46-68.ent.ppc as a component of Red Hat Desktop version 3", product_id: "3Desktop:httpd-debuginfo-0:2.0.46-68.ent.ppc", }, product_reference: "httpd-debuginfo-0:2.0.46-68.ent.ppc", relates_to_product_reference: "3Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.46-68.ent.s390 as a component of Red Hat Desktop version 3", product_id: "3Desktop:httpd-debuginfo-0:2.0.46-68.ent.s390", }, product_reference: "httpd-debuginfo-0:2.0.46-68.ent.s390", relates_to_product_reference: "3Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.46-68.ent.s390x as a component of Red Hat Desktop version 3", product_id: "3Desktop:httpd-debuginfo-0:2.0.46-68.ent.s390x", }, product_reference: "httpd-debuginfo-0:2.0.46-68.ent.s390x", relates_to_product_reference: "3Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.46-68.ent.x86_64 as a component of Red Hat Desktop version 3", product_id: "3Desktop:httpd-debuginfo-0:2.0.46-68.ent.x86_64", }, product_reference: "httpd-debuginfo-0:2.0.46-68.ent.x86_64", relates_to_product_reference: "3Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.46-68.ent.i386 as a component of Red Hat Desktop version 3", product_id: "3Desktop:httpd-devel-0:2.0.46-68.ent.i386", }, product_reference: "httpd-devel-0:2.0.46-68.ent.i386", relates_to_product_reference: "3Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.46-68.ent.ia64 as a component of Red Hat Desktop version 3", product_id: "3Desktop:httpd-devel-0:2.0.46-68.ent.ia64", }, product_reference: "httpd-devel-0:2.0.46-68.ent.ia64", relates_to_product_reference: "3Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.46-68.ent.ppc as a component of Red Hat Desktop version 3", product_id: "3Desktop:httpd-devel-0:2.0.46-68.ent.ppc", }, product_reference: "httpd-devel-0:2.0.46-68.ent.ppc", relates_to_product_reference: "3Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.46-68.ent.s390 as a component of Red Hat Desktop version 3", product_id: "3Desktop:httpd-devel-0:2.0.46-68.ent.s390", }, product_reference: "httpd-devel-0:2.0.46-68.ent.s390", relates_to_product_reference: "3Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.46-68.ent.s390x as a component of Red Hat Desktop version 3", product_id: "3Desktop:httpd-devel-0:2.0.46-68.ent.s390x", }, product_reference: "httpd-devel-0:2.0.46-68.ent.s390x", relates_to_product_reference: "3Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.46-68.ent.x86_64 as a component of Red Hat Desktop version 3", product_id: "3Desktop:httpd-devel-0:2.0.46-68.ent.x86_64", }, product_reference: "httpd-devel-0:2.0.46-68.ent.x86_64", relates_to_product_reference: "3Desktop", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.46-68.ent.i386 as a component of Red Hat Desktop version 3", product_id: "3Desktop:mod_ssl-1:2.0.46-68.ent.i386", }, product_reference: "mod_ssl-1:2.0.46-68.ent.i386", relates_to_product_reference: "3Desktop", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.46-68.ent.ia64 as a component of Red Hat Desktop version 3", product_id: "3Desktop:mod_ssl-1:2.0.46-68.ent.ia64", }, product_reference: "mod_ssl-1:2.0.46-68.ent.ia64", relates_to_product_reference: "3Desktop", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.46-68.ent.ppc as a component of Red Hat Desktop version 3", product_id: "3Desktop:mod_ssl-1:2.0.46-68.ent.ppc", }, product_reference: "mod_ssl-1:2.0.46-68.ent.ppc", relates_to_product_reference: "3Desktop", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.46-68.ent.s390 as a component of Red Hat Desktop version 3", product_id: "3Desktop:mod_ssl-1:2.0.46-68.ent.s390", }, product_reference: "mod_ssl-1:2.0.46-68.ent.s390", relates_to_product_reference: "3Desktop", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.46-68.ent.s390x as a component of Red Hat Desktop version 3", product_id: "3Desktop:mod_ssl-1:2.0.46-68.ent.s390x", }, product_reference: "mod_ssl-1:2.0.46-68.ent.s390x", relates_to_product_reference: "3Desktop", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.46-68.ent.x86_64 as a component of Red Hat Desktop version 3", product_id: "3Desktop:mod_ssl-1:2.0.46-68.ent.x86_64", }, product_reference: "mod_ssl-1:2.0.46-68.ent.x86_64", relates_to_product_reference: "3Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.46-68.ent.i386 as a component of Red Hat Enterprise Linux ES version 3", product_id: "3ES:httpd-0:2.0.46-68.ent.i386", }, product_reference: "httpd-0:2.0.46-68.ent.i386", relates_to_product_reference: "3ES", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.46-68.ent.ia64 as a component of Red Hat Enterprise Linux ES version 3", product_id: "3ES:httpd-0:2.0.46-68.ent.ia64", }, product_reference: "httpd-0:2.0.46-68.ent.ia64", relates_to_product_reference: "3ES", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.46-68.ent.ppc as a component of Red Hat Enterprise Linux ES version 3", product_id: "3ES:httpd-0:2.0.46-68.ent.ppc", }, product_reference: "httpd-0:2.0.46-68.ent.ppc", relates_to_product_reference: "3ES", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.46-68.ent.s390 as a component of Red Hat Enterprise Linux ES version 3", product_id: "3ES:httpd-0:2.0.46-68.ent.s390", }, product_reference: "httpd-0:2.0.46-68.ent.s390", relates_to_product_reference: "3ES", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.46-68.ent.s390x as a component of Red Hat Enterprise Linux ES version 3", product_id: "3ES:httpd-0:2.0.46-68.ent.s390x", }, product_reference: "httpd-0:2.0.46-68.ent.s390x", relates_to_product_reference: "3ES", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.46-68.ent.src as a component of Red Hat Enterprise Linux ES version 3", product_id: "3ES:httpd-0:2.0.46-68.ent.src", }, product_reference: "httpd-0:2.0.46-68.ent.src", relates_to_product_reference: "3ES", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.46-68.ent.x86_64 as a component of Red Hat Enterprise Linux ES version 3", product_id: "3ES:httpd-0:2.0.46-68.ent.x86_64", }, product_reference: "httpd-0:2.0.46-68.ent.x86_64", relates_to_product_reference: "3ES", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.46-68.ent.i386 as a component of Red Hat Enterprise Linux ES version 3", product_id: "3ES:httpd-debuginfo-0:2.0.46-68.ent.i386", }, product_reference: "httpd-debuginfo-0:2.0.46-68.ent.i386", relates_to_product_reference: "3ES", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.46-68.ent.ia64 as a component of Red Hat Enterprise Linux ES version 3", product_id: "3ES:httpd-debuginfo-0:2.0.46-68.ent.ia64", }, product_reference: "httpd-debuginfo-0:2.0.46-68.ent.ia64", relates_to_product_reference: "3ES", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.46-68.ent.ppc as a component of Red Hat Enterprise Linux ES version 3", product_id: "3ES:httpd-debuginfo-0:2.0.46-68.ent.ppc", }, product_reference: "httpd-debuginfo-0:2.0.46-68.ent.ppc", relates_to_product_reference: "3ES", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.46-68.ent.s390 as a component of Red Hat Enterprise Linux ES version 3", product_id: "3ES:httpd-debuginfo-0:2.0.46-68.ent.s390", }, product_reference: "httpd-debuginfo-0:2.0.46-68.ent.s390", relates_to_product_reference: "3ES", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.46-68.ent.s390x as a component of Red Hat Enterprise Linux ES version 3", product_id: "3ES:httpd-debuginfo-0:2.0.46-68.ent.s390x", }, product_reference: "httpd-debuginfo-0:2.0.46-68.ent.s390x", relates_to_product_reference: "3ES", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.46-68.ent.x86_64 as a component of Red Hat Enterprise Linux ES version 3", product_id: "3ES:httpd-debuginfo-0:2.0.46-68.ent.x86_64", }, product_reference: "httpd-debuginfo-0:2.0.46-68.ent.x86_64", relates_to_product_reference: "3ES", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.46-68.ent.i386 as a component of Red Hat Enterprise Linux ES version 3", product_id: "3ES:httpd-devel-0:2.0.46-68.ent.i386", }, product_reference: "httpd-devel-0:2.0.46-68.ent.i386", relates_to_product_reference: "3ES", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.46-68.ent.ia64 as a component of Red Hat Enterprise Linux ES version 3", product_id: "3ES:httpd-devel-0:2.0.46-68.ent.ia64", }, product_reference: "httpd-devel-0:2.0.46-68.ent.ia64", relates_to_product_reference: "3ES", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.46-68.ent.ppc as a component of Red Hat Enterprise Linux ES version 3", product_id: "3ES:httpd-devel-0:2.0.46-68.ent.ppc", }, product_reference: "httpd-devel-0:2.0.46-68.ent.ppc", relates_to_product_reference: "3ES", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.46-68.ent.s390 as a component of Red Hat Enterprise Linux ES version 3", product_id: "3ES:httpd-devel-0:2.0.46-68.ent.s390", }, product_reference: "httpd-devel-0:2.0.46-68.ent.s390", relates_to_product_reference: "3ES", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.46-68.ent.s390x as a component of Red Hat Enterprise Linux ES version 3", product_id: "3ES:httpd-devel-0:2.0.46-68.ent.s390x", }, product_reference: "httpd-devel-0:2.0.46-68.ent.s390x", relates_to_product_reference: "3ES", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.46-68.ent.x86_64 as a component of Red Hat Enterprise Linux ES version 3", product_id: "3ES:httpd-devel-0:2.0.46-68.ent.x86_64", }, product_reference: "httpd-devel-0:2.0.46-68.ent.x86_64", relates_to_product_reference: "3ES", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.46-68.ent.i386 as a component of Red Hat Enterprise Linux ES version 3", product_id: "3ES:mod_ssl-1:2.0.46-68.ent.i386", }, product_reference: "mod_ssl-1:2.0.46-68.ent.i386", relates_to_product_reference: "3ES", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.46-68.ent.ia64 as a component of Red Hat Enterprise Linux ES version 3", product_id: "3ES:mod_ssl-1:2.0.46-68.ent.ia64", }, product_reference: "mod_ssl-1:2.0.46-68.ent.ia64", relates_to_product_reference: "3ES", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.46-68.ent.ppc as a component of Red Hat Enterprise Linux ES version 3", product_id: "3ES:mod_ssl-1:2.0.46-68.ent.ppc", }, product_reference: "mod_ssl-1:2.0.46-68.ent.ppc", relates_to_product_reference: "3ES", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.46-68.ent.s390 as a component of Red Hat Enterprise Linux ES version 3", product_id: "3ES:mod_ssl-1:2.0.46-68.ent.s390", }, product_reference: "mod_ssl-1:2.0.46-68.ent.s390", relates_to_product_reference: "3ES", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.46-68.ent.s390x as a component of Red Hat Enterprise Linux ES version 3", product_id: "3ES:mod_ssl-1:2.0.46-68.ent.s390x", }, product_reference: "mod_ssl-1:2.0.46-68.ent.s390x", relates_to_product_reference: "3ES", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.46-68.ent.x86_64 as a component of Red Hat Enterprise Linux ES version 3", product_id: "3ES:mod_ssl-1:2.0.46-68.ent.x86_64", }, product_reference: "mod_ssl-1:2.0.46-68.ent.x86_64", relates_to_product_reference: "3ES", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.46-68.ent.i386 as a component of Red Hat Enterprise Linux WS version 3", product_id: "3WS:httpd-0:2.0.46-68.ent.i386", }, product_reference: "httpd-0:2.0.46-68.ent.i386", relates_to_product_reference: "3WS", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.46-68.ent.ia64 as a component of Red Hat Enterprise Linux WS version 3", product_id: "3WS:httpd-0:2.0.46-68.ent.ia64", }, product_reference: "httpd-0:2.0.46-68.ent.ia64", relates_to_product_reference: "3WS", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.46-68.ent.ppc as a component of Red Hat Enterprise Linux WS version 3", product_id: "3WS:httpd-0:2.0.46-68.ent.ppc", }, product_reference: "httpd-0:2.0.46-68.ent.ppc", relates_to_product_reference: "3WS", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.46-68.ent.s390 as a component of Red Hat Enterprise Linux WS version 3", product_id: "3WS:httpd-0:2.0.46-68.ent.s390", }, product_reference: "httpd-0:2.0.46-68.ent.s390", relates_to_product_reference: "3WS", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.46-68.ent.s390x as a component of Red Hat Enterprise Linux WS version 3", product_id: "3WS:httpd-0:2.0.46-68.ent.s390x", }, product_reference: "httpd-0:2.0.46-68.ent.s390x", relates_to_product_reference: "3WS", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.46-68.ent.src as a component of Red Hat Enterprise Linux WS version 3", product_id: "3WS:httpd-0:2.0.46-68.ent.src", }, product_reference: "httpd-0:2.0.46-68.ent.src", relates_to_product_reference: "3WS", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.46-68.ent.x86_64 as a component of Red Hat Enterprise Linux WS version 3", product_id: "3WS:httpd-0:2.0.46-68.ent.x86_64", }, product_reference: "httpd-0:2.0.46-68.ent.x86_64", relates_to_product_reference: "3WS", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.46-68.ent.i386 as a component of Red Hat Enterprise Linux WS version 3", product_id: "3WS:httpd-debuginfo-0:2.0.46-68.ent.i386", }, product_reference: "httpd-debuginfo-0:2.0.46-68.ent.i386", relates_to_product_reference: "3WS", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.46-68.ent.ia64 as a component of Red Hat Enterprise Linux WS version 3", product_id: "3WS:httpd-debuginfo-0:2.0.46-68.ent.ia64", }, product_reference: "httpd-debuginfo-0:2.0.46-68.ent.ia64", relates_to_product_reference: "3WS", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.46-68.ent.ppc as a component of Red Hat Enterprise Linux WS version 3", product_id: "3WS:httpd-debuginfo-0:2.0.46-68.ent.ppc", }, product_reference: "httpd-debuginfo-0:2.0.46-68.ent.ppc", relates_to_product_reference: "3WS", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.46-68.ent.s390 as a component of Red Hat Enterprise Linux WS version 3", product_id: "3WS:httpd-debuginfo-0:2.0.46-68.ent.s390", }, product_reference: "httpd-debuginfo-0:2.0.46-68.ent.s390", relates_to_product_reference: "3WS", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.46-68.ent.s390x as a component of Red Hat Enterprise Linux WS version 3", product_id: "3WS:httpd-debuginfo-0:2.0.46-68.ent.s390x", }, product_reference: "httpd-debuginfo-0:2.0.46-68.ent.s390x", relates_to_product_reference: "3WS", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.46-68.ent.x86_64 as a component of Red Hat Enterprise Linux WS version 3", product_id: "3WS:httpd-debuginfo-0:2.0.46-68.ent.x86_64", }, product_reference: "httpd-debuginfo-0:2.0.46-68.ent.x86_64", relates_to_product_reference: "3WS", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.46-68.ent.i386 as a component of Red Hat Enterprise Linux WS version 3", product_id: "3WS:httpd-devel-0:2.0.46-68.ent.i386", }, product_reference: "httpd-devel-0:2.0.46-68.ent.i386", relates_to_product_reference: "3WS", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.46-68.ent.ia64 as a component of Red Hat Enterprise Linux WS version 3", product_id: "3WS:httpd-devel-0:2.0.46-68.ent.ia64", }, product_reference: "httpd-devel-0:2.0.46-68.ent.ia64", relates_to_product_reference: "3WS", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.46-68.ent.ppc as a component of Red Hat Enterprise Linux WS version 3", product_id: "3WS:httpd-devel-0:2.0.46-68.ent.ppc", }, product_reference: "httpd-devel-0:2.0.46-68.ent.ppc", relates_to_product_reference: "3WS", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.46-68.ent.s390 as a component of Red Hat Enterprise Linux WS version 3", product_id: "3WS:httpd-devel-0:2.0.46-68.ent.s390", }, product_reference: "httpd-devel-0:2.0.46-68.ent.s390", relates_to_product_reference: "3WS", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.46-68.ent.s390x as a component of Red Hat Enterprise Linux WS version 3", product_id: "3WS:httpd-devel-0:2.0.46-68.ent.s390x", }, product_reference: "httpd-devel-0:2.0.46-68.ent.s390x", relates_to_product_reference: "3WS", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.46-68.ent.x86_64 as a component of Red Hat Enterprise Linux WS version 3", product_id: "3WS:httpd-devel-0:2.0.46-68.ent.x86_64", }, product_reference: "httpd-devel-0:2.0.46-68.ent.x86_64", relates_to_product_reference: "3WS", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.46-68.ent.i386 as a component of Red Hat Enterprise Linux WS version 3", product_id: "3WS:mod_ssl-1:2.0.46-68.ent.i386", }, product_reference: "mod_ssl-1:2.0.46-68.ent.i386", relates_to_product_reference: "3WS", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.46-68.ent.ia64 as a component of Red Hat Enterprise Linux WS version 3", product_id: "3WS:mod_ssl-1:2.0.46-68.ent.ia64", }, product_reference: "mod_ssl-1:2.0.46-68.ent.ia64", relates_to_product_reference: "3WS", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.46-68.ent.ppc as a component of Red Hat Enterprise Linux WS version 3", product_id: "3WS:mod_ssl-1:2.0.46-68.ent.ppc", }, product_reference: "mod_ssl-1:2.0.46-68.ent.ppc", relates_to_product_reference: "3WS", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.46-68.ent.s390 as a component of Red Hat Enterprise Linux WS version 3", product_id: "3WS:mod_ssl-1:2.0.46-68.ent.s390", }, product_reference: "mod_ssl-1:2.0.46-68.ent.s390", relates_to_product_reference: "3WS", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.46-68.ent.s390x as a component of Red Hat Enterprise Linux WS version 3", product_id: "3WS:mod_ssl-1:2.0.46-68.ent.s390x", }, product_reference: "mod_ssl-1:2.0.46-68.ent.s390x", relates_to_product_reference: "3WS", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.46-68.ent.x86_64 as a component of Red Hat Enterprise Linux WS version 3", product_id: "3WS:mod_ssl-1:2.0.46-68.ent.x86_64", }, product_reference: "mod_ssl-1:2.0.46-68.ent.x86_64", relates_to_product_reference: "3WS", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.52-32.3.ent.i386 as a component of Red Hat Enterprise Linux AS version 4", product_id: "4AS:httpd-0:2.0.52-32.3.ent.i386", }, product_reference: "httpd-0:2.0.52-32.3.ent.i386", relates_to_product_reference: "4AS", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.52-32.3.ent.ia64 as a component of Red Hat Enterprise Linux AS version 4", product_id: "4AS:httpd-0:2.0.52-32.3.ent.ia64", }, product_reference: "httpd-0:2.0.52-32.3.ent.ia64", relates_to_product_reference: "4AS", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.52-32.3.ent.ppc as a component of Red Hat Enterprise Linux AS version 4", product_id: "4AS:httpd-0:2.0.52-32.3.ent.ppc", }, product_reference: "httpd-0:2.0.52-32.3.ent.ppc", relates_to_product_reference: "4AS", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.52-32.3.ent.s390 as a component of Red Hat Enterprise Linux AS version 4", product_id: "4AS:httpd-0:2.0.52-32.3.ent.s390", }, product_reference: "httpd-0:2.0.52-32.3.ent.s390", relates_to_product_reference: "4AS", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.52-32.3.ent.s390x as a component of Red Hat Enterprise Linux AS version 4", product_id: "4AS:httpd-0:2.0.52-32.3.ent.s390x", }, product_reference: "httpd-0:2.0.52-32.3.ent.s390x", relates_to_product_reference: "4AS", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.52-32.3.ent.src as a component of Red Hat Enterprise Linux AS version 4", product_id: "4AS:httpd-0:2.0.52-32.3.ent.src", }, product_reference: "httpd-0:2.0.52-32.3.ent.src", relates_to_product_reference: "4AS", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.52-32.3.ent.x86_64 as a component of Red Hat Enterprise Linux AS version 4", product_id: "4AS:httpd-0:2.0.52-32.3.ent.x86_64", }, product_reference: "httpd-0:2.0.52-32.3.ent.x86_64", relates_to_product_reference: "4AS", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.52-32.3.ent.i386 as a component of Red Hat Enterprise Linux AS version 4", product_id: "4AS:httpd-debuginfo-0:2.0.52-32.3.ent.i386", }, product_reference: "httpd-debuginfo-0:2.0.52-32.3.ent.i386", relates_to_product_reference: "4AS", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.52-32.3.ent.ia64 as a component of Red Hat Enterprise Linux AS version 4", product_id: "4AS:httpd-debuginfo-0:2.0.52-32.3.ent.ia64", }, product_reference: "httpd-debuginfo-0:2.0.52-32.3.ent.ia64", relates_to_product_reference: "4AS", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.52-32.3.ent.ppc as a component of Red Hat Enterprise Linux AS version 4", product_id: "4AS:httpd-debuginfo-0:2.0.52-32.3.ent.ppc", }, product_reference: "httpd-debuginfo-0:2.0.52-32.3.ent.ppc", relates_to_product_reference: "4AS", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.52-32.3.ent.s390 as a component of Red Hat Enterprise Linux AS version 4", product_id: "4AS:httpd-debuginfo-0:2.0.52-32.3.ent.s390", }, product_reference: "httpd-debuginfo-0:2.0.52-32.3.ent.s390", relates_to_product_reference: "4AS", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.52-32.3.ent.s390x as a component of Red Hat Enterprise Linux AS version 4", product_id: "4AS:httpd-debuginfo-0:2.0.52-32.3.ent.s390x", }, product_reference: "httpd-debuginfo-0:2.0.52-32.3.ent.s390x", relates_to_product_reference: "4AS", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.52-32.3.ent.x86_64 as a component of Red Hat Enterprise Linux AS version 4", product_id: "4AS:httpd-debuginfo-0:2.0.52-32.3.ent.x86_64", }, product_reference: "httpd-debuginfo-0:2.0.52-32.3.ent.x86_64", relates_to_product_reference: "4AS", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.52-32.3.ent.i386 as a component of Red Hat Enterprise Linux AS version 4", product_id: "4AS:httpd-devel-0:2.0.52-32.3.ent.i386", }, product_reference: "httpd-devel-0:2.0.52-32.3.ent.i386", relates_to_product_reference: "4AS", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.52-32.3.ent.ia64 as a component of Red Hat Enterprise Linux AS version 4", product_id: "4AS:httpd-devel-0:2.0.52-32.3.ent.ia64", }, product_reference: "httpd-devel-0:2.0.52-32.3.ent.ia64", relates_to_product_reference: "4AS", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.52-32.3.ent.ppc as a component of Red Hat Enterprise Linux AS version 4", product_id: "4AS:httpd-devel-0:2.0.52-32.3.ent.ppc", }, product_reference: "httpd-devel-0:2.0.52-32.3.ent.ppc", relates_to_product_reference: "4AS", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.52-32.3.ent.s390 as a component of Red Hat Enterprise Linux AS version 4", product_id: "4AS:httpd-devel-0:2.0.52-32.3.ent.s390", }, product_reference: "httpd-devel-0:2.0.52-32.3.ent.s390", relates_to_product_reference: "4AS", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.52-32.3.ent.s390x as a component of Red Hat Enterprise Linux AS version 4", product_id: "4AS:httpd-devel-0:2.0.52-32.3.ent.s390x", }, product_reference: "httpd-devel-0:2.0.52-32.3.ent.s390x", relates_to_product_reference: "4AS", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.52-32.3.ent.x86_64 as a component of Red Hat Enterprise Linux AS version 4", product_id: "4AS:httpd-devel-0:2.0.52-32.3.ent.x86_64", }, product_reference: "httpd-devel-0:2.0.52-32.3.ent.x86_64", relates_to_product_reference: "4AS", }, { category: "default_component_of", full_product_name: { name: "httpd-manual-0:2.0.52-32.3.ent.i386 as a component of Red Hat Enterprise Linux AS version 4", product_id: "4AS:httpd-manual-0:2.0.52-32.3.ent.i386", }, product_reference: "httpd-manual-0:2.0.52-32.3.ent.i386", relates_to_product_reference: "4AS", }, { category: "default_component_of", full_product_name: { name: "httpd-manual-0:2.0.52-32.3.ent.ia64 as a component of Red Hat Enterprise Linux AS version 4", product_id: "4AS:httpd-manual-0:2.0.52-32.3.ent.ia64", }, product_reference: "httpd-manual-0:2.0.52-32.3.ent.ia64", relates_to_product_reference: "4AS", }, { category: "default_component_of", full_product_name: { name: "httpd-manual-0:2.0.52-32.3.ent.ppc as a component of Red Hat Enterprise Linux AS version 4", product_id: "4AS:httpd-manual-0:2.0.52-32.3.ent.ppc", }, product_reference: "httpd-manual-0:2.0.52-32.3.ent.ppc", relates_to_product_reference: "4AS", }, { category: "default_component_of", full_product_name: { name: "httpd-manual-0:2.0.52-32.3.ent.s390 as a component of Red Hat Enterprise Linux AS version 4", product_id: "4AS:httpd-manual-0:2.0.52-32.3.ent.s390", }, product_reference: "httpd-manual-0:2.0.52-32.3.ent.s390", relates_to_product_reference: "4AS", }, { category: "default_component_of", full_product_name: { name: "httpd-manual-0:2.0.52-32.3.ent.s390x as a component of Red Hat Enterprise Linux AS version 4", product_id: "4AS:httpd-manual-0:2.0.52-32.3.ent.s390x", }, product_reference: "httpd-manual-0:2.0.52-32.3.ent.s390x", relates_to_product_reference: "4AS", }, { category: "default_component_of", full_product_name: { name: "httpd-manual-0:2.0.52-32.3.ent.x86_64 as a component of Red Hat Enterprise Linux AS version 4", product_id: "4AS:httpd-manual-0:2.0.52-32.3.ent.x86_64", }, product_reference: "httpd-manual-0:2.0.52-32.3.ent.x86_64", relates_to_product_reference: "4AS", }, { category: "default_component_of", full_product_name: { name: "httpd-suexec-0:2.0.52-32.3.ent.i386 as a component of Red Hat Enterprise Linux AS version 4", product_id: "4AS:httpd-suexec-0:2.0.52-32.3.ent.i386", }, product_reference: "httpd-suexec-0:2.0.52-32.3.ent.i386", relates_to_product_reference: "4AS", }, { category: "default_component_of", full_product_name: { name: "httpd-suexec-0:2.0.52-32.3.ent.ia64 as a component of Red Hat Enterprise Linux AS version 4", product_id: "4AS:httpd-suexec-0:2.0.52-32.3.ent.ia64", }, product_reference: "httpd-suexec-0:2.0.52-32.3.ent.ia64", relates_to_product_reference: "4AS", }, { category: "default_component_of", full_product_name: { name: "httpd-suexec-0:2.0.52-32.3.ent.ppc as a component of Red Hat Enterprise Linux AS version 4", product_id: "4AS:httpd-suexec-0:2.0.52-32.3.ent.ppc", }, product_reference: "httpd-suexec-0:2.0.52-32.3.ent.ppc", relates_to_product_reference: "4AS", }, { category: "default_component_of", full_product_name: { name: "httpd-suexec-0:2.0.52-32.3.ent.s390 as a component of Red Hat Enterprise Linux AS version 4", product_id: "4AS:httpd-suexec-0:2.0.52-32.3.ent.s390", }, product_reference: "httpd-suexec-0:2.0.52-32.3.ent.s390", relates_to_product_reference: "4AS", }, { category: "default_component_of", full_product_name: { name: "httpd-suexec-0:2.0.52-32.3.ent.s390x as a component of Red Hat Enterprise Linux AS version 4", product_id: "4AS:httpd-suexec-0:2.0.52-32.3.ent.s390x", }, product_reference: "httpd-suexec-0:2.0.52-32.3.ent.s390x", relates_to_product_reference: "4AS", }, { category: "default_component_of", full_product_name: { name: "httpd-suexec-0:2.0.52-32.3.ent.x86_64 as a component of Red Hat Enterprise Linux AS version 4", product_id: "4AS:httpd-suexec-0:2.0.52-32.3.ent.x86_64", }, product_reference: "httpd-suexec-0:2.0.52-32.3.ent.x86_64", relates_to_product_reference: "4AS", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.52-32.3.ent.i386 as a component of Red Hat Enterprise Linux AS version 4", product_id: "4AS:mod_ssl-1:2.0.52-32.3.ent.i386", }, product_reference: "mod_ssl-1:2.0.52-32.3.ent.i386", relates_to_product_reference: "4AS", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.52-32.3.ent.ia64 as a component of Red Hat Enterprise Linux AS version 4", product_id: "4AS:mod_ssl-1:2.0.52-32.3.ent.ia64", }, product_reference: "mod_ssl-1:2.0.52-32.3.ent.ia64", relates_to_product_reference: "4AS", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.52-32.3.ent.ppc as a component of Red Hat Enterprise Linux AS version 4", product_id: "4AS:mod_ssl-1:2.0.52-32.3.ent.ppc", }, product_reference: "mod_ssl-1:2.0.52-32.3.ent.ppc", relates_to_product_reference: "4AS", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.52-32.3.ent.s390 as a component of Red Hat Enterprise Linux AS version 4", product_id: "4AS:mod_ssl-1:2.0.52-32.3.ent.s390", }, product_reference: "mod_ssl-1:2.0.52-32.3.ent.s390", relates_to_product_reference: "4AS", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.52-32.3.ent.s390x as a component of Red Hat Enterprise Linux AS version 4", product_id: "4AS:mod_ssl-1:2.0.52-32.3.ent.s390x", }, product_reference: "mod_ssl-1:2.0.52-32.3.ent.s390x", relates_to_product_reference: "4AS", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.52-32.3.ent.x86_64 as a component of Red Hat Enterprise Linux AS version 4", product_id: "4AS:mod_ssl-1:2.0.52-32.3.ent.x86_64", }, product_reference: "mod_ssl-1:2.0.52-32.3.ent.x86_64", relates_to_product_reference: "4AS", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.52-32.3.ent.i386 as a component of Red Hat Enterprise Linux Desktop version 4", product_id: "4Desktop:httpd-0:2.0.52-32.3.ent.i386", }, product_reference: "httpd-0:2.0.52-32.3.ent.i386", relates_to_product_reference: "4Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.52-32.3.ent.ia64 as a component of Red Hat Enterprise Linux Desktop version 4", product_id: "4Desktop:httpd-0:2.0.52-32.3.ent.ia64", }, product_reference: "httpd-0:2.0.52-32.3.ent.ia64", relates_to_product_reference: "4Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.52-32.3.ent.ppc as a component of Red Hat Enterprise Linux Desktop version 4", product_id: "4Desktop:httpd-0:2.0.52-32.3.ent.ppc", }, product_reference: "httpd-0:2.0.52-32.3.ent.ppc", relates_to_product_reference: "4Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.52-32.3.ent.s390 as a component of Red Hat Enterprise Linux Desktop version 4", product_id: "4Desktop:httpd-0:2.0.52-32.3.ent.s390", }, product_reference: "httpd-0:2.0.52-32.3.ent.s390", relates_to_product_reference: "4Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.52-32.3.ent.s390x as a component of Red Hat Enterprise Linux Desktop version 4", product_id: "4Desktop:httpd-0:2.0.52-32.3.ent.s390x", }, product_reference: "httpd-0:2.0.52-32.3.ent.s390x", relates_to_product_reference: "4Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.52-32.3.ent.src as a component of Red Hat Enterprise Linux Desktop version 4", product_id: "4Desktop:httpd-0:2.0.52-32.3.ent.src", }, product_reference: "httpd-0:2.0.52-32.3.ent.src", relates_to_product_reference: "4Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.52-32.3.ent.x86_64 as a component of Red Hat Enterprise Linux Desktop version 4", product_id: "4Desktop:httpd-0:2.0.52-32.3.ent.x86_64", }, product_reference: "httpd-0:2.0.52-32.3.ent.x86_64", relates_to_product_reference: "4Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.52-32.3.ent.i386 as a component of Red Hat Enterprise Linux Desktop version 4", product_id: "4Desktop:httpd-debuginfo-0:2.0.52-32.3.ent.i386", }, product_reference: "httpd-debuginfo-0:2.0.52-32.3.ent.i386", relates_to_product_reference: "4Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.52-32.3.ent.ia64 as a component of Red Hat Enterprise Linux Desktop version 4", product_id: "4Desktop:httpd-debuginfo-0:2.0.52-32.3.ent.ia64", }, product_reference: "httpd-debuginfo-0:2.0.52-32.3.ent.ia64", relates_to_product_reference: "4Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.52-32.3.ent.ppc as a component of Red Hat Enterprise Linux Desktop version 4", product_id: "4Desktop:httpd-debuginfo-0:2.0.52-32.3.ent.ppc", }, product_reference: "httpd-debuginfo-0:2.0.52-32.3.ent.ppc", relates_to_product_reference: "4Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.52-32.3.ent.s390 as a component of Red Hat Enterprise Linux Desktop version 4", product_id: "4Desktop:httpd-debuginfo-0:2.0.52-32.3.ent.s390", }, product_reference: "httpd-debuginfo-0:2.0.52-32.3.ent.s390", relates_to_product_reference: "4Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.52-32.3.ent.s390x as a component of Red Hat Enterprise Linux Desktop version 4", product_id: "4Desktop:httpd-debuginfo-0:2.0.52-32.3.ent.s390x", }, product_reference: "httpd-debuginfo-0:2.0.52-32.3.ent.s390x", relates_to_product_reference: "4Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.52-32.3.ent.x86_64 as a component of Red Hat Enterprise Linux Desktop version 4", product_id: "4Desktop:httpd-debuginfo-0:2.0.52-32.3.ent.x86_64", }, product_reference: "httpd-debuginfo-0:2.0.52-32.3.ent.x86_64", relates_to_product_reference: "4Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.52-32.3.ent.i386 as a component of Red Hat Enterprise Linux Desktop version 4", product_id: "4Desktop:httpd-devel-0:2.0.52-32.3.ent.i386", }, product_reference: "httpd-devel-0:2.0.52-32.3.ent.i386", relates_to_product_reference: "4Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.52-32.3.ent.ia64 as a component of Red Hat Enterprise Linux Desktop version 4", product_id: "4Desktop:httpd-devel-0:2.0.52-32.3.ent.ia64", }, product_reference: "httpd-devel-0:2.0.52-32.3.ent.ia64", relates_to_product_reference: "4Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.52-32.3.ent.ppc as a component of Red Hat Enterprise Linux Desktop version 4", product_id: "4Desktop:httpd-devel-0:2.0.52-32.3.ent.ppc", }, product_reference: "httpd-devel-0:2.0.52-32.3.ent.ppc", relates_to_product_reference: "4Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.52-32.3.ent.s390 as a component of Red Hat Enterprise Linux Desktop version 4", product_id: "4Desktop:httpd-devel-0:2.0.52-32.3.ent.s390", }, product_reference: "httpd-devel-0:2.0.52-32.3.ent.s390", relates_to_product_reference: "4Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.52-32.3.ent.s390x as a component of Red Hat Enterprise Linux Desktop version 4", product_id: "4Desktop:httpd-devel-0:2.0.52-32.3.ent.s390x", }, product_reference: "httpd-devel-0:2.0.52-32.3.ent.s390x", relates_to_product_reference: "4Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.52-32.3.ent.x86_64 as a component of Red Hat Enterprise Linux Desktop version 4", product_id: "4Desktop:httpd-devel-0:2.0.52-32.3.ent.x86_64", }, product_reference: "httpd-devel-0:2.0.52-32.3.ent.x86_64", relates_to_product_reference: "4Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-manual-0:2.0.52-32.3.ent.i386 as a component of Red Hat Enterprise Linux Desktop version 4", product_id: "4Desktop:httpd-manual-0:2.0.52-32.3.ent.i386", }, product_reference: "httpd-manual-0:2.0.52-32.3.ent.i386", relates_to_product_reference: "4Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-manual-0:2.0.52-32.3.ent.ia64 as a component of Red Hat Enterprise Linux Desktop version 4", product_id: "4Desktop:httpd-manual-0:2.0.52-32.3.ent.ia64", }, product_reference: "httpd-manual-0:2.0.52-32.3.ent.ia64", relates_to_product_reference: "4Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-manual-0:2.0.52-32.3.ent.ppc as a component of Red Hat Enterprise Linux Desktop version 4", product_id: "4Desktop:httpd-manual-0:2.0.52-32.3.ent.ppc", }, product_reference: "httpd-manual-0:2.0.52-32.3.ent.ppc", relates_to_product_reference: "4Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-manual-0:2.0.52-32.3.ent.s390 as a component of Red Hat Enterprise Linux Desktop version 4", product_id: "4Desktop:httpd-manual-0:2.0.52-32.3.ent.s390", }, product_reference: "httpd-manual-0:2.0.52-32.3.ent.s390", relates_to_product_reference: "4Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-manual-0:2.0.52-32.3.ent.s390x as a component of Red Hat Enterprise Linux Desktop version 4", product_id: "4Desktop:httpd-manual-0:2.0.52-32.3.ent.s390x", }, product_reference: "httpd-manual-0:2.0.52-32.3.ent.s390x", relates_to_product_reference: "4Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-manual-0:2.0.52-32.3.ent.x86_64 as a component of Red Hat Enterprise Linux Desktop version 4", product_id: "4Desktop:httpd-manual-0:2.0.52-32.3.ent.x86_64", }, product_reference: "httpd-manual-0:2.0.52-32.3.ent.x86_64", relates_to_product_reference: "4Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-suexec-0:2.0.52-32.3.ent.i386 as a component of Red Hat Enterprise Linux Desktop version 4", product_id: "4Desktop:httpd-suexec-0:2.0.52-32.3.ent.i386", }, product_reference: "httpd-suexec-0:2.0.52-32.3.ent.i386", relates_to_product_reference: "4Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-suexec-0:2.0.52-32.3.ent.ia64 as a component of Red Hat Enterprise Linux Desktop version 4", product_id: "4Desktop:httpd-suexec-0:2.0.52-32.3.ent.ia64", }, product_reference: "httpd-suexec-0:2.0.52-32.3.ent.ia64", relates_to_product_reference: "4Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-suexec-0:2.0.52-32.3.ent.ppc as a component of Red Hat Enterprise Linux Desktop version 4", product_id: "4Desktop:httpd-suexec-0:2.0.52-32.3.ent.ppc", }, product_reference: "httpd-suexec-0:2.0.52-32.3.ent.ppc", relates_to_product_reference: "4Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-suexec-0:2.0.52-32.3.ent.s390 as a component of Red Hat Enterprise Linux Desktop version 4", product_id: "4Desktop:httpd-suexec-0:2.0.52-32.3.ent.s390", }, product_reference: "httpd-suexec-0:2.0.52-32.3.ent.s390", relates_to_product_reference: "4Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-suexec-0:2.0.52-32.3.ent.s390x as a component of Red Hat Enterprise Linux Desktop version 4", product_id: "4Desktop:httpd-suexec-0:2.0.52-32.3.ent.s390x", }, product_reference: "httpd-suexec-0:2.0.52-32.3.ent.s390x", relates_to_product_reference: "4Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-suexec-0:2.0.52-32.3.ent.x86_64 as a component of Red Hat Enterprise Linux Desktop version 4", product_id: "4Desktop:httpd-suexec-0:2.0.52-32.3.ent.x86_64", }, product_reference: "httpd-suexec-0:2.0.52-32.3.ent.x86_64", relates_to_product_reference: "4Desktop", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.52-32.3.ent.i386 as a component of Red Hat Enterprise Linux Desktop version 4", product_id: "4Desktop:mod_ssl-1:2.0.52-32.3.ent.i386", }, product_reference: "mod_ssl-1:2.0.52-32.3.ent.i386", relates_to_product_reference: "4Desktop", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.52-32.3.ent.ia64 as a component of Red Hat Enterprise Linux Desktop version 4", product_id: "4Desktop:mod_ssl-1:2.0.52-32.3.ent.ia64", }, product_reference: "mod_ssl-1:2.0.52-32.3.ent.ia64", relates_to_product_reference: "4Desktop", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.52-32.3.ent.ppc as a component of Red Hat Enterprise Linux Desktop version 4", product_id: "4Desktop:mod_ssl-1:2.0.52-32.3.ent.ppc", }, product_reference: "mod_ssl-1:2.0.52-32.3.ent.ppc", relates_to_product_reference: "4Desktop", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.52-32.3.ent.s390 as a component of Red Hat Enterprise Linux Desktop version 4", product_id: "4Desktop:mod_ssl-1:2.0.52-32.3.ent.s390", }, product_reference: "mod_ssl-1:2.0.52-32.3.ent.s390", relates_to_product_reference: "4Desktop", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.52-32.3.ent.s390x as a component of Red Hat Enterprise Linux Desktop version 4", product_id: "4Desktop:mod_ssl-1:2.0.52-32.3.ent.s390x", }, product_reference: "mod_ssl-1:2.0.52-32.3.ent.s390x", relates_to_product_reference: "4Desktop", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.52-32.3.ent.x86_64 as a component of Red Hat Enterprise Linux Desktop version 4", product_id: "4Desktop:mod_ssl-1:2.0.52-32.3.ent.x86_64", }, product_reference: "mod_ssl-1:2.0.52-32.3.ent.x86_64", relates_to_product_reference: "4Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.52-32.3.ent.i386 as a component of Red Hat Enterprise Linux ES version 4", product_id: "4ES:httpd-0:2.0.52-32.3.ent.i386", }, product_reference: "httpd-0:2.0.52-32.3.ent.i386", relates_to_product_reference: "4ES", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.52-32.3.ent.ia64 as a component of Red Hat Enterprise Linux ES version 4", product_id: "4ES:httpd-0:2.0.52-32.3.ent.ia64", }, product_reference: "httpd-0:2.0.52-32.3.ent.ia64", relates_to_product_reference: "4ES", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.52-32.3.ent.ppc as a component of Red Hat Enterprise Linux ES version 4", product_id: "4ES:httpd-0:2.0.52-32.3.ent.ppc", }, product_reference: "httpd-0:2.0.52-32.3.ent.ppc", relates_to_product_reference: "4ES", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.52-32.3.ent.s390 as a component of Red Hat Enterprise Linux ES version 4", product_id: "4ES:httpd-0:2.0.52-32.3.ent.s390", }, product_reference: "httpd-0:2.0.52-32.3.ent.s390", relates_to_product_reference: "4ES", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.52-32.3.ent.s390x as a component of Red Hat Enterprise Linux ES version 4", product_id: "4ES:httpd-0:2.0.52-32.3.ent.s390x", }, product_reference: "httpd-0:2.0.52-32.3.ent.s390x", relates_to_product_reference: "4ES", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.52-32.3.ent.src as a component of Red Hat Enterprise Linux ES version 4", product_id: "4ES:httpd-0:2.0.52-32.3.ent.src", }, product_reference: "httpd-0:2.0.52-32.3.ent.src", relates_to_product_reference: "4ES", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.52-32.3.ent.x86_64 as a component of Red Hat Enterprise Linux ES version 4", product_id: "4ES:httpd-0:2.0.52-32.3.ent.x86_64", }, product_reference: "httpd-0:2.0.52-32.3.ent.x86_64", relates_to_product_reference: "4ES", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.52-32.3.ent.i386 as a component of Red Hat Enterprise Linux ES version 4", product_id: "4ES:httpd-debuginfo-0:2.0.52-32.3.ent.i386", }, product_reference: "httpd-debuginfo-0:2.0.52-32.3.ent.i386", relates_to_product_reference: "4ES", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.52-32.3.ent.ia64 as a component of Red Hat Enterprise Linux ES version 4", product_id: "4ES:httpd-debuginfo-0:2.0.52-32.3.ent.ia64", }, product_reference: "httpd-debuginfo-0:2.0.52-32.3.ent.ia64", relates_to_product_reference: "4ES", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.52-32.3.ent.ppc as a component of Red Hat Enterprise Linux ES version 4", product_id: "4ES:httpd-debuginfo-0:2.0.52-32.3.ent.ppc", }, product_reference: "httpd-debuginfo-0:2.0.52-32.3.ent.ppc", relates_to_product_reference: "4ES", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.52-32.3.ent.s390 as a component of Red Hat Enterprise Linux ES version 4", product_id: "4ES:httpd-debuginfo-0:2.0.52-32.3.ent.s390", }, product_reference: "httpd-debuginfo-0:2.0.52-32.3.ent.s390", relates_to_product_reference: "4ES", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.52-32.3.ent.s390x as a component of Red Hat Enterprise Linux ES version 4", product_id: "4ES:httpd-debuginfo-0:2.0.52-32.3.ent.s390x", }, product_reference: "httpd-debuginfo-0:2.0.52-32.3.ent.s390x", relates_to_product_reference: "4ES", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.52-32.3.ent.x86_64 as a component of Red Hat Enterprise Linux ES version 4", product_id: "4ES:httpd-debuginfo-0:2.0.52-32.3.ent.x86_64", }, product_reference: "httpd-debuginfo-0:2.0.52-32.3.ent.x86_64", relates_to_product_reference: "4ES", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.52-32.3.ent.i386 as a component of Red Hat Enterprise Linux ES version 4", product_id: "4ES:httpd-devel-0:2.0.52-32.3.ent.i386", }, product_reference: "httpd-devel-0:2.0.52-32.3.ent.i386", relates_to_product_reference: "4ES", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.52-32.3.ent.ia64 as a component of Red Hat Enterprise Linux ES version 4", product_id: "4ES:httpd-devel-0:2.0.52-32.3.ent.ia64", }, product_reference: "httpd-devel-0:2.0.52-32.3.ent.ia64", relates_to_product_reference: "4ES", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.52-32.3.ent.ppc as a component of Red Hat Enterprise Linux ES version 4", product_id: "4ES:httpd-devel-0:2.0.52-32.3.ent.ppc", }, product_reference: "httpd-devel-0:2.0.52-32.3.ent.ppc", relates_to_product_reference: "4ES", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.52-32.3.ent.s390 as a component of Red Hat Enterprise Linux ES version 4", product_id: "4ES:httpd-devel-0:2.0.52-32.3.ent.s390", }, product_reference: "httpd-devel-0:2.0.52-32.3.ent.s390", relates_to_product_reference: "4ES", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.52-32.3.ent.s390x as a component of Red Hat Enterprise Linux ES version 4", product_id: "4ES:httpd-devel-0:2.0.52-32.3.ent.s390x", }, product_reference: "httpd-devel-0:2.0.52-32.3.ent.s390x", relates_to_product_reference: "4ES", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.52-32.3.ent.x86_64 as a component of Red Hat Enterprise Linux ES version 4", product_id: "4ES:httpd-devel-0:2.0.52-32.3.ent.x86_64", }, product_reference: "httpd-devel-0:2.0.52-32.3.ent.x86_64", relates_to_product_reference: "4ES", }, { category: "default_component_of", full_product_name: { name: "httpd-manual-0:2.0.52-32.3.ent.i386 as a component of Red Hat Enterprise Linux ES version 4", product_id: "4ES:httpd-manual-0:2.0.52-32.3.ent.i386", }, product_reference: "httpd-manual-0:2.0.52-32.3.ent.i386", relates_to_product_reference: "4ES", }, { category: "default_component_of", full_product_name: { name: "httpd-manual-0:2.0.52-32.3.ent.ia64 as a component of Red Hat Enterprise Linux ES version 4", product_id: "4ES:httpd-manual-0:2.0.52-32.3.ent.ia64", }, product_reference: "httpd-manual-0:2.0.52-32.3.ent.ia64", relates_to_product_reference: "4ES", }, { category: "default_component_of", full_product_name: { name: "httpd-manual-0:2.0.52-32.3.ent.ppc as a component of Red Hat Enterprise Linux ES version 4", product_id: "4ES:httpd-manual-0:2.0.52-32.3.ent.ppc", }, product_reference: "httpd-manual-0:2.0.52-32.3.ent.ppc", relates_to_product_reference: "4ES", }, { category: "default_component_of", full_product_name: { name: "httpd-manual-0:2.0.52-32.3.ent.s390 as a component of Red Hat Enterprise Linux ES version 4", product_id: "4ES:httpd-manual-0:2.0.52-32.3.ent.s390", }, product_reference: "httpd-manual-0:2.0.52-32.3.ent.s390", relates_to_product_reference: "4ES", }, { category: "default_component_of", full_product_name: { name: "httpd-manual-0:2.0.52-32.3.ent.s390x as a component of Red Hat Enterprise Linux ES version 4", product_id: "4ES:httpd-manual-0:2.0.52-32.3.ent.s390x", }, product_reference: "httpd-manual-0:2.0.52-32.3.ent.s390x", relates_to_product_reference: "4ES", }, { category: "default_component_of", full_product_name: { name: "httpd-manual-0:2.0.52-32.3.ent.x86_64 as a component of Red Hat Enterprise Linux ES version 4", product_id: "4ES:httpd-manual-0:2.0.52-32.3.ent.x86_64", }, product_reference: "httpd-manual-0:2.0.52-32.3.ent.x86_64", relates_to_product_reference: "4ES", }, { category: "default_component_of", full_product_name: { name: "httpd-suexec-0:2.0.52-32.3.ent.i386 as a component of Red Hat Enterprise Linux ES version 4", product_id: "4ES:httpd-suexec-0:2.0.52-32.3.ent.i386", }, product_reference: "httpd-suexec-0:2.0.52-32.3.ent.i386", relates_to_product_reference: "4ES", }, { category: "default_component_of", full_product_name: { name: "httpd-suexec-0:2.0.52-32.3.ent.ia64 as a component of Red Hat Enterprise Linux ES version 4", product_id: "4ES:httpd-suexec-0:2.0.52-32.3.ent.ia64", }, product_reference: "httpd-suexec-0:2.0.52-32.3.ent.ia64", relates_to_product_reference: "4ES", }, { category: "default_component_of", full_product_name: { name: "httpd-suexec-0:2.0.52-32.3.ent.ppc as a component of Red Hat Enterprise Linux ES version 4", product_id: "4ES:httpd-suexec-0:2.0.52-32.3.ent.ppc", }, product_reference: "httpd-suexec-0:2.0.52-32.3.ent.ppc", relates_to_product_reference: "4ES", }, { category: "default_component_of", full_product_name: { name: "httpd-suexec-0:2.0.52-32.3.ent.s390 as a component of Red Hat Enterprise Linux ES version 4", product_id: "4ES:httpd-suexec-0:2.0.52-32.3.ent.s390", }, product_reference: "httpd-suexec-0:2.0.52-32.3.ent.s390", relates_to_product_reference: "4ES", }, { category: "default_component_of", full_product_name: { name: "httpd-suexec-0:2.0.52-32.3.ent.s390x as a component of Red Hat Enterprise Linux ES version 4", product_id: "4ES:httpd-suexec-0:2.0.52-32.3.ent.s390x", }, product_reference: "httpd-suexec-0:2.0.52-32.3.ent.s390x", relates_to_product_reference: "4ES", }, { category: "default_component_of", full_product_name: { name: "httpd-suexec-0:2.0.52-32.3.ent.x86_64 as a component of Red Hat Enterprise Linux ES version 4", product_id: "4ES:httpd-suexec-0:2.0.52-32.3.ent.x86_64", }, product_reference: "httpd-suexec-0:2.0.52-32.3.ent.x86_64", relates_to_product_reference: "4ES", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.52-32.3.ent.i386 as a component of Red Hat Enterprise Linux ES version 4", product_id: "4ES:mod_ssl-1:2.0.52-32.3.ent.i386", }, product_reference: "mod_ssl-1:2.0.52-32.3.ent.i386", relates_to_product_reference: "4ES", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.52-32.3.ent.ia64 as a component of Red Hat Enterprise Linux ES version 4", product_id: "4ES:mod_ssl-1:2.0.52-32.3.ent.ia64", }, product_reference: "mod_ssl-1:2.0.52-32.3.ent.ia64", relates_to_product_reference: "4ES", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.52-32.3.ent.ppc as a component of Red Hat Enterprise Linux ES version 4", product_id: "4ES:mod_ssl-1:2.0.52-32.3.ent.ppc", }, product_reference: "mod_ssl-1:2.0.52-32.3.ent.ppc", relates_to_product_reference: "4ES", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.52-32.3.ent.s390 as a component of Red Hat Enterprise Linux ES version 4", product_id: "4ES:mod_ssl-1:2.0.52-32.3.ent.s390", }, product_reference: "mod_ssl-1:2.0.52-32.3.ent.s390", relates_to_product_reference: "4ES", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.52-32.3.ent.s390x as a component of Red Hat Enterprise Linux ES version 4", product_id: "4ES:mod_ssl-1:2.0.52-32.3.ent.s390x", }, product_reference: "mod_ssl-1:2.0.52-32.3.ent.s390x", relates_to_product_reference: "4ES", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.52-32.3.ent.x86_64 as a component of Red Hat Enterprise Linux ES version 4", product_id: "4ES:mod_ssl-1:2.0.52-32.3.ent.x86_64", }, product_reference: "mod_ssl-1:2.0.52-32.3.ent.x86_64", relates_to_product_reference: "4ES", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.52-32.3.ent.i386 as a component of Red Hat Enterprise Linux WS version 4", product_id: "4WS:httpd-0:2.0.52-32.3.ent.i386", }, product_reference: "httpd-0:2.0.52-32.3.ent.i386", relates_to_product_reference: "4WS", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.52-32.3.ent.ia64 as a component of Red Hat Enterprise Linux WS version 4", product_id: "4WS:httpd-0:2.0.52-32.3.ent.ia64", }, product_reference: "httpd-0:2.0.52-32.3.ent.ia64", relates_to_product_reference: "4WS", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.52-32.3.ent.ppc as a component of Red Hat Enterprise Linux WS version 4", product_id: "4WS:httpd-0:2.0.52-32.3.ent.ppc", }, product_reference: "httpd-0:2.0.52-32.3.ent.ppc", relates_to_product_reference: "4WS", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.52-32.3.ent.s390 as a component of Red Hat Enterprise Linux WS version 4", product_id: "4WS:httpd-0:2.0.52-32.3.ent.s390", }, product_reference: "httpd-0:2.0.52-32.3.ent.s390", relates_to_product_reference: "4WS", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.52-32.3.ent.s390x as a component of Red Hat Enterprise Linux WS version 4", product_id: "4WS:httpd-0:2.0.52-32.3.ent.s390x", }, product_reference: "httpd-0:2.0.52-32.3.ent.s390x", relates_to_product_reference: "4WS", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.52-32.3.ent.src as a component of Red Hat Enterprise Linux WS version 4", product_id: "4WS:httpd-0:2.0.52-32.3.ent.src", }, product_reference: "httpd-0:2.0.52-32.3.ent.src", relates_to_product_reference: "4WS", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.52-32.3.ent.x86_64 as a component of Red Hat Enterprise Linux WS version 4", product_id: "4WS:httpd-0:2.0.52-32.3.ent.x86_64", }, product_reference: "httpd-0:2.0.52-32.3.ent.x86_64", relates_to_product_reference: "4WS", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.52-32.3.ent.i386 as a component of Red Hat Enterprise Linux WS version 4", product_id: "4WS:httpd-debuginfo-0:2.0.52-32.3.ent.i386", }, product_reference: "httpd-debuginfo-0:2.0.52-32.3.ent.i386", relates_to_product_reference: "4WS", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.52-32.3.ent.ia64 as a component of Red Hat Enterprise Linux WS version 4", product_id: "4WS:httpd-debuginfo-0:2.0.52-32.3.ent.ia64", }, product_reference: "httpd-debuginfo-0:2.0.52-32.3.ent.ia64", relates_to_product_reference: "4WS", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.52-32.3.ent.ppc as a component of Red Hat Enterprise Linux WS version 4", product_id: "4WS:httpd-debuginfo-0:2.0.52-32.3.ent.ppc", }, product_reference: "httpd-debuginfo-0:2.0.52-32.3.ent.ppc", relates_to_product_reference: "4WS", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.52-32.3.ent.s390 as a component of Red Hat Enterprise Linux WS version 4", product_id: "4WS:httpd-debuginfo-0:2.0.52-32.3.ent.s390", }, product_reference: "httpd-debuginfo-0:2.0.52-32.3.ent.s390", relates_to_product_reference: "4WS", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.52-32.3.ent.s390x as a component of Red Hat Enterprise Linux WS version 4", product_id: "4WS:httpd-debuginfo-0:2.0.52-32.3.ent.s390x", }, product_reference: "httpd-debuginfo-0:2.0.52-32.3.ent.s390x", relates_to_product_reference: "4WS", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.52-32.3.ent.x86_64 as a component of Red Hat Enterprise Linux WS version 4", product_id: "4WS:httpd-debuginfo-0:2.0.52-32.3.ent.x86_64", }, product_reference: "httpd-debuginfo-0:2.0.52-32.3.ent.x86_64", relates_to_product_reference: "4WS", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.52-32.3.ent.i386 as a component of Red Hat Enterprise Linux WS version 4", product_id: "4WS:httpd-devel-0:2.0.52-32.3.ent.i386", }, product_reference: "httpd-devel-0:2.0.52-32.3.ent.i386", relates_to_product_reference: "4WS", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.52-32.3.ent.ia64 as a component of Red Hat Enterprise Linux WS version 4", product_id: "4WS:httpd-devel-0:2.0.52-32.3.ent.ia64", }, product_reference: "httpd-devel-0:2.0.52-32.3.ent.ia64", relates_to_product_reference: "4WS", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.52-32.3.ent.ppc as a component of Red Hat Enterprise Linux WS version 4", product_id: "4WS:httpd-devel-0:2.0.52-32.3.ent.ppc", }, product_reference: "httpd-devel-0:2.0.52-32.3.ent.ppc", relates_to_product_reference: "4WS", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.52-32.3.ent.s390 as a component of Red Hat Enterprise Linux WS version 4", product_id: "4WS:httpd-devel-0:2.0.52-32.3.ent.s390", }, product_reference: "httpd-devel-0:2.0.52-32.3.ent.s390", relates_to_product_reference: "4WS", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.52-32.3.ent.s390x as a component of Red Hat Enterprise Linux WS version 4", product_id: "4WS:httpd-devel-0:2.0.52-32.3.ent.s390x", }, product_reference: "httpd-devel-0:2.0.52-32.3.ent.s390x", relates_to_product_reference: "4WS", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.52-32.3.ent.x86_64 as a component of Red Hat Enterprise Linux WS version 4", product_id: "4WS:httpd-devel-0:2.0.52-32.3.ent.x86_64", }, product_reference: "httpd-devel-0:2.0.52-32.3.ent.x86_64", relates_to_product_reference: "4WS", }, { category: "default_component_of", full_product_name: { name: "httpd-manual-0:2.0.52-32.3.ent.i386 as a component of Red Hat Enterprise Linux WS version 4", product_id: "4WS:httpd-manual-0:2.0.52-32.3.ent.i386", }, product_reference: "httpd-manual-0:2.0.52-32.3.ent.i386", relates_to_product_reference: "4WS", }, { category: "default_component_of", full_product_name: { name: "httpd-manual-0:2.0.52-32.3.ent.ia64 as a component of Red Hat Enterprise Linux WS version 4", product_id: "4WS:httpd-manual-0:2.0.52-32.3.ent.ia64", }, product_reference: "httpd-manual-0:2.0.52-32.3.ent.ia64", relates_to_product_reference: "4WS", }, { category: "default_component_of", full_product_name: { name: "httpd-manual-0:2.0.52-32.3.ent.ppc as a component of Red Hat Enterprise Linux WS version 4", product_id: "4WS:httpd-manual-0:2.0.52-32.3.ent.ppc", }, product_reference: "httpd-manual-0:2.0.52-32.3.ent.ppc", relates_to_product_reference: "4WS", }, { category: "default_component_of", full_product_name: { name: "httpd-manual-0:2.0.52-32.3.ent.s390 as a component of Red Hat Enterprise Linux WS version 4", product_id: "4WS:httpd-manual-0:2.0.52-32.3.ent.s390", }, product_reference: "httpd-manual-0:2.0.52-32.3.ent.s390", relates_to_product_reference: "4WS", }, { category: "default_component_of", full_product_name: { name: "httpd-manual-0:2.0.52-32.3.ent.s390x as a component of Red Hat Enterprise Linux WS version 4", product_id: "4WS:httpd-manual-0:2.0.52-32.3.ent.s390x", }, product_reference: "httpd-manual-0:2.0.52-32.3.ent.s390x", relates_to_product_reference: "4WS", }, { category: "default_component_of", full_product_name: { name: "httpd-manual-0:2.0.52-32.3.ent.x86_64 as a component of Red Hat Enterprise Linux WS version 4", product_id: "4WS:httpd-manual-0:2.0.52-32.3.ent.x86_64", }, product_reference: "httpd-manual-0:2.0.52-32.3.ent.x86_64", relates_to_product_reference: "4WS", }, { category: "default_component_of", full_product_name: { name: "httpd-suexec-0:2.0.52-32.3.ent.i386 as a component of Red Hat Enterprise Linux WS version 4", product_id: "4WS:httpd-suexec-0:2.0.52-32.3.ent.i386", }, product_reference: "httpd-suexec-0:2.0.52-32.3.ent.i386", relates_to_product_reference: "4WS", }, { category: "default_component_of", full_product_name: { name: "httpd-suexec-0:2.0.52-32.3.ent.ia64 as a component of Red Hat Enterprise Linux WS version 4", product_id: "4WS:httpd-suexec-0:2.0.52-32.3.ent.ia64", }, product_reference: "httpd-suexec-0:2.0.52-32.3.ent.ia64", relates_to_product_reference: "4WS", }, { category: "default_component_of", full_product_name: { name: "httpd-suexec-0:2.0.52-32.3.ent.ppc as a component of Red Hat Enterprise Linux WS version 4", product_id: "4WS:httpd-suexec-0:2.0.52-32.3.ent.ppc", }, product_reference: "httpd-suexec-0:2.0.52-32.3.ent.ppc", relates_to_product_reference: "4WS", }, { category: "default_component_of", full_product_name: { name: "httpd-suexec-0:2.0.52-32.3.ent.s390 as a component of Red Hat Enterprise Linux WS version 4", product_id: "4WS:httpd-suexec-0:2.0.52-32.3.ent.s390", }, product_reference: "httpd-suexec-0:2.0.52-32.3.ent.s390", relates_to_product_reference: "4WS", }, { category: "default_component_of", full_product_name: { name: "httpd-suexec-0:2.0.52-32.3.ent.s390x as a component of Red Hat Enterprise Linux WS version 4", product_id: "4WS:httpd-suexec-0:2.0.52-32.3.ent.s390x", }, product_reference: "httpd-suexec-0:2.0.52-32.3.ent.s390x", relates_to_product_reference: "4WS", }, { category: "default_component_of", full_product_name: { name: "httpd-suexec-0:2.0.52-32.3.ent.x86_64 as a component of Red Hat Enterprise Linux WS version 4", product_id: "4WS:httpd-suexec-0:2.0.52-32.3.ent.x86_64", }, product_reference: "httpd-suexec-0:2.0.52-32.3.ent.x86_64", relates_to_product_reference: "4WS", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.52-32.3.ent.i386 as a component of Red Hat Enterprise Linux WS version 4", product_id: "4WS:mod_ssl-1:2.0.52-32.3.ent.i386", }, product_reference: "mod_ssl-1:2.0.52-32.3.ent.i386", relates_to_product_reference: "4WS", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.52-32.3.ent.ia64 as a component of Red Hat Enterprise Linux WS version 4", product_id: "4WS:mod_ssl-1:2.0.52-32.3.ent.ia64", }, product_reference: "mod_ssl-1:2.0.52-32.3.ent.ia64", relates_to_product_reference: "4WS", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.52-32.3.ent.ppc as a component of Red Hat Enterprise Linux WS version 4", product_id: "4WS:mod_ssl-1:2.0.52-32.3.ent.ppc", }, product_reference: "mod_ssl-1:2.0.52-32.3.ent.ppc", relates_to_product_reference: "4WS", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.52-32.3.ent.s390 as a component of Red Hat Enterprise Linux WS version 4", product_id: "4WS:mod_ssl-1:2.0.52-32.3.ent.s390", }, product_reference: "mod_ssl-1:2.0.52-32.3.ent.s390", relates_to_product_reference: "4WS", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.52-32.3.ent.s390x as a component of Red Hat Enterprise Linux WS version 4", product_id: "4WS:mod_ssl-1:2.0.52-32.3.ent.s390x", }, product_reference: "mod_ssl-1:2.0.52-32.3.ent.s390x", relates_to_product_reference: "4WS", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.52-32.3.ent.x86_64 as a component of Red Hat Enterprise Linux WS version 4", product_id: "4WS:mod_ssl-1:2.0.52-32.3.ent.x86_64", }, product_reference: "mod_ssl-1:2.0.52-32.3.ent.x86_64", relates_to_product_reference: "4WS", }, ], }, vulnerabilities: [ { cve: "CVE-2007-3304", discovery_date: "2007-06-19T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "245111", }, ], notes: [ { category: "description", text: "Apache httpd 1.3.37, 2.0.59, and 2.2.4 with the Prefork MPM module, allows local users to cause a denial of service by modifying the worker_score and process_score arrays to reference an arbitrary process ID, which is sent a SIGUSR1 signal from the master process, aka \"SIGUSR1 killer.\"", title: "Vulnerability description", }, { category: "summary", text: "httpd scoreboard lack of PID protection", title: "Vulnerability summary", }, ], product_status: { fixed: [ "3AS:httpd-0:2.0.46-68.ent.i386", "3AS:httpd-0:2.0.46-68.ent.ia64", "3AS:httpd-0:2.0.46-68.ent.ppc", "3AS:httpd-0:2.0.46-68.ent.s390", "3AS:httpd-0:2.0.46-68.ent.s390x", "3AS:httpd-0:2.0.46-68.ent.src", "3AS:httpd-0:2.0.46-68.ent.x86_64", "3AS:httpd-debuginfo-0:2.0.46-68.ent.i386", "3AS:httpd-debuginfo-0:2.0.46-68.ent.ia64", "3AS:httpd-debuginfo-0:2.0.46-68.ent.ppc", "3AS:httpd-debuginfo-0:2.0.46-68.ent.s390", "3AS:httpd-debuginfo-0:2.0.46-68.ent.s390x", "3AS:httpd-debuginfo-0:2.0.46-68.ent.x86_64", "3AS:httpd-devel-0:2.0.46-68.ent.i386", "3AS:httpd-devel-0:2.0.46-68.ent.ia64", "3AS:httpd-devel-0:2.0.46-68.ent.ppc", "3AS:httpd-devel-0:2.0.46-68.ent.s390", "3AS:httpd-devel-0:2.0.46-68.ent.s390x", "3AS:httpd-devel-0:2.0.46-68.ent.x86_64", "3AS:mod_ssl-1:2.0.46-68.ent.i386", "3AS:mod_ssl-1:2.0.46-68.ent.ia64", "3AS:mod_ssl-1:2.0.46-68.ent.ppc", "3AS:mod_ssl-1:2.0.46-68.ent.s390", "3AS:mod_ssl-1:2.0.46-68.ent.s390x", "3AS:mod_ssl-1:2.0.46-68.ent.x86_64", "3Desktop:httpd-0:2.0.46-68.ent.i386", "3Desktop:httpd-0:2.0.46-68.ent.ia64", "3Desktop:httpd-0:2.0.46-68.ent.ppc", "3Desktop:httpd-0:2.0.46-68.ent.s390", "3Desktop:httpd-0:2.0.46-68.ent.s390x", "3Desktop:httpd-0:2.0.46-68.ent.src", "3Desktop:httpd-0:2.0.46-68.ent.x86_64", "3Desktop:httpd-debuginfo-0:2.0.46-68.ent.i386", "3Desktop:httpd-debuginfo-0:2.0.46-68.ent.ia64", "3Desktop:httpd-debuginfo-0:2.0.46-68.ent.ppc", "3Desktop:httpd-debuginfo-0:2.0.46-68.ent.s390", "3Desktop:httpd-debuginfo-0:2.0.46-68.ent.s390x", "3Desktop:httpd-debuginfo-0:2.0.46-68.ent.x86_64", "3Desktop:httpd-devel-0:2.0.46-68.ent.i386", "3Desktop:httpd-devel-0:2.0.46-68.ent.ia64", "3Desktop:httpd-devel-0:2.0.46-68.ent.ppc", "3Desktop:httpd-devel-0:2.0.46-68.ent.s390", "3Desktop:httpd-devel-0:2.0.46-68.ent.s390x", "3Desktop:httpd-devel-0:2.0.46-68.ent.x86_64", "3Desktop:mod_ssl-1:2.0.46-68.ent.i386", "3Desktop:mod_ssl-1:2.0.46-68.ent.ia64", "3Desktop:mod_ssl-1:2.0.46-68.ent.ppc", "3Desktop:mod_ssl-1:2.0.46-68.ent.s390", "3Desktop:mod_ssl-1:2.0.46-68.ent.s390x", "3Desktop:mod_ssl-1:2.0.46-68.ent.x86_64", "3ES:httpd-0:2.0.46-68.ent.i386", "3ES:httpd-0:2.0.46-68.ent.ia64", "3ES:httpd-0:2.0.46-68.ent.ppc", "3ES:httpd-0:2.0.46-68.ent.s390", "3ES:httpd-0:2.0.46-68.ent.s390x", "3ES:httpd-0:2.0.46-68.ent.src", "3ES:httpd-0:2.0.46-68.ent.x86_64", "3ES:httpd-debuginfo-0:2.0.46-68.ent.i386", "3ES:httpd-debuginfo-0:2.0.46-68.ent.ia64", "3ES:httpd-debuginfo-0:2.0.46-68.ent.ppc", "3ES:httpd-debuginfo-0:2.0.46-68.ent.s390", "3ES:httpd-debuginfo-0:2.0.46-68.ent.s390x", "3ES:httpd-debuginfo-0:2.0.46-68.ent.x86_64", "3ES:httpd-devel-0:2.0.46-68.ent.i386", "3ES:httpd-devel-0:2.0.46-68.ent.ia64", "3ES:httpd-devel-0:2.0.46-68.ent.ppc", "3ES:httpd-devel-0:2.0.46-68.ent.s390", "3ES:httpd-devel-0:2.0.46-68.ent.s390x", "3ES:httpd-devel-0:2.0.46-68.ent.x86_64", "3ES:mod_ssl-1:2.0.46-68.ent.i386", "3ES:mod_ssl-1:2.0.46-68.ent.ia64", "3ES:mod_ssl-1:2.0.46-68.ent.ppc", "3ES:mod_ssl-1:2.0.46-68.ent.s390", "3ES:mod_ssl-1:2.0.46-68.ent.s390x", "3ES:mod_ssl-1:2.0.46-68.ent.x86_64", "3WS:httpd-0:2.0.46-68.ent.i386", "3WS:httpd-0:2.0.46-68.ent.ia64", "3WS:httpd-0:2.0.46-68.ent.ppc", "3WS:httpd-0:2.0.46-68.ent.s390", "3WS:httpd-0:2.0.46-68.ent.s390x", "3WS:httpd-0:2.0.46-68.ent.src", "3WS:httpd-0:2.0.46-68.ent.x86_64", "3WS:httpd-debuginfo-0:2.0.46-68.ent.i386", "3WS:httpd-debuginfo-0:2.0.46-68.ent.ia64", "3WS:httpd-debuginfo-0:2.0.46-68.ent.ppc", "3WS:httpd-debuginfo-0:2.0.46-68.ent.s390", "3WS:httpd-debuginfo-0:2.0.46-68.ent.s390x", "3WS:httpd-debuginfo-0:2.0.46-68.ent.x86_64", "3WS:httpd-devel-0:2.0.46-68.ent.i386", "3WS:httpd-devel-0:2.0.46-68.ent.ia64", "3WS:httpd-devel-0:2.0.46-68.ent.ppc", "3WS:httpd-devel-0:2.0.46-68.ent.s390", "3WS:httpd-devel-0:2.0.46-68.ent.s390x", "3WS:httpd-devel-0:2.0.46-68.ent.x86_64", "3WS:mod_ssl-1:2.0.46-68.ent.i386", "3WS:mod_ssl-1:2.0.46-68.ent.ia64", "3WS:mod_ssl-1:2.0.46-68.ent.ppc", "3WS:mod_ssl-1:2.0.46-68.ent.s390", "3WS:mod_ssl-1:2.0.46-68.ent.s390x", "3WS:mod_ssl-1:2.0.46-68.ent.x86_64", "4AS:httpd-0:2.0.52-32.3.ent.i386", "4AS:httpd-0:2.0.52-32.3.ent.ia64", "4AS:httpd-0:2.0.52-32.3.ent.ppc", "4AS:httpd-0:2.0.52-32.3.ent.s390", "4AS:httpd-0:2.0.52-32.3.ent.s390x", "4AS:httpd-0:2.0.52-32.3.ent.src", "4AS:httpd-0:2.0.52-32.3.ent.x86_64", "4AS:httpd-debuginfo-0:2.0.52-32.3.ent.i386", "4AS:httpd-debuginfo-0:2.0.52-32.3.ent.ia64", "4AS:httpd-debuginfo-0:2.0.52-32.3.ent.ppc", "4AS:httpd-debuginfo-0:2.0.52-32.3.ent.s390", "4AS:httpd-debuginfo-0:2.0.52-32.3.ent.s390x", "4AS:httpd-debuginfo-0:2.0.52-32.3.ent.x86_64", "4AS:httpd-devel-0:2.0.52-32.3.ent.i386", "4AS:httpd-devel-0:2.0.52-32.3.ent.ia64", "4AS:httpd-devel-0:2.0.52-32.3.ent.ppc", "4AS:httpd-devel-0:2.0.52-32.3.ent.s390", "4AS:httpd-devel-0:2.0.52-32.3.ent.s390x", "4AS:httpd-devel-0:2.0.52-32.3.ent.x86_64", "4AS:httpd-manual-0:2.0.52-32.3.ent.i386", "4AS:httpd-manual-0:2.0.52-32.3.ent.ia64", "4AS:httpd-manual-0:2.0.52-32.3.ent.ppc", "4AS:httpd-manual-0:2.0.52-32.3.ent.s390", "4AS:httpd-manual-0:2.0.52-32.3.ent.s390x", "4AS:httpd-manual-0:2.0.52-32.3.ent.x86_64", "4AS:httpd-suexec-0:2.0.52-32.3.ent.i386", "4AS:httpd-suexec-0:2.0.52-32.3.ent.ia64", "4AS:httpd-suexec-0:2.0.52-32.3.ent.ppc", "4AS:httpd-suexec-0:2.0.52-32.3.ent.s390", "4AS:httpd-suexec-0:2.0.52-32.3.ent.s390x", "4AS:httpd-suexec-0:2.0.52-32.3.ent.x86_64", "4AS:mod_ssl-1:2.0.52-32.3.ent.i386", "4AS:mod_ssl-1:2.0.52-32.3.ent.ia64", "4AS:mod_ssl-1:2.0.52-32.3.ent.ppc", "4AS:mod_ssl-1:2.0.52-32.3.ent.s390", "4AS:mod_ssl-1:2.0.52-32.3.ent.s390x", "4AS:mod_ssl-1:2.0.52-32.3.ent.x86_64", "4Desktop:httpd-0:2.0.52-32.3.ent.i386", "4Desktop:httpd-0:2.0.52-32.3.ent.ia64", "4Desktop:httpd-0:2.0.52-32.3.ent.ppc", "4Desktop:httpd-0:2.0.52-32.3.ent.s390", "4Desktop:httpd-0:2.0.52-32.3.ent.s390x", "4Desktop:httpd-0:2.0.52-32.3.ent.src", "4Desktop:httpd-0:2.0.52-32.3.ent.x86_64", "4Desktop:httpd-debuginfo-0:2.0.52-32.3.ent.i386", "4Desktop:httpd-debuginfo-0:2.0.52-32.3.ent.ia64", "4Desktop:httpd-debuginfo-0:2.0.52-32.3.ent.ppc", "4Desktop:httpd-debuginfo-0:2.0.52-32.3.ent.s390", "4Desktop:httpd-debuginfo-0:2.0.52-32.3.ent.s390x", "4Desktop:httpd-debuginfo-0:2.0.52-32.3.ent.x86_64", "4Desktop:httpd-devel-0:2.0.52-32.3.ent.i386", "4Desktop:httpd-devel-0:2.0.52-32.3.ent.ia64", "4Desktop:httpd-devel-0:2.0.52-32.3.ent.ppc", "4Desktop:httpd-devel-0:2.0.52-32.3.ent.s390", "4Desktop:httpd-devel-0:2.0.52-32.3.ent.s390x", "4Desktop:httpd-devel-0:2.0.52-32.3.ent.x86_64", "4Desktop:httpd-manual-0:2.0.52-32.3.ent.i386", "4Desktop:httpd-manual-0:2.0.52-32.3.ent.ia64", "4Desktop:httpd-manual-0:2.0.52-32.3.ent.ppc", "4Desktop:httpd-manual-0:2.0.52-32.3.ent.s390", "4Desktop:httpd-manual-0:2.0.52-32.3.ent.s390x", "4Desktop:httpd-manual-0:2.0.52-32.3.ent.x86_64", "4Desktop:httpd-suexec-0:2.0.52-32.3.ent.i386", "4Desktop:httpd-suexec-0:2.0.52-32.3.ent.ia64", "4Desktop:httpd-suexec-0:2.0.52-32.3.ent.ppc", "4Desktop:httpd-suexec-0:2.0.52-32.3.ent.s390", "4Desktop:httpd-suexec-0:2.0.52-32.3.ent.s390x", "4Desktop:httpd-suexec-0:2.0.52-32.3.ent.x86_64", "4Desktop:mod_ssl-1:2.0.52-32.3.ent.i386", "4Desktop:mod_ssl-1:2.0.52-32.3.ent.ia64", "4Desktop:mod_ssl-1:2.0.52-32.3.ent.ppc", "4Desktop:mod_ssl-1:2.0.52-32.3.ent.s390", "4Desktop:mod_ssl-1:2.0.52-32.3.ent.s390x", "4Desktop:mod_ssl-1:2.0.52-32.3.ent.x86_64", "4ES:httpd-0:2.0.52-32.3.ent.i386", "4ES:httpd-0:2.0.52-32.3.ent.ia64", "4ES:httpd-0:2.0.52-32.3.ent.ppc", "4ES:httpd-0:2.0.52-32.3.ent.s390", "4ES:httpd-0:2.0.52-32.3.ent.s390x", "4ES:httpd-0:2.0.52-32.3.ent.src", "4ES:httpd-0:2.0.52-32.3.ent.x86_64", "4ES:httpd-debuginfo-0:2.0.52-32.3.ent.i386", "4ES:httpd-debuginfo-0:2.0.52-32.3.ent.ia64", "4ES:httpd-debuginfo-0:2.0.52-32.3.ent.ppc", "4ES:httpd-debuginfo-0:2.0.52-32.3.ent.s390", "4ES:httpd-debuginfo-0:2.0.52-32.3.ent.s390x", "4ES:httpd-debuginfo-0:2.0.52-32.3.ent.x86_64", "4ES:httpd-devel-0:2.0.52-32.3.ent.i386", "4ES:httpd-devel-0:2.0.52-32.3.ent.ia64", "4ES:httpd-devel-0:2.0.52-32.3.ent.ppc", "4ES:httpd-devel-0:2.0.52-32.3.ent.s390", "4ES:httpd-devel-0:2.0.52-32.3.ent.s390x", "4ES:httpd-devel-0:2.0.52-32.3.ent.x86_64", "4ES:httpd-manual-0:2.0.52-32.3.ent.i386", "4ES:httpd-manual-0:2.0.52-32.3.ent.ia64", "4ES:httpd-manual-0:2.0.52-32.3.ent.ppc", "4ES:httpd-manual-0:2.0.52-32.3.ent.s390", "4ES:httpd-manual-0:2.0.52-32.3.ent.s390x", "4ES:httpd-manual-0:2.0.52-32.3.ent.x86_64", "4ES:httpd-suexec-0:2.0.52-32.3.ent.i386", "4ES:httpd-suexec-0:2.0.52-32.3.ent.ia64", "4ES:httpd-suexec-0:2.0.52-32.3.ent.ppc", "4ES:httpd-suexec-0:2.0.52-32.3.ent.s390", "4ES:httpd-suexec-0:2.0.52-32.3.ent.s390x", "4ES:httpd-suexec-0:2.0.52-32.3.ent.x86_64", "4ES:mod_ssl-1:2.0.52-32.3.ent.i386", "4ES:mod_ssl-1:2.0.52-32.3.ent.ia64", "4ES:mod_ssl-1:2.0.52-32.3.ent.ppc", "4ES:mod_ssl-1:2.0.52-32.3.ent.s390", "4ES:mod_ssl-1:2.0.52-32.3.ent.s390x", "4ES:mod_ssl-1:2.0.52-32.3.ent.x86_64", "4WS:httpd-0:2.0.52-32.3.ent.i386", "4WS:httpd-0:2.0.52-32.3.ent.ia64", "4WS:httpd-0:2.0.52-32.3.ent.ppc", "4WS:httpd-0:2.0.52-32.3.ent.s390", "4WS:httpd-0:2.0.52-32.3.ent.s390x", "4WS:httpd-0:2.0.52-32.3.ent.src", "4WS:httpd-0:2.0.52-32.3.ent.x86_64", "4WS:httpd-debuginfo-0:2.0.52-32.3.ent.i386", "4WS:httpd-debuginfo-0:2.0.52-32.3.ent.ia64", "4WS:httpd-debuginfo-0:2.0.52-32.3.ent.ppc", "4WS:httpd-debuginfo-0:2.0.52-32.3.ent.s390", "4WS:httpd-debuginfo-0:2.0.52-32.3.ent.s390x", "4WS:httpd-debuginfo-0:2.0.52-32.3.ent.x86_64", "4WS:httpd-devel-0:2.0.52-32.3.ent.i386", "4WS:httpd-devel-0:2.0.52-32.3.ent.ia64", "4WS:httpd-devel-0:2.0.52-32.3.ent.ppc", "4WS:httpd-devel-0:2.0.52-32.3.ent.s390", "4WS:httpd-devel-0:2.0.52-32.3.ent.s390x", "4WS:httpd-devel-0:2.0.52-32.3.ent.x86_64", "4WS:httpd-manual-0:2.0.52-32.3.ent.i386", "4WS:httpd-manual-0:2.0.52-32.3.ent.ia64", "4WS:httpd-manual-0:2.0.52-32.3.ent.ppc", "4WS:httpd-manual-0:2.0.52-32.3.ent.s390", "4WS:httpd-manual-0:2.0.52-32.3.ent.s390x", "4WS:httpd-manual-0:2.0.52-32.3.ent.x86_64", "4WS:httpd-suexec-0:2.0.52-32.3.ent.i386", "4WS:httpd-suexec-0:2.0.52-32.3.ent.ia64", "4WS:httpd-suexec-0:2.0.52-32.3.ent.ppc", "4WS:httpd-suexec-0:2.0.52-32.3.ent.s390", "4WS:httpd-suexec-0:2.0.52-32.3.ent.s390x", "4WS:httpd-suexec-0:2.0.52-32.3.ent.x86_64", "4WS:mod_ssl-1:2.0.52-32.3.ent.i386", "4WS:mod_ssl-1:2.0.52-32.3.ent.ia64", "4WS:mod_ssl-1:2.0.52-32.3.ent.ppc", "4WS:mod_ssl-1:2.0.52-32.3.ent.s390", "4WS:mod_ssl-1:2.0.52-32.3.ent.s390x", "4WS:mod_ssl-1:2.0.52-32.3.ent.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-3304", }, { category: "external", summary: "RHBZ#245111", url: "https://bugzilla.redhat.com/show_bug.cgi?id=245111", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-3304", url: "https://www.cve.org/CVERecord?id=CVE-2007-3304", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-3304", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-3304", }, ], release_date: "2007-06-19T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2007-07-13T07:48:00+00:00", details: "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied. \n\nThis update is available via Red Hat Network. Details on how to use \nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/FAQ_58_10188", product_ids: [ "3AS:httpd-0:2.0.46-68.ent.i386", "3AS:httpd-0:2.0.46-68.ent.ia64", "3AS:httpd-0:2.0.46-68.ent.ppc", "3AS:httpd-0:2.0.46-68.ent.s390", "3AS:httpd-0:2.0.46-68.ent.s390x", "3AS:httpd-0:2.0.46-68.ent.src", "3AS:httpd-0:2.0.46-68.ent.x86_64", "3AS:httpd-debuginfo-0:2.0.46-68.ent.i386", "3AS:httpd-debuginfo-0:2.0.46-68.ent.ia64", "3AS:httpd-debuginfo-0:2.0.46-68.ent.ppc", "3AS:httpd-debuginfo-0:2.0.46-68.ent.s390", "3AS:httpd-debuginfo-0:2.0.46-68.ent.s390x", "3AS:httpd-debuginfo-0:2.0.46-68.ent.x86_64", "3AS:httpd-devel-0:2.0.46-68.ent.i386", "3AS:httpd-devel-0:2.0.46-68.ent.ia64", "3AS:httpd-devel-0:2.0.46-68.ent.ppc", "3AS:httpd-devel-0:2.0.46-68.ent.s390", "3AS:httpd-devel-0:2.0.46-68.ent.s390x", "3AS:httpd-devel-0:2.0.46-68.ent.x86_64", "3AS:mod_ssl-1:2.0.46-68.ent.i386", "3AS:mod_ssl-1:2.0.46-68.ent.ia64", "3AS:mod_ssl-1:2.0.46-68.ent.ppc", "3AS:mod_ssl-1:2.0.46-68.ent.s390", "3AS:mod_ssl-1:2.0.46-68.ent.s390x", "3AS:mod_ssl-1:2.0.46-68.ent.x86_64", "3Desktop:httpd-0:2.0.46-68.ent.i386", "3Desktop:httpd-0:2.0.46-68.ent.ia64", "3Desktop:httpd-0:2.0.46-68.ent.ppc", "3Desktop:httpd-0:2.0.46-68.ent.s390", "3Desktop:httpd-0:2.0.46-68.ent.s390x", "3Desktop:httpd-0:2.0.46-68.ent.src", "3Desktop:httpd-0:2.0.46-68.ent.x86_64", "3Desktop:httpd-debuginfo-0:2.0.46-68.ent.i386", "3Desktop:httpd-debuginfo-0:2.0.46-68.ent.ia64", "3Desktop:httpd-debuginfo-0:2.0.46-68.ent.ppc", "3Desktop:httpd-debuginfo-0:2.0.46-68.ent.s390", "3Desktop:httpd-debuginfo-0:2.0.46-68.ent.s390x", "3Desktop:httpd-debuginfo-0:2.0.46-68.ent.x86_64", "3Desktop:httpd-devel-0:2.0.46-68.ent.i386", "3Desktop:httpd-devel-0:2.0.46-68.ent.ia64", "3Desktop:httpd-devel-0:2.0.46-68.ent.ppc", "3Desktop:httpd-devel-0:2.0.46-68.ent.s390", "3Desktop:httpd-devel-0:2.0.46-68.ent.s390x", "3Desktop:httpd-devel-0:2.0.46-68.ent.x86_64", "3Desktop:mod_ssl-1:2.0.46-68.ent.i386", "3Desktop:mod_ssl-1:2.0.46-68.ent.ia64", "3Desktop:mod_ssl-1:2.0.46-68.ent.ppc", "3Desktop:mod_ssl-1:2.0.46-68.ent.s390", "3Desktop:mod_ssl-1:2.0.46-68.ent.s390x", "3Desktop:mod_ssl-1:2.0.46-68.ent.x86_64", "3ES:httpd-0:2.0.46-68.ent.i386", "3ES:httpd-0:2.0.46-68.ent.ia64", "3ES:httpd-0:2.0.46-68.ent.ppc", "3ES:httpd-0:2.0.46-68.ent.s390", "3ES:httpd-0:2.0.46-68.ent.s390x", "3ES:httpd-0:2.0.46-68.ent.src", "3ES:httpd-0:2.0.46-68.ent.x86_64", "3ES:httpd-debuginfo-0:2.0.46-68.ent.i386", "3ES:httpd-debuginfo-0:2.0.46-68.ent.ia64", "3ES:httpd-debuginfo-0:2.0.46-68.ent.ppc", "3ES:httpd-debuginfo-0:2.0.46-68.ent.s390", "3ES:httpd-debuginfo-0:2.0.46-68.ent.s390x", "3ES:httpd-debuginfo-0:2.0.46-68.ent.x86_64", "3ES:httpd-devel-0:2.0.46-68.ent.i386", "3ES:httpd-devel-0:2.0.46-68.ent.ia64", "3ES:httpd-devel-0:2.0.46-68.ent.ppc", "3ES:httpd-devel-0:2.0.46-68.ent.s390", "3ES:httpd-devel-0:2.0.46-68.ent.s390x", "3ES:httpd-devel-0:2.0.46-68.ent.x86_64", "3ES:mod_ssl-1:2.0.46-68.ent.i386", "3ES:mod_ssl-1:2.0.46-68.ent.ia64", "3ES:mod_ssl-1:2.0.46-68.ent.ppc", "3ES:mod_ssl-1:2.0.46-68.ent.s390", "3ES:mod_ssl-1:2.0.46-68.ent.s390x", "3ES:mod_ssl-1:2.0.46-68.ent.x86_64", "3WS:httpd-0:2.0.46-68.ent.i386", "3WS:httpd-0:2.0.46-68.ent.ia64", "3WS:httpd-0:2.0.46-68.ent.ppc", "3WS:httpd-0:2.0.46-68.ent.s390", "3WS:httpd-0:2.0.46-68.ent.s390x", "3WS:httpd-0:2.0.46-68.ent.src", "3WS:httpd-0:2.0.46-68.ent.x86_64", "3WS:httpd-debuginfo-0:2.0.46-68.ent.i386", "3WS:httpd-debuginfo-0:2.0.46-68.ent.ia64", "3WS:httpd-debuginfo-0:2.0.46-68.ent.ppc", "3WS:httpd-debuginfo-0:2.0.46-68.ent.s390", "3WS:httpd-debuginfo-0:2.0.46-68.ent.s390x", "3WS:httpd-debuginfo-0:2.0.46-68.ent.x86_64", "3WS:httpd-devel-0:2.0.46-68.ent.i386", "3WS:httpd-devel-0:2.0.46-68.ent.ia64", "3WS:httpd-devel-0:2.0.46-68.ent.ppc", "3WS:httpd-devel-0:2.0.46-68.ent.s390", "3WS:httpd-devel-0:2.0.46-68.ent.s390x", "3WS:httpd-devel-0:2.0.46-68.ent.x86_64", "3WS:mod_ssl-1:2.0.46-68.ent.i386", "3WS:mod_ssl-1:2.0.46-68.ent.ia64", "3WS:mod_ssl-1:2.0.46-68.ent.ppc", "3WS:mod_ssl-1:2.0.46-68.ent.s390", "3WS:mod_ssl-1:2.0.46-68.ent.s390x", "3WS:mod_ssl-1:2.0.46-68.ent.x86_64", "4AS:httpd-0:2.0.52-32.3.ent.i386", "4AS:httpd-0:2.0.52-32.3.ent.ia64", "4AS:httpd-0:2.0.52-32.3.ent.ppc", "4AS:httpd-0:2.0.52-32.3.ent.s390", "4AS:httpd-0:2.0.52-32.3.ent.s390x", "4AS:httpd-0:2.0.52-32.3.ent.src", "4AS:httpd-0:2.0.52-32.3.ent.x86_64", "4AS:httpd-debuginfo-0:2.0.52-32.3.ent.i386", "4AS:httpd-debuginfo-0:2.0.52-32.3.ent.ia64", "4AS:httpd-debuginfo-0:2.0.52-32.3.ent.ppc", "4AS:httpd-debuginfo-0:2.0.52-32.3.ent.s390", "4AS:httpd-debuginfo-0:2.0.52-32.3.ent.s390x", "4AS:httpd-debuginfo-0:2.0.52-32.3.ent.x86_64", "4AS:httpd-devel-0:2.0.52-32.3.ent.i386", "4AS:httpd-devel-0:2.0.52-32.3.ent.ia64", "4AS:httpd-devel-0:2.0.52-32.3.ent.ppc", "4AS:httpd-devel-0:2.0.52-32.3.ent.s390", "4AS:httpd-devel-0:2.0.52-32.3.ent.s390x", "4AS:httpd-devel-0:2.0.52-32.3.ent.x86_64", "4AS:httpd-manual-0:2.0.52-32.3.ent.i386", "4AS:httpd-manual-0:2.0.52-32.3.ent.ia64", "4AS:httpd-manual-0:2.0.52-32.3.ent.ppc", "4AS:httpd-manual-0:2.0.52-32.3.ent.s390", "4AS:httpd-manual-0:2.0.52-32.3.ent.s390x", "4AS:httpd-manual-0:2.0.52-32.3.ent.x86_64", "4AS:httpd-suexec-0:2.0.52-32.3.ent.i386", "4AS:httpd-suexec-0:2.0.52-32.3.ent.ia64", "4AS:httpd-suexec-0:2.0.52-32.3.ent.ppc", "4AS:httpd-suexec-0:2.0.52-32.3.ent.s390", "4AS:httpd-suexec-0:2.0.52-32.3.ent.s390x", "4AS:httpd-suexec-0:2.0.52-32.3.ent.x86_64", "4AS:mod_ssl-1:2.0.52-32.3.ent.i386", "4AS:mod_ssl-1:2.0.52-32.3.ent.ia64", "4AS:mod_ssl-1:2.0.52-32.3.ent.ppc", "4AS:mod_ssl-1:2.0.52-32.3.ent.s390", "4AS:mod_ssl-1:2.0.52-32.3.ent.s390x", "4AS:mod_ssl-1:2.0.52-32.3.ent.x86_64", "4Desktop:httpd-0:2.0.52-32.3.ent.i386", "4Desktop:httpd-0:2.0.52-32.3.ent.ia64", "4Desktop:httpd-0:2.0.52-32.3.ent.ppc", "4Desktop:httpd-0:2.0.52-32.3.ent.s390", "4Desktop:httpd-0:2.0.52-32.3.ent.s390x", "4Desktop:httpd-0:2.0.52-32.3.ent.src", "4Desktop:httpd-0:2.0.52-32.3.ent.x86_64", "4Desktop:httpd-debuginfo-0:2.0.52-32.3.ent.i386", "4Desktop:httpd-debuginfo-0:2.0.52-32.3.ent.ia64", "4Desktop:httpd-debuginfo-0:2.0.52-32.3.ent.ppc", "4Desktop:httpd-debuginfo-0:2.0.52-32.3.ent.s390", "4Desktop:httpd-debuginfo-0:2.0.52-32.3.ent.s390x", "4Desktop:httpd-debuginfo-0:2.0.52-32.3.ent.x86_64", "4Desktop:httpd-devel-0:2.0.52-32.3.ent.i386", "4Desktop:httpd-devel-0:2.0.52-32.3.ent.ia64", "4Desktop:httpd-devel-0:2.0.52-32.3.ent.ppc", "4Desktop:httpd-devel-0:2.0.52-32.3.ent.s390", "4Desktop:httpd-devel-0:2.0.52-32.3.ent.s390x", "4Desktop:httpd-devel-0:2.0.52-32.3.ent.x86_64", "4Desktop:httpd-manual-0:2.0.52-32.3.ent.i386", "4Desktop:httpd-manual-0:2.0.52-32.3.ent.ia64", "4Desktop:httpd-manual-0:2.0.52-32.3.ent.ppc", "4Desktop:httpd-manual-0:2.0.52-32.3.ent.s390", "4Desktop:httpd-manual-0:2.0.52-32.3.ent.s390x", "4Desktop:httpd-manual-0:2.0.52-32.3.ent.x86_64", "4Desktop:httpd-suexec-0:2.0.52-32.3.ent.i386", "4Desktop:httpd-suexec-0:2.0.52-32.3.ent.ia64", "4Desktop:httpd-suexec-0:2.0.52-32.3.ent.ppc", "4Desktop:httpd-suexec-0:2.0.52-32.3.ent.s390", "4Desktop:httpd-suexec-0:2.0.52-32.3.ent.s390x", "4Desktop:httpd-suexec-0:2.0.52-32.3.ent.x86_64", "4Desktop:mod_ssl-1:2.0.52-32.3.ent.i386", "4Desktop:mod_ssl-1:2.0.52-32.3.ent.ia64", "4Desktop:mod_ssl-1:2.0.52-32.3.ent.ppc", "4Desktop:mod_ssl-1:2.0.52-32.3.ent.s390", "4Desktop:mod_ssl-1:2.0.52-32.3.ent.s390x", "4Desktop:mod_ssl-1:2.0.52-32.3.ent.x86_64", "4ES:httpd-0:2.0.52-32.3.ent.i386", "4ES:httpd-0:2.0.52-32.3.ent.ia64", "4ES:httpd-0:2.0.52-32.3.ent.ppc", "4ES:httpd-0:2.0.52-32.3.ent.s390", "4ES:httpd-0:2.0.52-32.3.ent.s390x", "4ES:httpd-0:2.0.52-32.3.ent.src", "4ES:httpd-0:2.0.52-32.3.ent.x86_64", "4ES:httpd-debuginfo-0:2.0.52-32.3.ent.i386", "4ES:httpd-debuginfo-0:2.0.52-32.3.ent.ia64", "4ES:httpd-debuginfo-0:2.0.52-32.3.ent.ppc", "4ES:httpd-debuginfo-0:2.0.52-32.3.ent.s390", "4ES:httpd-debuginfo-0:2.0.52-32.3.ent.s390x", "4ES:httpd-debuginfo-0:2.0.52-32.3.ent.x86_64", "4ES:httpd-devel-0:2.0.52-32.3.ent.i386", "4ES:httpd-devel-0:2.0.52-32.3.ent.ia64", "4ES:httpd-devel-0:2.0.52-32.3.ent.ppc", "4ES:httpd-devel-0:2.0.52-32.3.ent.s390", "4ES:httpd-devel-0:2.0.52-32.3.ent.s390x", "4ES:httpd-devel-0:2.0.52-32.3.ent.x86_64", "4ES:httpd-manual-0:2.0.52-32.3.ent.i386", "4ES:httpd-manual-0:2.0.52-32.3.ent.ia64", "4ES:httpd-manual-0:2.0.52-32.3.ent.ppc", "4ES:httpd-manual-0:2.0.52-32.3.ent.s390", "4ES:httpd-manual-0:2.0.52-32.3.ent.s390x", "4ES:httpd-manual-0:2.0.52-32.3.ent.x86_64", "4ES:httpd-suexec-0:2.0.52-32.3.ent.i386", "4ES:httpd-suexec-0:2.0.52-32.3.ent.ia64", "4ES:httpd-suexec-0:2.0.52-32.3.ent.ppc", "4ES:httpd-suexec-0:2.0.52-32.3.ent.s390", "4ES:httpd-suexec-0:2.0.52-32.3.ent.s390x", "4ES:httpd-suexec-0:2.0.52-32.3.ent.x86_64", "4ES:mod_ssl-1:2.0.52-32.3.ent.i386", "4ES:mod_ssl-1:2.0.52-32.3.ent.ia64", "4ES:mod_ssl-1:2.0.52-32.3.ent.ppc", "4ES:mod_ssl-1:2.0.52-32.3.ent.s390", "4ES:mod_ssl-1:2.0.52-32.3.ent.s390x", "4ES:mod_ssl-1:2.0.52-32.3.ent.x86_64", "4WS:httpd-0:2.0.52-32.3.ent.i386", "4WS:httpd-0:2.0.52-32.3.ent.ia64", "4WS:httpd-0:2.0.52-32.3.ent.ppc", "4WS:httpd-0:2.0.52-32.3.ent.s390", "4WS:httpd-0:2.0.52-32.3.ent.s390x", "4WS:httpd-0:2.0.52-32.3.ent.src", "4WS:httpd-0:2.0.52-32.3.ent.x86_64", "4WS:httpd-debuginfo-0:2.0.52-32.3.ent.i386", "4WS:httpd-debuginfo-0:2.0.52-32.3.ent.ia64", "4WS:httpd-debuginfo-0:2.0.52-32.3.ent.ppc", "4WS:httpd-debuginfo-0:2.0.52-32.3.ent.s390", "4WS:httpd-debuginfo-0:2.0.52-32.3.ent.s390x", "4WS:httpd-debuginfo-0:2.0.52-32.3.ent.x86_64", "4WS:httpd-devel-0:2.0.52-32.3.ent.i386", "4WS:httpd-devel-0:2.0.52-32.3.ent.ia64", "4WS:httpd-devel-0:2.0.52-32.3.ent.ppc", "4WS:httpd-devel-0:2.0.52-32.3.ent.s390", "4WS:httpd-devel-0:2.0.52-32.3.ent.s390x", "4WS:httpd-devel-0:2.0.52-32.3.ent.x86_64", "4WS:httpd-manual-0:2.0.52-32.3.ent.i386", "4WS:httpd-manual-0:2.0.52-32.3.ent.ia64", "4WS:httpd-manual-0:2.0.52-32.3.ent.ppc", "4WS:httpd-manual-0:2.0.52-32.3.ent.s390", "4WS:httpd-manual-0:2.0.52-32.3.ent.s390x", "4WS:httpd-manual-0:2.0.52-32.3.ent.x86_64", "4WS:httpd-suexec-0:2.0.52-32.3.ent.i386", "4WS:httpd-suexec-0:2.0.52-32.3.ent.ia64", "4WS:httpd-suexec-0:2.0.52-32.3.ent.ppc", "4WS:httpd-suexec-0:2.0.52-32.3.ent.s390", "4WS:httpd-suexec-0:2.0.52-32.3.ent.s390x", "4WS:httpd-suexec-0:2.0.52-32.3.ent.x86_64", "4WS:mod_ssl-1:2.0.52-32.3.ent.i386", "4WS:mod_ssl-1:2.0.52-32.3.ent.ia64", "4WS:mod_ssl-1:2.0.52-32.3.ent.ppc", "4WS:mod_ssl-1:2.0.52-32.3.ent.s390", "4WS:mod_ssl-1:2.0.52-32.3.ent.s390x", "4WS:mod_ssl-1:2.0.52-32.3.ent.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2007:0662", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "httpd scoreboard lack of PID protection", }, ], }
rhsa-2008:0524
Vulnerability from csaf_redhat
Published
2008-06-30 15:33
Modified
2025-01-26 19:36
Summary
Red Hat Security Advisory: Red Hat Network Satellite Server security update
Notes
Topic
Red Hat Network Satellite Server version 4.2.3 is now available. This
update includes fixes for a number of security issues in Red Hat Network
Satellite Server components.
This update has been rated as having low security impact by the Red Hat
Security Response Team.
Details
This release corrects several security vulnerabilities in various
components shipped as part of the Red Hat Network Satellite Server 4.2. In
a typical operating environment, these components are not exposed to users
of Satellite Server in a vulnerable manner. These security updates will
reduce risk in unique Satellite Server environments.
Multiple flaws were fixed in the Apache HTTPD server. These flaws could
result in a cross-site scripting, denial-of-service, or information
disclosure attacks. (CVE-2004-0885, CVE-2006-5752, CVE-2006-7197,
CVE-2007-1860, CVE-2007-3304, CVE-2007-4465, CVE-2007-5000, CVE-2007-6388)
A denial-of-service flaw was fixed in mod_perl. (CVE-2007-1349)
A denial-of-service flaw was fixed in the jabberd server. (CVE-2006-1329)
Multiple cross-site scripting flaws were fixed in the image map feature in
the JFreeChart package. (CVE-2007-6306)
Multiple flaws were fixed in the IBM Java 1.4.2 Runtime. (CVE-2007-0243,
CVE-2007-2435, CVE-2007-2788, CVE-2007-2789)
Multiple flaws were fixed in the OpenMotif package. (CVE-2004-0687,
CVE-2004-0688, CVE-2004-0914, CVE-2005-3964, CVE-2005-0605)
A flaw which could result in weak encryption was fixed in the
perl-Crypt-CBC package. (CVE-2006-0898)
Multiple flaws were fixed in the Tomcat package. (CVE-2008-0128,
CVE-2007-5461, CVE-2007-3385, CVE-2007-3382, CVE-2007-1358, CVE-2007-1355,
CVE-2007-2450, CVE-2007-2449, CVE-2007-0450, CVE-2006-7196, CVE-2006-7195,
CVE-2006-3835, CVE-2006-0254, CVE-2005-2090, CVE-2005-4838, CVE-2005-3510)
Users of Red Hat Network Satellite Server 4.2 are advised to upgrade to
4.2.3, which resolves these issues.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ document: { aggregate_severity: { namespace: "https://access.redhat.com/security/updates/classification/", text: "Low", }, category: "csaf_security_advisory", csaf_version: "2.0", distribution: { text: "Copyright © Red Hat, Inc. All rights reserved.", tlp: { label: "WHITE", url: "https://www.first.org/tlp/", }, }, lang: "en", notes: [ { category: "summary", text: "Red Hat Network Satellite Server version 4.2.3 is now available. This\nupdate includes fixes for a number of security issues in Red Hat Network\nSatellite Server components.\n\nThis update has been rated as having low security impact by the Red Hat\nSecurity Response Team.", title: "Topic", }, { category: "general", text: "This release corrects several security vulnerabilities in various\ncomponents shipped as part of the Red Hat Network Satellite Server 4.2. In\na typical operating environment, these components are not exposed to users\nof Satellite Server in a vulnerable manner. These security updates will\nreduce risk in unique Satellite Server environments.\n\nMultiple flaws were fixed in the Apache HTTPD server. These flaws could\nresult in a cross-site scripting, denial-of-service, or information\ndisclosure attacks. (CVE-2004-0885, CVE-2006-5752, CVE-2006-7197,\nCVE-2007-1860, CVE-2007-3304, CVE-2007-4465, CVE-2007-5000, CVE-2007-6388)\n\nA denial-of-service flaw was fixed in mod_perl. (CVE-2007-1349)\n\nA denial-of-service flaw was fixed in the jabberd server. (CVE-2006-1329)\n\nMultiple cross-site scripting flaws were fixed in the image map feature in\nthe JFreeChart package. (CVE-2007-6306)\n\nMultiple flaws were fixed in the IBM Java 1.4.2 Runtime. (CVE-2007-0243,\nCVE-2007-2435, CVE-2007-2788, CVE-2007-2789)\n\nMultiple flaws were fixed in the OpenMotif package. (CVE-2004-0687,\nCVE-2004-0688, CVE-2004-0914, CVE-2005-3964, CVE-2005-0605)\n\nA flaw which could result in weak encryption was fixed in the\nperl-Crypt-CBC package. (CVE-2006-0898)\n\nMultiple flaws were fixed in the Tomcat package. (CVE-2008-0128,\nCVE-2007-5461, CVE-2007-3385, CVE-2007-3382, CVE-2007-1358, CVE-2007-1355,\nCVE-2007-2450, CVE-2007-2449, CVE-2007-0450, CVE-2006-7196, CVE-2006-7195,\nCVE-2006-3835, CVE-2006-0254, CVE-2005-2090, CVE-2005-4838, CVE-2005-3510)\n\nUsers of Red Hat Network Satellite Server 4.2 are advised to upgrade to\n4.2.3, which resolves these issues.", title: "Details", }, { category: "legal_disclaimer", text: "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", title: "Terms of Use", }, ], publisher: { category: "vendor", contact_details: "https://access.redhat.com/security/team/contact/", issuing_authority: "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", name: "Red Hat Product Security", namespace: "https://www.redhat.com", }, references: [ { category: "self", summary: "https://access.redhat.com/errata/RHSA-2008:0524", url: "https://access.redhat.com/errata/RHSA-2008:0524", }, { category: "external", summary: "https://access.redhat.com/security/updates/classification/#low", url: "https://access.redhat.com/security/updates/classification/#low", }, { category: "external", summary: "449337", url: "https://bugzilla.redhat.com/show_bug.cgi?id=449337", }, { category: "self", summary: "Canonical URL", url: "https://security.access.redhat.com/data/csaf/v2/advisories/2008/rhsa-2008_0524.json", }, ], title: "Red Hat Security Advisory: Red Hat Network Satellite Server security update", tracking: { current_release_date: "2025-01-26T19:36:01+00:00", generator: { date: "2025-01-26T19:36:01+00:00", engine: { name: "Red Hat SDEngine", version: "4.2.6", }, }, id: "RHSA-2008:0524", initial_release_date: "2008-06-30T15:33:00+00:00", revision_history: [ { date: "2008-06-30T15:33:00+00:00", number: "1", summary: "Initial version", }, { date: "2008-06-30T11:33:26+00:00", number: "2", summary: "Last updated version", }, { date: "2025-01-26T19:36:01+00:00", number: "3", summary: "Last generated version", }, ], status: "final", version: "3", }, }, product_tree: { branches: [ { branches: [ { branches: [ { category: "product_name", name: "Red Hat Satellite v 4.2 (RHEL v.3 AS)", product: { name: "Red Hat Satellite v 4.2 (RHEL v.3 AS)", product_id: "3AS-RHNSAT4.2", product_identification_helper: { cpe: "cpe:/a:redhat:network_satellite:4.2::el3", }, }, }, { category: "product_name", name: "Red Hat Satellite v 4.2 (RHEL v.4 AS)", product: { name: "Red Hat Satellite v 4.2 (RHEL v.4 AS)", product_id: "4AS-RHNSAT4.2", product_identification_helper: { cpe: "cpe:/a:redhat:network_satellite:4.2::el4", }, }, }, ], category: "product_family", name: "Red Hat Satellite", }, { branches: [ { category: "product_version", name: "jabberd-0:2.0s10-3.37.rhn.i386", product: { name: "jabberd-0:2.0s10-3.37.rhn.i386", product_id: "jabberd-0:2.0s10-3.37.rhn.i386", product_identification_helper: { purl: "pkg:rpm/redhat/jabberd@2.0s10-3.37.rhn?arch=i386", }, }, }, { category: "product_version", name: "java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", product: { name: "java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", product_id: "java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", product_identification_helper: { purl: "pkg:rpm/redhat/java-1.4.2-ibm-devel@1.4.2.10-1jpp.2.el3?arch=i386", }, }, }, { category: "product_version", name: "java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", product: { name: "java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", product_id: "java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", product_identification_helper: { purl: "pkg:rpm/redhat/java-1.4.2-ibm@1.4.2.10-1jpp.2.el3?arch=i386", }, }, }, { category: "product_version", name: "rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", product: { name: "rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", product_id: "rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", product_identification_helper: { purl: "pkg:rpm/redhat/rhn-modjk-ap13@1.2.23-2rhn.rhel3?arch=i386", }, }, }, { category: "product_version", name: "openmotif21-0:2.1.30-9.RHEL3.8.i386", product: { name: "openmotif21-0:2.1.30-9.RHEL3.8.i386", product_id: "openmotif21-0:2.1.30-9.RHEL3.8.i386", product_identification_helper: { purl: "pkg:rpm/redhat/openmotif21@2.1.30-9.RHEL3.8?arch=i386", }, }, }, { category: "product_version", name: "openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", product: { name: "openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", product_id: "openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", product_identification_helper: { purl: "pkg:rpm/redhat/openmotif21-debuginfo@2.1.30-9.RHEL3.8?arch=i386", }, }, }, { category: "product_version", name: "rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", product: { name: "rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", product_id: "rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", product_identification_helper: { purl: "pkg:rpm/redhat/rhn-modssl@2.8.12-8.rhn.10.rhel3?arch=i386", }, }, }, { category: "product_version", name: "rhn-apache-0:1.3.27-36.rhn.rhel3.i386", product: { name: "rhn-apache-0:1.3.27-36.rhn.rhel3.i386", product_id: "rhn-apache-0:1.3.27-36.rhn.rhel3.i386", product_identification_helper: { purl: "pkg:rpm/redhat/rhn-apache@1.3.27-36.rhn.rhel3?arch=i386", }, }, }, { category: "product_version", name: "rhn-modperl-0:1.29-16.rhel3.i386", product: { name: "rhn-modperl-0:1.29-16.rhel3.i386", product_id: "rhn-modperl-0:1.29-16.rhel3.i386", product_identification_helper: { purl: "pkg:rpm/redhat/rhn-modperl@1.29-16.rhel3?arch=i386", }, }, }, { category: "product_version", name: "rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", product: { name: "rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", product_id: "rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", product_identification_helper: { purl: "pkg:rpm/redhat/rhn-modssl@2.8.12-8.rhn.10.rhel4?arch=i386", }, }, }, { category: "product_version", name: "jabberd-0:2.0s10-3.38.rhn.i386", product: { name: "jabberd-0:2.0s10-3.38.rhn.i386", product_id: "jabberd-0:2.0s10-3.38.rhn.i386", product_identification_helper: { purl: "pkg:rpm/redhat/jabberd@2.0s10-3.38.rhn?arch=i386", }, }, }, { category: "product_version", name: "openmotif21-0:2.1.30-11.RHEL4.6.i386", product: { name: "openmotif21-0:2.1.30-11.RHEL4.6.i386", product_id: "openmotif21-0:2.1.30-11.RHEL4.6.i386", product_identification_helper: { purl: "pkg:rpm/redhat/openmotif21@2.1.30-11.RHEL4.6?arch=i386", }, }, }, { category: "product_version", name: "openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", product: { name: "openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", product_id: "openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", product_identification_helper: { purl: "pkg:rpm/redhat/openmotif21-debuginfo@2.1.30-11.RHEL4.6?arch=i386", }, }, }, { category: "product_version", name: "rhn-apache-0:1.3.27-36.rhn.rhel4.i386", product: { name: "rhn-apache-0:1.3.27-36.rhn.rhel4.i386", product_id: "rhn-apache-0:1.3.27-36.rhn.rhel4.i386", product_identification_helper: { purl: "pkg:rpm/redhat/rhn-apache@1.3.27-36.rhn.rhel4?arch=i386", }, }, }, { category: "product_version", name: "java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", product: { name: "java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", product_id: "java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", product_identification_helper: { purl: "pkg:rpm/redhat/java-1.4.2-ibm@1.4.2.10-1jpp.2.el4?arch=i386", }, }, }, { category: "product_version", name: "java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", product: { name: "java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", product_id: "java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", product_identification_helper: { purl: "pkg:rpm/redhat/java-1.4.2-ibm-devel@1.4.2.10-1jpp.2.el4?arch=i386", }, }, }, { category: "product_version", name: "rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", product: { name: "rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", product_id: "rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", product_identification_helper: { purl: "pkg:rpm/redhat/rhn-modjk-ap13@1.2.23-2rhn.rhel4?arch=i386", }, }, }, { category: "product_version", name: "rhn-modperl-0:1.29-16.rhel4.i386", product: { name: "rhn-modperl-0:1.29-16.rhel4.i386", product_id: "rhn-modperl-0:1.29-16.rhel4.i386", product_identification_helper: { purl: "pkg:rpm/redhat/rhn-modperl@1.29-16.rhel4?arch=i386", }, }, }, ], category: "architecture", name: "i386", }, { branches: [ { category: "product_version", name: "jfreechart-0:0.9.20-3.rhn.noarch", product: { name: "jfreechart-0:0.9.20-3.rhn.noarch", product_id: "jfreechart-0:0.9.20-3.rhn.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/jfreechart@0.9.20-3.rhn?arch=noarch", }, }, }, { category: "product_version", name: "tomcat5-0:5.0.30-0jpp_10rh.noarch", product: { name: "tomcat5-0:5.0.30-0jpp_10rh.noarch", product_id: "tomcat5-0:5.0.30-0jpp_10rh.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/tomcat5@5.0.30-0jpp_10rh?arch=noarch", }, }, }, { category: "product_version", name: "perl-Crypt-CBC-0:2.24-1.el3.noarch", product: { name: "perl-Crypt-CBC-0:2.24-1.el3.noarch", product_id: "perl-Crypt-CBC-0:2.24-1.el3.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/perl-Crypt-CBC@2.24-1.el3?arch=noarch", }, }, }, { category: "product_version", name: "perl-Crypt-CBC-0:2.24-1.el4.noarch", product: { name: "perl-Crypt-CBC-0:2.24-1.el4.noarch", product_id: "perl-Crypt-CBC-0:2.24-1.el4.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/perl-Crypt-CBC@2.24-1.el4?arch=noarch", }, }, }, ], category: "architecture", name: "noarch", }, ], category: "vendor", name: "Red Hat", }, ], relationships: [ { category: "default_component_of", full_product_name: { name: "jabberd-0:2.0s10-3.37.rhn.i386 as a component of Red Hat Satellite v 4.2 (RHEL v.3 AS)", product_id: "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", }, product_reference: "jabberd-0:2.0s10-3.37.rhn.i386", relates_to_product_reference: "3AS-RHNSAT4.2", }, { category: "default_component_of", full_product_name: { name: "java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386 as a component of Red Hat Satellite v 4.2 (RHEL v.3 AS)", product_id: "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", }, product_reference: "java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", relates_to_product_reference: "3AS-RHNSAT4.2", }, { category: "default_component_of", full_product_name: { name: "java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386 as a component of Red Hat Satellite v 4.2 (RHEL v.3 AS)", product_id: "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", }, product_reference: "java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", relates_to_product_reference: "3AS-RHNSAT4.2", }, { category: "default_component_of", full_product_name: { name: "jfreechart-0:0.9.20-3.rhn.noarch as a component of Red Hat Satellite v 4.2 (RHEL v.3 AS)", product_id: "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", }, product_reference: "jfreechart-0:0.9.20-3.rhn.noarch", relates_to_product_reference: "3AS-RHNSAT4.2", }, { category: "default_component_of", full_product_name: { name: "openmotif21-0:2.1.30-9.RHEL3.8.i386 as a component of Red Hat Satellite v 4.2 (RHEL v.3 AS)", product_id: "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", }, product_reference: "openmotif21-0:2.1.30-9.RHEL3.8.i386", relates_to_product_reference: "3AS-RHNSAT4.2", }, { category: "default_component_of", full_product_name: { name: "openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386 as a component of Red Hat Satellite v 4.2 (RHEL v.3 AS)", product_id: "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", }, product_reference: "openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", relates_to_product_reference: "3AS-RHNSAT4.2", }, { category: "default_component_of", full_product_name: { name: "perl-Crypt-CBC-0:2.24-1.el3.noarch as a component of Red Hat Satellite v 4.2 (RHEL v.3 AS)", product_id: "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", }, product_reference: "perl-Crypt-CBC-0:2.24-1.el3.noarch", relates_to_product_reference: "3AS-RHNSAT4.2", }, { category: "default_component_of", full_product_name: { name: "rhn-apache-0:1.3.27-36.rhn.rhel3.i386 as a component of Red Hat Satellite v 4.2 (RHEL v.3 AS)", product_id: "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", }, product_reference: "rhn-apache-0:1.3.27-36.rhn.rhel3.i386", relates_to_product_reference: "3AS-RHNSAT4.2", }, { category: "default_component_of", full_product_name: { name: "rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386 as a component of Red Hat Satellite v 4.2 (RHEL v.3 AS)", product_id: "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", }, product_reference: "rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", relates_to_product_reference: "3AS-RHNSAT4.2", }, { category: "default_component_of", full_product_name: { name: "rhn-modperl-0:1.29-16.rhel3.i386 as a component of Red Hat Satellite v 4.2 (RHEL v.3 AS)", product_id: "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", }, product_reference: "rhn-modperl-0:1.29-16.rhel3.i386", relates_to_product_reference: "3AS-RHNSAT4.2", }, { category: "default_component_of", full_product_name: { name: "rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386 as a component of Red Hat Satellite v 4.2 (RHEL v.3 AS)", product_id: "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", }, product_reference: "rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", relates_to_product_reference: "3AS-RHNSAT4.2", }, { category: "default_component_of", full_product_name: { name: "tomcat5-0:5.0.30-0jpp_10rh.noarch as a component of Red Hat Satellite v 4.2 (RHEL v.3 AS)", product_id: "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", }, product_reference: "tomcat5-0:5.0.30-0jpp_10rh.noarch", relates_to_product_reference: "3AS-RHNSAT4.2", }, { category: "default_component_of", full_product_name: { name: "jabberd-0:2.0s10-3.38.rhn.i386 as a component of Red Hat Satellite v 4.2 (RHEL v.4 AS)", product_id: "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", }, product_reference: "jabberd-0:2.0s10-3.38.rhn.i386", relates_to_product_reference: "4AS-RHNSAT4.2", }, { category: "default_component_of", full_product_name: { name: "java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386 as a component of Red Hat Satellite v 4.2 (RHEL v.4 AS)", product_id: "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", }, product_reference: "java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", relates_to_product_reference: "4AS-RHNSAT4.2", }, { category: "default_component_of", full_product_name: { name: "java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386 as a component of Red Hat Satellite v 4.2 (RHEL v.4 AS)", product_id: "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", }, product_reference: "java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", relates_to_product_reference: "4AS-RHNSAT4.2", }, { category: "default_component_of", full_product_name: { name: "jfreechart-0:0.9.20-3.rhn.noarch as a component of Red Hat Satellite v 4.2 (RHEL v.4 AS)", product_id: "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", }, product_reference: "jfreechart-0:0.9.20-3.rhn.noarch", relates_to_product_reference: "4AS-RHNSAT4.2", }, { category: "default_component_of", full_product_name: { name: "openmotif21-0:2.1.30-11.RHEL4.6.i386 as a component of Red Hat Satellite v 4.2 (RHEL v.4 AS)", product_id: "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", }, product_reference: "openmotif21-0:2.1.30-11.RHEL4.6.i386", relates_to_product_reference: "4AS-RHNSAT4.2", }, { category: "default_component_of", full_product_name: { name: "openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386 as a component of Red Hat Satellite v 4.2 (RHEL v.4 AS)", product_id: "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", }, product_reference: "openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", relates_to_product_reference: "4AS-RHNSAT4.2", }, { category: "default_component_of", full_product_name: { name: "perl-Crypt-CBC-0:2.24-1.el4.noarch as a component of Red Hat Satellite v 4.2 (RHEL v.4 AS)", product_id: "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", }, product_reference: "perl-Crypt-CBC-0:2.24-1.el4.noarch", relates_to_product_reference: "4AS-RHNSAT4.2", }, { category: "default_component_of", full_product_name: { name: "rhn-apache-0:1.3.27-36.rhn.rhel4.i386 as a component of Red Hat Satellite v 4.2 (RHEL v.4 AS)", product_id: "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", }, product_reference: "rhn-apache-0:1.3.27-36.rhn.rhel4.i386", relates_to_product_reference: "4AS-RHNSAT4.2", }, { category: "default_component_of", full_product_name: { name: "rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386 as a component of Red Hat Satellite v 4.2 (RHEL v.4 AS)", product_id: "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", }, product_reference: "rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", relates_to_product_reference: "4AS-RHNSAT4.2", }, { category: "default_component_of", full_product_name: { name: "rhn-modperl-0:1.29-16.rhel4.i386 as a component of Red Hat Satellite v 4.2 (RHEL v.4 AS)", product_id: "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", }, product_reference: "rhn-modperl-0:1.29-16.rhel4.i386", relates_to_product_reference: "4AS-RHNSAT4.2", }, { category: "default_component_of", full_product_name: { name: "rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386 as a component of Red Hat Satellite v 4.2 (RHEL v.4 AS)", product_id: "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", }, product_reference: "rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", relates_to_product_reference: "4AS-RHNSAT4.2", }, { category: "default_component_of", full_product_name: { name: "tomcat5-0:5.0.30-0jpp_10rh.noarch as a component of Red Hat Satellite v 4.2 (RHEL v.4 AS)", product_id: "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", }, product_reference: "tomcat5-0:5.0.30-0jpp_10rh.noarch", relates_to_product_reference: "4AS-RHNSAT4.2", }, ], }, vulnerabilities: [ { cve: "CVE-2004-0687", ids: [ { system_name: "Red Hat Bugzilla ID", text: "430513", }, ], notes: [ { category: "description", text: "Multiple stack-based buffer overflows in (1) xpmParseColors in parse.c, (2) ParseAndPutPixels in create.c, and (3) ParsePixels in parse.c for libXpm before 6.8.1 allow remote attackers to execute arbitrary code via a malformed XPM image file.", title: "Vulnerability description", }, { category: "summary", text: "openmotif21 stack overflows in libxpm", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Enterprise Linux 5 is not vulnerable to this issue as it contains a backported patch.", title: "Statement", }, ], product_status: { fixed: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2004-0687", }, { category: "external", summary: "RHBZ#430513", url: "https://bugzilla.redhat.com/show_bug.cgi?id=430513", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2004-0687", url: "https://www.cve.org/CVERecord?id=CVE-2004-0687", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2004-0687", url: "https://nvd.nist.gov/vuln/detail/CVE-2004-0687", }, ], release_date: "2004-10-07T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-06-30T15:33:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0524", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "openmotif21 stack overflows in libxpm", }, { cve: "CVE-2004-0688", ids: [ { system_name: "Red Hat Bugzilla ID", text: "430515", }, ], notes: [ { category: "description", text: "Multiple integer overflows in (1) the xpmParseColors function in parse.c, (2) XpmCreateImageFromXpmImage, (3) CreateXImage, (4) ParsePixels, and (5) ParseAndPutPixels for libXpm before 6.8.1 may allow remote attackers to execute arbitrary code via a malformed XPM image file.", title: "Vulnerability description", }, { category: "summary", text: "openmotif21 stack overflows in libxpm", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Enterprise Linux 5 is not vulnerable to this issue as it contains a backported patch.", title: "Statement", }, ], product_status: { fixed: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2004-0688", }, { category: "external", summary: "RHBZ#430515", url: "https://bugzilla.redhat.com/show_bug.cgi?id=430515", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2004-0688", url: "https://www.cve.org/CVERecord?id=CVE-2004-0688", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2004-0688", url: "https://nvd.nist.gov/vuln/detail/CVE-2004-0688", }, ], release_date: "2004-09-15T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-06-30T15:33:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0524", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "openmotif21 stack overflows in libxpm", }, { cve: "CVE-2004-0885", ids: [ { system_name: "Red Hat Bugzilla ID", text: "430637", }, ], notes: [ { category: "description", text: "The mod_ssl module in Apache 2.0.35 through 2.0.52, when using the \"SSLCipherSuite\" directive in directory or location context, allows remote clients to bypass intended restrictions by using any cipher suite that is allowed by the virtual host configuration.", title: "Vulnerability description", }, { category: "summary", text: "mod_ssl SSLCipherSuite bypass", title: "Vulnerability summary", }, ], product_status: { fixed: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2004-0885", }, { category: "external", summary: "RHBZ#430637", url: "https://bugzilla.redhat.com/show_bug.cgi?id=430637", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2004-0885", url: "https://www.cve.org/CVERecord?id=CVE-2004-0885", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2004-0885", url: "https://nvd.nist.gov/vuln/detail/CVE-2004-0885", }, ], release_date: "2004-10-05T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-06-30T15:33:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0524", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "mod_ssl SSLCipherSuite bypass", }, { cve: "CVE-2004-0914", ids: [ { system_name: "Red Hat Bugzilla ID", text: "430516", }, ], notes: [ { category: "description", text: "Multiple vulnerabilities in libXpm for 6.8.1 and earlier, as used in XFree86 and other packages, include (1) multiple integer overflows, (2) out-of-bounds memory accesses, (3) directory traversal, (4) shell metacharacter, (5) endless loops, and (6) memory leaks, which could allow remote attackers to obtain sensitive information, cause a denial of service (application crash), or execute arbitrary code via a certain XPM image file. NOTE: it is highly likely that this candidate will be SPLIT into other candidates in the future, per CVE's content decisions.", title: "Vulnerability description", }, { category: "summary", text: "openmotif21 stack overflows in libxpm", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Enterprise Linux 5 is not vulnerable to this issue as it contains a backported patch.", title: "Statement", }, ], product_status: { fixed: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2004-0914", }, { category: "external", summary: "RHBZ#430516", url: "https://bugzilla.redhat.com/show_bug.cgi?id=430516", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2004-0914", url: "https://www.cve.org/CVERecord?id=CVE-2004-0914", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2004-0914", url: "https://nvd.nist.gov/vuln/detail/CVE-2004-0914", }, ], release_date: "2004-09-15T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-06-30T15:33:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0524", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "openmotif21 stack overflows in libxpm", }, { cve: "CVE-2005-0605", discovery_date: "2005-02-28T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "430520", }, ], notes: [ { category: "description", text: "scan.c for LibXPM may allow attackers to execute arbitrary code via a negative bitmap_unit value that leads to a buffer overflow.", title: "Vulnerability description", }, { category: "summary", text: "libxpm buffer overflow", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Enterprise Linux 5 is not vulnerable to this issue as it contains a backported patch.", title: "Statement", }, ], product_status: { fixed: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2005-0605", }, { category: "external", summary: "RHBZ#430520", url: "https://bugzilla.redhat.com/show_bug.cgi?id=430520", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2005-0605", url: "https://www.cve.org/CVERecord?id=CVE-2005-0605", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2005-0605", url: "https://nvd.nist.gov/vuln/detail/CVE-2005-0605", }, ], release_date: "2005-03-01T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-06-30T15:33:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0524", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "libxpm buffer overflow", }, { cve: "CVE-2005-2090", discovery_date: "2005-06-06T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "237079", }, ], notes: [ { category: "description", text: "Jakarta Tomcat 5.0.19 (Coyote/1.1) and Tomcat 4.1.24 (Coyote/1.0) allows remote attackers to poison the web cache, bypass web application firewall protection, and conduct XSS attacks via an HTTP request with both a \"Transfer-Encoding: chunked\" header and a Content-Length header, which causes Tomcat to incorrectly handle and forward the body of the request in a way that causes the receiving server to process it as a separate HTTP request, aka \"HTTP Request Smuggling.\"", title: "Vulnerability description", }, { category: "summary", text: "tomcat multiple content-length header poisioning", title: "Vulnerability summary", }, ], product_status: { fixed: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2005-2090", }, { category: "external", summary: "RHBZ#237079", url: "https://bugzilla.redhat.com/show_bug.cgi?id=237079", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2005-2090", url: "https://www.cve.org/CVERecord?id=CVE-2005-2090", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2005-2090", url: "https://nvd.nist.gov/vuln/detail/CVE-2005-2090", }, ], release_date: "2005-06-06T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-06-30T15:33:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0524", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "tomcat multiple content-length header poisioning", }, { cve: "CVE-2005-3510", discovery_date: "2005-11-07T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "237085", }, ], notes: [ { category: "description", text: "Apache Tomcat 5.5.0 to 5.5.11 allows remote attackers to cause a denial of service (CPU consumption) via a large number of simultaneous requests to list a web directory that has a large number of files.", title: "Vulnerability description", }, { category: "summary", text: "tomcat DoS", title: "Vulnerability summary", }, ], product_status: { fixed: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2005-3510", }, { category: "external", summary: "RHBZ#237085", url: "https://bugzilla.redhat.com/show_bug.cgi?id=237085", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2005-3510", url: "https://www.cve.org/CVERecord?id=CVE-2005-3510", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2005-3510", url: "https://nvd.nist.gov/vuln/detail/CVE-2005-3510", }, ], release_date: "2005-11-03T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-06-30T15:33:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0524", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "tomcat DoS", }, { cve: "CVE-2005-3964", discovery_date: "2005-12-02T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "430519", }, ], notes: [ { category: "description", text: "Multiple buffer overflows in libUil (libUil.so) in OpenMotif 2.2.3, and possibly other versions, allows attackers to execute arbitrary code via the (1) diag_issue_diagnostic function in UilDiags.c and (2) open_source_file function in UilSrcSrc.c.", title: "Vulnerability description", }, { category: "summary", text: "openmotif libUil buffer overflows", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Enterprise Linux 5 is not vulnerable to this issue as it contains a backported patch.", title: "Statement", }, ], product_status: { fixed: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2005-3964", }, { category: "external", summary: "RHBZ#430519", url: "https://bugzilla.redhat.com/show_bug.cgi?id=430519", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2005-3964", url: "https://www.cve.org/CVERecord?id=CVE-2005-3964", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2005-3964", url: "https://nvd.nist.gov/vuln/detail/CVE-2005-3964", }, ], release_date: "2005-12-02T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-06-30T15:33:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0524", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "openmotif libUil buffer overflows", }, { cve: "CVE-2005-4838", discovery_date: "2005-01-03T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "238401", }, ], notes: [ { category: "description", text: "Multiple cross-site scripting (XSS) vulnerabilities in the example web applications for Jakarta Tomcat 5.5.6 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) el/functions.jsp, (2) el/implicit-objects.jsp, and (3) jspx/textRotate.jspx in examples/jsp2/, as demonstrated via script in a request to snp/snoop.jsp. NOTE: other XSS issues in the manager were simultaneously reported, but these require admin access and do not cross privilege boundaries.", title: "Vulnerability description", }, { category: "summary", text: "tomcat manager example DoS", title: "Vulnerability summary", }, ], product_status: { fixed: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2005-4838", }, { category: "external", summary: "RHBZ#238401", url: "https://bugzilla.redhat.com/show_bug.cgi?id=238401", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2005-4838", url: "https://www.cve.org/CVERecord?id=CVE-2005-4838", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2005-4838", url: "https://nvd.nist.gov/vuln/detail/CVE-2005-4838", }, ], release_date: "2005-01-03T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-06-30T15:33:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0524", }, ], threats: [ { category: "impact", details: "Low", }, ], title: "tomcat manager example DoS", }, { cve: "CVE-2006-0254", cwe: { id: "CWE-79", name: "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", }, discovery_date: "2006-01-17T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "430646", }, ], notes: [ { category: "description", text: "Multiple cross-site scripting (XSS) vulnerabilities in Apache Geronimo 1.0 allow remote attackers to inject arbitrary web script or HTML via the (1) time parameter to cal2.jsp and (2) any invalid parameter, which causes an XSS when the log file is viewed by the Web-Access-Log viewer.", title: "Vulnerability description", }, { category: "summary", text: "tomcat examples XSS", title: "Vulnerability summary", }, ], product_status: { fixed: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2006-0254", }, { category: "external", summary: "RHBZ#430646", url: "https://bugzilla.redhat.com/show_bug.cgi?id=430646", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2006-0254", url: "https://www.cve.org/CVERecord?id=CVE-2006-0254", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2006-0254", url: "https://nvd.nist.gov/vuln/detail/CVE-2006-0254", }, ], release_date: "2006-01-15T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-06-30T15:33:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0524", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "tomcat examples XSS", }, { cve: "CVE-2006-0898", ids: [ { system_name: "Red Hat Bugzilla ID", text: "430522", }, ], notes: [ { category: "description", text: "Crypt::CBC Perl module 2.16 and earlier, when running in RandomIV mode, uses an initialization vector (IV) of 8 bytes, which results in weaker encryption when used with a cipher that requires a larger block size than 8 bytes, such as Rijndael.", title: "Vulnerability description", }, { category: "summary", text: "perl-Crypt-CBC weaker encryption with some ciphers", title: "Vulnerability summary", }, ], product_status: { fixed: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2006-0898", }, { category: "external", summary: "RHBZ#430522", url: "https://bugzilla.redhat.com/show_bug.cgi?id=430522", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2006-0898", url: "https://www.cve.org/CVERecord?id=CVE-2006-0898", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2006-0898", url: "https://nvd.nist.gov/vuln/detail/CVE-2006-0898", }, ], release_date: "2006-02-23T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-06-30T15:33:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0524", }, ], threats: [ { category: "impact", details: "Low", }, ], title: "perl-Crypt-CBC weaker encryption with some ciphers", }, { cve: "CVE-2006-1329", ids: [ { system_name: "Red Hat Bugzilla ID", text: "429254", }, ], notes: [ { category: "description", text: "The SASL negotiation in Jabber Studio jabberd before 2.0s11 allows remote attackers to cause a denial of service (\"c2s segfault\") by sending a \"response stanza before an auth stanza\".", title: "Vulnerability description", }, { category: "summary", text: "jabberd SASL DoS", title: "Vulnerability summary", }, ], product_status: { fixed: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2006-1329", }, { category: "external", summary: "RHBZ#429254", url: "https://bugzilla.redhat.com/show_bug.cgi?id=429254", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2006-1329", url: "https://www.cve.org/CVERecord?id=CVE-2006-1329", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2006-1329", url: "https://nvd.nist.gov/vuln/detail/CVE-2006-1329", }, ], release_date: "2006-03-09T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-06-30T15:33:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0524", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "jabberd SASL DoS", }, { cve: "CVE-2006-3835", discovery_date: "2006-07-21T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "237084", }, ], notes: [ { category: "description", text: "Apache Tomcat 5 before 5.5.17 allows remote attackers to list directories via a semicolon (;) preceding a filename with a mapped extension, as demonstrated by URLs ending with /;index.jsp and /;help.do.", title: "Vulnerability description", }, { category: "summary", text: "tomcat directory listing issue", title: "Vulnerability summary", }, { category: "other", text: "This issue is not a security issue in Tomcat itself, but is caused when directory listings are enabled.\n\nDetails on how to disable directory listings are available at: http://tomcat.apache.org/faq/misc.html#listing", title: "Statement", }, ], product_status: { fixed: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2006-3835", }, { category: "external", summary: "RHBZ#237084", url: "https://bugzilla.redhat.com/show_bug.cgi?id=237084", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2006-3835", url: "https://www.cve.org/CVERecord?id=CVE-2006-3835", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2006-3835", url: "https://nvd.nist.gov/vuln/detail/CVE-2006-3835", }, ], release_date: "2006-07-21T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-06-30T15:33:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0524", }, ], threats: [ { category: "impact", details: "Low", }, ], title: "tomcat directory listing issue", }, { cve: "CVE-2006-5752", cwe: { id: "CWE-79", name: "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", }, discovery_date: "2007-06-20T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "245112", }, ], notes: [ { category: "description", text: "Cross-site scripting (XSS) vulnerability in mod_status.c in the mod_status module in Apache HTTP Server (httpd), when ExtendedStatus is enabled and a public server-status page is used, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors involving charsets with browsers that perform \"charset detection\" when the content-type is not specified.", title: "Vulnerability description", }, { category: "summary", text: "httpd mod_status XSS", title: "Vulnerability summary", }, ], product_status: { fixed: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2006-5752", }, { category: "external", summary: "RHBZ#245112", url: "https://bugzilla.redhat.com/show_bug.cgi?id=245112", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2006-5752", url: "https://www.cve.org/CVERecord?id=CVE-2006-5752", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2006-5752", url: "https://nvd.nist.gov/vuln/detail/CVE-2006-5752", }, ], release_date: "2007-06-20T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-06-30T15:33:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0524", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "httpd mod_status XSS", }, { cve: "CVE-2006-7195", cwe: { id: "CWE-79", name: "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", }, discovery_date: "2007-04-19T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "237081", }, ], notes: [ { category: "description", text: "Cross-site scripting (XSS) vulnerability in implicit-objects.jsp in Apache Tomcat 5.0.0 through 5.0.30 and 5.5.0 through 5.5.17 allows remote attackers to inject arbitrary web script or HTML via certain header values.", title: "Vulnerability description", }, { category: "summary", text: "tomcat XSS in example webapps", title: "Vulnerability summary", }, ], product_status: { fixed: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2006-7195", }, { category: "external", summary: "RHBZ#237081", url: "https://bugzilla.redhat.com/show_bug.cgi?id=237081", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2006-7195", url: "https://www.cve.org/CVERecord?id=CVE-2006-7195", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2006-7195", url: "https://nvd.nist.gov/vuln/detail/CVE-2006-7195", }, ], release_date: "2007-04-19T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-06-30T15:33:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0524", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "tomcat XSS in example webapps", }, { cve: "CVE-2006-7196", cwe: { id: "CWE-79", name: "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", }, discovery_date: "2007-04-26T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "238131", }, ], notes: [ { category: "description", text: "Cross-site scripting (XSS) vulnerability in the calendar application example in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0 through 4.1.31, 5.0.0 through 5.0.30, and 5.5.0 through 5.5.15 allows remote attackers to inject arbitrary web script or HTML via the time parameter to cal2.jsp and possibly unspecified other vectors. NOTE: this may be related to CVE-2006-0254.1.", title: "Vulnerability description", }, { category: "summary", text: "tomcat XSS in example webapps", title: "Vulnerability summary", }, ], product_status: { fixed: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2006-7196", }, { category: "external", summary: "RHBZ#238131", url: "https://bugzilla.redhat.com/show_bug.cgi?id=238131", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2006-7196", url: "https://www.cve.org/CVERecord?id=CVE-2006-7196", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2006-7196", url: "https://nvd.nist.gov/vuln/detail/CVE-2006-7196", }, ], release_date: "2007-04-26T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-06-30T15:33:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0524", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "tomcat XSS in example webapps", }, { cve: "CVE-2006-7197", ids: [ { system_name: "Red Hat Bugzilla ID", text: "430642", }, ], notes: [ { category: "description", text: "The AJP connector in Apache Tomcat 5.5.15 uses an incorrect length for chunks, which can cause a buffer over-read in the ajp_process_callback in mod_jk, which allows remote attackers to read portions of sensitive memory.", title: "Vulnerability description", }, { category: "summary", text: "mod_jk chunk too long", title: "Vulnerability summary", }, ], product_status: { fixed: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2006-7197", }, { category: "external", summary: "RHBZ#430642", url: "https://bugzilla.redhat.com/show_bug.cgi?id=430642", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2006-7197", url: "https://www.cve.org/CVERecord?id=CVE-2006-7197", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2006-7197", url: "https://nvd.nist.gov/vuln/detail/CVE-2006-7197", }, ], release_date: "2006-03-05T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-06-30T15:33:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0524", }, ], threats: [ { category: "impact", details: "Important", }, ], title: "mod_jk chunk too long", }, { cve: "CVE-2007-0243", discovery_date: "2007-04-17T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "325941", }, ], notes: [ { category: "description", text: "Buffer overflow in Sun JDK and Java Runtime Environment (JRE) 5.0 Update 9 and earlier, SDK and JRE 1.4.2_12 and earlier, and SDK and JRE 1.3.1_18 and earlier allows applets to gain privileges via a GIF image with a block with a 0 width field, which triggers memory corruption.", title: "Vulnerability description", }, { category: "summary", text: "java-jre: GIF buffer overflow", title: "Vulnerability summary", }, ], product_status: { fixed: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-0243", }, { category: "external", summary: "RHBZ#325941", url: "https://bugzilla.redhat.com/show_bug.cgi?id=325941", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-0243", url: "https://www.cve.org/CVERecord?id=CVE-2007-0243", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-0243", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-0243", }, ], release_date: "2007-01-17T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-06-30T15:33:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0524", }, ], threats: [ { category: "impact", details: "Important", }, ], title: "java-jre: GIF buffer overflow", }, { cve: "CVE-2007-0450", discovery_date: "2007-03-14T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "237080", }, ], notes: [ { category: "description", text: "Directory traversal vulnerability in Apache HTTP Server and Tomcat 5.x before 5.5.22 and 6.x before 6.0.10, when using certain proxy modules (mod_proxy, mod_rewrite, mod_jk), allows remote attackers to read arbitrary files via a .. (dot dot) sequence with combinations of (1) \"/\" (slash), (2) \"\\\" (backslash), and (3) URL-encoded backslash (%5C) characters in the URL, which are valid separators in Tomcat but not in Apache.", title: "Vulnerability description", }, { category: "summary", text: "tomcat directory traversal", title: "Vulnerability summary", }, ], product_status: { fixed: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-0450", }, { category: "external", summary: "RHBZ#237080", url: "https://bugzilla.redhat.com/show_bug.cgi?id=237080", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-0450", url: "https://www.cve.org/CVERecord?id=CVE-2007-0450", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-0450", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-0450", }, ], release_date: "2007-03-14T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-06-30T15:33:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0524", }, ], threats: [ { category: "impact", details: "Important", }, ], title: "tomcat directory traversal", }, { cve: "CVE-2007-1349", discovery_date: "2007-05-17T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "240423", }, ], notes: [ { category: "description", text: "PerlRun.pm in Apache mod_perl before 1.30, and RegistryCooker.pm in mod_perl 2.x, does not properly escape PATH_INFO before use in a regular expression, which allows remote attackers to cause a denial of service (resource consumption) via a crafted URI.", title: "Vulnerability description", }, { category: "summary", text: "mod_perl PerlRun denial of service", title: "Vulnerability summary", }, ], product_status: { fixed: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-1349", }, { category: "external", summary: "RHBZ#240423", url: "https://bugzilla.redhat.com/show_bug.cgi?id=240423", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-1349", url: "https://www.cve.org/CVERecord?id=CVE-2007-1349", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-1349", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-1349", }, ], release_date: "2007-03-22T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-06-30T15:33:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0524", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "mod_perl PerlRun denial of service", }, { cve: "CVE-2007-1355", cwe: { id: "CWE-79", name: "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", }, discovery_date: "2007-05-19T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "253166", }, ], notes: [ { category: "description", text: "Multiple cross-site scripting (XSS) vulnerabilities in the appdev/sample/web/hello.jsp example application in Tomcat 4.0.0 through 4.0.6, 4.1.0 through 4.1.36, 5.0.0 through 5.0.30, 5.5.0 through 5.5.23, and 6.0.0 through 6.0.10 allow remote attackers to inject arbitrary web script or HTML via the test parameter and unspecified vectors.", title: "Vulnerability description", }, { category: "summary", text: "tomcat XSS in samples", title: "Vulnerability summary", }, ], product_status: { fixed: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-1355", }, { category: "external", summary: "RHBZ#253166", url: "https://bugzilla.redhat.com/show_bug.cgi?id=253166", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-1355", url: "https://www.cve.org/CVERecord?id=CVE-2007-1355", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-1355", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-1355", }, ], release_date: "2007-05-19T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-06-30T15:33:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0524", }, ], threats: [ { category: "impact", details: "Low", }, ], title: "tomcat XSS in samples", }, { cve: "CVE-2007-1358", cwe: { id: "CWE-79", name: "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", }, discovery_date: "2007-04-10T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "244803", }, ], notes: [ { category: "description", text: "Cross-site scripting (XSS) vulnerability in certain applications using Apache Tomcat 4.0.0 through 4.0.6 and 4.1.0 through 4.1.34 allows remote attackers to inject arbitrary web script or HTML via crafted \"Accept-Language headers that do not conform to RFC 2616\".", title: "Vulnerability description", }, { category: "summary", text: "tomcat accept-language xss flaw", title: "Vulnerability summary", }, ], product_status: { fixed: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-1358", }, { category: "external", summary: "RHBZ#244803", url: "https://bugzilla.redhat.com/show_bug.cgi?id=244803", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-1358", url: "https://www.cve.org/CVERecord?id=CVE-2007-1358", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-1358", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-1358", }, ], release_date: "2007-06-06T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-06-30T15:33:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0524", }, ], threats: [ { category: "impact", details: "Low", }, ], title: "tomcat accept-language xss flaw", }, { cve: "CVE-2007-1860", discovery_date: "2007-04-20T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "237656", }, ], notes: [ { category: "description", text: "mod_jk in Apache Tomcat JK Web Server Connector 1.2.x before 1.2.23 decodes request URLs within the Apache HTTP Server before passing the URL to Tomcat, which allows remote attackers to access protected pages via a crafted prefix JkMount, possibly involving double-encoded .. (dot dot) sequences and directory traversal, a related issue to CVE-2007-0450.", title: "Vulnerability description", }, { category: "summary", text: "mod_jk sends decoded URL to tomcat", title: "Vulnerability summary", }, ], product_status: { fixed: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-1860", }, { category: "external", summary: "RHBZ#237656", url: "https://bugzilla.redhat.com/show_bug.cgi?id=237656", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-1860", url: "https://www.cve.org/CVERecord?id=CVE-2007-1860", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-1860", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-1860", }, ], release_date: "2007-05-21T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-06-30T15:33:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0524", }, ], threats: [ { category: "impact", details: "Important", }, ], title: "mod_jk sends decoded URL to tomcat", }, { cve: "CVE-2007-2435", discovery_date: "2007-05-01T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "239660", }, ], notes: [ { category: "description", text: "Sun Java Web Start in JDK and JRE 5.0 Update 10 and earlier, and Java Web Start in SDK and JRE 1.4.2_13 and earlier, allows remote attackers to perform unauthorized actions via an application that grants privileges to itself, related to \"Incorrect Use of System Classes\" and probably related to support for JNLP files.", title: "Vulnerability description", }, { category: "summary", text: "javaws vulnerabilities", title: "Vulnerability summary", }, ], product_status: { fixed: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-2435", }, { category: "external", summary: "RHBZ#239660", url: "https://bugzilla.redhat.com/show_bug.cgi?id=239660", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-2435", url: "https://www.cve.org/CVERecord?id=CVE-2007-2435", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-2435", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-2435", }, ], release_date: "2007-04-30T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-06-30T15:33:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0524", }, ], threats: [ { category: "impact", details: "Critical", }, ], title: "javaws vulnerabilities", }, { cve: "CVE-2007-2449", cwe: { id: "CWE-79", name: "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", }, discovery_date: "2007-05-24T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "244804", }, ], notes: [ { category: "description", text: "Multiple cross-site scripting (XSS) vulnerabilities in certain JSP files in the examples web application in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0 through 4.1.36, 5.0.0 through 5.0.30, 5.5.0 through 5.5.24, and 6.0.0 through 6.0.13 allow remote attackers to inject arbitrary web script or HTML via the portion of the URI after the ';' character, as demonstrated by a URI containing a \"snp/snoop.jsp;\" sequence.", title: "Vulnerability description", }, { category: "summary", text: "tomcat examples jsp XSS", title: "Vulnerability summary", }, ], product_status: { fixed: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-2449", }, { category: "external", summary: "RHBZ#244804", url: "https://bugzilla.redhat.com/show_bug.cgi?id=244804", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-2449", url: "https://www.cve.org/CVERecord?id=CVE-2007-2449", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-2449", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-2449", }, ], release_date: "2007-06-13T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-06-30T15:33:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0524", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "tomcat examples jsp XSS", }, { cve: "CVE-2007-2450", cwe: { id: "CWE-79", name: "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", }, discovery_date: "2007-05-24T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "244808", }, ], notes: [ { category: "description", text: "Multiple cross-site scripting (XSS) vulnerabilities in the (1) Manager and (2) Host Manager web applications in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0 through 4.1.36, 5.0.0 through 5.0.30, 5.5.0 through 5.5.24, and 6.0.0 through 6.0.13 allow remote authenticated users to inject arbitrary web script or HTML via a parameter name to manager/html/upload, and other unspecified vectors.", title: "Vulnerability description", }, { category: "summary", text: "tomcat host manager XSS", title: "Vulnerability summary", }, ], product_status: { fixed: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-2450", }, { category: "external", summary: "RHBZ#244808", url: "https://bugzilla.redhat.com/show_bug.cgi?id=244808", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-2450", url: "https://www.cve.org/CVERecord?id=CVE-2007-2450", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-2450", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-2450", }, ], release_date: "2007-06-13T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-06-30T15:33:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0524", }, ], threats: [ { category: "impact", details: "Low", }, ], title: "tomcat host manager XSS", }, { cve: "CVE-2007-2788", cwe: { id: "CWE-190", name: "Integer Overflow or Wraparound", }, discovery_date: "2007-05-21T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "250725", }, ], notes: [ { category: "description", text: "Integer overflow in the embedded ICC profile image parser in Sun Java Development Kit (JDK) before 1.5.0_11-b03 and 1.6.x before 1.6.0_01-b06, and Sun Java Runtime Environment in JDK and JRE 6, JDK and JRE 5.0 Update 10 and earlier, SDK and JRE 1.4.2_14 and earlier, and SDK and JRE 1.3.1_20 and earlier, allows remote attackers to execute arbitrary code or cause a denial of service (JVM crash) via a crafted JPEG or BMP file that triggers a buffer overflow.", title: "Vulnerability description", }, { category: "summary", text: "Integer overflow in the embedded ICC profile image parser in Sun Java Development Kit", title: "Vulnerability summary", }, ], product_status: { fixed: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-2788", }, { category: "external", summary: "RHBZ#250725", url: "https://bugzilla.redhat.com/show_bug.cgi?id=250725", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-2788", url: "https://www.cve.org/CVERecord?id=CVE-2007-2788", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-2788", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-2788", }, ], release_date: "2007-05-21T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-06-30T15:33:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0524", }, ], threats: [ { category: "impact", details: "Critical", }, ], title: "Integer overflow in the embedded ICC profile image parser in Sun Java Development Kit", }, { cve: "CVE-2007-2789", discovery_date: "2007-05-21T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "250729", }, ], notes: [ { category: "description", text: "The BMP image parser in Sun Java Development Kit (JDK) before 1.5.0_11-b03 and 1.6.x before 1.6.0_01-b06, and Sun Java Runtime Environment in JDK and JRE 6, JDK and JRE 5.0 Update 10 and earlier, SDK and JRE 1.4.2_14 and earlier, and SDK and JRE 1.3.1_19 and earlier, when running on Unix/Linux systems, allows remote attackers to cause a denial of service (JVM hang) via untrusted applets or applications that open arbitrary local files via a crafted BMP file, such as /dev/tty.", title: "Vulnerability description", }, { category: "summary", text: "BMP image parser vulnerability", title: "Vulnerability summary", }, ], product_status: { fixed: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-2789", }, { category: "external", summary: "RHBZ#250729", url: "https://bugzilla.redhat.com/show_bug.cgi?id=250729", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-2789", url: "https://www.cve.org/CVERecord?id=CVE-2007-2789", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-2789", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-2789", }, ], release_date: "2007-05-21T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-06-30T15:33:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0524", }, ], threats: [ { category: "impact", details: "Critical", }, ], title: "BMP image parser vulnerability", }, { cve: "CVE-2007-3304", discovery_date: "2007-06-19T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "245111", }, ], notes: [ { category: "description", text: "Apache httpd 1.3.37, 2.0.59, and 2.2.4 with the Prefork MPM module, allows local users to cause a denial of service by modifying the worker_score and process_score arrays to reference an arbitrary process ID, which is sent a SIGUSR1 signal from the master process, aka \"SIGUSR1 killer.\"", title: "Vulnerability description", }, { category: "summary", text: "httpd scoreboard lack of PID protection", title: "Vulnerability summary", }, ], product_status: { fixed: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-3304", }, { category: "external", summary: "RHBZ#245111", url: "https://bugzilla.redhat.com/show_bug.cgi?id=245111", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-3304", url: "https://www.cve.org/CVERecord?id=CVE-2007-3304", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-3304", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-3304", }, ], release_date: "2007-06-19T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-06-30T15:33:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0524", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "httpd scoreboard lack of PID protection", }, { cve: "CVE-2007-3382", discovery_date: "2007-07-12T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "247972", }, ], notes: [ { category: "description", text: "Apache Tomcat 6.0.0 to 6.0.13, 5.5.0 to 5.5.24, 5.0.0 to 5.0.30, 4.1.0 to 4.1.36, and 3.3 to 3.3.2 treats single quotes (\"'\") as delimiters in cookies, which might cause sensitive information such as session IDs to be leaked and allow remote attackers to conduct session hijacking attacks.", title: "Vulnerability description", }, { category: "summary", text: "tomcat handling of cookies", title: "Vulnerability summary", }, ], product_status: { fixed: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-3382", }, { category: "external", summary: "RHBZ#247972", url: "https://bugzilla.redhat.com/show_bug.cgi?id=247972", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-3382", url: "https://www.cve.org/CVERecord?id=CVE-2007-3382", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-3382", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-3382", }, ], release_date: "2007-08-14T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-06-30T15:33:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0524", }, ], threats: [ { category: "impact", details: "Low", }, ], title: "tomcat handling of cookies", }, { cve: "CVE-2007-3385", discovery_date: "2007-07-12T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "247976", }, ], notes: [ { category: "description", text: "Apache Tomcat 6.0.0 to 6.0.13, 5.5.0 to 5.5.24, 5.0.0 to 5.0.30, 4.1.0 to 4.1.36, and 3.3 to 3.3.2 does not properly handle the \\\" character sequence in a cookie value, which might cause sensitive information such as session IDs to be leaked to remote attackers and enable session hijacking attacks.", title: "Vulnerability description", }, { category: "summary", text: "tomcat handling of cookie values", title: "Vulnerability summary", }, ], product_status: { fixed: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-3385", }, { category: "external", summary: "RHBZ#247976", url: "https://bugzilla.redhat.com/show_bug.cgi?id=247976", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-3385", url: "https://www.cve.org/CVERecord?id=CVE-2007-3385", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-3385", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-3385", }, ], release_date: "2007-08-14T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-06-30T15:33:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0524", }, ], threats: [ { category: "impact", details: "Low", }, ], title: "tomcat handling of cookie values", }, { cve: "CVE-2007-4465", cwe: { id: "CWE-79", name: "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", }, discovery_date: "2007-09-13T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "289511", }, ], notes: [ { category: "description", text: "Cross-site scripting (XSS) vulnerability in mod_autoindex.c in the Apache HTTP Server before 2.2.6, when the charset on a server-generated page is not defined, allows remote attackers to inject arbitrary web script or HTML via the P parameter using the UTF-7 charset. NOTE: it could be argued that this issue is due to a design limitation of browsers that attempt to perform automatic content type detection.", title: "Vulnerability description", }, { category: "summary", text: "mod_autoindex XSS", title: "Vulnerability summary", }, { category: "other", text: "This is actually a flaw in browsers that do not derive the response character set as required by RFC 2616. This does not affect the default configuration of Apache httpd in Red Hat products and will only affect customers who have removed the \"AddDefaultCharset\" directive and are using directory indexes. The Red Hat Product Security has rated this issue as having low security impact, a future update may address this flaw.", title: "Statement", }, ], product_status: { fixed: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-4465", }, { category: "external", summary: "RHBZ#289511", url: "https://bugzilla.redhat.com/show_bug.cgi?id=289511", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-4465", url: "https://www.cve.org/CVERecord?id=CVE-2007-4465", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-4465", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-4465", }, ], release_date: "2007-09-13T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-06-30T15:33:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0524", }, ], threats: [ { category: "impact", details: "Low", }, ], title: "mod_autoindex XSS", }, { cve: "CVE-2007-5000", cwe: { id: "CWE-79", name: "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", }, discovery_date: "2007-12-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "419931", }, ], notes: [ { category: "description", text: "Cross-site scripting (XSS) vulnerability in the (1) mod_imap module in the Apache HTTP Server 1.3.0 through 1.3.39 and 2.0.35 through 2.0.61 and the (2) mod_imagemap module in the Apache HTTP Server 2.2.0 through 2.2.6 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.", title: "Vulnerability description", }, { category: "summary", text: "httpd: mod_imagemap XSS", title: "Vulnerability summary", }, ], product_status: { fixed: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-5000", }, { category: "external", summary: "RHBZ#419931", url: "https://bugzilla.redhat.com/show_bug.cgi?id=419931", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-5000", url: "https://www.cve.org/CVERecord?id=CVE-2007-5000", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-5000", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-5000", }, ], release_date: "2007-12-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-06-30T15:33:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0524", }, ], threats: [ { category: "impact", details: "Low", }, ], title: "httpd: mod_imagemap XSS", }, { cve: "CVE-2007-5461", discovery_date: "2007-10-14T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "333791", }, ], notes: [ { category: "description", text: "Absolute path traversal vulnerability in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0, 5.0.0, 5.5.0 through 5.5.25, and 6.0.0 through 6.0.14, under certain configurations, allows remote authenticated users to read arbitrary files via a WebDAV write request that specifies an entity with a SYSTEM tag.", title: "Vulnerability description", }, { category: "summary", text: "Absolute path traversal Apache Tomcat WEBDAV", title: "Vulnerability summary", }, ], product_status: { fixed: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-5461", }, { category: "external", summary: "RHBZ#333791", url: "https://bugzilla.redhat.com/show_bug.cgi?id=333791", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-5461", url: "https://www.cve.org/CVERecord?id=CVE-2007-5461", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-5461", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-5461", }, ], release_date: "2007-10-14T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-06-30T15:33:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0524", }, ], threats: [ { category: "impact", details: "Important", }, ], title: "Absolute path traversal Apache Tomcat WEBDAV", }, { cve: "CVE-2007-6306", cwe: { id: "CWE-79", name: "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", }, discovery_date: "2007-12-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "421081", }, ], notes: [ { category: "description", text: "Multiple cross-site scripting (XSS) vulnerabilities in the image map feature in JFreeChart 1.0.8 allow remote attackers to inject arbitrary web script or HTML via the (1) chart name or (2) chart tool tip text; or the (3) href, (4) shape, or (5) coords attribute of a chart area.", title: "Vulnerability description", }, { category: "summary", text: "JFreeChart: XSS vulnerabilities in the image map feature", title: "Vulnerability summary", }, ], product_status: { fixed: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-6306", }, { category: "external", summary: "RHBZ#421081", url: "https://bugzilla.redhat.com/show_bug.cgi?id=421081", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-6306", url: "https://www.cve.org/CVERecord?id=CVE-2007-6306", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-6306", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-6306", }, ], release_date: "2007-12-06T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-06-30T15:33:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0524", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "JFreeChart: XSS vulnerabilities in the image map feature", }, { cve: "CVE-2007-6388", cwe: { id: "CWE-79", name: "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", }, discovery_date: "2008-01-02T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "427228", }, ], notes: [ { category: "description", text: "Cross-site scripting (XSS) vulnerability in mod_status in the Apache HTTP Server 2.2.0 through 2.2.6, 2.0.35 through 2.0.61, and 1.3.2 through 1.3.39, when the server-status page is enabled, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.", title: "Vulnerability description", }, { category: "summary", text: "apache mod_status cross-site scripting", title: "Vulnerability summary", }, ], product_status: { fixed: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-6388", }, { category: "external", summary: "RHBZ#427228", url: "https://bugzilla.redhat.com/show_bug.cgi?id=427228", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-6388", url: "https://www.cve.org/CVERecord?id=CVE-2007-6388", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-6388", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-6388", }, ], release_date: "2007-12-29T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-06-30T15:33:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0524", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "apache mod_status cross-site scripting", }, { cve: "CVE-2008-0128", discovery_date: "2008-01-23T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "429821", }, ], notes: [ { category: "description", text: "The SingleSignOn Valve (org.apache.catalina.authenticator.SingleSignOn) in Apache Tomcat before 5.5.21 does not set the secure flag for the JSESSIONIDSSO cookie in an https session, which can cause the cookie to be sent in http requests and make it easier for remote attackers to capture this cookie.", title: "Vulnerability description", }, { category: "summary", text: "tomcat5 SSO cookie login information disclosure", title: "Vulnerability summary", }, ], product_status: { fixed: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2008-0128", }, { category: "external", summary: "RHBZ#429821", url: "https://bugzilla.redhat.com/show_bug.cgi?id=429821", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2008-0128", url: "https://www.cve.org/CVERecord?id=CVE-2008-0128", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2008-0128", url: "https://nvd.nist.gov/vuln/detail/CVE-2008-0128", }, ], release_date: "2006-12-20T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-06-30T15:33:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "3AS-RHNSAT4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el3.i386", "3AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "3AS-RHNSAT4.2:openmotif21-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-9.RHEL3.8.i386", "3AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el3.noarch", "3AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel3.i386", "3AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel3.i386", "3AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel3.i386", "3AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", "4AS-RHNSAT4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT4.2:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT4.2:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT4.2:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT4.2:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT4.2:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT4.2:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0524", }, ], threats: [ { category: "impact", details: "Low", }, ], title: "tomcat5 SSO cookie login information disclosure", }, ], }
rhsa-2008_0523
Vulnerability from csaf_redhat
Published
2008-06-30 15:29
Modified
2024-12-08 10:33
Summary
Red Hat Security Advisory: Red Hat Network Proxy Server security update
Notes
Topic
Red Hat Network Proxy Server version 4.2.3 is now available. This update
includes fixes for a number of security issues in Red Hat Network Proxy
Server components.
This update has been rated as having low security impact by the Red
Hat Security Response Team.
Details
The Red Hat Network Proxy Server 4.2.3 release corrects several security
vulnerabilities in several shipped components. In a typical operating
environment, these components are not exposed to users of Proxy Server in a
vulnerable manner. These security updates will reduce risk in unique Proxy
Server environments.
Multiple flaws were fixed in the Apache HTTPD server. These flaws could
result in a cross-site scripting or denial-of-service attack.
(CVE-2007-6388, CVE-2007-5000, CVE-2007-4465, CVE-2007-3304, CVE-2006-5752,
CVE-2006-3918, CVE-2005-3352)
A denial-of-service flaw was fixed in mod_perl. (CVE-2007-1349)
Multiple flaws in mod_ssl. (CVE-2004-0488, CVE-2004-0700, CVE-2004-0885)
A denial-of-service flaw was fixed in the jabberd server. (CVE-2006-1329)
Users of Red Hat Network Proxy Server 4.2 are advised to upgrade to 4.2.3,
which resolves these issues.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ document: { aggregate_severity: { namespace: "https://access.redhat.com/security/updates/classification/", text: "Low", }, category: "csaf_security_advisory", csaf_version: "2.0", distribution: { text: "Copyright © Red Hat, Inc. All rights reserved.", tlp: { label: "WHITE", url: "https://www.first.org/tlp/", }, }, lang: "en", notes: [ { category: "summary", text: "Red Hat Network Proxy Server version 4.2.3 is now available. This update\nincludes fixes for a number of security issues in Red Hat Network Proxy\nServer components.\n\nThis update has been rated as having low security impact by the Red\nHat Security Response Team.", title: "Topic", }, { category: "general", text: "The Red Hat Network Proxy Server 4.2.3 release corrects several security\nvulnerabilities in several shipped components. In a typical operating\nenvironment, these components are not exposed to users of Proxy Server in a\nvulnerable manner. These security updates will reduce risk in unique Proxy\nServer environments.\n\nMultiple flaws were fixed in the Apache HTTPD server. These flaws could\nresult in a cross-site scripting or denial-of-service attack.\n(CVE-2007-6388, CVE-2007-5000, CVE-2007-4465, CVE-2007-3304, CVE-2006-5752,\nCVE-2006-3918, CVE-2005-3352)\n\nA denial-of-service flaw was fixed in mod_perl. (CVE-2007-1349)\n\nMultiple flaws in mod_ssl. (CVE-2004-0488, CVE-2004-0700, CVE-2004-0885)\n\nA denial-of-service flaw was fixed in the jabberd server. (CVE-2006-1329)\n\nUsers of Red Hat Network Proxy Server 4.2 are advised to upgrade to 4.2.3,\nwhich resolves these issues.", title: "Details", }, { category: "legal_disclaimer", text: "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", title: "Terms of Use", }, ], publisher: { category: "vendor", contact_details: "https://access.redhat.com/security/team/contact/", issuing_authority: "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", name: "Red Hat Product Security", namespace: "https://www.redhat.com", }, references: [ { category: "self", summary: "https://access.redhat.com/errata/RHSA-2008:0523", url: "https://access.redhat.com/errata/RHSA-2008:0523", }, { category: "external", summary: "https://access.redhat.com/security/updates/classification/#low", url: "https://access.redhat.com/security/updates/classification/#low", }, { category: "external", summary: "449336", url: "https://bugzilla.redhat.com/show_bug.cgi?id=449336", }, { category: "self", summary: "Canonical URL", url: "https://security.access.redhat.com/data/csaf/v2/advisories/2008/rhsa-2008_0523.json", }, ], title: "Red Hat Security Advisory: Red Hat Network Proxy Server security update", tracking: { current_release_date: "2024-12-08T10:33:39+00:00", generator: { date: "2024-12-08T10:33:39+00:00", engine: { name: "Red Hat SDEngine", version: "4.2.3", }, }, id: "RHSA-2008:0523", initial_release_date: "2008-06-30T15:29:00+00:00", revision_history: [ { date: "2008-06-30T15:29:00+00:00", number: "1", summary: "Initial version", }, { date: "2008-06-30T11:32:56+00:00", number: "2", summary: "Last updated version", }, { date: "2024-12-08T10:33:39+00:00", number: "3", summary: "Last generated version", }, ], status: "final", version: "3", }, }, product_tree: { branches: [ { branches: [ { branches: [ { category: "product_name", name: "Red Hat Satellite Proxy v 4.2 (RHEL v.3 AS)", product: { name: "Red Hat Satellite Proxy v 4.2 (RHEL v.3 AS)", product_id: "3AS-RHNPROXY4.2", product_identification_helper: { cpe: "cpe:/a:redhat:network_proxy:4.2::el3", }, }, }, { category: "product_name", name: "Red Hat Satellite Proxy v 4.2 (RHEL v.4 AS)", product: { name: "Red Hat Satellite Proxy v 4.2 (RHEL v.4 AS)", product_id: "4AS-RHNPROXY4.2", product_identification_helper: { cpe: "cpe:/a:redhat:network_proxy:4.2::el4", }, }, }, ], category: "product_family", name: "Red Hat Satellite Proxy", }, { branches: [ { category: "product_version", name: "jabberd-0:2.0s10-3.37.rhn.i386", product: { name: "jabberd-0:2.0s10-3.37.rhn.i386", product_id: "jabberd-0:2.0s10-3.37.rhn.i386", product_identification_helper: { purl: "pkg:rpm/redhat/jabberd@2.0s10-3.37.rhn?arch=i386", }, }, }, { category: "product_version", name: "rhn-apache-0:1.3.27-36.rhn.rhel3.i386", product: { name: "rhn-apache-0:1.3.27-36.rhn.rhel3.i386", product_id: "rhn-apache-0:1.3.27-36.rhn.rhel3.i386", product_identification_helper: { purl: "pkg:rpm/redhat/rhn-apache@1.3.27-36.rhn.rhel3?arch=i386", }, }, }, { category: "product_version", name: "rhn-modperl-0:1.29-16.rhel3.i386", product: { name: "rhn-modperl-0:1.29-16.rhel3.i386", product_id: "rhn-modperl-0:1.29-16.rhel3.i386", product_identification_helper: { purl: "pkg:rpm/redhat/rhn-modperl@1.29-16.rhel3?arch=i386", }, }, }, { category: "product_version", name: "jabberd-0:2.0s10-3.38.rhn.i386", product: { name: "jabberd-0:2.0s10-3.38.rhn.i386", product_id: "jabberd-0:2.0s10-3.38.rhn.i386", product_identification_helper: { purl: "pkg:rpm/redhat/jabberd@2.0s10-3.38.rhn?arch=i386", }, }, }, { category: "product_version", name: "rhn-apache-0:1.3.27-36.rhn.rhel4.i386", product: { name: "rhn-apache-0:1.3.27-36.rhn.rhel4.i386", product_id: "rhn-apache-0:1.3.27-36.rhn.rhel4.i386", product_identification_helper: { purl: "pkg:rpm/redhat/rhn-apache@1.3.27-36.rhn.rhel4?arch=i386", }, }, }, { category: "product_version", name: "rhn-modperl-0:1.29-16.rhel4.i386", product: { name: "rhn-modperl-0:1.29-16.rhel4.i386", product_id: "rhn-modperl-0:1.29-16.rhel4.i386", product_identification_helper: { purl: "pkg:rpm/redhat/rhn-modperl@1.29-16.rhel4?arch=i386", }, }, }, ], category: "architecture", name: "i386", }, ], category: "vendor", name: "Red Hat", }, ], relationships: [ { category: "default_component_of", full_product_name: { name: "jabberd-0:2.0s10-3.37.rhn.i386 as a component of Red Hat Satellite Proxy v 4.2 (RHEL v.3 AS)", product_id: "3AS-RHNPROXY4.2:jabberd-0:2.0s10-3.37.rhn.i386", }, product_reference: "jabberd-0:2.0s10-3.37.rhn.i386", relates_to_product_reference: "3AS-RHNPROXY4.2", }, { category: "default_component_of", full_product_name: { name: "rhn-apache-0:1.3.27-36.rhn.rhel3.i386 as a component of Red Hat Satellite Proxy v 4.2 (RHEL v.3 AS)", product_id: "3AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", }, product_reference: "rhn-apache-0:1.3.27-36.rhn.rhel3.i386", relates_to_product_reference: "3AS-RHNPROXY4.2", }, { category: "default_component_of", full_product_name: { name: "rhn-modperl-0:1.29-16.rhel3.i386 as a component of Red Hat Satellite Proxy v 4.2 (RHEL v.3 AS)", product_id: "3AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel3.i386", }, product_reference: "rhn-modperl-0:1.29-16.rhel3.i386", relates_to_product_reference: "3AS-RHNPROXY4.2", }, { category: "default_component_of", full_product_name: { name: "jabberd-0:2.0s10-3.38.rhn.i386 as a component of Red Hat Satellite Proxy v 4.2 (RHEL v.4 AS)", product_id: "4AS-RHNPROXY4.2:jabberd-0:2.0s10-3.38.rhn.i386", }, product_reference: "jabberd-0:2.0s10-3.38.rhn.i386", relates_to_product_reference: "4AS-RHNPROXY4.2", }, { category: "default_component_of", full_product_name: { name: "rhn-apache-0:1.3.27-36.rhn.rhel4.i386 as a component of Red Hat Satellite Proxy v 4.2 (RHEL v.4 AS)", product_id: "4AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", }, product_reference: "rhn-apache-0:1.3.27-36.rhn.rhel4.i386", relates_to_product_reference: "4AS-RHNPROXY4.2", }, { category: "default_component_of", full_product_name: { name: "rhn-modperl-0:1.29-16.rhel4.i386 as a component of Red Hat Satellite Proxy v 4.2 (RHEL v.4 AS)", product_id: "4AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel4.i386", }, product_reference: "rhn-modperl-0:1.29-16.rhel4.i386", relates_to_product_reference: "4AS-RHNPROXY4.2", }, ], }, vulnerabilities: [ { cve: "CVE-2004-0488", ids: [ { system_name: "Red Hat Bugzilla ID", text: "430867", }, ], notes: [ { category: "description", text: "Stack-based buffer overflow in the ssl_util_uuencode_binary function in ssl_util.c for Apache mod_ssl, when mod_ssl is configured to trust the issuing CA, may allow remote attackers to execute arbitrary code via a client certificate with a long subject DN.", title: "Vulnerability description", }, { category: "summary", text: "mod_ssl ssl_util_uuencode_binary CA issue", title: "Vulnerability summary", }, ], product_status: { fixed: [ "3AS-RHNPROXY4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel3.i386", "4AS-RHNPROXY4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel4.i386", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2004-0488", }, { category: "external", summary: "RHBZ#430867", url: "https://bugzilla.redhat.com/show_bug.cgi?id=430867", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2004-0488", url: "https://www.cve.org/CVERecord?id=CVE-2004-0488", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2004-0488", url: "https://nvd.nist.gov/vuln/detail/CVE-2004-0488", }, ], release_date: "2004-05-17T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-06-30T15:29:00+00:00", details: "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.\n\nThis update is available via Red Hat Network. Details on how to use \nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/FAQ_58_10188", product_ids: [ "3AS-RHNPROXY4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel3.i386", "4AS-RHNPROXY4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel4.i386", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0523", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "mod_ssl ssl_util_uuencode_binary CA issue", }, { cve: "CVE-2004-0700", ids: [ { system_name: "Red Hat Bugzilla ID", text: "430866", }, ], notes: [ { category: "description", text: "Format string vulnerability in the mod_proxy hook functions function in ssl_engine_log.c in mod_ssl before 2.8.19 for Apache before 1.3.31 may allow remote attackers to execute arbitrary messages via format string specifiers in certain log messages for HTTPS that are handled by the ssl_log function.", title: "Vulnerability description", }, { category: "summary", text: "mod_proxy hook format string", title: "Vulnerability summary", }, ], product_status: { fixed: [ "3AS-RHNPROXY4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel3.i386", "4AS-RHNPROXY4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel4.i386", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2004-0700", }, { category: "external", summary: "RHBZ#430866", url: "https://bugzilla.redhat.com/show_bug.cgi?id=430866", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2004-0700", url: "https://www.cve.org/CVERecord?id=CVE-2004-0700", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2004-0700", url: "https://nvd.nist.gov/vuln/detail/CVE-2004-0700", }, ], release_date: "2004-07-16T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-06-30T15:29:00+00:00", details: "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.\n\nThis update is available via Red Hat Network. Details on how to use \nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/FAQ_58_10188", product_ids: [ "3AS-RHNPROXY4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel3.i386", "4AS-RHNPROXY4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel4.i386", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0523", }, ], threats: [ { category: "impact", details: "Important", }, ], title: "mod_proxy hook format string", }, { cve: "CVE-2004-0885", ids: [ { system_name: "Red Hat Bugzilla ID", text: "430637", }, ], notes: [ { category: "description", text: "The mod_ssl module in Apache 2.0.35 through 2.0.52, when using the \"SSLCipherSuite\" directive in directory or location context, allows remote clients to bypass intended restrictions by using any cipher suite that is allowed by the virtual host configuration.", title: "Vulnerability description", }, { category: "summary", text: "mod_ssl SSLCipherSuite bypass", title: "Vulnerability summary", }, ], product_status: { fixed: [ "3AS-RHNPROXY4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel3.i386", "4AS-RHNPROXY4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel4.i386", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2004-0885", }, { category: "external", summary: "RHBZ#430637", url: "https://bugzilla.redhat.com/show_bug.cgi?id=430637", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2004-0885", url: "https://www.cve.org/CVERecord?id=CVE-2004-0885", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2004-0885", url: "https://nvd.nist.gov/vuln/detail/CVE-2004-0885", }, ], release_date: "2004-10-05T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-06-30T15:29:00+00:00", details: "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.\n\nThis update is available via Red Hat Network. Details on how to use \nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/FAQ_58_10188", product_ids: [ "3AS-RHNPROXY4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel3.i386", "4AS-RHNPROXY4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel4.i386", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0523", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "mod_ssl SSLCipherSuite bypass", }, { cve: "CVE-2005-3352", cwe: { id: "CWE-79", name: "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", }, discovery_date: "2005-12-12T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "430524", }, ], notes: [ { category: "description", text: "Cross-site scripting (XSS) vulnerability in the mod_imap module of Apache httpd before 1.3.35-dev and Apache httpd 2.0.x before 2.0.56-dev allows remote attackers to inject arbitrary web script or HTML via the Referer when using image maps.", title: "Vulnerability description", }, { category: "summary", text: "httpd cross-site scripting flaw in mod_imap", title: "Vulnerability summary", }, ], product_status: { fixed: [ "3AS-RHNPROXY4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel3.i386", "4AS-RHNPROXY4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel4.i386", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2005-3352", }, { category: "external", summary: "RHBZ#430524", url: "https://bugzilla.redhat.com/show_bug.cgi?id=430524", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2005-3352", url: "https://www.cve.org/CVERecord?id=CVE-2005-3352", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2005-3352", url: "https://nvd.nist.gov/vuln/detail/CVE-2005-3352", }, ], release_date: "2005-12-12T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-06-30T15:29:00+00:00", details: "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.\n\nThis update is available via Red Hat Network. Details on how to use \nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/FAQ_58_10188", product_ids: [ "3AS-RHNPROXY4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel3.i386", "4AS-RHNPROXY4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel4.i386", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0523", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "httpd cross-site scripting flaw in mod_imap", }, { cve: "CVE-2006-1329", ids: [ { system_name: "Red Hat Bugzilla ID", text: "429254", }, ], notes: [ { category: "description", text: "The SASL negotiation in Jabber Studio jabberd before 2.0s11 allows remote attackers to cause a denial of service (\"c2s segfault\") by sending a \"response stanza before an auth stanza\".", title: "Vulnerability description", }, { category: "summary", text: "jabberd SASL DoS", title: "Vulnerability summary", }, ], product_status: { fixed: [ "3AS-RHNPROXY4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel3.i386", "4AS-RHNPROXY4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel4.i386", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2006-1329", }, { category: "external", summary: "RHBZ#429254", url: "https://bugzilla.redhat.com/show_bug.cgi?id=429254", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2006-1329", url: "https://www.cve.org/CVERecord?id=CVE-2006-1329", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2006-1329", url: "https://nvd.nist.gov/vuln/detail/CVE-2006-1329", }, ], release_date: "2006-03-09T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-06-30T15:29:00+00:00", details: "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.\n\nThis update is available via Red Hat Network. Details on how to use \nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/FAQ_58_10188", product_ids: [ "3AS-RHNPROXY4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel3.i386", "4AS-RHNPROXY4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel4.i386", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0523", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "jabberd SASL DoS", }, { cve: "CVE-2006-3918", cwe: { id: "CWE-79", name: "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", }, discovery_date: "2006-07-31T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "200732", }, ], notes: [ { category: "description", text: "http_protocol.c in (1) IBM HTTP Server 6.0 before 6.0.2.13 and 6.1 before 6.1.0.1, and (2) Apache HTTP Server 1.3 before 1.3.35, 2.0 before 2.0.58, and 2.2 before 2.2.2, does not sanitize the Expect header from an HTTP request when it is reflected back in an error message, which might allow cross-site scripting (XSS) style attacks using web client components that can send arbitrary headers in requests, as demonstrated using a Flash SWF file.", title: "Vulnerability description", }, { category: "summary", text: "httpd: Expect header XSS", title: "Vulnerability summary", }, ], product_status: { fixed: [ "3AS-RHNPROXY4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel3.i386", "4AS-RHNPROXY4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel4.i386", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2006-3918", }, { category: "external", summary: "RHBZ#200732", url: "https://bugzilla.redhat.com/show_bug.cgi?id=200732", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2006-3918", url: "https://www.cve.org/CVERecord?id=CVE-2006-3918", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2006-3918", url: "https://nvd.nist.gov/vuln/detail/CVE-2006-3918", }, ], release_date: "2006-05-08T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-06-30T15:29:00+00:00", details: "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.\n\nThis update is available via Red Hat Network. Details on how to use \nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/FAQ_58_10188", product_ids: [ "3AS-RHNPROXY4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel3.i386", "4AS-RHNPROXY4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel4.i386", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0523", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "httpd: Expect header XSS", }, { cve: "CVE-2006-5752", cwe: { id: "CWE-79", name: "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", }, discovery_date: "2007-06-20T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "245112", }, ], notes: [ { category: "description", text: "Cross-site scripting (XSS) vulnerability in mod_status.c in the mod_status module in Apache HTTP Server (httpd), when ExtendedStatus is enabled and a public server-status page is used, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors involving charsets with browsers that perform \"charset detection\" when the content-type is not specified.", title: "Vulnerability description", }, { category: "summary", text: "httpd mod_status XSS", title: "Vulnerability summary", }, ], product_status: { fixed: [ "3AS-RHNPROXY4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel3.i386", "4AS-RHNPROXY4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel4.i386", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2006-5752", }, { category: "external", summary: "RHBZ#245112", url: "https://bugzilla.redhat.com/show_bug.cgi?id=245112", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2006-5752", url: "https://www.cve.org/CVERecord?id=CVE-2006-5752", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2006-5752", url: "https://nvd.nist.gov/vuln/detail/CVE-2006-5752", }, ], release_date: "2007-06-20T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-06-30T15:29:00+00:00", details: "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.\n\nThis update is available via Red Hat Network. Details on how to use \nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/FAQ_58_10188", product_ids: [ "3AS-RHNPROXY4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel3.i386", "4AS-RHNPROXY4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel4.i386", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0523", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "httpd mod_status XSS", }, { cve: "CVE-2007-1349", discovery_date: "2007-05-17T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "240423", }, ], notes: [ { category: "description", text: "PerlRun.pm in Apache mod_perl before 1.30, and RegistryCooker.pm in mod_perl 2.x, does not properly escape PATH_INFO before use in a regular expression, which allows remote attackers to cause a denial of service (resource consumption) via a crafted URI.", title: "Vulnerability description", }, { category: "summary", text: "mod_perl PerlRun denial of service", title: "Vulnerability summary", }, ], product_status: { fixed: [ "3AS-RHNPROXY4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel3.i386", "4AS-RHNPROXY4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel4.i386", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-1349", }, { category: "external", summary: "RHBZ#240423", url: "https://bugzilla.redhat.com/show_bug.cgi?id=240423", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-1349", url: "https://www.cve.org/CVERecord?id=CVE-2007-1349", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-1349", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-1349", }, ], release_date: "2007-03-22T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-06-30T15:29:00+00:00", details: "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.\n\nThis update is available via Red Hat Network. Details on how to use \nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/FAQ_58_10188", product_ids: [ "3AS-RHNPROXY4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel3.i386", "4AS-RHNPROXY4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel4.i386", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0523", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "mod_perl PerlRun denial of service", }, { cve: "CVE-2007-3304", discovery_date: "2007-06-19T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "245111", }, ], notes: [ { category: "description", text: "Apache httpd 1.3.37, 2.0.59, and 2.2.4 with the Prefork MPM module, allows local users to cause a denial of service by modifying the worker_score and process_score arrays to reference an arbitrary process ID, which is sent a SIGUSR1 signal from the master process, aka \"SIGUSR1 killer.\"", title: "Vulnerability description", }, { category: "summary", text: "httpd scoreboard lack of PID protection", title: "Vulnerability summary", }, ], product_status: { fixed: [ "3AS-RHNPROXY4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel3.i386", "4AS-RHNPROXY4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel4.i386", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-3304", }, { category: "external", summary: "RHBZ#245111", url: "https://bugzilla.redhat.com/show_bug.cgi?id=245111", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-3304", url: "https://www.cve.org/CVERecord?id=CVE-2007-3304", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-3304", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-3304", }, ], release_date: "2007-06-19T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-06-30T15:29:00+00:00", details: "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.\n\nThis update is available via Red Hat Network. Details on how to use \nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/FAQ_58_10188", product_ids: [ "3AS-RHNPROXY4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel3.i386", "4AS-RHNPROXY4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel4.i386", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0523", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "httpd scoreboard lack of PID protection", }, { cve: "CVE-2007-4465", cwe: { id: "CWE-79", name: "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", }, discovery_date: "2007-09-13T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "289511", }, ], notes: [ { category: "description", text: "Cross-site scripting (XSS) vulnerability in mod_autoindex.c in the Apache HTTP Server before 2.2.6, when the charset on a server-generated page is not defined, allows remote attackers to inject arbitrary web script or HTML via the P parameter using the UTF-7 charset. NOTE: it could be argued that this issue is due to a design limitation of browsers that attempt to perform automatic content type detection.", title: "Vulnerability description", }, { category: "summary", text: "mod_autoindex XSS", title: "Vulnerability summary", }, { category: "other", text: "This is actually a flaw in browsers that do not derive the response character set as required by RFC 2616. This does not affect the default configuration of Apache httpd in Red Hat products and will only affect customers who have removed the \"AddDefaultCharset\" directive and are using directory indexes. The Red Hat Product Security has rated this issue as having low security impact, a future update may address this flaw.", title: "Statement", }, ], product_status: { fixed: [ "3AS-RHNPROXY4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel3.i386", "4AS-RHNPROXY4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel4.i386", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-4465", }, { category: "external", summary: "RHBZ#289511", url: "https://bugzilla.redhat.com/show_bug.cgi?id=289511", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-4465", url: "https://www.cve.org/CVERecord?id=CVE-2007-4465", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-4465", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-4465", }, ], release_date: "2007-09-13T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-06-30T15:29:00+00:00", details: "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.\n\nThis update is available via Red Hat Network. Details on how to use \nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/FAQ_58_10188", product_ids: [ "3AS-RHNPROXY4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel3.i386", "4AS-RHNPROXY4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel4.i386", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0523", }, ], threats: [ { category: "impact", details: "Low", }, ], title: "mod_autoindex XSS", }, { cve: "CVE-2007-5000", cwe: { id: "CWE-79", name: "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", }, discovery_date: "2007-12-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "419931", }, ], notes: [ { category: "description", text: "Cross-site scripting (XSS) vulnerability in the (1) mod_imap module in the Apache HTTP Server 1.3.0 through 1.3.39 and 2.0.35 through 2.0.61 and the (2) mod_imagemap module in the Apache HTTP Server 2.2.0 through 2.2.6 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.", title: "Vulnerability description", }, { category: "summary", text: "httpd: mod_imagemap XSS", title: "Vulnerability summary", }, ], product_status: { fixed: [ "3AS-RHNPROXY4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel3.i386", "4AS-RHNPROXY4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel4.i386", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-5000", }, { category: "external", summary: "RHBZ#419931", url: "https://bugzilla.redhat.com/show_bug.cgi?id=419931", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-5000", url: "https://www.cve.org/CVERecord?id=CVE-2007-5000", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-5000", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-5000", }, ], release_date: "2007-12-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-06-30T15:29:00+00:00", details: "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.\n\nThis update is available via Red Hat Network. Details on how to use \nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/FAQ_58_10188", product_ids: [ "3AS-RHNPROXY4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel3.i386", "4AS-RHNPROXY4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel4.i386", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0523", }, ], threats: [ { category: "impact", details: "Low", }, ], title: "httpd: mod_imagemap XSS", }, { cve: "CVE-2007-6388", cwe: { id: "CWE-79", name: "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", }, discovery_date: "2008-01-02T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "427228", }, ], notes: [ { category: "description", text: "Cross-site scripting (XSS) vulnerability in mod_status in the Apache HTTP Server 2.2.0 through 2.2.6, 2.0.35 through 2.0.61, and 1.3.2 through 1.3.39, when the server-status page is enabled, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.", title: "Vulnerability description", }, { category: "summary", text: "apache mod_status cross-site scripting", title: "Vulnerability summary", }, ], product_status: { fixed: [ "3AS-RHNPROXY4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel3.i386", "4AS-RHNPROXY4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel4.i386", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-6388", }, { category: "external", summary: "RHBZ#427228", url: "https://bugzilla.redhat.com/show_bug.cgi?id=427228", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-6388", url: "https://www.cve.org/CVERecord?id=CVE-2007-6388", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-6388", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-6388", }, ], release_date: "2007-12-29T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-06-30T15:29:00+00:00", details: "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.\n\nThis update is available via Red Hat Network. Details on how to use \nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/FAQ_58_10188", product_ids: [ "3AS-RHNPROXY4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel3.i386", "4AS-RHNPROXY4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel4.i386", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0523", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "apache mod_status cross-site scripting", }, ], }
RHSA-2007:0532
Vulnerability from csaf_redhat
Published
2007-06-26 15:13
Modified
2024-12-01 11:53
Summary
Red Hat Security Advisory: apache security update
Notes
Topic
Updated Apache httpd packages that correct two security issues are now
available for Red Hat Enterprise Linux 2.1.
This update has been rated as having moderate security impact by the Red
Hat Security Response Team.
Details
The Apache HTTP Server is a popular Web server.
The Apache HTTP Server did not verify that a process was an Apache child
process before sending it signals. A local attacker who has the ability to
run scripts on the Apache HTTP Server could manipulate the scoreboard and
cause arbitrary processes to be terminated, which could lead to a denial of
service. (CVE-2007-3304)
A flaw was found in the Apache HTTP Server mod_status module. Sites with
the server-status page publicly accessible and ExtendedStatus enabled were
vulnerable to a cross-site scripting attack. On Red Hat Enterprise Linux
the server-status page is not enabled by default and it is best practice to
not make this publicly available. (CVE-2006-5752)
Users of Apache should upgrade to these updated packages, which contain
backported patches to correct these issues. Users should restart Apache
after installing this update.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ document: { aggregate_severity: { namespace: "https://access.redhat.com/security/updates/classification/", text: "Moderate", }, category: "csaf_security_advisory", csaf_version: "2.0", distribution: { text: "Copyright © Red Hat, Inc. All rights reserved.", tlp: { label: "WHITE", url: "https://www.first.org/tlp/", }, }, lang: "en", notes: [ { category: "summary", text: "Updated Apache httpd packages that correct two security issues are now\navailable for Red Hat Enterprise Linux 2.1.\n\nThis update has been rated as having moderate security impact by the Red\nHat Security Response Team.", title: "Topic", }, { category: "general", text: "The Apache HTTP Server is a popular Web server.\n\nThe Apache HTTP Server did not verify that a process was an Apache child\nprocess before sending it signals. A local attacker who has the ability to\nrun scripts on the Apache HTTP Server could manipulate the scoreboard and\ncause arbitrary processes to be terminated, which could lead to a denial of\nservice. (CVE-2007-3304) \n\nA flaw was found in the Apache HTTP Server mod_status module. Sites with\nthe server-status page publicly accessible and ExtendedStatus enabled were\nvulnerable to a cross-site scripting attack. On Red Hat Enterprise Linux\nthe server-status page is not enabled by default and it is best practice to\nnot make this publicly available. (CVE-2006-5752)\n\nUsers of Apache should upgrade to these updated packages, which contain\nbackported patches to correct these issues. Users should restart Apache\nafter installing this update.", title: "Details", }, { category: "legal_disclaimer", text: "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", title: "Terms of Use", }, ], publisher: { category: "vendor", contact_details: "https://access.redhat.com/security/team/contact/", issuing_authority: "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", name: "Red Hat Product Security", namespace: "https://www.redhat.com", }, references: [ { category: "self", summary: "https://access.redhat.com/errata/RHSA-2007:0532", url: "https://access.redhat.com/errata/RHSA-2007:0532", }, { category: "external", summary: "https://access.redhat.com/security/updates/classification/#moderate", url: "https://access.redhat.com/security/updates/classification/#moderate", }, { category: "external", summary: "245111", url: "https://bugzilla.redhat.com/show_bug.cgi?id=245111", }, { category: "external", summary: "245112", url: "https://bugzilla.redhat.com/show_bug.cgi?id=245112", }, { category: "self", summary: "Canonical URL", url: "https://security.access.redhat.com/data/csaf/v2/advisories/2007/rhsa-2007_0532.json", }, ], title: "Red Hat Security Advisory: apache security update", tracking: { current_release_date: "2024-12-01T11:53:04+00:00", generator: { date: "2024-12-01T11:53:04+00:00", engine: { name: "Red Hat SDEngine", version: "4.2.1", }, }, id: "RHSA-2007:0532", initial_release_date: "2007-06-26T15:13:00+00:00", revision_history: [ { date: "2007-06-26T15:13:00+00:00", number: "1", summary: "Initial version", }, { date: "2007-06-26T11:13:14+00:00", number: "2", summary: "Last updated version", }, { date: "2024-12-01T11:53:04+00:00", number: "3", summary: "Last generated version", }, ], status: "final", version: "3", }, }, product_tree: { branches: [ { branches: [ { branches: [ { category: "product_name", name: "Red Hat Enterprise Linux AS (Advanced Server) version 2.1 ", product: { name: "Red Hat Enterprise Linux AS (Advanced Server) version 2.1 ", product_id: "2.1AS", product_identification_helper: { cpe: "cpe:/o:redhat:enterprise_linux:2.1::as", }, }, }, { category: "product_name", name: "Red Hat Linux Advanced Workstation 2.1", product: { name: "Red Hat Linux Advanced Workstation 2.1", product_id: "2.1AW", product_identification_helper: { cpe: "cpe:/o:redhat:enterprise_linux:2.1::aw", }, }, }, { category: "product_name", name: "Red Hat Enterprise Linux ES version 2.1", product: { name: "Red Hat Enterprise Linux ES version 2.1", product_id: "2.1ES", product_identification_helper: { cpe: "cpe:/o:redhat:enterprise_linux:2.1::es", }, }, }, { category: "product_name", name: "Red Hat Enterprise Linux WS version 2.1", product: { name: "Red Hat Enterprise Linux WS version 2.1", product_id: "2.1WS", product_identification_helper: { cpe: "cpe:/o:redhat:enterprise_linux:2.1::ws", }, }, }, ], category: "product_family", name: "Red Hat Enterprise Linux", }, { branches: [ { category: "product_version", name: "apache-manual-0:1.3.27-12.ent.ia64", product: { name: "apache-manual-0:1.3.27-12.ent.ia64", product_id: "apache-manual-0:1.3.27-12.ent.ia64", product_identification_helper: { purl: "pkg:rpm/redhat/apache-manual@1.3.27-12.ent?arch=ia64", }, }, }, { category: "product_version", name: "apache-0:1.3.27-12.ent.ia64", product: { name: "apache-0:1.3.27-12.ent.ia64", product_id: "apache-0:1.3.27-12.ent.ia64", product_identification_helper: { purl: "pkg:rpm/redhat/apache@1.3.27-12.ent?arch=ia64", }, }, }, { category: "product_version", name: "apache-devel-0:1.3.27-12.ent.ia64", product: { name: "apache-devel-0:1.3.27-12.ent.ia64", product_id: "apache-devel-0:1.3.27-12.ent.ia64", product_identification_helper: { purl: "pkg:rpm/redhat/apache-devel@1.3.27-12.ent?arch=ia64", }, }, }, ], category: "architecture", name: "ia64", }, { branches: [ { category: "product_version", name: "apache-0:1.3.27-12.ent.src", product: { name: "apache-0:1.3.27-12.ent.src", product_id: "apache-0:1.3.27-12.ent.src", product_identification_helper: { purl: "pkg:rpm/redhat/apache@1.3.27-12.ent?arch=src", }, }, }, ], category: "architecture", name: "src", }, { branches: [ { category: "product_version", name: "apache-manual-0:1.3.27-12.ent.i386", product: { name: "apache-manual-0:1.3.27-12.ent.i386", product_id: "apache-manual-0:1.3.27-12.ent.i386", product_identification_helper: { purl: "pkg:rpm/redhat/apache-manual@1.3.27-12.ent?arch=i386", }, }, }, { category: "product_version", name: "apache-0:1.3.27-12.ent.i386", product: { name: "apache-0:1.3.27-12.ent.i386", product_id: "apache-0:1.3.27-12.ent.i386", product_identification_helper: { purl: "pkg:rpm/redhat/apache@1.3.27-12.ent?arch=i386", }, }, }, { category: "product_version", name: "apache-devel-0:1.3.27-12.ent.i386", product: { name: "apache-devel-0:1.3.27-12.ent.i386", product_id: "apache-devel-0:1.3.27-12.ent.i386", product_identification_helper: { purl: "pkg:rpm/redhat/apache-devel@1.3.27-12.ent?arch=i386", }, }, }, ], category: "architecture", name: "i386", }, ], category: "vendor", name: "Red Hat", }, ], relationships: [ { category: "default_component_of", full_product_name: { name: "apache-0:1.3.27-12.ent.i386 as a component of Red Hat Enterprise Linux AS (Advanced Server) version 2.1 ", product_id: "2.1AS:apache-0:1.3.27-12.ent.i386", }, product_reference: "apache-0:1.3.27-12.ent.i386", relates_to_product_reference: "2.1AS", }, { category: "default_component_of", full_product_name: { name: "apache-0:1.3.27-12.ent.ia64 as a component of Red Hat Enterprise Linux AS (Advanced Server) version 2.1 ", product_id: "2.1AS:apache-0:1.3.27-12.ent.ia64", }, product_reference: "apache-0:1.3.27-12.ent.ia64", relates_to_product_reference: "2.1AS", }, { category: "default_component_of", full_product_name: { name: "apache-0:1.3.27-12.ent.src as a component of Red Hat Enterprise Linux AS (Advanced Server) version 2.1 ", product_id: "2.1AS:apache-0:1.3.27-12.ent.src", }, product_reference: "apache-0:1.3.27-12.ent.src", relates_to_product_reference: "2.1AS", }, { category: "default_component_of", full_product_name: { name: "apache-devel-0:1.3.27-12.ent.i386 as a component of Red Hat Enterprise Linux AS (Advanced Server) version 2.1 ", product_id: "2.1AS:apache-devel-0:1.3.27-12.ent.i386", }, product_reference: "apache-devel-0:1.3.27-12.ent.i386", relates_to_product_reference: "2.1AS", }, { category: "default_component_of", full_product_name: { name: "apache-devel-0:1.3.27-12.ent.ia64 as a component of Red Hat Enterprise Linux AS (Advanced Server) version 2.1 ", product_id: "2.1AS:apache-devel-0:1.3.27-12.ent.ia64", }, product_reference: "apache-devel-0:1.3.27-12.ent.ia64", relates_to_product_reference: "2.1AS", }, { category: "default_component_of", full_product_name: { name: "apache-manual-0:1.3.27-12.ent.i386 as a component of Red Hat Enterprise Linux AS (Advanced Server) version 2.1 ", product_id: "2.1AS:apache-manual-0:1.3.27-12.ent.i386", }, product_reference: "apache-manual-0:1.3.27-12.ent.i386", relates_to_product_reference: "2.1AS", }, { category: "default_component_of", full_product_name: { name: "apache-manual-0:1.3.27-12.ent.ia64 as a component of Red Hat Enterprise Linux AS (Advanced Server) version 2.1 ", product_id: "2.1AS:apache-manual-0:1.3.27-12.ent.ia64", }, product_reference: "apache-manual-0:1.3.27-12.ent.ia64", relates_to_product_reference: "2.1AS", }, { category: "default_component_of", full_product_name: { name: "apache-0:1.3.27-12.ent.i386 as a component of Red Hat Linux Advanced Workstation 2.1", product_id: "2.1AW:apache-0:1.3.27-12.ent.i386", }, product_reference: "apache-0:1.3.27-12.ent.i386", relates_to_product_reference: "2.1AW", }, { category: "default_component_of", full_product_name: { name: "apache-0:1.3.27-12.ent.ia64 as a component of Red Hat Linux Advanced Workstation 2.1", product_id: "2.1AW:apache-0:1.3.27-12.ent.ia64", }, product_reference: "apache-0:1.3.27-12.ent.ia64", relates_to_product_reference: "2.1AW", }, { category: "default_component_of", full_product_name: { name: "apache-0:1.3.27-12.ent.src as a component of Red Hat Linux Advanced Workstation 2.1", product_id: "2.1AW:apache-0:1.3.27-12.ent.src", }, product_reference: "apache-0:1.3.27-12.ent.src", relates_to_product_reference: "2.1AW", }, { category: "default_component_of", full_product_name: { name: "apache-devel-0:1.3.27-12.ent.i386 as a component of Red Hat Linux Advanced Workstation 2.1", product_id: "2.1AW:apache-devel-0:1.3.27-12.ent.i386", }, product_reference: "apache-devel-0:1.3.27-12.ent.i386", relates_to_product_reference: "2.1AW", }, { category: "default_component_of", full_product_name: { name: "apache-devel-0:1.3.27-12.ent.ia64 as a component of Red Hat Linux Advanced Workstation 2.1", product_id: "2.1AW:apache-devel-0:1.3.27-12.ent.ia64", }, product_reference: "apache-devel-0:1.3.27-12.ent.ia64", relates_to_product_reference: "2.1AW", }, { category: "default_component_of", full_product_name: { name: "apache-manual-0:1.3.27-12.ent.i386 as a component of Red Hat Linux Advanced Workstation 2.1", product_id: "2.1AW:apache-manual-0:1.3.27-12.ent.i386", }, product_reference: "apache-manual-0:1.3.27-12.ent.i386", relates_to_product_reference: "2.1AW", }, { category: "default_component_of", full_product_name: { name: "apache-manual-0:1.3.27-12.ent.ia64 as a component of Red Hat Linux Advanced Workstation 2.1", product_id: "2.1AW:apache-manual-0:1.3.27-12.ent.ia64", }, product_reference: "apache-manual-0:1.3.27-12.ent.ia64", relates_to_product_reference: "2.1AW", }, { category: "default_component_of", full_product_name: { name: "apache-0:1.3.27-12.ent.i386 as a component of Red Hat Enterprise Linux ES version 2.1", product_id: "2.1ES:apache-0:1.3.27-12.ent.i386", }, product_reference: "apache-0:1.3.27-12.ent.i386", relates_to_product_reference: "2.1ES", }, { category: "default_component_of", full_product_name: { name: "apache-0:1.3.27-12.ent.ia64 as a component of Red Hat Enterprise Linux ES version 2.1", product_id: "2.1ES:apache-0:1.3.27-12.ent.ia64", }, product_reference: "apache-0:1.3.27-12.ent.ia64", relates_to_product_reference: "2.1ES", }, { category: "default_component_of", full_product_name: { name: "apache-0:1.3.27-12.ent.src as a component of Red Hat Enterprise Linux ES version 2.1", product_id: "2.1ES:apache-0:1.3.27-12.ent.src", }, product_reference: "apache-0:1.3.27-12.ent.src", relates_to_product_reference: "2.1ES", }, { category: "default_component_of", full_product_name: { name: "apache-devel-0:1.3.27-12.ent.i386 as a component of Red Hat Enterprise Linux ES version 2.1", product_id: "2.1ES:apache-devel-0:1.3.27-12.ent.i386", }, product_reference: "apache-devel-0:1.3.27-12.ent.i386", relates_to_product_reference: "2.1ES", }, { category: "default_component_of", full_product_name: { name: "apache-devel-0:1.3.27-12.ent.ia64 as a component of Red Hat Enterprise Linux ES version 2.1", product_id: "2.1ES:apache-devel-0:1.3.27-12.ent.ia64", }, product_reference: "apache-devel-0:1.3.27-12.ent.ia64", relates_to_product_reference: "2.1ES", }, { category: "default_component_of", full_product_name: { name: "apache-manual-0:1.3.27-12.ent.i386 as a component of Red Hat Enterprise Linux ES version 2.1", product_id: "2.1ES:apache-manual-0:1.3.27-12.ent.i386", }, product_reference: "apache-manual-0:1.3.27-12.ent.i386", relates_to_product_reference: "2.1ES", }, { category: "default_component_of", full_product_name: { name: "apache-manual-0:1.3.27-12.ent.ia64 as a component of Red Hat Enterprise Linux ES version 2.1", product_id: "2.1ES:apache-manual-0:1.3.27-12.ent.ia64", }, product_reference: "apache-manual-0:1.3.27-12.ent.ia64", relates_to_product_reference: "2.1ES", }, { category: "default_component_of", full_product_name: { name: "apache-0:1.3.27-12.ent.i386 as a component of Red Hat Enterprise Linux WS version 2.1", product_id: "2.1WS:apache-0:1.3.27-12.ent.i386", }, product_reference: "apache-0:1.3.27-12.ent.i386", relates_to_product_reference: "2.1WS", }, { category: "default_component_of", full_product_name: { name: "apache-0:1.3.27-12.ent.ia64 as a component of Red Hat Enterprise Linux WS version 2.1", product_id: "2.1WS:apache-0:1.3.27-12.ent.ia64", }, product_reference: "apache-0:1.3.27-12.ent.ia64", relates_to_product_reference: "2.1WS", }, { category: "default_component_of", full_product_name: { name: "apache-0:1.3.27-12.ent.src as a component of Red Hat Enterprise Linux WS version 2.1", product_id: "2.1WS:apache-0:1.3.27-12.ent.src", }, product_reference: "apache-0:1.3.27-12.ent.src", relates_to_product_reference: "2.1WS", }, { category: "default_component_of", full_product_name: { name: "apache-devel-0:1.3.27-12.ent.i386 as a component of Red Hat Enterprise Linux WS version 2.1", product_id: "2.1WS:apache-devel-0:1.3.27-12.ent.i386", }, product_reference: "apache-devel-0:1.3.27-12.ent.i386", relates_to_product_reference: "2.1WS", }, { category: "default_component_of", full_product_name: { name: "apache-devel-0:1.3.27-12.ent.ia64 as a component of Red Hat Enterprise Linux WS version 2.1", product_id: "2.1WS:apache-devel-0:1.3.27-12.ent.ia64", }, product_reference: "apache-devel-0:1.3.27-12.ent.ia64", relates_to_product_reference: "2.1WS", }, { category: "default_component_of", full_product_name: { name: "apache-manual-0:1.3.27-12.ent.i386 as a component of Red Hat Enterprise Linux WS version 2.1", product_id: "2.1WS:apache-manual-0:1.3.27-12.ent.i386", }, product_reference: "apache-manual-0:1.3.27-12.ent.i386", relates_to_product_reference: "2.1WS", }, { category: "default_component_of", full_product_name: { name: "apache-manual-0:1.3.27-12.ent.ia64 as a component of Red Hat Enterprise Linux WS version 2.1", product_id: "2.1WS:apache-manual-0:1.3.27-12.ent.ia64", }, product_reference: "apache-manual-0:1.3.27-12.ent.ia64", relates_to_product_reference: "2.1WS", }, ], }, vulnerabilities: [ { cve: "CVE-2006-5752", cwe: { id: "CWE-79", name: "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", }, discovery_date: "2007-06-20T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "245112", }, ], notes: [ { category: "description", text: "Cross-site scripting (XSS) vulnerability in mod_status.c in the mod_status module in Apache HTTP Server (httpd), when ExtendedStatus is enabled and a public server-status page is used, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors involving charsets with browsers that perform \"charset detection\" when the content-type is not specified.", title: "Vulnerability description", }, { category: "summary", text: "httpd mod_status XSS", title: "Vulnerability summary", }, ], product_status: { fixed: [ "2.1AS:apache-0:1.3.27-12.ent.i386", "2.1AS:apache-0:1.3.27-12.ent.ia64", "2.1AS:apache-0:1.3.27-12.ent.src", "2.1AS:apache-devel-0:1.3.27-12.ent.i386", "2.1AS:apache-devel-0:1.3.27-12.ent.ia64", "2.1AS:apache-manual-0:1.3.27-12.ent.i386", "2.1AS:apache-manual-0:1.3.27-12.ent.ia64", "2.1AW:apache-0:1.3.27-12.ent.i386", "2.1AW:apache-0:1.3.27-12.ent.ia64", "2.1AW:apache-0:1.3.27-12.ent.src", "2.1AW:apache-devel-0:1.3.27-12.ent.i386", "2.1AW:apache-devel-0:1.3.27-12.ent.ia64", "2.1AW:apache-manual-0:1.3.27-12.ent.i386", "2.1AW:apache-manual-0:1.3.27-12.ent.ia64", "2.1ES:apache-0:1.3.27-12.ent.i386", "2.1ES:apache-0:1.3.27-12.ent.ia64", "2.1ES:apache-0:1.3.27-12.ent.src", "2.1ES:apache-devel-0:1.3.27-12.ent.i386", "2.1ES:apache-devel-0:1.3.27-12.ent.ia64", "2.1ES:apache-manual-0:1.3.27-12.ent.i386", "2.1ES:apache-manual-0:1.3.27-12.ent.ia64", "2.1WS:apache-0:1.3.27-12.ent.i386", "2.1WS:apache-0:1.3.27-12.ent.ia64", "2.1WS:apache-0:1.3.27-12.ent.src", "2.1WS:apache-devel-0:1.3.27-12.ent.i386", "2.1WS:apache-devel-0:1.3.27-12.ent.ia64", "2.1WS:apache-manual-0:1.3.27-12.ent.i386", "2.1WS:apache-manual-0:1.3.27-12.ent.ia64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2006-5752", }, { category: "external", summary: "RHBZ#245112", url: "https://bugzilla.redhat.com/show_bug.cgi?id=245112", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2006-5752", url: "https://www.cve.org/CVERecord?id=CVE-2006-5752", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2006-5752", url: "https://nvd.nist.gov/vuln/detail/CVE-2006-5752", }, ], release_date: "2007-06-20T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2007-06-26T15:13:00+00:00", details: "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied. \n\nThis update is available via Red Hat Network. Details on how to use \nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/FAQ_58_10188", product_ids: [ "2.1AS:apache-0:1.3.27-12.ent.i386", "2.1AS:apache-0:1.3.27-12.ent.ia64", "2.1AS:apache-0:1.3.27-12.ent.src", "2.1AS:apache-devel-0:1.3.27-12.ent.i386", "2.1AS:apache-devel-0:1.3.27-12.ent.ia64", "2.1AS:apache-manual-0:1.3.27-12.ent.i386", "2.1AS:apache-manual-0:1.3.27-12.ent.ia64", "2.1AW:apache-0:1.3.27-12.ent.i386", "2.1AW:apache-0:1.3.27-12.ent.ia64", "2.1AW:apache-0:1.3.27-12.ent.src", "2.1AW:apache-devel-0:1.3.27-12.ent.i386", "2.1AW:apache-devel-0:1.3.27-12.ent.ia64", "2.1AW:apache-manual-0:1.3.27-12.ent.i386", "2.1AW:apache-manual-0:1.3.27-12.ent.ia64", "2.1ES:apache-0:1.3.27-12.ent.i386", "2.1ES:apache-0:1.3.27-12.ent.ia64", "2.1ES:apache-0:1.3.27-12.ent.src", "2.1ES:apache-devel-0:1.3.27-12.ent.i386", "2.1ES:apache-devel-0:1.3.27-12.ent.ia64", "2.1ES:apache-manual-0:1.3.27-12.ent.i386", "2.1ES:apache-manual-0:1.3.27-12.ent.ia64", "2.1WS:apache-0:1.3.27-12.ent.i386", "2.1WS:apache-0:1.3.27-12.ent.ia64", "2.1WS:apache-0:1.3.27-12.ent.src", "2.1WS:apache-devel-0:1.3.27-12.ent.i386", "2.1WS:apache-devel-0:1.3.27-12.ent.ia64", "2.1WS:apache-manual-0:1.3.27-12.ent.i386", "2.1WS:apache-manual-0:1.3.27-12.ent.ia64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2007:0532", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "httpd mod_status XSS", }, { cve: "CVE-2007-3304", discovery_date: "2007-06-19T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "245111", }, ], notes: [ { category: "description", text: "Apache httpd 1.3.37, 2.0.59, and 2.2.4 with the Prefork MPM module, allows local users to cause a denial of service by modifying the worker_score and process_score arrays to reference an arbitrary process ID, which is sent a SIGUSR1 signal from the master process, aka \"SIGUSR1 killer.\"", title: "Vulnerability description", }, { category: "summary", text: "httpd scoreboard lack of PID protection", title: "Vulnerability summary", }, ], product_status: { fixed: [ "2.1AS:apache-0:1.3.27-12.ent.i386", "2.1AS:apache-0:1.3.27-12.ent.ia64", "2.1AS:apache-0:1.3.27-12.ent.src", "2.1AS:apache-devel-0:1.3.27-12.ent.i386", "2.1AS:apache-devel-0:1.3.27-12.ent.ia64", "2.1AS:apache-manual-0:1.3.27-12.ent.i386", "2.1AS:apache-manual-0:1.3.27-12.ent.ia64", "2.1AW:apache-0:1.3.27-12.ent.i386", "2.1AW:apache-0:1.3.27-12.ent.ia64", "2.1AW:apache-0:1.3.27-12.ent.src", "2.1AW:apache-devel-0:1.3.27-12.ent.i386", "2.1AW:apache-devel-0:1.3.27-12.ent.ia64", "2.1AW:apache-manual-0:1.3.27-12.ent.i386", "2.1AW:apache-manual-0:1.3.27-12.ent.ia64", "2.1ES:apache-0:1.3.27-12.ent.i386", "2.1ES:apache-0:1.3.27-12.ent.ia64", "2.1ES:apache-0:1.3.27-12.ent.src", "2.1ES:apache-devel-0:1.3.27-12.ent.i386", "2.1ES:apache-devel-0:1.3.27-12.ent.ia64", "2.1ES:apache-manual-0:1.3.27-12.ent.i386", "2.1ES:apache-manual-0:1.3.27-12.ent.ia64", "2.1WS:apache-0:1.3.27-12.ent.i386", "2.1WS:apache-0:1.3.27-12.ent.ia64", "2.1WS:apache-0:1.3.27-12.ent.src", "2.1WS:apache-devel-0:1.3.27-12.ent.i386", "2.1WS:apache-devel-0:1.3.27-12.ent.ia64", "2.1WS:apache-manual-0:1.3.27-12.ent.i386", "2.1WS:apache-manual-0:1.3.27-12.ent.ia64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-3304", }, { category: "external", summary: "RHBZ#245111", url: "https://bugzilla.redhat.com/show_bug.cgi?id=245111", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-3304", url: "https://www.cve.org/CVERecord?id=CVE-2007-3304", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-3304", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-3304", }, ], release_date: "2007-06-19T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2007-06-26T15:13:00+00:00", details: "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied. \n\nThis update is available via Red Hat Network. Details on how to use \nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/FAQ_58_10188", product_ids: [ "2.1AS:apache-0:1.3.27-12.ent.i386", "2.1AS:apache-0:1.3.27-12.ent.ia64", "2.1AS:apache-0:1.3.27-12.ent.src", "2.1AS:apache-devel-0:1.3.27-12.ent.i386", "2.1AS:apache-devel-0:1.3.27-12.ent.ia64", "2.1AS:apache-manual-0:1.3.27-12.ent.i386", "2.1AS:apache-manual-0:1.3.27-12.ent.ia64", "2.1AW:apache-0:1.3.27-12.ent.i386", "2.1AW:apache-0:1.3.27-12.ent.ia64", "2.1AW:apache-0:1.3.27-12.ent.src", "2.1AW:apache-devel-0:1.3.27-12.ent.i386", "2.1AW:apache-devel-0:1.3.27-12.ent.ia64", "2.1AW:apache-manual-0:1.3.27-12.ent.i386", "2.1AW:apache-manual-0:1.3.27-12.ent.ia64", "2.1ES:apache-0:1.3.27-12.ent.i386", "2.1ES:apache-0:1.3.27-12.ent.ia64", "2.1ES:apache-0:1.3.27-12.ent.src", "2.1ES:apache-devel-0:1.3.27-12.ent.i386", "2.1ES:apache-devel-0:1.3.27-12.ent.ia64", "2.1ES:apache-manual-0:1.3.27-12.ent.i386", "2.1ES:apache-manual-0:1.3.27-12.ent.ia64", "2.1WS:apache-0:1.3.27-12.ent.i386", "2.1WS:apache-0:1.3.27-12.ent.ia64", "2.1WS:apache-0:1.3.27-12.ent.src", "2.1WS:apache-devel-0:1.3.27-12.ent.i386", "2.1WS:apache-devel-0:1.3.27-12.ent.ia64", "2.1WS:apache-manual-0:1.3.27-12.ent.i386", "2.1WS:apache-manual-0:1.3.27-12.ent.ia64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2007:0532", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "httpd scoreboard lack of PID protection", }, ], }
rhsa-2007:0556
Vulnerability from csaf_redhat
Published
2007-06-26 15:22
Modified
2024-12-01 11:53
Summary
Red Hat Security Advisory: httpd security update
Notes
Topic
Updated Apache httpd packages that correct three security issues are now
available for Red Hat Enterprise Linux 5.
This update has been rated as having moderate security impact by the Red
Hat Security Response Team.
Details
The Apache HTTP Server is a popular Web server.
The Apache HTTP Server did not verify that a process was an Apache child
process before sending it signals. A local attacker with the ability to run
scripts on the Apache HTTP Server could manipulate the scoreboard and cause
arbitrary processes to be terminated which could lead to a denial of
service (CVE-2007-3304). This issue is not exploitable on Red Hat
Enterprise Linux 5 if using the default SELinux targeted policy.
A flaw was found in the Apache HTTP Server mod_status module. On sites
where the server-status page is publicly accessible and ExtendedStatus is
enabled this could lead to a cross-site scripting attack. On Red Hat
Enterprise Linux the server-status page is not enabled by default and it is
best practice to not make this publicly available. (CVE-2006-5752)
A bug was found in the Apache HTTP Server mod_cache module. On sites where
caching is enabled, a remote attacker could send a carefully crafted
request that would cause the Apache child process handling that request to
crash. This could lead to a denial of service if using a threaded
Multi-Processing Module. (CVE-2007-1863)
Users of httpd should upgrade to these updated packages, which contain
backported patches to correct these issues. Users should restart Apache
after installing this update.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ document: { aggregate_severity: { namespace: "https://access.redhat.com/security/updates/classification/", text: "Moderate", }, category: "csaf_security_advisory", csaf_version: "2.0", distribution: { text: "Copyright © Red Hat, Inc. All rights reserved.", tlp: { label: "WHITE", url: "https://www.first.org/tlp/", }, }, lang: "en", notes: [ { category: "summary", text: "Updated Apache httpd packages that correct three security issues are now\navailable for Red Hat Enterprise Linux 5.\n\nThis update has been rated as having moderate security impact by the Red\nHat Security Response Team.", title: "Topic", }, { category: "general", text: "The Apache HTTP Server is a popular Web server.\n\nThe Apache HTTP Server did not verify that a process was an Apache child\nprocess before sending it signals. A local attacker with the ability to run\nscripts on the Apache HTTP Server could manipulate the scoreboard and cause\narbitrary processes to be terminated which could lead to a denial of\nservice (CVE-2007-3304). This issue is not exploitable on Red Hat\nEnterprise Linux 5 if using the default SELinux targeted policy.\n\nA flaw was found in the Apache HTTP Server mod_status module. On sites\nwhere the server-status page is publicly accessible and ExtendedStatus is\nenabled this could lead to a cross-site scripting attack. On Red Hat\nEnterprise Linux the server-status page is not enabled by default and it is\nbest practice to not make this publicly available. (CVE-2006-5752)\n\nA bug was found in the Apache HTTP Server mod_cache module. On sites where\ncaching is enabled, a remote attacker could send a carefully crafted\nrequest that would cause the Apache child process handling that request to\ncrash. This could lead to a denial of service if using a threaded\nMulti-Processing Module. (CVE-2007-1863)\n\nUsers of httpd should upgrade to these updated packages, which contain\nbackported patches to correct these issues. Users should restart Apache\nafter installing this update.", title: "Details", }, { category: "legal_disclaimer", text: "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", title: "Terms of Use", }, ], publisher: { category: "vendor", contact_details: "https://access.redhat.com/security/team/contact/", issuing_authority: "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", name: "Red Hat Product Security", namespace: "https://www.redhat.com", }, references: [ { category: "self", summary: "https://access.redhat.com/errata/RHSA-2007:0556", url: "https://access.redhat.com/errata/RHSA-2007:0556", }, { category: "external", summary: "http://www.redhat.com/security/updates/classification/#moderate", url: "http://www.redhat.com/security/updates/classification/#moderate", }, { category: "external", summary: "244658", url: "https://bugzilla.redhat.com/show_bug.cgi?id=244658", }, { category: "external", summary: "245111", url: "https://bugzilla.redhat.com/show_bug.cgi?id=245111", }, { category: "external", summary: "245112", url: "https://bugzilla.redhat.com/show_bug.cgi?id=245112", }, { category: "self", summary: "Canonical URL", url: "https://security.access.redhat.com/data/csaf/v2/advisories/2007/rhsa-2007_0556.json", }, ], title: "Red Hat Security Advisory: httpd security update", tracking: { current_release_date: "2024-12-01T11:53:16+00:00", generator: { date: "2024-12-01T11:53:16+00:00", engine: { name: "Red Hat SDEngine", version: "4.2.1", }, }, id: "RHSA-2007:0556", initial_release_date: "2007-06-26T15:22:00+00:00", revision_history: [ { date: "2007-06-26T15:22:00+00:00", number: "1", summary: "Initial version", }, { date: "2007-06-26T11:22:15+00:00", number: "2", summary: "Last updated version", }, { date: "2024-12-01T11:53:16+00:00", number: "3", summary: "Last generated version", }, ], status: "final", version: "3", }, }, product_tree: { branches: [ { branches: [ { branches: [ { category: "product_name", name: "Red Hat Enterprise Linux Desktop (v. 5 client)", product: { name: "Red Hat Enterprise Linux Desktop (v. 5 client)", product_id: "5Client", product_identification_helper: { cpe: "cpe:/o:redhat:enterprise_linux:5::client", }, }, }, { category: "product_name", name: "Red Hat Enterprise Linux Desktop Workstation (v. 5 client)", product: { name: "Red Hat Enterprise Linux Desktop Workstation (v. 5 client)", product_id: "5Client-Workstation", product_identification_helper: { cpe: "cpe:/o:redhat:enterprise_linux:5::client_workstation", }, }, }, { category: "product_name", name: "Red Hat Enterprise Linux (v. 5 server)", product: { name: "Red Hat Enterprise Linux (v. 5 server)", product_id: "5Server", product_identification_helper: { cpe: "cpe:/o:redhat:enterprise_linux:5::server", }, }, }, ], category: "product_family", name: "Red Hat Enterprise Linux", }, { branches: [ { category: "product_version", name: "httpd-devel-0:2.2.3-7.el5.x86_64", product: { name: "httpd-devel-0:2.2.3-7.el5.x86_64", product_id: "httpd-devel-0:2.2.3-7.el5.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-devel@2.2.3-7.el5?arch=x86_64", }, }, }, { category: "product_version", name: "httpd-debuginfo-0:2.2.3-7.el5.x86_64", product: { name: "httpd-debuginfo-0:2.2.3-7.el5.x86_64", product_id: "httpd-debuginfo-0:2.2.3-7.el5.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-debuginfo@2.2.3-7.el5?arch=x86_64", }, }, }, { category: "product_version", name: "httpd-manual-0:2.2.3-7.el5.x86_64", product: { name: "httpd-manual-0:2.2.3-7.el5.x86_64", product_id: "httpd-manual-0:2.2.3-7.el5.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-manual@2.2.3-7.el5?arch=x86_64", }, }, }, { category: "product_version", name: "mod_ssl-1:2.2.3-7.el5.x86_64", product: { name: "mod_ssl-1:2.2.3-7.el5.x86_64", product_id: "mod_ssl-1:2.2.3-7.el5.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/mod_ssl@2.2.3-7.el5?arch=x86_64&epoch=1", }, }, }, { category: "product_version", name: "httpd-0:2.2.3-7.el5.x86_64", product: { name: "httpd-0:2.2.3-7.el5.x86_64", product_id: "httpd-0:2.2.3-7.el5.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/httpd@2.2.3-7.el5?arch=x86_64", }, }, }, ], category: "architecture", name: "x86_64", }, { branches: [ { category: "product_version", name: "httpd-devel-0:2.2.3-7.el5.i386", product: { name: "httpd-devel-0:2.2.3-7.el5.i386", product_id: "httpd-devel-0:2.2.3-7.el5.i386", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-devel@2.2.3-7.el5?arch=i386", }, }, }, { category: "product_version", name: "httpd-debuginfo-0:2.2.3-7.el5.i386", product: { name: "httpd-debuginfo-0:2.2.3-7.el5.i386", product_id: "httpd-debuginfo-0:2.2.3-7.el5.i386", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-debuginfo@2.2.3-7.el5?arch=i386", }, }, }, { category: "product_version", name: "httpd-manual-0:2.2.3-7.el5.i386", product: { name: "httpd-manual-0:2.2.3-7.el5.i386", product_id: "httpd-manual-0:2.2.3-7.el5.i386", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-manual@2.2.3-7.el5?arch=i386", }, }, }, { category: "product_version", name: "mod_ssl-1:2.2.3-7.el5.i386", product: { name: "mod_ssl-1:2.2.3-7.el5.i386", product_id: "mod_ssl-1:2.2.3-7.el5.i386", product_identification_helper: { purl: "pkg:rpm/redhat/mod_ssl@2.2.3-7.el5?arch=i386&epoch=1", }, }, }, { category: "product_version", name: "httpd-0:2.2.3-7.el5.i386", product: { name: "httpd-0:2.2.3-7.el5.i386", product_id: "httpd-0:2.2.3-7.el5.i386", product_identification_helper: { purl: "pkg:rpm/redhat/httpd@2.2.3-7.el5?arch=i386", }, }, }, ], category: "architecture", name: "i386", }, { branches: [ { category: "product_version", name: "httpd-0:2.2.3-7.el5.src", product: { name: "httpd-0:2.2.3-7.el5.src", product_id: "httpd-0:2.2.3-7.el5.src", product_identification_helper: { purl: "pkg:rpm/redhat/httpd@2.2.3-7.el5?arch=src", }, }, }, ], category: "architecture", name: "src", }, { branches: [ { category: "product_version", name: "mod_ssl-1:2.2.3-7.el5.ia64", product: { name: "mod_ssl-1:2.2.3-7.el5.ia64", product_id: "mod_ssl-1:2.2.3-7.el5.ia64", product_identification_helper: { purl: "pkg:rpm/redhat/mod_ssl@2.2.3-7.el5?arch=ia64&epoch=1", }, }, }, { category: "product_version", name: "httpd-devel-0:2.2.3-7.el5.ia64", product: { name: "httpd-devel-0:2.2.3-7.el5.ia64", product_id: "httpd-devel-0:2.2.3-7.el5.ia64", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-devel@2.2.3-7.el5?arch=ia64", }, }, }, { category: "product_version", name: "httpd-debuginfo-0:2.2.3-7.el5.ia64", product: { name: "httpd-debuginfo-0:2.2.3-7.el5.ia64", product_id: "httpd-debuginfo-0:2.2.3-7.el5.ia64", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-debuginfo@2.2.3-7.el5?arch=ia64", }, }, }, { category: "product_version", name: "httpd-manual-0:2.2.3-7.el5.ia64", product: { name: "httpd-manual-0:2.2.3-7.el5.ia64", product_id: "httpd-manual-0:2.2.3-7.el5.ia64", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-manual@2.2.3-7.el5?arch=ia64", }, }, }, { category: "product_version", name: "httpd-0:2.2.3-7.el5.ia64", product: { name: "httpd-0:2.2.3-7.el5.ia64", product_id: "httpd-0:2.2.3-7.el5.ia64", product_identification_helper: { purl: "pkg:rpm/redhat/httpd@2.2.3-7.el5?arch=ia64", }, }, }, ], category: "architecture", name: "ia64", }, { branches: [ { category: "product_version", name: "mod_ssl-1:2.2.3-7.el5.ppc", product: { name: "mod_ssl-1:2.2.3-7.el5.ppc", product_id: "mod_ssl-1:2.2.3-7.el5.ppc", product_identification_helper: { purl: "pkg:rpm/redhat/mod_ssl@2.2.3-7.el5?arch=ppc&epoch=1", }, }, }, { category: "product_version", name: "httpd-devel-0:2.2.3-7.el5.ppc", product: { name: "httpd-devel-0:2.2.3-7.el5.ppc", product_id: "httpd-devel-0:2.2.3-7.el5.ppc", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-devel@2.2.3-7.el5?arch=ppc", }, }, }, { category: "product_version", name: "httpd-debuginfo-0:2.2.3-7.el5.ppc", product: { name: "httpd-debuginfo-0:2.2.3-7.el5.ppc", product_id: "httpd-debuginfo-0:2.2.3-7.el5.ppc", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-debuginfo@2.2.3-7.el5?arch=ppc", }, }, }, { category: "product_version", name: "httpd-manual-0:2.2.3-7.el5.ppc", product: { name: "httpd-manual-0:2.2.3-7.el5.ppc", product_id: "httpd-manual-0:2.2.3-7.el5.ppc", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-manual@2.2.3-7.el5?arch=ppc", }, }, }, { category: "product_version", name: "httpd-0:2.2.3-7.el5.ppc", product: { name: "httpd-0:2.2.3-7.el5.ppc", product_id: "httpd-0:2.2.3-7.el5.ppc", product_identification_helper: { purl: "pkg:rpm/redhat/httpd@2.2.3-7.el5?arch=ppc", }, }, }, ], category: "architecture", name: "ppc", }, { branches: [ { category: "product_version", name: "httpd-devel-0:2.2.3-7.el5.ppc64", product: { name: "httpd-devel-0:2.2.3-7.el5.ppc64", product_id: "httpd-devel-0:2.2.3-7.el5.ppc64", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-devel@2.2.3-7.el5?arch=ppc64", }, }, }, { category: "product_version", name: "httpd-debuginfo-0:2.2.3-7.el5.ppc64", product: { name: "httpd-debuginfo-0:2.2.3-7.el5.ppc64", product_id: "httpd-debuginfo-0:2.2.3-7.el5.ppc64", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-debuginfo@2.2.3-7.el5?arch=ppc64", }, }, }, ], category: "architecture", name: "ppc64", }, { branches: [ { category: "product_version", name: "mod_ssl-1:2.2.3-7.el5.s390x", product: { name: "mod_ssl-1:2.2.3-7.el5.s390x", product_id: "mod_ssl-1:2.2.3-7.el5.s390x", product_identification_helper: { purl: "pkg:rpm/redhat/mod_ssl@2.2.3-7.el5?arch=s390x&epoch=1", }, }, }, { category: "product_version", name: "httpd-devel-0:2.2.3-7.el5.s390x", product: { name: "httpd-devel-0:2.2.3-7.el5.s390x", product_id: "httpd-devel-0:2.2.3-7.el5.s390x", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-devel@2.2.3-7.el5?arch=s390x", }, }, }, { category: "product_version", name: "httpd-debuginfo-0:2.2.3-7.el5.s390x", product: { name: "httpd-debuginfo-0:2.2.3-7.el5.s390x", product_id: "httpd-debuginfo-0:2.2.3-7.el5.s390x", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-debuginfo@2.2.3-7.el5?arch=s390x", }, }, }, { category: "product_version", name: "httpd-manual-0:2.2.3-7.el5.s390x", product: { name: "httpd-manual-0:2.2.3-7.el5.s390x", product_id: "httpd-manual-0:2.2.3-7.el5.s390x", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-manual@2.2.3-7.el5?arch=s390x", }, }, }, { category: "product_version", name: "httpd-0:2.2.3-7.el5.s390x", product: { name: "httpd-0:2.2.3-7.el5.s390x", product_id: "httpd-0:2.2.3-7.el5.s390x", product_identification_helper: { purl: "pkg:rpm/redhat/httpd@2.2.3-7.el5?arch=s390x", }, }, }, ], category: "architecture", name: "s390x", }, { branches: [ { category: "product_version", name: "httpd-devel-0:2.2.3-7.el5.s390", product: { name: "httpd-devel-0:2.2.3-7.el5.s390", product_id: "httpd-devel-0:2.2.3-7.el5.s390", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-devel@2.2.3-7.el5?arch=s390", }, }, }, { category: "product_version", name: "httpd-debuginfo-0:2.2.3-7.el5.s390", product: { name: "httpd-debuginfo-0:2.2.3-7.el5.s390", product_id: "httpd-debuginfo-0:2.2.3-7.el5.s390", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-debuginfo@2.2.3-7.el5?arch=s390", }, }, }, ], category: "architecture", name: "s390", }, ], category: "vendor", name: "Red Hat", }, ], relationships: [ { category: "default_component_of", full_product_name: { name: "httpd-0:2.2.3-7.el5.i386 as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)", product_id: "5Client-Workstation:httpd-0:2.2.3-7.el5.i386", }, product_reference: "httpd-0:2.2.3-7.el5.i386", relates_to_product_reference: "5Client-Workstation", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.2.3-7.el5.ia64 as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)", product_id: "5Client-Workstation:httpd-0:2.2.3-7.el5.ia64", }, product_reference: "httpd-0:2.2.3-7.el5.ia64", relates_to_product_reference: "5Client-Workstation", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.2.3-7.el5.ppc as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)", product_id: "5Client-Workstation:httpd-0:2.2.3-7.el5.ppc", }, product_reference: "httpd-0:2.2.3-7.el5.ppc", relates_to_product_reference: "5Client-Workstation", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.2.3-7.el5.s390x as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)", product_id: "5Client-Workstation:httpd-0:2.2.3-7.el5.s390x", }, product_reference: "httpd-0:2.2.3-7.el5.s390x", relates_to_product_reference: "5Client-Workstation", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.2.3-7.el5.src as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)", product_id: "5Client-Workstation:httpd-0:2.2.3-7.el5.src", }, product_reference: "httpd-0:2.2.3-7.el5.src", relates_to_product_reference: "5Client-Workstation", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.2.3-7.el5.x86_64 as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)", product_id: "5Client-Workstation:httpd-0:2.2.3-7.el5.x86_64", }, product_reference: "httpd-0:2.2.3-7.el5.x86_64", relates_to_product_reference: "5Client-Workstation", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.2.3-7.el5.i386 as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)", product_id: "5Client-Workstation:httpd-debuginfo-0:2.2.3-7.el5.i386", }, product_reference: "httpd-debuginfo-0:2.2.3-7.el5.i386", relates_to_product_reference: "5Client-Workstation", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.2.3-7.el5.ia64 as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)", product_id: "5Client-Workstation:httpd-debuginfo-0:2.2.3-7.el5.ia64", }, product_reference: "httpd-debuginfo-0:2.2.3-7.el5.ia64", relates_to_product_reference: "5Client-Workstation", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.2.3-7.el5.ppc as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)", product_id: "5Client-Workstation:httpd-debuginfo-0:2.2.3-7.el5.ppc", }, product_reference: "httpd-debuginfo-0:2.2.3-7.el5.ppc", relates_to_product_reference: "5Client-Workstation", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.2.3-7.el5.ppc64 as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)", product_id: "5Client-Workstation:httpd-debuginfo-0:2.2.3-7.el5.ppc64", }, product_reference: "httpd-debuginfo-0:2.2.3-7.el5.ppc64", relates_to_product_reference: "5Client-Workstation", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.2.3-7.el5.s390 as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)", product_id: "5Client-Workstation:httpd-debuginfo-0:2.2.3-7.el5.s390", }, product_reference: "httpd-debuginfo-0:2.2.3-7.el5.s390", relates_to_product_reference: "5Client-Workstation", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.2.3-7.el5.s390x as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)", product_id: "5Client-Workstation:httpd-debuginfo-0:2.2.3-7.el5.s390x", }, product_reference: "httpd-debuginfo-0:2.2.3-7.el5.s390x", relates_to_product_reference: "5Client-Workstation", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.2.3-7.el5.x86_64 as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)", product_id: "5Client-Workstation:httpd-debuginfo-0:2.2.3-7.el5.x86_64", }, product_reference: "httpd-debuginfo-0:2.2.3-7.el5.x86_64", relates_to_product_reference: "5Client-Workstation", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.2.3-7.el5.i386 as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)", product_id: "5Client-Workstation:httpd-devel-0:2.2.3-7.el5.i386", }, product_reference: "httpd-devel-0:2.2.3-7.el5.i386", relates_to_product_reference: "5Client-Workstation", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.2.3-7.el5.ia64 as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)", product_id: "5Client-Workstation:httpd-devel-0:2.2.3-7.el5.ia64", }, product_reference: "httpd-devel-0:2.2.3-7.el5.ia64", relates_to_product_reference: "5Client-Workstation", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.2.3-7.el5.ppc as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)", product_id: "5Client-Workstation:httpd-devel-0:2.2.3-7.el5.ppc", }, product_reference: "httpd-devel-0:2.2.3-7.el5.ppc", relates_to_product_reference: "5Client-Workstation", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.2.3-7.el5.ppc64 as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)", product_id: "5Client-Workstation:httpd-devel-0:2.2.3-7.el5.ppc64", }, product_reference: "httpd-devel-0:2.2.3-7.el5.ppc64", relates_to_product_reference: "5Client-Workstation", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.2.3-7.el5.s390 as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)", product_id: "5Client-Workstation:httpd-devel-0:2.2.3-7.el5.s390", }, product_reference: "httpd-devel-0:2.2.3-7.el5.s390", relates_to_product_reference: "5Client-Workstation", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.2.3-7.el5.s390x as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)", product_id: "5Client-Workstation:httpd-devel-0:2.2.3-7.el5.s390x", }, product_reference: "httpd-devel-0:2.2.3-7.el5.s390x", relates_to_product_reference: "5Client-Workstation", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.2.3-7.el5.x86_64 as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)", product_id: "5Client-Workstation:httpd-devel-0:2.2.3-7.el5.x86_64", }, product_reference: "httpd-devel-0:2.2.3-7.el5.x86_64", relates_to_product_reference: "5Client-Workstation", }, { category: "default_component_of", full_product_name: { name: "httpd-manual-0:2.2.3-7.el5.i386 as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)", product_id: "5Client-Workstation:httpd-manual-0:2.2.3-7.el5.i386", }, product_reference: "httpd-manual-0:2.2.3-7.el5.i386", relates_to_product_reference: "5Client-Workstation", }, { category: "default_component_of", full_product_name: { name: "httpd-manual-0:2.2.3-7.el5.ia64 as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)", product_id: "5Client-Workstation:httpd-manual-0:2.2.3-7.el5.ia64", }, product_reference: "httpd-manual-0:2.2.3-7.el5.ia64", relates_to_product_reference: "5Client-Workstation", }, { category: "default_component_of", full_product_name: { name: "httpd-manual-0:2.2.3-7.el5.ppc as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)", product_id: "5Client-Workstation:httpd-manual-0:2.2.3-7.el5.ppc", }, product_reference: "httpd-manual-0:2.2.3-7.el5.ppc", relates_to_product_reference: "5Client-Workstation", }, { category: "default_component_of", full_product_name: { name: "httpd-manual-0:2.2.3-7.el5.s390x as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)", product_id: "5Client-Workstation:httpd-manual-0:2.2.3-7.el5.s390x", }, product_reference: "httpd-manual-0:2.2.3-7.el5.s390x", relates_to_product_reference: "5Client-Workstation", }, { category: "default_component_of", full_product_name: { name: "httpd-manual-0:2.2.3-7.el5.x86_64 as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)", product_id: "5Client-Workstation:httpd-manual-0:2.2.3-7.el5.x86_64", }, product_reference: "httpd-manual-0:2.2.3-7.el5.x86_64", relates_to_product_reference: "5Client-Workstation", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.2.3-7.el5.i386 as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)", product_id: "5Client-Workstation:mod_ssl-1:2.2.3-7.el5.i386", }, product_reference: "mod_ssl-1:2.2.3-7.el5.i386", relates_to_product_reference: "5Client-Workstation", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.2.3-7.el5.ia64 as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)", product_id: "5Client-Workstation:mod_ssl-1:2.2.3-7.el5.ia64", }, product_reference: "mod_ssl-1:2.2.3-7.el5.ia64", relates_to_product_reference: "5Client-Workstation", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.2.3-7.el5.ppc as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)", product_id: "5Client-Workstation:mod_ssl-1:2.2.3-7.el5.ppc", }, product_reference: "mod_ssl-1:2.2.3-7.el5.ppc", relates_to_product_reference: "5Client-Workstation", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.2.3-7.el5.s390x as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)", product_id: "5Client-Workstation:mod_ssl-1:2.2.3-7.el5.s390x", }, product_reference: "mod_ssl-1:2.2.3-7.el5.s390x", relates_to_product_reference: "5Client-Workstation", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.2.3-7.el5.x86_64 as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)", product_id: "5Client-Workstation:mod_ssl-1:2.2.3-7.el5.x86_64", }, product_reference: "mod_ssl-1:2.2.3-7.el5.x86_64", relates_to_product_reference: "5Client-Workstation", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.2.3-7.el5.i386 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)", product_id: "5Client:httpd-0:2.2.3-7.el5.i386", }, product_reference: "httpd-0:2.2.3-7.el5.i386", relates_to_product_reference: "5Client", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.2.3-7.el5.ia64 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)", product_id: "5Client:httpd-0:2.2.3-7.el5.ia64", }, product_reference: "httpd-0:2.2.3-7.el5.ia64", relates_to_product_reference: "5Client", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.2.3-7.el5.ppc as a component of Red Hat Enterprise Linux Desktop (v. 5 client)", product_id: "5Client:httpd-0:2.2.3-7.el5.ppc", }, product_reference: "httpd-0:2.2.3-7.el5.ppc", relates_to_product_reference: "5Client", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.2.3-7.el5.s390x as a component of Red Hat Enterprise Linux Desktop (v. 5 client)", product_id: "5Client:httpd-0:2.2.3-7.el5.s390x", }, product_reference: "httpd-0:2.2.3-7.el5.s390x", relates_to_product_reference: "5Client", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.2.3-7.el5.src as a component of Red Hat Enterprise Linux Desktop (v. 5 client)", product_id: "5Client:httpd-0:2.2.3-7.el5.src", }, product_reference: "httpd-0:2.2.3-7.el5.src", relates_to_product_reference: "5Client", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.2.3-7.el5.x86_64 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)", product_id: "5Client:httpd-0:2.2.3-7.el5.x86_64", }, product_reference: "httpd-0:2.2.3-7.el5.x86_64", relates_to_product_reference: "5Client", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.2.3-7.el5.i386 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)", product_id: "5Client:httpd-debuginfo-0:2.2.3-7.el5.i386", }, product_reference: "httpd-debuginfo-0:2.2.3-7.el5.i386", relates_to_product_reference: "5Client", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.2.3-7.el5.ia64 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)", product_id: "5Client:httpd-debuginfo-0:2.2.3-7.el5.ia64", }, product_reference: "httpd-debuginfo-0:2.2.3-7.el5.ia64", relates_to_product_reference: "5Client", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.2.3-7.el5.ppc as a component of Red Hat Enterprise Linux Desktop (v. 5 client)", product_id: "5Client:httpd-debuginfo-0:2.2.3-7.el5.ppc", }, product_reference: "httpd-debuginfo-0:2.2.3-7.el5.ppc", relates_to_product_reference: "5Client", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.2.3-7.el5.ppc64 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)", product_id: "5Client:httpd-debuginfo-0:2.2.3-7.el5.ppc64", }, product_reference: "httpd-debuginfo-0:2.2.3-7.el5.ppc64", relates_to_product_reference: "5Client", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.2.3-7.el5.s390 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)", product_id: "5Client:httpd-debuginfo-0:2.2.3-7.el5.s390", }, product_reference: "httpd-debuginfo-0:2.2.3-7.el5.s390", relates_to_product_reference: "5Client", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.2.3-7.el5.s390x as a component of Red Hat Enterprise Linux Desktop (v. 5 client)", product_id: "5Client:httpd-debuginfo-0:2.2.3-7.el5.s390x", }, product_reference: "httpd-debuginfo-0:2.2.3-7.el5.s390x", relates_to_product_reference: "5Client", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.2.3-7.el5.x86_64 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)", product_id: "5Client:httpd-debuginfo-0:2.2.3-7.el5.x86_64", }, product_reference: "httpd-debuginfo-0:2.2.3-7.el5.x86_64", relates_to_product_reference: "5Client", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.2.3-7.el5.i386 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)", product_id: "5Client:httpd-devel-0:2.2.3-7.el5.i386", }, product_reference: "httpd-devel-0:2.2.3-7.el5.i386", relates_to_product_reference: "5Client", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.2.3-7.el5.ia64 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)", product_id: "5Client:httpd-devel-0:2.2.3-7.el5.ia64", }, product_reference: "httpd-devel-0:2.2.3-7.el5.ia64", relates_to_product_reference: "5Client", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.2.3-7.el5.ppc as a component of Red Hat Enterprise Linux Desktop (v. 5 client)", product_id: "5Client:httpd-devel-0:2.2.3-7.el5.ppc", }, product_reference: "httpd-devel-0:2.2.3-7.el5.ppc", relates_to_product_reference: "5Client", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.2.3-7.el5.ppc64 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)", product_id: "5Client:httpd-devel-0:2.2.3-7.el5.ppc64", }, product_reference: "httpd-devel-0:2.2.3-7.el5.ppc64", relates_to_product_reference: "5Client", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.2.3-7.el5.s390 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)", product_id: "5Client:httpd-devel-0:2.2.3-7.el5.s390", }, product_reference: "httpd-devel-0:2.2.3-7.el5.s390", relates_to_product_reference: "5Client", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.2.3-7.el5.s390x as a component of Red Hat Enterprise Linux Desktop (v. 5 client)", product_id: "5Client:httpd-devel-0:2.2.3-7.el5.s390x", }, product_reference: "httpd-devel-0:2.2.3-7.el5.s390x", relates_to_product_reference: "5Client", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.2.3-7.el5.x86_64 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)", product_id: "5Client:httpd-devel-0:2.2.3-7.el5.x86_64", }, product_reference: "httpd-devel-0:2.2.3-7.el5.x86_64", relates_to_product_reference: "5Client", }, { category: "default_component_of", full_product_name: { name: "httpd-manual-0:2.2.3-7.el5.i386 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)", product_id: "5Client:httpd-manual-0:2.2.3-7.el5.i386", }, product_reference: "httpd-manual-0:2.2.3-7.el5.i386", relates_to_product_reference: "5Client", }, { category: "default_component_of", full_product_name: { name: "httpd-manual-0:2.2.3-7.el5.ia64 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)", product_id: "5Client:httpd-manual-0:2.2.3-7.el5.ia64", }, product_reference: "httpd-manual-0:2.2.3-7.el5.ia64", relates_to_product_reference: "5Client", }, { category: "default_component_of", full_product_name: { name: "httpd-manual-0:2.2.3-7.el5.ppc as a component of Red Hat Enterprise Linux Desktop (v. 5 client)", product_id: "5Client:httpd-manual-0:2.2.3-7.el5.ppc", }, product_reference: "httpd-manual-0:2.2.3-7.el5.ppc", relates_to_product_reference: "5Client", }, { category: "default_component_of", full_product_name: { name: "httpd-manual-0:2.2.3-7.el5.s390x as a component of Red Hat Enterprise Linux Desktop (v. 5 client)", product_id: "5Client:httpd-manual-0:2.2.3-7.el5.s390x", }, product_reference: "httpd-manual-0:2.2.3-7.el5.s390x", relates_to_product_reference: "5Client", }, { category: "default_component_of", full_product_name: { name: "httpd-manual-0:2.2.3-7.el5.x86_64 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)", product_id: "5Client:httpd-manual-0:2.2.3-7.el5.x86_64", }, product_reference: "httpd-manual-0:2.2.3-7.el5.x86_64", relates_to_product_reference: "5Client", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.2.3-7.el5.i386 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)", product_id: "5Client:mod_ssl-1:2.2.3-7.el5.i386", }, product_reference: "mod_ssl-1:2.2.3-7.el5.i386", relates_to_product_reference: "5Client", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.2.3-7.el5.ia64 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)", product_id: "5Client:mod_ssl-1:2.2.3-7.el5.ia64", }, product_reference: "mod_ssl-1:2.2.3-7.el5.ia64", relates_to_product_reference: "5Client", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.2.3-7.el5.ppc as a component of Red Hat Enterprise Linux Desktop (v. 5 client)", product_id: "5Client:mod_ssl-1:2.2.3-7.el5.ppc", }, product_reference: "mod_ssl-1:2.2.3-7.el5.ppc", relates_to_product_reference: "5Client", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.2.3-7.el5.s390x as a component of Red Hat Enterprise Linux Desktop (v. 5 client)", product_id: "5Client:mod_ssl-1:2.2.3-7.el5.s390x", }, product_reference: "mod_ssl-1:2.2.3-7.el5.s390x", relates_to_product_reference: "5Client", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.2.3-7.el5.x86_64 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)", product_id: "5Client:mod_ssl-1:2.2.3-7.el5.x86_64", }, product_reference: "mod_ssl-1:2.2.3-7.el5.x86_64", relates_to_product_reference: "5Client", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.2.3-7.el5.i386 as a component of Red Hat Enterprise Linux (v. 5 server)", product_id: "5Server:httpd-0:2.2.3-7.el5.i386", }, product_reference: "httpd-0:2.2.3-7.el5.i386", relates_to_product_reference: "5Server", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.2.3-7.el5.ia64 as a component of Red Hat Enterprise Linux (v. 5 server)", product_id: "5Server:httpd-0:2.2.3-7.el5.ia64", }, product_reference: "httpd-0:2.2.3-7.el5.ia64", relates_to_product_reference: "5Server", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.2.3-7.el5.ppc as a component of Red Hat Enterprise Linux (v. 5 server)", product_id: "5Server:httpd-0:2.2.3-7.el5.ppc", }, product_reference: "httpd-0:2.2.3-7.el5.ppc", relates_to_product_reference: "5Server", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.2.3-7.el5.s390x as a component of Red Hat Enterprise Linux (v. 5 server)", product_id: "5Server:httpd-0:2.2.3-7.el5.s390x", }, product_reference: "httpd-0:2.2.3-7.el5.s390x", relates_to_product_reference: "5Server", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.2.3-7.el5.src as a component of Red Hat Enterprise Linux (v. 5 server)", product_id: "5Server:httpd-0:2.2.3-7.el5.src", }, product_reference: "httpd-0:2.2.3-7.el5.src", relates_to_product_reference: "5Server", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.2.3-7.el5.x86_64 as a component of Red Hat Enterprise Linux (v. 5 server)", product_id: "5Server:httpd-0:2.2.3-7.el5.x86_64", }, product_reference: "httpd-0:2.2.3-7.el5.x86_64", relates_to_product_reference: "5Server", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.2.3-7.el5.i386 as a component of Red Hat Enterprise Linux (v. 5 server)", product_id: "5Server:httpd-debuginfo-0:2.2.3-7.el5.i386", }, product_reference: "httpd-debuginfo-0:2.2.3-7.el5.i386", relates_to_product_reference: "5Server", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.2.3-7.el5.ia64 as a component of Red Hat Enterprise Linux (v. 5 server)", product_id: "5Server:httpd-debuginfo-0:2.2.3-7.el5.ia64", }, product_reference: "httpd-debuginfo-0:2.2.3-7.el5.ia64", relates_to_product_reference: "5Server", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.2.3-7.el5.ppc as a component of Red Hat Enterprise Linux (v. 5 server)", product_id: "5Server:httpd-debuginfo-0:2.2.3-7.el5.ppc", }, product_reference: "httpd-debuginfo-0:2.2.3-7.el5.ppc", relates_to_product_reference: "5Server", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.2.3-7.el5.ppc64 as a component of Red Hat Enterprise Linux (v. 5 server)", product_id: "5Server:httpd-debuginfo-0:2.2.3-7.el5.ppc64", }, product_reference: "httpd-debuginfo-0:2.2.3-7.el5.ppc64", relates_to_product_reference: "5Server", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.2.3-7.el5.s390 as a component of Red Hat Enterprise Linux (v. 5 server)", product_id: "5Server:httpd-debuginfo-0:2.2.3-7.el5.s390", }, product_reference: "httpd-debuginfo-0:2.2.3-7.el5.s390", relates_to_product_reference: "5Server", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.2.3-7.el5.s390x as a component of Red Hat Enterprise Linux (v. 5 server)", product_id: "5Server:httpd-debuginfo-0:2.2.3-7.el5.s390x", }, product_reference: "httpd-debuginfo-0:2.2.3-7.el5.s390x", relates_to_product_reference: "5Server", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.2.3-7.el5.x86_64 as a component of Red Hat Enterprise Linux (v. 5 server)", product_id: "5Server:httpd-debuginfo-0:2.2.3-7.el5.x86_64", }, product_reference: "httpd-debuginfo-0:2.2.3-7.el5.x86_64", relates_to_product_reference: "5Server", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.2.3-7.el5.i386 as a component of Red Hat Enterprise Linux (v. 5 server)", product_id: "5Server:httpd-devel-0:2.2.3-7.el5.i386", }, product_reference: "httpd-devel-0:2.2.3-7.el5.i386", relates_to_product_reference: "5Server", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.2.3-7.el5.ia64 as a component of Red Hat Enterprise Linux (v. 5 server)", product_id: "5Server:httpd-devel-0:2.2.3-7.el5.ia64", }, product_reference: "httpd-devel-0:2.2.3-7.el5.ia64", relates_to_product_reference: "5Server", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.2.3-7.el5.ppc as a component of Red Hat Enterprise Linux (v. 5 server)", product_id: "5Server:httpd-devel-0:2.2.3-7.el5.ppc", }, product_reference: "httpd-devel-0:2.2.3-7.el5.ppc", relates_to_product_reference: "5Server", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.2.3-7.el5.ppc64 as a component of Red Hat Enterprise Linux (v. 5 server)", product_id: "5Server:httpd-devel-0:2.2.3-7.el5.ppc64", }, product_reference: "httpd-devel-0:2.2.3-7.el5.ppc64", relates_to_product_reference: "5Server", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.2.3-7.el5.s390 as a component of Red Hat Enterprise Linux (v. 5 server)", product_id: "5Server:httpd-devel-0:2.2.3-7.el5.s390", }, product_reference: "httpd-devel-0:2.2.3-7.el5.s390", relates_to_product_reference: "5Server", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.2.3-7.el5.s390x as a component of Red Hat Enterprise Linux (v. 5 server)", product_id: "5Server:httpd-devel-0:2.2.3-7.el5.s390x", }, product_reference: "httpd-devel-0:2.2.3-7.el5.s390x", relates_to_product_reference: "5Server", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.2.3-7.el5.x86_64 as a component of Red Hat Enterprise Linux (v. 5 server)", product_id: "5Server:httpd-devel-0:2.2.3-7.el5.x86_64", }, product_reference: "httpd-devel-0:2.2.3-7.el5.x86_64", relates_to_product_reference: "5Server", }, { category: "default_component_of", full_product_name: { name: "httpd-manual-0:2.2.3-7.el5.i386 as a component of Red Hat Enterprise Linux (v. 5 server)", product_id: "5Server:httpd-manual-0:2.2.3-7.el5.i386", }, product_reference: "httpd-manual-0:2.2.3-7.el5.i386", relates_to_product_reference: "5Server", }, { category: "default_component_of", full_product_name: { name: "httpd-manual-0:2.2.3-7.el5.ia64 as a component of Red Hat Enterprise Linux (v. 5 server)", product_id: "5Server:httpd-manual-0:2.2.3-7.el5.ia64", }, product_reference: "httpd-manual-0:2.2.3-7.el5.ia64", relates_to_product_reference: "5Server", }, { category: "default_component_of", full_product_name: { name: "httpd-manual-0:2.2.3-7.el5.ppc as a component of Red Hat Enterprise Linux (v. 5 server)", product_id: "5Server:httpd-manual-0:2.2.3-7.el5.ppc", }, product_reference: "httpd-manual-0:2.2.3-7.el5.ppc", relates_to_product_reference: "5Server", }, { category: "default_component_of", full_product_name: { name: "httpd-manual-0:2.2.3-7.el5.s390x as a component of Red Hat Enterprise Linux (v. 5 server)", product_id: "5Server:httpd-manual-0:2.2.3-7.el5.s390x", }, product_reference: "httpd-manual-0:2.2.3-7.el5.s390x", relates_to_product_reference: "5Server", }, { category: "default_component_of", full_product_name: { name: "httpd-manual-0:2.2.3-7.el5.x86_64 as a component of Red Hat Enterprise Linux (v. 5 server)", product_id: "5Server:httpd-manual-0:2.2.3-7.el5.x86_64", }, product_reference: "httpd-manual-0:2.2.3-7.el5.x86_64", relates_to_product_reference: "5Server", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.2.3-7.el5.i386 as a component of Red Hat Enterprise Linux (v. 5 server)", product_id: "5Server:mod_ssl-1:2.2.3-7.el5.i386", }, product_reference: "mod_ssl-1:2.2.3-7.el5.i386", relates_to_product_reference: "5Server", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.2.3-7.el5.ia64 as a component of Red Hat Enterprise Linux (v. 5 server)", product_id: "5Server:mod_ssl-1:2.2.3-7.el5.ia64", }, product_reference: "mod_ssl-1:2.2.3-7.el5.ia64", relates_to_product_reference: "5Server", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.2.3-7.el5.ppc as a component of Red Hat Enterprise Linux (v. 5 server)", product_id: "5Server:mod_ssl-1:2.2.3-7.el5.ppc", }, product_reference: "mod_ssl-1:2.2.3-7.el5.ppc", relates_to_product_reference: "5Server", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.2.3-7.el5.s390x as a component of Red Hat Enterprise Linux (v. 5 server)", product_id: "5Server:mod_ssl-1:2.2.3-7.el5.s390x", }, product_reference: "mod_ssl-1:2.2.3-7.el5.s390x", relates_to_product_reference: "5Server", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.2.3-7.el5.x86_64 as a component of Red Hat Enterprise Linux (v. 5 server)", product_id: "5Server:mod_ssl-1:2.2.3-7.el5.x86_64", }, product_reference: "mod_ssl-1:2.2.3-7.el5.x86_64", relates_to_product_reference: "5Server", }, ], }, vulnerabilities: [ { cve: "CVE-2006-5752", cwe: { id: "CWE-79", name: "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", }, discovery_date: "2007-06-20T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "245112", }, ], notes: [ { category: "description", text: "Cross-site scripting (XSS) vulnerability in mod_status.c in the mod_status module in Apache HTTP Server (httpd), when ExtendedStatus is enabled and a public server-status page is used, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors involving charsets with browsers that perform \"charset detection\" when the content-type is not specified.", title: "Vulnerability description", }, { category: "summary", text: "httpd mod_status XSS", title: "Vulnerability summary", }, ], product_status: { fixed: [ "5Client-Workstation:httpd-0:2.2.3-7.el5.i386", "5Client-Workstation:httpd-0:2.2.3-7.el5.ia64", "5Client-Workstation:httpd-0:2.2.3-7.el5.ppc", "5Client-Workstation:httpd-0:2.2.3-7.el5.s390x", "5Client-Workstation:httpd-0:2.2.3-7.el5.src", "5Client-Workstation:httpd-0:2.2.3-7.el5.x86_64", "5Client-Workstation:httpd-debuginfo-0:2.2.3-7.el5.i386", "5Client-Workstation:httpd-debuginfo-0:2.2.3-7.el5.ia64", "5Client-Workstation:httpd-debuginfo-0:2.2.3-7.el5.ppc", "5Client-Workstation:httpd-debuginfo-0:2.2.3-7.el5.ppc64", "5Client-Workstation:httpd-debuginfo-0:2.2.3-7.el5.s390", "5Client-Workstation:httpd-debuginfo-0:2.2.3-7.el5.s390x", "5Client-Workstation:httpd-debuginfo-0:2.2.3-7.el5.x86_64", "5Client-Workstation:httpd-devel-0:2.2.3-7.el5.i386", "5Client-Workstation:httpd-devel-0:2.2.3-7.el5.ia64", "5Client-Workstation:httpd-devel-0:2.2.3-7.el5.ppc", "5Client-Workstation:httpd-devel-0:2.2.3-7.el5.ppc64", "5Client-Workstation:httpd-devel-0:2.2.3-7.el5.s390", "5Client-Workstation:httpd-devel-0:2.2.3-7.el5.s390x", "5Client-Workstation:httpd-devel-0:2.2.3-7.el5.x86_64", "5Client-Workstation:httpd-manual-0:2.2.3-7.el5.i386", "5Client-Workstation:httpd-manual-0:2.2.3-7.el5.ia64", "5Client-Workstation:httpd-manual-0:2.2.3-7.el5.ppc", "5Client-Workstation:httpd-manual-0:2.2.3-7.el5.s390x", "5Client-Workstation:httpd-manual-0:2.2.3-7.el5.x86_64", "5Client-Workstation:mod_ssl-1:2.2.3-7.el5.i386", "5Client-Workstation:mod_ssl-1:2.2.3-7.el5.ia64", "5Client-Workstation:mod_ssl-1:2.2.3-7.el5.ppc", "5Client-Workstation:mod_ssl-1:2.2.3-7.el5.s390x", "5Client-Workstation:mod_ssl-1:2.2.3-7.el5.x86_64", "5Client:httpd-0:2.2.3-7.el5.i386", "5Client:httpd-0:2.2.3-7.el5.ia64", "5Client:httpd-0:2.2.3-7.el5.ppc", "5Client:httpd-0:2.2.3-7.el5.s390x", "5Client:httpd-0:2.2.3-7.el5.src", "5Client:httpd-0:2.2.3-7.el5.x86_64", "5Client:httpd-debuginfo-0:2.2.3-7.el5.i386", "5Client:httpd-debuginfo-0:2.2.3-7.el5.ia64", "5Client:httpd-debuginfo-0:2.2.3-7.el5.ppc", "5Client:httpd-debuginfo-0:2.2.3-7.el5.ppc64", "5Client:httpd-debuginfo-0:2.2.3-7.el5.s390", "5Client:httpd-debuginfo-0:2.2.3-7.el5.s390x", "5Client:httpd-debuginfo-0:2.2.3-7.el5.x86_64", "5Client:httpd-devel-0:2.2.3-7.el5.i386", "5Client:httpd-devel-0:2.2.3-7.el5.ia64", "5Client:httpd-devel-0:2.2.3-7.el5.ppc", "5Client:httpd-devel-0:2.2.3-7.el5.ppc64", "5Client:httpd-devel-0:2.2.3-7.el5.s390", "5Client:httpd-devel-0:2.2.3-7.el5.s390x", "5Client:httpd-devel-0:2.2.3-7.el5.x86_64", "5Client:httpd-manual-0:2.2.3-7.el5.i386", "5Client:httpd-manual-0:2.2.3-7.el5.ia64", "5Client:httpd-manual-0:2.2.3-7.el5.ppc", "5Client:httpd-manual-0:2.2.3-7.el5.s390x", "5Client:httpd-manual-0:2.2.3-7.el5.x86_64", "5Client:mod_ssl-1:2.2.3-7.el5.i386", "5Client:mod_ssl-1:2.2.3-7.el5.ia64", "5Client:mod_ssl-1:2.2.3-7.el5.ppc", "5Client:mod_ssl-1:2.2.3-7.el5.s390x", "5Client:mod_ssl-1:2.2.3-7.el5.x86_64", "5Server:httpd-0:2.2.3-7.el5.i386", "5Server:httpd-0:2.2.3-7.el5.ia64", "5Server:httpd-0:2.2.3-7.el5.ppc", "5Server:httpd-0:2.2.3-7.el5.s390x", "5Server:httpd-0:2.2.3-7.el5.src", "5Server:httpd-0:2.2.3-7.el5.x86_64", "5Server:httpd-debuginfo-0:2.2.3-7.el5.i386", "5Server:httpd-debuginfo-0:2.2.3-7.el5.ia64", "5Server:httpd-debuginfo-0:2.2.3-7.el5.ppc", "5Server:httpd-debuginfo-0:2.2.3-7.el5.ppc64", "5Server:httpd-debuginfo-0:2.2.3-7.el5.s390", "5Server:httpd-debuginfo-0:2.2.3-7.el5.s390x", "5Server:httpd-debuginfo-0:2.2.3-7.el5.x86_64", "5Server:httpd-devel-0:2.2.3-7.el5.i386", "5Server:httpd-devel-0:2.2.3-7.el5.ia64", "5Server:httpd-devel-0:2.2.3-7.el5.ppc", "5Server:httpd-devel-0:2.2.3-7.el5.ppc64", "5Server:httpd-devel-0:2.2.3-7.el5.s390", "5Server:httpd-devel-0:2.2.3-7.el5.s390x", "5Server:httpd-devel-0:2.2.3-7.el5.x86_64", "5Server:httpd-manual-0:2.2.3-7.el5.i386", "5Server:httpd-manual-0:2.2.3-7.el5.ia64", "5Server:httpd-manual-0:2.2.3-7.el5.ppc", "5Server:httpd-manual-0:2.2.3-7.el5.s390x", "5Server:httpd-manual-0:2.2.3-7.el5.x86_64", "5Server:mod_ssl-1:2.2.3-7.el5.i386", "5Server:mod_ssl-1:2.2.3-7.el5.ia64", "5Server:mod_ssl-1:2.2.3-7.el5.ppc", "5Server:mod_ssl-1:2.2.3-7.el5.s390x", "5Server:mod_ssl-1:2.2.3-7.el5.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2006-5752", }, { category: "external", summary: "RHBZ#245112", url: "https://bugzilla.redhat.com/show_bug.cgi?id=245112", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2006-5752", url: "https://www.cve.org/CVERecord?id=CVE-2006-5752", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2006-5752", url: "https://nvd.nist.gov/vuln/detail/CVE-2006-5752", }, ], release_date: "2007-06-20T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2007-06-26T15:22:00+00:00", details: "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied. \n\nThis update is available via Red Hat Network. Details on how to use \nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/FAQ_58_10188", product_ids: [ "5Client-Workstation:httpd-0:2.2.3-7.el5.i386", "5Client-Workstation:httpd-0:2.2.3-7.el5.ia64", "5Client-Workstation:httpd-0:2.2.3-7.el5.ppc", "5Client-Workstation:httpd-0:2.2.3-7.el5.s390x", "5Client-Workstation:httpd-0:2.2.3-7.el5.src", "5Client-Workstation:httpd-0:2.2.3-7.el5.x86_64", "5Client-Workstation:httpd-debuginfo-0:2.2.3-7.el5.i386", "5Client-Workstation:httpd-debuginfo-0:2.2.3-7.el5.ia64", "5Client-Workstation:httpd-debuginfo-0:2.2.3-7.el5.ppc", "5Client-Workstation:httpd-debuginfo-0:2.2.3-7.el5.ppc64", "5Client-Workstation:httpd-debuginfo-0:2.2.3-7.el5.s390", "5Client-Workstation:httpd-debuginfo-0:2.2.3-7.el5.s390x", "5Client-Workstation:httpd-debuginfo-0:2.2.3-7.el5.x86_64", "5Client-Workstation:httpd-devel-0:2.2.3-7.el5.i386", "5Client-Workstation:httpd-devel-0:2.2.3-7.el5.ia64", "5Client-Workstation:httpd-devel-0:2.2.3-7.el5.ppc", "5Client-Workstation:httpd-devel-0:2.2.3-7.el5.ppc64", "5Client-Workstation:httpd-devel-0:2.2.3-7.el5.s390", "5Client-Workstation:httpd-devel-0:2.2.3-7.el5.s390x", "5Client-Workstation:httpd-devel-0:2.2.3-7.el5.x86_64", "5Client-Workstation:httpd-manual-0:2.2.3-7.el5.i386", "5Client-Workstation:httpd-manual-0:2.2.3-7.el5.ia64", "5Client-Workstation:httpd-manual-0:2.2.3-7.el5.ppc", "5Client-Workstation:httpd-manual-0:2.2.3-7.el5.s390x", "5Client-Workstation:httpd-manual-0:2.2.3-7.el5.x86_64", "5Client-Workstation:mod_ssl-1:2.2.3-7.el5.i386", "5Client-Workstation:mod_ssl-1:2.2.3-7.el5.ia64", "5Client-Workstation:mod_ssl-1:2.2.3-7.el5.ppc", "5Client-Workstation:mod_ssl-1:2.2.3-7.el5.s390x", "5Client-Workstation:mod_ssl-1:2.2.3-7.el5.x86_64", "5Client:httpd-0:2.2.3-7.el5.i386", "5Client:httpd-0:2.2.3-7.el5.ia64", "5Client:httpd-0:2.2.3-7.el5.ppc", "5Client:httpd-0:2.2.3-7.el5.s390x", "5Client:httpd-0:2.2.3-7.el5.src", "5Client:httpd-0:2.2.3-7.el5.x86_64", "5Client:httpd-debuginfo-0:2.2.3-7.el5.i386", "5Client:httpd-debuginfo-0:2.2.3-7.el5.ia64", "5Client:httpd-debuginfo-0:2.2.3-7.el5.ppc", "5Client:httpd-debuginfo-0:2.2.3-7.el5.ppc64", "5Client:httpd-debuginfo-0:2.2.3-7.el5.s390", "5Client:httpd-debuginfo-0:2.2.3-7.el5.s390x", "5Client:httpd-debuginfo-0:2.2.3-7.el5.x86_64", "5Client:httpd-devel-0:2.2.3-7.el5.i386", "5Client:httpd-devel-0:2.2.3-7.el5.ia64", "5Client:httpd-devel-0:2.2.3-7.el5.ppc", "5Client:httpd-devel-0:2.2.3-7.el5.ppc64", "5Client:httpd-devel-0:2.2.3-7.el5.s390", "5Client:httpd-devel-0:2.2.3-7.el5.s390x", "5Client:httpd-devel-0:2.2.3-7.el5.x86_64", "5Client:httpd-manual-0:2.2.3-7.el5.i386", "5Client:httpd-manual-0:2.2.3-7.el5.ia64", "5Client:httpd-manual-0:2.2.3-7.el5.ppc", "5Client:httpd-manual-0:2.2.3-7.el5.s390x", "5Client:httpd-manual-0:2.2.3-7.el5.x86_64", "5Client:mod_ssl-1:2.2.3-7.el5.i386", "5Client:mod_ssl-1:2.2.3-7.el5.ia64", "5Client:mod_ssl-1:2.2.3-7.el5.ppc", "5Client:mod_ssl-1:2.2.3-7.el5.s390x", "5Client:mod_ssl-1:2.2.3-7.el5.x86_64", "5Server:httpd-0:2.2.3-7.el5.i386", "5Server:httpd-0:2.2.3-7.el5.ia64", "5Server:httpd-0:2.2.3-7.el5.ppc", "5Server:httpd-0:2.2.3-7.el5.s390x", "5Server:httpd-0:2.2.3-7.el5.src", "5Server:httpd-0:2.2.3-7.el5.x86_64", "5Server:httpd-debuginfo-0:2.2.3-7.el5.i386", "5Server:httpd-debuginfo-0:2.2.3-7.el5.ia64", "5Server:httpd-debuginfo-0:2.2.3-7.el5.ppc", "5Server:httpd-debuginfo-0:2.2.3-7.el5.ppc64", "5Server:httpd-debuginfo-0:2.2.3-7.el5.s390", "5Server:httpd-debuginfo-0:2.2.3-7.el5.s390x", "5Server:httpd-debuginfo-0:2.2.3-7.el5.x86_64", "5Server:httpd-devel-0:2.2.3-7.el5.i386", "5Server:httpd-devel-0:2.2.3-7.el5.ia64", "5Server:httpd-devel-0:2.2.3-7.el5.ppc", "5Server:httpd-devel-0:2.2.3-7.el5.ppc64", "5Server:httpd-devel-0:2.2.3-7.el5.s390", "5Server:httpd-devel-0:2.2.3-7.el5.s390x", "5Server:httpd-devel-0:2.2.3-7.el5.x86_64", "5Server:httpd-manual-0:2.2.3-7.el5.i386", "5Server:httpd-manual-0:2.2.3-7.el5.ia64", "5Server:httpd-manual-0:2.2.3-7.el5.ppc", "5Server:httpd-manual-0:2.2.3-7.el5.s390x", "5Server:httpd-manual-0:2.2.3-7.el5.x86_64", "5Server:mod_ssl-1:2.2.3-7.el5.i386", "5Server:mod_ssl-1:2.2.3-7.el5.ia64", "5Server:mod_ssl-1:2.2.3-7.el5.ppc", "5Server:mod_ssl-1:2.2.3-7.el5.s390x", "5Server:mod_ssl-1:2.2.3-7.el5.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2007:0556", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "httpd mod_status XSS", }, { cve: "CVE-2007-1863", discovery_date: "2007-05-02T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "244658", }, ], notes: [ { category: "description", text: "cache_util.c in the mod_cache module in Apache HTTP Server (httpd), when caching is enabled and a threaded Multi-Processing Module (MPM) is used, allows remote attackers to cause a denial of service (child processing handler crash) via a request with the (1) s-maxage, (2) max-age, (3) min-fresh, or (4) max-stale Cache-Control headers without a value.", title: "Vulnerability description", }, { category: "summary", text: "httpd mod_cache segfault", title: "Vulnerability summary", }, ], product_status: { fixed: [ "5Client-Workstation:httpd-0:2.2.3-7.el5.i386", "5Client-Workstation:httpd-0:2.2.3-7.el5.ia64", "5Client-Workstation:httpd-0:2.2.3-7.el5.ppc", "5Client-Workstation:httpd-0:2.2.3-7.el5.s390x", "5Client-Workstation:httpd-0:2.2.3-7.el5.src", "5Client-Workstation:httpd-0:2.2.3-7.el5.x86_64", "5Client-Workstation:httpd-debuginfo-0:2.2.3-7.el5.i386", "5Client-Workstation:httpd-debuginfo-0:2.2.3-7.el5.ia64", "5Client-Workstation:httpd-debuginfo-0:2.2.3-7.el5.ppc", "5Client-Workstation:httpd-debuginfo-0:2.2.3-7.el5.ppc64", "5Client-Workstation:httpd-debuginfo-0:2.2.3-7.el5.s390", "5Client-Workstation:httpd-debuginfo-0:2.2.3-7.el5.s390x", "5Client-Workstation:httpd-debuginfo-0:2.2.3-7.el5.x86_64", "5Client-Workstation:httpd-devel-0:2.2.3-7.el5.i386", "5Client-Workstation:httpd-devel-0:2.2.3-7.el5.ia64", "5Client-Workstation:httpd-devel-0:2.2.3-7.el5.ppc", "5Client-Workstation:httpd-devel-0:2.2.3-7.el5.ppc64", "5Client-Workstation:httpd-devel-0:2.2.3-7.el5.s390", "5Client-Workstation:httpd-devel-0:2.2.3-7.el5.s390x", "5Client-Workstation:httpd-devel-0:2.2.3-7.el5.x86_64", "5Client-Workstation:httpd-manual-0:2.2.3-7.el5.i386", "5Client-Workstation:httpd-manual-0:2.2.3-7.el5.ia64", "5Client-Workstation:httpd-manual-0:2.2.3-7.el5.ppc", "5Client-Workstation:httpd-manual-0:2.2.3-7.el5.s390x", "5Client-Workstation:httpd-manual-0:2.2.3-7.el5.x86_64", "5Client-Workstation:mod_ssl-1:2.2.3-7.el5.i386", "5Client-Workstation:mod_ssl-1:2.2.3-7.el5.ia64", "5Client-Workstation:mod_ssl-1:2.2.3-7.el5.ppc", "5Client-Workstation:mod_ssl-1:2.2.3-7.el5.s390x", "5Client-Workstation:mod_ssl-1:2.2.3-7.el5.x86_64", "5Client:httpd-0:2.2.3-7.el5.i386", "5Client:httpd-0:2.2.3-7.el5.ia64", "5Client:httpd-0:2.2.3-7.el5.ppc", "5Client:httpd-0:2.2.3-7.el5.s390x", "5Client:httpd-0:2.2.3-7.el5.src", "5Client:httpd-0:2.2.3-7.el5.x86_64", "5Client:httpd-debuginfo-0:2.2.3-7.el5.i386", "5Client:httpd-debuginfo-0:2.2.3-7.el5.ia64", "5Client:httpd-debuginfo-0:2.2.3-7.el5.ppc", "5Client:httpd-debuginfo-0:2.2.3-7.el5.ppc64", "5Client:httpd-debuginfo-0:2.2.3-7.el5.s390", "5Client:httpd-debuginfo-0:2.2.3-7.el5.s390x", "5Client:httpd-debuginfo-0:2.2.3-7.el5.x86_64", "5Client:httpd-devel-0:2.2.3-7.el5.i386", "5Client:httpd-devel-0:2.2.3-7.el5.ia64", "5Client:httpd-devel-0:2.2.3-7.el5.ppc", "5Client:httpd-devel-0:2.2.3-7.el5.ppc64", "5Client:httpd-devel-0:2.2.3-7.el5.s390", "5Client:httpd-devel-0:2.2.3-7.el5.s390x", "5Client:httpd-devel-0:2.2.3-7.el5.x86_64", "5Client:httpd-manual-0:2.2.3-7.el5.i386", "5Client:httpd-manual-0:2.2.3-7.el5.ia64", "5Client:httpd-manual-0:2.2.3-7.el5.ppc", "5Client:httpd-manual-0:2.2.3-7.el5.s390x", "5Client:httpd-manual-0:2.2.3-7.el5.x86_64", "5Client:mod_ssl-1:2.2.3-7.el5.i386", "5Client:mod_ssl-1:2.2.3-7.el5.ia64", "5Client:mod_ssl-1:2.2.3-7.el5.ppc", "5Client:mod_ssl-1:2.2.3-7.el5.s390x", "5Client:mod_ssl-1:2.2.3-7.el5.x86_64", "5Server:httpd-0:2.2.3-7.el5.i386", "5Server:httpd-0:2.2.3-7.el5.ia64", "5Server:httpd-0:2.2.3-7.el5.ppc", "5Server:httpd-0:2.2.3-7.el5.s390x", "5Server:httpd-0:2.2.3-7.el5.src", "5Server:httpd-0:2.2.3-7.el5.x86_64", "5Server:httpd-debuginfo-0:2.2.3-7.el5.i386", "5Server:httpd-debuginfo-0:2.2.3-7.el5.ia64", "5Server:httpd-debuginfo-0:2.2.3-7.el5.ppc", "5Server:httpd-debuginfo-0:2.2.3-7.el5.ppc64", "5Server:httpd-debuginfo-0:2.2.3-7.el5.s390", "5Server:httpd-debuginfo-0:2.2.3-7.el5.s390x", "5Server:httpd-debuginfo-0:2.2.3-7.el5.x86_64", "5Server:httpd-devel-0:2.2.3-7.el5.i386", "5Server:httpd-devel-0:2.2.3-7.el5.ia64", "5Server:httpd-devel-0:2.2.3-7.el5.ppc", "5Server:httpd-devel-0:2.2.3-7.el5.ppc64", "5Server:httpd-devel-0:2.2.3-7.el5.s390", "5Server:httpd-devel-0:2.2.3-7.el5.s390x", "5Server:httpd-devel-0:2.2.3-7.el5.x86_64", "5Server:httpd-manual-0:2.2.3-7.el5.i386", "5Server:httpd-manual-0:2.2.3-7.el5.ia64", "5Server:httpd-manual-0:2.2.3-7.el5.ppc", "5Server:httpd-manual-0:2.2.3-7.el5.s390x", "5Server:httpd-manual-0:2.2.3-7.el5.x86_64", "5Server:mod_ssl-1:2.2.3-7.el5.i386", "5Server:mod_ssl-1:2.2.3-7.el5.ia64", "5Server:mod_ssl-1:2.2.3-7.el5.ppc", "5Server:mod_ssl-1:2.2.3-7.el5.s390x", "5Server:mod_ssl-1:2.2.3-7.el5.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-1863", }, { category: "external", summary: "RHBZ#244658", url: "https://bugzilla.redhat.com/show_bug.cgi?id=244658", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-1863", url: "https://www.cve.org/CVERecord?id=CVE-2007-1863", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-1863", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-1863", }, ], release_date: "2007-05-02T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2007-06-26T15:22:00+00:00", details: "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied. \n\nThis update is available via Red Hat Network. Details on how to use \nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/FAQ_58_10188", product_ids: [ "5Client-Workstation:httpd-0:2.2.3-7.el5.i386", "5Client-Workstation:httpd-0:2.2.3-7.el5.ia64", "5Client-Workstation:httpd-0:2.2.3-7.el5.ppc", "5Client-Workstation:httpd-0:2.2.3-7.el5.s390x", "5Client-Workstation:httpd-0:2.2.3-7.el5.src", "5Client-Workstation:httpd-0:2.2.3-7.el5.x86_64", "5Client-Workstation:httpd-debuginfo-0:2.2.3-7.el5.i386", "5Client-Workstation:httpd-debuginfo-0:2.2.3-7.el5.ia64", "5Client-Workstation:httpd-debuginfo-0:2.2.3-7.el5.ppc", "5Client-Workstation:httpd-debuginfo-0:2.2.3-7.el5.ppc64", "5Client-Workstation:httpd-debuginfo-0:2.2.3-7.el5.s390", "5Client-Workstation:httpd-debuginfo-0:2.2.3-7.el5.s390x", "5Client-Workstation:httpd-debuginfo-0:2.2.3-7.el5.x86_64", "5Client-Workstation:httpd-devel-0:2.2.3-7.el5.i386", "5Client-Workstation:httpd-devel-0:2.2.3-7.el5.ia64", "5Client-Workstation:httpd-devel-0:2.2.3-7.el5.ppc", "5Client-Workstation:httpd-devel-0:2.2.3-7.el5.ppc64", "5Client-Workstation:httpd-devel-0:2.2.3-7.el5.s390", "5Client-Workstation:httpd-devel-0:2.2.3-7.el5.s390x", "5Client-Workstation:httpd-devel-0:2.2.3-7.el5.x86_64", "5Client-Workstation:httpd-manual-0:2.2.3-7.el5.i386", "5Client-Workstation:httpd-manual-0:2.2.3-7.el5.ia64", "5Client-Workstation:httpd-manual-0:2.2.3-7.el5.ppc", "5Client-Workstation:httpd-manual-0:2.2.3-7.el5.s390x", "5Client-Workstation:httpd-manual-0:2.2.3-7.el5.x86_64", "5Client-Workstation:mod_ssl-1:2.2.3-7.el5.i386", "5Client-Workstation:mod_ssl-1:2.2.3-7.el5.ia64", "5Client-Workstation:mod_ssl-1:2.2.3-7.el5.ppc", "5Client-Workstation:mod_ssl-1:2.2.3-7.el5.s390x", "5Client-Workstation:mod_ssl-1:2.2.3-7.el5.x86_64", "5Client:httpd-0:2.2.3-7.el5.i386", "5Client:httpd-0:2.2.3-7.el5.ia64", "5Client:httpd-0:2.2.3-7.el5.ppc", "5Client:httpd-0:2.2.3-7.el5.s390x", "5Client:httpd-0:2.2.3-7.el5.src", "5Client:httpd-0:2.2.3-7.el5.x86_64", "5Client:httpd-debuginfo-0:2.2.3-7.el5.i386", "5Client:httpd-debuginfo-0:2.2.3-7.el5.ia64", "5Client:httpd-debuginfo-0:2.2.3-7.el5.ppc", "5Client:httpd-debuginfo-0:2.2.3-7.el5.ppc64", "5Client:httpd-debuginfo-0:2.2.3-7.el5.s390", "5Client:httpd-debuginfo-0:2.2.3-7.el5.s390x", "5Client:httpd-debuginfo-0:2.2.3-7.el5.x86_64", "5Client:httpd-devel-0:2.2.3-7.el5.i386", "5Client:httpd-devel-0:2.2.3-7.el5.ia64", "5Client:httpd-devel-0:2.2.3-7.el5.ppc", "5Client:httpd-devel-0:2.2.3-7.el5.ppc64", "5Client:httpd-devel-0:2.2.3-7.el5.s390", "5Client:httpd-devel-0:2.2.3-7.el5.s390x", "5Client:httpd-devel-0:2.2.3-7.el5.x86_64", "5Client:httpd-manual-0:2.2.3-7.el5.i386", "5Client:httpd-manual-0:2.2.3-7.el5.ia64", "5Client:httpd-manual-0:2.2.3-7.el5.ppc", "5Client:httpd-manual-0:2.2.3-7.el5.s390x", "5Client:httpd-manual-0:2.2.3-7.el5.x86_64", "5Client:mod_ssl-1:2.2.3-7.el5.i386", "5Client:mod_ssl-1:2.2.3-7.el5.ia64", "5Client:mod_ssl-1:2.2.3-7.el5.ppc", "5Client:mod_ssl-1:2.2.3-7.el5.s390x", "5Client:mod_ssl-1:2.2.3-7.el5.x86_64", "5Server:httpd-0:2.2.3-7.el5.i386", "5Server:httpd-0:2.2.3-7.el5.ia64", "5Server:httpd-0:2.2.3-7.el5.ppc", "5Server:httpd-0:2.2.3-7.el5.s390x", "5Server:httpd-0:2.2.3-7.el5.src", "5Server:httpd-0:2.2.3-7.el5.x86_64", "5Server:httpd-debuginfo-0:2.2.3-7.el5.i386", "5Server:httpd-debuginfo-0:2.2.3-7.el5.ia64", "5Server:httpd-debuginfo-0:2.2.3-7.el5.ppc", "5Server:httpd-debuginfo-0:2.2.3-7.el5.ppc64", "5Server:httpd-debuginfo-0:2.2.3-7.el5.s390", "5Server:httpd-debuginfo-0:2.2.3-7.el5.s390x", "5Server:httpd-debuginfo-0:2.2.3-7.el5.x86_64", "5Server:httpd-devel-0:2.2.3-7.el5.i386", "5Server:httpd-devel-0:2.2.3-7.el5.ia64", "5Server:httpd-devel-0:2.2.3-7.el5.ppc", "5Server:httpd-devel-0:2.2.3-7.el5.ppc64", "5Server:httpd-devel-0:2.2.3-7.el5.s390", "5Server:httpd-devel-0:2.2.3-7.el5.s390x", "5Server:httpd-devel-0:2.2.3-7.el5.x86_64", "5Server:httpd-manual-0:2.2.3-7.el5.i386", "5Server:httpd-manual-0:2.2.3-7.el5.ia64", "5Server:httpd-manual-0:2.2.3-7.el5.ppc", "5Server:httpd-manual-0:2.2.3-7.el5.s390x", "5Server:httpd-manual-0:2.2.3-7.el5.x86_64", "5Server:mod_ssl-1:2.2.3-7.el5.i386", "5Server:mod_ssl-1:2.2.3-7.el5.ia64", "5Server:mod_ssl-1:2.2.3-7.el5.ppc", "5Server:mod_ssl-1:2.2.3-7.el5.s390x", "5Server:mod_ssl-1:2.2.3-7.el5.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2007:0556", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "httpd mod_cache segfault", }, { cve: "CVE-2007-3304", discovery_date: "2007-06-19T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "245111", }, ], notes: [ { category: "description", text: "Apache httpd 1.3.37, 2.0.59, and 2.2.4 with the Prefork MPM module, allows local users to cause a denial of service by modifying the worker_score and process_score arrays to reference an arbitrary process ID, which is sent a SIGUSR1 signal from the master process, aka \"SIGUSR1 killer.\"", title: "Vulnerability description", }, { category: "summary", text: "httpd scoreboard lack of PID protection", title: "Vulnerability summary", }, ], product_status: { fixed: [ "5Client-Workstation:httpd-0:2.2.3-7.el5.i386", "5Client-Workstation:httpd-0:2.2.3-7.el5.ia64", "5Client-Workstation:httpd-0:2.2.3-7.el5.ppc", "5Client-Workstation:httpd-0:2.2.3-7.el5.s390x", "5Client-Workstation:httpd-0:2.2.3-7.el5.src", "5Client-Workstation:httpd-0:2.2.3-7.el5.x86_64", "5Client-Workstation:httpd-debuginfo-0:2.2.3-7.el5.i386", "5Client-Workstation:httpd-debuginfo-0:2.2.3-7.el5.ia64", "5Client-Workstation:httpd-debuginfo-0:2.2.3-7.el5.ppc", "5Client-Workstation:httpd-debuginfo-0:2.2.3-7.el5.ppc64", "5Client-Workstation:httpd-debuginfo-0:2.2.3-7.el5.s390", "5Client-Workstation:httpd-debuginfo-0:2.2.3-7.el5.s390x", "5Client-Workstation:httpd-debuginfo-0:2.2.3-7.el5.x86_64", "5Client-Workstation:httpd-devel-0:2.2.3-7.el5.i386", "5Client-Workstation:httpd-devel-0:2.2.3-7.el5.ia64", "5Client-Workstation:httpd-devel-0:2.2.3-7.el5.ppc", "5Client-Workstation:httpd-devel-0:2.2.3-7.el5.ppc64", "5Client-Workstation:httpd-devel-0:2.2.3-7.el5.s390", "5Client-Workstation:httpd-devel-0:2.2.3-7.el5.s390x", "5Client-Workstation:httpd-devel-0:2.2.3-7.el5.x86_64", "5Client-Workstation:httpd-manual-0:2.2.3-7.el5.i386", "5Client-Workstation:httpd-manual-0:2.2.3-7.el5.ia64", "5Client-Workstation:httpd-manual-0:2.2.3-7.el5.ppc", "5Client-Workstation:httpd-manual-0:2.2.3-7.el5.s390x", "5Client-Workstation:httpd-manual-0:2.2.3-7.el5.x86_64", "5Client-Workstation:mod_ssl-1:2.2.3-7.el5.i386", "5Client-Workstation:mod_ssl-1:2.2.3-7.el5.ia64", "5Client-Workstation:mod_ssl-1:2.2.3-7.el5.ppc", "5Client-Workstation:mod_ssl-1:2.2.3-7.el5.s390x", "5Client-Workstation:mod_ssl-1:2.2.3-7.el5.x86_64", "5Client:httpd-0:2.2.3-7.el5.i386", "5Client:httpd-0:2.2.3-7.el5.ia64", "5Client:httpd-0:2.2.3-7.el5.ppc", "5Client:httpd-0:2.2.3-7.el5.s390x", "5Client:httpd-0:2.2.3-7.el5.src", "5Client:httpd-0:2.2.3-7.el5.x86_64", "5Client:httpd-debuginfo-0:2.2.3-7.el5.i386", "5Client:httpd-debuginfo-0:2.2.3-7.el5.ia64", "5Client:httpd-debuginfo-0:2.2.3-7.el5.ppc", "5Client:httpd-debuginfo-0:2.2.3-7.el5.ppc64", "5Client:httpd-debuginfo-0:2.2.3-7.el5.s390", "5Client:httpd-debuginfo-0:2.2.3-7.el5.s390x", "5Client:httpd-debuginfo-0:2.2.3-7.el5.x86_64", "5Client:httpd-devel-0:2.2.3-7.el5.i386", "5Client:httpd-devel-0:2.2.3-7.el5.ia64", "5Client:httpd-devel-0:2.2.3-7.el5.ppc", "5Client:httpd-devel-0:2.2.3-7.el5.ppc64", "5Client:httpd-devel-0:2.2.3-7.el5.s390", "5Client:httpd-devel-0:2.2.3-7.el5.s390x", "5Client:httpd-devel-0:2.2.3-7.el5.x86_64", "5Client:httpd-manual-0:2.2.3-7.el5.i386", "5Client:httpd-manual-0:2.2.3-7.el5.ia64", "5Client:httpd-manual-0:2.2.3-7.el5.ppc", "5Client:httpd-manual-0:2.2.3-7.el5.s390x", "5Client:httpd-manual-0:2.2.3-7.el5.x86_64", "5Client:mod_ssl-1:2.2.3-7.el5.i386", "5Client:mod_ssl-1:2.2.3-7.el5.ia64", "5Client:mod_ssl-1:2.2.3-7.el5.ppc", "5Client:mod_ssl-1:2.2.3-7.el5.s390x", "5Client:mod_ssl-1:2.2.3-7.el5.x86_64", "5Server:httpd-0:2.2.3-7.el5.i386", "5Server:httpd-0:2.2.3-7.el5.ia64", "5Server:httpd-0:2.2.3-7.el5.ppc", "5Server:httpd-0:2.2.3-7.el5.s390x", "5Server:httpd-0:2.2.3-7.el5.src", "5Server:httpd-0:2.2.3-7.el5.x86_64", "5Server:httpd-debuginfo-0:2.2.3-7.el5.i386", "5Server:httpd-debuginfo-0:2.2.3-7.el5.ia64", "5Server:httpd-debuginfo-0:2.2.3-7.el5.ppc", "5Server:httpd-debuginfo-0:2.2.3-7.el5.ppc64", "5Server:httpd-debuginfo-0:2.2.3-7.el5.s390", "5Server:httpd-debuginfo-0:2.2.3-7.el5.s390x", "5Server:httpd-debuginfo-0:2.2.3-7.el5.x86_64", "5Server:httpd-devel-0:2.2.3-7.el5.i386", "5Server:httpd-devel-0:2.2.3-7.el5.ia64", "5Server:httpd-devel-0:2.2.3-7.el5.ppc", "5Server:httpd-devel-0:2.2.3-7.el5.ppc64", "5Server:httpd-devel-0:2.2.3-7.el5.s390", "5Server:httpd-devel-0:2.2.3-7.el5.s390x", "5Server:httpd-devel-0:2.2.3-7.el5.x86_64", "5Server:httpd-manual-0:2.2.3-7.el5.i386", "5Server:httpd-manual-0:2.2.3-7.el5.ia64", "5Server:httpd-manual-0:2.2.3-7.el5.ppc", "5Server:httpd-manual-0:2.2.3-7.el5.s390x", "5Server:httpd-manual-0:2.2.3-7.el5.x86_64", "5Server:mod_ssl-1:2.2.3-7.el5.i386", "5Server:mod_ssl-1:2.2.3-7.el5.ia64", "5Server:mod_ssl-1:2.2.3-7.el5.ppc", "5Server:mod_ssl-1:2.2.3-7.el5.s390x", "5Server:mod_ssl-1:2.2.3-7.el5.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-3304", }, { category: "external", summary: "RHBZ#245111", url: "https://bugzilla.redhat.com/show_bug.cgi?id=245111", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-3304", url: "https://www.cve.org/CVERecord?id=CVE-2007-3304", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-3304", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-3304", }, ], release_date: "2007-06-19T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2007-06-26T15:22:00+00:00", details: "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied. \n\nThis update is available via Red Hat Network. Details on how to use \nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/FAQ_58_10188", product_ids: [ "5Client-Workstation:httpd-0:2.2.3-7.el5.i386", "5Client-Workstation:httpd-0:2.2.3-7.el5.ia64", "5Client-Workstation:httpd-0:2.2.3-7.el5.ppc", "5Client-Workstation:httpd-0:2.2.3-7.el5.s390x", "5Client-Workstation:httpd-0:2.2.3-7.el5.src", "5Client-Workstation:httpd-0:2.2.3-7.el5.x86_64", "5Client-Workstation:httpd-debuginfo-0:2.2.3-7.el5.i386", "5Client-Workstation:httpd-debuginfo-0:2.2.3-7.el5.ia64", "5Client-Workstation:httpd-debuginfo-0:2.2.3-7.el5.ppc", "5Client-Workstation:httpd-debuginfo-0:2.2.3-7.el5.ppc64", "5Client-Workstation:httpd-debuginfo-0:2.2.3-7.el5.s390", "5Client-Workstation:httpd-debuginfo-0:2.2.3-7.el5.s390x", "5Client-Workstation:httpd-debuginfo-0:2.2.3-7.el5.x86_64", "5Client-Workstation:httpd-devel-0:2.2.3-7.el5.i386", "5Client-Workstation:httpd-devel-0:2.2.3-7.el5.ia64", "5Client-Workstation:httpd-devel-0:2.2.3-7.el5.ppc", "5Client-Workstation:httpd-devel-0:2.2.3-7.el5.ppc64", "5Client-Workstation:httpd-devel-0:2.2.3-7.el5.s390", "5Client-Workstation:httpd-devel-0:2.2.3-7.el5.s390x", "5Client-Workstation:httpd-devel-0:2.2.3-7.el5.x86_64", "5Client-Workstation:httpd-manual-0:2.2.3-7.el5.i386", "5Client-Workstation:httpd-manual-0:2.2.3-7.el5.ia64", "5Client-Workstation:httpd-manual-0:2.2.3-7.el5.ppc", "5Client-Workstation:httpd-manual-0:2.2.3-7.el5.s390x", "5Client-Workstation:httpd-manual-0:2.2.3-7.el5.x86_64", "5Client-Workstation:mod_ssl-1:2.2.3-7.el5.i386", "5Client-Workstation:mod_ssl-1:2.2.3-7.el5.ia64", "5Client-Workstation:mod_ssl-1:2.2.3-7.el5.ppc", "5Client-Workstation:mod_ssl-1:2.2.3-7.el5.s390x", "5Client-Workstation:mod_ssl-1:2.2.3-7.el5.x86_64", "5Client:httpd-0:2.2.3-7.el5.i386", "5Client:httpd-0:2.2.3-7.el5.ia64", "5Client:httpd-0:2.2.3-7.el5.ppc", "5Client:httpd-0:2.2.3-7.el5.s390x", "5Client:httpd-0:2.2.3-7.el5.src", "5Client:httpd-0:2.2.3-7.el5.x86_64", "5Client:httpd-debuginfo-0:2.2.3-7.el5.i386", "5Client:httpd-debuginfo-0:2.2.3-7.el5.ia64", "5Client:httpd-debuginfo-0:2.2.3-7.el5.ppc", "5Client:httpd-debuginfo-0:2.2.3-7.el5.ppc64", "5Client:httpd-debuginfo-0:2.2.3-7.el5.s390", "5Client:httpd-debuginfo-0:2.2.3-7.el5.s390x", "5Client:httpd-debuginfo-0:2.2.3-7.el5.x86_64", "5Client:httpd-devel-0:2.2.3-7.el5.i386", "5Client:httpd-devel-0:2.2.3-7.el5.ia64", "5Client:httpd-devel-0:2.2.3-7.el5.ppc", "5Client:httpd-devel-0:2.2.3-7.el5.ppc64", "5Client:httpd-devel-0:2.2.3-7.el5.s390", "5Client:httpd-devel-0:2.2.3-7.el5.s390x", "5Client:httpd-devel-0:2.2.3-7.el5.x86_64", "5Client:httpd-manual-0:2.2.3-7.el5.i386", "5Client:httpd-manual-0:2.2.3-7.el5.ia64", "5Client:httpd-manual-0:2.2.3-7.el5.ppc", "5Client:httpd-manual-0:2.2.3-7.el5.s390x", "5Client:httpd-manual-0:2.2.3-7.el5.x86_64", "5Client:mod_ssl-1:2.2.3-7.el5.i386", "5Client:mod_ssl-1:2.2.3-7.el5.ia64", "5Client:mod_ssl-1:2.2.3-7.el5.ppc", "5Client:mod_ssl-1:2.2.3-7.el5.s390x", "5Client:mod_ssl-1:2.2.3-7.el5.x86_64", "5Server:httpd-0:2.2.3-7.el5.i386", "5Server:httpd-0:2.2.3-7.el5.ia64", "5Server:httpd-0:2.2.3-7.el5.ppc", "5Server:httpd-0:2.2.3-7.el5.s390x", "5Server:httpd-0:2.2.3-7.el5.src", "5Server:httpd-0:2.2.3-7.el5.x86_64", "5Server:httpd-debuginfo-0:2.2.3-7.el5.i386", "5Server:httpd-debuginfo-0:2.2.3-7.el5.ia64", "5Server:httpd-debuginfo-0:2.2.3-7.el5.ppc", "5Server:httpd-debuginfo-0:2.2.3-7.el5.ppc64", "5Server:httpd-debuginfo-0:2.2.3-7.el5.s390", "5Server:httpd-debuginfo-0:2.2.3-7.el5.s390x", "5Server:httpd-debuginfo-0:2.2.3-7.el5.x86_64", "5Server:httpd-devel-0:2.2.3-7.el5.i386", "5Server:httpd-devel-0:2.2.3-7.el5.ia64", "5Server:httpd-devel-0:2.2.3-7.el5.ppc", "5Server:httpd-devel-0:2.2.3-7.el5.ppc64", "5Server:httpd-devel-0:2.2.3-7.el5.s390", "5Server:httpd-devel-0:2.2.3-7.el5.s390x", "5Server:httpd-devel-0:2.2.3-7.el5.x86_64", "5Server:httpd-manual-0:2.2.3-7.el5.i386", "5Server:httpd-manual-0:2.2.3-7.el5.ia64", "5Server:httpd-manual-0:2.2.3-7.el5.ppc", "5Server:httpd-manual-0:2.2.3-7.el5.s390x", "5Server:httpd-manual-0:2.2.3-7.el5.x86_64", "5Server:mod_ssl-1:2.2.3-7.el5.i386", "5Server:mod_ssl-1:2.2.3-7.el5.ia64", "5Server:mod_ssl-1:2.2.3-7.el5.ppc", "5Server:mod_ssl-1:2.2.3-7.el5.s390x", "5Server:mod_ssl-1:2.2.3-7.el5.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2007:0556", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "httpd scoreboard lack of PID protection", }, ], }
rhsa-2007_0556
Vulnerability from csaf_redhat
Published
2007-06-26 15:22
Modified
2024-12-01 11:53
Summary
Red Hat Security Advisory: httpd security update
Notes
Topic
Updated Apache httpd packages that correct three security issues are now
available for Red Hat Enterprise Linux 5.
This update has been rated as having moderate security impact by the Red
Hat Security Response Team.
Details
The Apache HTTP Server is a popular Web server.
The Apache HTTP Server did not verify that a process was an Apache child
process before sending it signals. A local attacker with the ability to run
scripts on the Apache HTTP Server could manipulate the scoreboard and cause
arbitrary processes to be terminated which could lead to a denial of
service (CVE-2007-3304). This issue is not exploitable on Red Hat
Enterprise Linux 5 if using the default SELinux targeted policy.
A flaw was found in the Apache HTTP Server mod_status module. On sites
where the server-status page is publicly accessible and ExtendedStatus is
enabled this could lead to a cross-site scripting attack. On Red Hat
Enterprise Linux the server-status page is not enabled by default and it is
best practice to not make this publicly available. (CVE-2006-5752)
A bug was found in the Apache HTTP Server mod_cache module. On sites where
caching is enabled, a remote attacker could send a carefully crafted
request that would cause the Apache child process handling that request to
crash. This could lead to a denial of service if using a threaded
Multi-Processing Module. (CVE-2007-1863)
Users of httpd should upgrade to these updated packages, which contain
backported patches to correct these issues. Users should restart Apache
after installing this update.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ document: { aggregate_severity: { namespace: "https://access.redhat.com/security/updates/classification/", text: "Moderate", }, category: "csaf_security_advisory", csaf_version: "2.0", distribution: { text: "Copyright © Red Hat, Inc. All rights reserved.", tlp: { label: "WHITE", url: "https://www.first.org/tlp/", }, }, lang: "en", notes: [ { category: "summary", text: "Updated Apache httpd packages that correct three security issues are now\navailable for Red Hat Enterprise Linux 5.\n\nThis update has been rated as having moderate security impact by the Red\nHat Security Response Team.", title: "Topic", }, { category: "general", text: "The Apache HTTP Server is a popular Web server.\n\nThe Apache HTTP Server did not verify that a process was an Apache child\nprocess before sending it signals. A local attacker with the ability to run\nscripts on the Apache HTTP Server could manipulate the scoreboard and cause\narbitrary processes to be terminated which could lead to a denial of\nservice (CVE-2007-3304). This issue is not exploitable on Red Hat\nEnterprise Linux 5 if using the default SELinux targeted policy.\n\nA flaw was found in the Apache HTTP Server mod_status module. On sites\nwhere the server-status page is publicly accessible and ExtendedStatus is\nenabled this could lead to a cross-site scripting attack. On Red Hat\nEnterprise Linux the server-status page is not enabled by default and it is\nbest practice to not make this publicly available. (CVE-2006-5752)\n\nA bug was found in the Apache HTTP Server mod_cache module. On sites where\ncaching is enabled, a remote attacker could send a carefully crafted\nrequest that would cause the Apache child process handling that request to\ncrash. This could lead to a denial of service if using a threaded\nMulti-Processing Module. (CVE-2007-1863)\n\nUsers of httpd should upgrade to these updated packages, which contain\nbackported patches to correct these issues. Users should restart Apache\nafter installing this update.", title: "Details", }, { category: "legal_disclaimer", text: "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", title: "Terms of Use", }, ], publisher: { category: "vendor", contact_details: "https://access.redhat.com/security/team/contact/", issuing_authority: "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", name: "Red Hat Product Security", namespace: "https://www.redhat.com", }, references: [ { category: "self", summary: "https://access.redhat.com/errata/RHSA-2007:0556", url: "https://access.redhat.com/errata/RHSA-2007:0556", }, { category: "external", summary: "http://www.redhat.com/security/updates/classification/#moderate", url: "http://www.redhat.com/security/updates/classification/#moderate", }, { category: "external", summary: "244658", url: "https://bugzilla.redhat.com/show_bug.cgi?id=244658", }, { category: "external", summary: "245111", url: "https://bugzilla.redhat.com/show_bug.cgi?id=245111", }, { category: "external", summary: "245112", url: "https://bugzilla.redhat.com/show_bug.cgi?id=245112", }, { category: "self", summary: "Canonical URL", url: "https://security.access.redhat.com/data/csaf/v2/advisories/2007/rhsa-2007_0556.json", }, ], title: "Red Hat Security Advisory: httpd security update", tracking: { current_release_date: "2024-12-01T11:53:16+00:00", generator: { date: "2024-12-01T11:53:16+00:00", engine: { name: "Red Hat SDEngine", version: "4.2.1", }, }, id: "RHSA-2007:0556", initial_release_date: "2007-06-26T15:22:00+00:00", revision_history: [ { date: "2007-06-26T15:22:00+00:00", number: "1", summary: "Initial version", }, { date: "2007-06-26T11:22:15+00:00", number: "2", summary: "Last updated version", }, { date: "2024-12-01T11:53:16+00:00", number: "3", summary: "Last generated version", }, ], status: "final", version: "3", }, }, product_tree: { branches: [ { branches: [ { branches: [ { category: "product_name", name: "Red Hat Enterprise Linux Desktop (v. 5 client)", product: { name: "Red Hat Enterprise Linux Desktop (v. 5 client)", product_id: "5Client", product_identification_helper: { cpe: "cpe:/o:redhat:enterprise_linux:5::client", }, }, }, { category: "product_name", name: "Red Hat Enterprise Linux Desktop Workstation (v. 5 client)", product: { name: "Red Hat Enterprise Linux Desktop Workstation (v. 5 client)", product_id: "5Client-Workstation", product_identification_helper: { cpe: "cpe:/o:redhat:enterprise_linux:5::client_workstation", }, }, }, { category: "product_name", name: "Red Hat Enterprise Linux (v. 5 server)", product: { name: "Red Hat Enterprise Linux (v. 5 server)", product_id: "5Server", product_identification_helper: { cpe: "cpe:/o:redhat:enterprise_linux:5::server", }, }, }, ], category: "product_family", name: "Red Hat Enterprise Linux", }, { branches: [ { category: "product_version", name: "httpd-devel-0:2.2.3-7.el5.x86_64", product: { name: "httpd-devel-0:2.2.3-7.el5.x86_64", product_id: "httpd-devel-0:2.2.3-7.el5.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-devel@2.2.3-7.el5?arch=x86_64", }, }, }, { category: "product_version", name: "httpd-debuginfo-0:2.2.3-7.el5.x86_64", product: { name: "httpd-debuginfo-0:2.2.3-7.el5.x86_64", product_id: "httpd-debuginfo-0:2.2.3-7.el5.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-debuginfo@2.2.3-7.el5?arch=x86_64", }, }, }, { category: "product_version", name: "httpd-manual-0:2.2.3-7.el5.x86_64", product: { name: "httpd-manual-0:2.2.3-7.el5.x86_64", product_id: "httpd-manual-0:2.2.3-7.el5.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-manual@2.2.3-7.el5?arch=x86_64", }, }, }, { category: "product_version", name: "mod_ssl-1:2.2.3-7.el5.x86_64", product: { name: "mod_ssl-1:2.2.3-7.el5.x86_64", product_id: "mod_ssl-1:2.2.3-7.el5.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/mod_ssl@2.2.3-7.el5?arch=x86_64&epoch=1", }, }, }, { category: "product_version", name: "httpd-0:2.2.3-7.el5.x86_64", product: { name: "httpd-0:2.2.3-7.el5.x86_64", product_id: "httpd-0:2.2.3-7.el5.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/httpd@2.2.3-7.el5?arch=x86_64", }, }, }, ], category: "architecture", name: "x86_64", }, { branches: [ { category: "product_version", name: "httpd-devel-0:2.2.3-7.el5.i386", product: { name: "httpd-devel-0:2.2.3-7.el5.i386", product_id: "httpd-devel-0:2.2.3-7.el5.i386", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-devel@2.2.3-7.el5?arch=i386", }, }, }, { category: "product_version", name: "httpd-debuginfo-0:2.2.3-7.el5.i386", product: { name: "httpd-debuginfo-0:2.2.3-7.el5.i386", product_id: "httpd-debuginfo-0:2.2.3-7.el5.i386", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-debuginfo@2.2.3-7.el5?arch=i386", }, }, }, { category: "product_version", name: "httpd-manual-0:2.2.3-7.el5.i386", product: { name: "httpd-manual-0:2.2.3-7.el5.i386", product_id: "httpd-manual-0:2.2.3-7.el5.i386", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-manual@2.2.3-7.el5?arch=i386", }, }, }, { category: "product_version", name: "mod_ssl-1:2.2.3-7.el5.i386", product: { name: "mod_ssl-1:2.2.3-7.el5.i386", product_id: "mod_ssl-1:2.2.3-7.el5.i386", product_identification_helper: { purl: "pkg:rpm/redhat/mod_ssl@2.2.3-7.el5?arch=i386&epoch=1", }, }, }, { category: "product_version", name: "httpd-0:2.2.3-7.el5.i386", product: { name: "httpd-0:2.2.3-7.el5.i386", product_id: "httpd-0:2.2.3-7.el5.i386", product_identification_helper: { purl: "pkg:rpm/redhat/httpd@2.2.3-7.el5?arch=i386", }, }, }, ], category: "architecture", name: "i386", }, { branches: [ { category: "product_version", name: "httpd-0:2.2.3-7.el5.src", product: { name: "httpd-0:2.2.3-7.el5.src", product_id: "httpd-0:2.2.3-7.el5.src", product_identification_helper: { purl: "pkg:rpm/redhat/httpd@2.2.3-7.el5?arch=src", }, }, }, ], category: "architecture", name: "src", }, { branches: [ { category: "product_version", name: "mod_ssl-1:2.2.3-7.el5.ia64", product: { name: "mod_ssl-1:2.2.3-7.el5.ia64", product_id: "mod_ssl-1:2.2.3-7.el5.ia64", product_identification_helper: { purl: "pkg:rpm/redhat/mod_ssl@2.2.3-7.el5?arch=ia64&epoch=1", }, }, }, { category: "product_version", name: "httpd-devel-0:2.2.3-7.el5.ia64", product: { name: "httpd-devel-0:2.2.3-7.el5.ia64", product_id: "httpd-devel-0:2.2.3-7.el5.ia64", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-devel@2.2.3-7.el5?arch=ia64", }, }, }, { category: "product_version", name: "httpd-debuginfo-0:2.2.3-7.el5.ia64", product: { name: "httpd-debuginfo-0:2.2.3-7.el5.ia64", product_id: "httpd-debuginfo-0:2.2.3-7.el5.ia64", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-debuginfo@2.2.3-7.el5?arch=ia64", }, }, }, { category: "product_version", name: "httpd-manual-0:2.2.3-7.el5.ia64", product: { name: "httpd-manual-0:2.2.3-7.el5.ia64", product_id: "httpd-manual-0:2.2.3-7.el5.ia64", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-manual@2.2.3-7.el5?arch=ia64", }, }, }, { category: "product_version", name: "httpd-0:2.2.3-7.el5.ia64", product: { name: "httpd-0:2.2.3-7.el5.ia64", product_id: "httpd-0:2.2.3-7.el5.ia64", product_identification_helper: { purl: "pkg:rpm/redhat/httpd@2.2.3-7.el5?arch=ia64", }, }, }, ], category: "architecture", name: "ia64", }, { branches: [ { category: "product_version", name: "mod_ssl-1:2.2.3-7.el5.ppc", product: { name: "mod_ssl-1:2.2.3-7.el5.ppc", product_id: "mod_ssl-1:2.2.3-7.el5.ppc", product_identification_helper: { purl: "pkg:rpm/redhat/mod_ssl@2.2.3-7.el5?arch=ppc&epoch=1", }, }, }, { category: "product_version", name: "httpd-devel-0:2.2.3-7.el5.ppc", product: { name: "httpd-devel-0:2.2.3-7.el5.ppc", product_id: "httpd-devel-0:2.2.3-7.el5.ppc", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-devel@2.2.3-7.el5?arch=ppc", }, }, }, { category: "product_version", name: "httpd-debuginfo-0:2.2.3-7.el5.ppc", product: { name: "httpd-debuginfo-0:2.2.3-7.el5.ppc", product_id: "httpd-debuginfo-0:2.2.3-7.el5.ppc", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-debuginfo@2.2.3-7.el5?arch=ppc", }, }, }, { category: "product_version", name: "httpd-manual-0:2.2.3-7.el5.ppc", product: { name: "httpd-manual-0:2.2.3-7.el5.ppc", product_id: "httpd-manual-0:2.2.3-7.el5.ppc", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-manual@2.2.3-7.el5?arch=ppc", }, }, }, { category: "product_version", name: "httpd-0:2.2.3-7.el5.ppc", product: { name: "httpd-0:2.2.3-7.el5.ppc", product_id: "httpd-0:2.2.3-7.el5.ppc", product_identification_helper: { purl: "pkg:rpm/redhat/httpd@2.2.3-7.el5?arch=ppc", }, }, }, ], category: "architecture", name: "ppc", }, { branches: [ { category: "product_version", name: "httpd-devel-0:2.2.3-7.el5.ppc64", product: { name: "httpd-devel-0:2.2.3-7.el5.ppc64", product_id: "httpd-devel-0:2.2.3-7.el5.ppc64", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-devel@2.2.3-7.el5?arch=ppc64", }, }, }, { category: "product_version", name: "httpd-debuginfo-0:2.2.3-7.el5.ppc64", product: { name: "httpd-debuginfo-0:2.2.3-7.el5.ppc64", product_id: "httpd-debuginfo-0:2.2.3-7.el5.ppc64", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-debuginfo@2.2.3-7.el5?arch=ppc64", }, }, }, ], category: "architecture", name: "ppc64", }, { branches: [ { category: "product_version", name: "mod_ssl-1:2.2.3-7.el5.s390x", product: { name: "mod_ssl-1:2.2.3-7.el5.s390x", product_id: "mod_ssl-1:2.2.3-7.el5.s390x", product_identification_helper: { purl: "pkg:rpm/redhat/mod_ssl@2.2.3-7.el5?arch=s390x&epoch=1", }, }, }, { category: "product_version", name: "httpd-devel-0:2.2.3-7.el5.s390x", product: { name: "httpd-devel-0:2.2.3-7.el5.s390x", product_id: "httpd-devel-0:2.2.3-7.el5.s390x", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-devel@2.2.3-7.el5?arch=s390x", }, }, }, { category: "product_version", name: "httpd-debuginfo-0:2.2.3-7.el5.s390x", product: { name: "httpd-debuginfo-0:2.2.3-7.el5.s390x", product_id: "httpd-debuginfo-0:2.2.3-7.el5.s390x", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-debuginfo@2.2.3-7.el5?arch=s390x", }, }, }, { category: "product_version", name: "httpd-manual-0:2.2.3-7.el5.s390x", product: { name: "httpd-manual-0:2.2.3-7.el5.s390x", product_id: "httpd-manual-0:2.2.3-7.el5.s390x", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-manual@2.2.3-7.el5?arch=s390x", }, }, }, { category: "product_version", name: "httpd-0:2.2.3-7.el5.s390x", product: { name: "httpd-0:2.2.3-7.el5.s390x", product_id: "httpd-0:2.2.3-7.el5.s390x", product_identification_helper: { purl: "pkg:rpm/redhat/httpd@2.2.3-7.el5?arch=s390x", }, }, }, ], category: "architecture", name: "s390x", }, { branches: [ { category: "product_version", name: "httpd-devel-0:2.2.3-7.el5.s390", product: { name: "httpd-devel-0:2.2.3-7.el5.s390", product_id: "httpd-devel-0:2.2.3-7.el5.s390", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-devel@2.2.3-7.el5?arch=s390", }, }, }, { category: "product_version", name: "httpd-debuginfo-0:2.2.3-7.el5.s390", product: { name: "httpd-debuginfo-0:2.2.3-7.el5.s390", product_id: "httpd-debuginfo-0:2.2.3-7.el5.s390", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-debuginfo@2.2.3-7.el5?arch=s390", }, }, }, ], category: "architecture", name: "s390", }, ], category: "vendor", name: "Red Hat", }, ], relationships: [ { category: "default_component_of", full_product_name: { name: "httpd-0:2.2.3-7.el5.i386 as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)", product_id: "5Client-Workstation:httpd-0:2.2.3-7.el5.i386", }, product_reference: "httpd-0:2.2.3-7.el5.i386", relates_to_product_reference: "5Client-Workstation", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.2.3-7.el5.ia64 as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)", product_id: "5Client-Workstation:httpd-0:2.2.3-7.el5.ia64", }, product_reference: "httpd-0:2.2.3-7.el5.ia64", relates_to_product_reference: "5Client-Workstation", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.2.3-7.el5.ppc as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)", product_id: "5Client-Workstation:httpd-0:2.2.3-7.el5.ppc", }, product_reference: "httpd-0:2.2.3-7.el5.ppc", relates_to_product_reference: "5Client-Workstation", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.2.3-7.el5.s390x as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)", product_id: "5Client-Workstation:httpd-0:2.2.3-7.el5.s390x", }, product_reference: "httpd-0:2.2.3-7.el5.s390x", relates_to_product_reference: "5Client-Workstation", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.2.3-7.el5.src as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)", product_id: "5Client-Workstation:httpd-0:2.2.3-7.el5.src", }, product_reference: "httpd-0:2.2.3-7.el5.src", relates_to_product_reference: "5Client-Workstation", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.2.3-7.el5.x86_64 as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)", product_id: "5Client-Workstation:httpd-0:2.2.3-7.el5.x86_64", }, product_reference: "httpd-0:2.2.3-7.el5.x86_64", relates_to_product_reference: "5Client-Workstation", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.2.3-7.el5.i386 as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)", product_id: "5Client-Workstation:httpd-debuginfo-0:2.2.3-7.el5.i386", }, product_reference: "httpd-debuginfo-0:2.2.3-7.el5.i386", relates_to_product_reference: "5Client-Workstation", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.2.3-7.el5.ia64 as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)", product_id: "5Client-Workstation:httpd-debuginfo-0:2.2.3-7.el5.ia64", }, product_reference: "httpd-debuginfo-0:2.2.3-7.el5.ia64", relates_to_product_reference: "5Client-Workstation", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.2.3-7.el5.ppc as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)", product_id: "5Client-Workstation:httpd-debuginfo-0:2.2.3-7.el5.ppc", }, product_reference: "httpd-debuginfo-0:2.2.3-7.el5.ppc", relates_to_product_reference: "5Client-Workstation", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.2.3-7.el5.ppc64 as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)", product_id: "5Client-Workstation:httpd-debuginfo-0:2.2.3-7.el5.ppc64", }, product_reference: "httpd-debuginfo-0:2.2.3-7.el5.ppc64", relates_to_product_reference: "5Client-Workstation", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.2.3-7.el5.s390 as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)", product_id: "5Client-Workstation:httpd-debuginfo-0:2.2.3-7.el5.s390", }, product_reference: "httpd-debuginfo-0:2.2.3-7.el5.s390", relates_to_product_reference: "5Client-Workstation", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.2.3-7.el5.s390x as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)", product_id: "5Client-Workstation:httpd-debuginfo-0:2.2.3-7.el5.s390x", }, product_reference: "httpd-debuginfo-0:2.2.3-7.el5.s390x", relates_to_product_reference: "5Client-Workstation", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.2.3-7.el5.x86_64 as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)", product_id: "5Client-Workstation:httpd-debuginfo-0:2.2.3-7.el5.x86_64", }, product_reference: "httpd-debuginfo-0:2.2.3-7.el5.x86_64", relates_to_product_reference: "5Client-Workstation", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.2.3-7.el5.i386 as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)", product_id: "5Client-Workstation:httpd-devel-0:2.2.3-7.el5.i386", }, product_reference: "httpd-devel-0:2.2.3-7.el5.i386", relates_to_product_reference: "5Client-Workstation", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.2.3-7.el5.ia64 as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)", product_id: "5Client-Workstation:httpd-devel-0:2.2.3-7.el5.ia64", }, product_reference: "httpd-devel-0:2.2.3-7.el5.ia64", relates_to_product_reference: "5Client-Workstation", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.2.3-7.el5.ppc as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)", product_id: "5Client-Workstation:httpd-devel-0:2.2.3-7.el5.ppc", }, product_reference: "httpd-devel-0:2.2.3-7.el5.ppc", relates_to_product_reference: "5Client-Workstation", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.2.3-7.el5.ppc64 as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)", product_id: "5Client-Workstation:httpd-devel-0:2.2.3-7.el5.ppc64", }, product_reference: "httpd-devel-0:2.2.3-7.el5.ppc64", relates_to_product_reference: "5Client-Workstation", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.2.3-7.el5.s390 as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)", product_id: "5Client-Workstation:httpd-devel-0:2.2.3-7.el5.s390", }, product_reference: "httpd-devel-0:2.2.3-7.el5.s390", relates_to_product_reference: "5Client-Workstation", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.2.3-7.el5.s390x as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)", product_id: "5Client-Workstation:httpd-devel-0:2.2.3-7.el5.s390x", }, product_reference: "httpd-devel-0:2.2.3-7.el5.s390x", relates_to_product_reference: "5Client-Workstation", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.2.3-7.el5.x86_64 as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)", product_id: "5Client-Workstation:httpd-devel-0:2.2.3-7.el5.x86_64", }, product_reference: "httpd-devel-0:2.2.3-7.el5.x86_64", relates_to_product_reference: "5Client-Workstation", }, { category: "default_component_of", full_product_name: { name: "httpd-manual-0:2.2.3-7.el5.i386 as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)", product_id: "5Client-Workstation:httpd-manual-0:2.2.3-7.el5.i386", }, product_reference: "httpd-manual-0:2.2.3-7.el5.i386", relates_to_product_reference: "5Client-Workstation", }, { category: "default_component_of", full_product_name: { name: "httpd-manual-0:2.2.3-7.el5.ia64 as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)", product_id: "5Client-Workstation:httpd-manual-0:2.2.3-7.el5.ia64", }, product_reference: "httpd-manual-0:2.2.3-7.el5.ia64", relates_to_product_reference: "5Client-Workstation", }, { category: "default_component_of", full_product_name: { name: "httpd-manual-0:2.2.3-7.el5.ppc as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)", product_id: "5Client-Workstation:httpd-manual-0:2.2.3-7.el5.ppc", }, product_reference: "httpd-manual-0:2.2.3-7.el5.ppc", relates_to_product_reference: "5Client-Workstation", }, { category: "default_component_of", full_product_name: { name: "httpd-manual-0:2.2.3-7.el5.s390x as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)", product_id: "5Client-Workstation:httpd-manual-0:2.2.3-7.el5.s390x", }, product_reference: "httpd-manual-0:2.2.3-7.el5.s390x", relates_to_product_reference: "5Client-Workstation", }, { category: "default_component_of", full_product_name: { name: "httpd-manual-0:2.2.3-7.el5.x86_64 as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)", product_id: "5Client-Workstation:httpd-manual-0:2.2.3-7.el5.x86_64", }, product_reference: "httpd-manual-0:2.2.3-7.el5.x86_64", relates_to_product_reference: "5Client-Workstation", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.2.3-7.el5.i386 as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)", product_id: "5Client-Workstation:mod_ssl-1:2.2.3-7.el5.i386", }, product_reference: "mod_ssl-1:2.2.3-7.el5.i386", relates_to_product_reference: "5Client-Workstation", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.2.3-7.el5.ia64 as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)", product_id: "5Client-Workstation:mod_ssl-1:2.2.3-7.el5.ia64", }, product_reference: "mod_ssl-1:2.2.3-7.el5.ia64", relates_to_product_reference: "5Client-Workstation", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.2.3-7.el5.ppc as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)", product_id: "5Client-Workstation:mod_ssl-1:2.2.3-7.el5.ppc", }, product_reference: "mod_ssl-1:2.2.3-7.el5.ppc", relates_to_product_reference: "5Client-Workstation", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.2.3-7.el5.s390x as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)", product_id: "5Client-Workstation:mod_ssl-1:2.2.3-7.el5.s390x", }, product_reference: "mod_ssl-1:2.2.3-7.el5.s390x", relates_to_product_reference: "5Client-Workstation", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.2.3-7.el5.x86_64 as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)", product_id: "5Client-Workstation:mod_ssl-1:2.2.3-7.el5.x86_64", }, product_reference: "mod_ssl-1:2.2.3-7.el5.x86_64", relates_to_product_reference: "5Client-Workstation", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.2.3-7.el5.i386 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)", product_id: "5Client:httpd-0:2.2.3-7.el5.i386", }, product_reference: "httpd-0:2.2.3-7.el5.i386", relates_to_product_reference: "5Client", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.2.3-7.el5.ia64 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)", product_id: "5Client:httpd-0:2.2.3-7.el5.ia64", }, product_reference: "httpd-0:2.2.3-7.el5.ia64", relates_to_product_reference: "5Client", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.2.3-7.el5.ppc as a component of Red Hat Enterprise Linux Desktop (v. 5 client)", product_id: "5Client:httpd-0:2.2.3-7.el5.ppc", }, product_reference: "httpd-0:2.2.3-7.el5.ppc", relates_to_product_reference: "5Client", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.2.3-7.el5.s390x as a component of Red Hat Enterprise Linux Desktop (v. 5 client)", product_id: "5Client:httpd-0:2.2.3-7.el5.s390x", }, product_reference: "httpd-0:2.2.3-7.el5.s390x", relates_to_product_reference: "5Client", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.2.3-7.el5.src as a component of Red Hat Enterprise Linux Desktop (v. 5 client)", product_id: "5Client:httpd-0:2.2.3-7.el5.src", }, product_reference: "httpd-0:2.2.3-7.el5.src", relates_to_product_reference: "5Client", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.2.3-7.el5.x86_64 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)", product_id: "5Client:httpd-0:2.2.3-7.el5.x86_64", }, product_reference: "httpd-0:2.2.3-7.el5.x86_64", relates_to_product_reference: "5Client", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.2.3-7.el5.i386 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)", product_id: "5Client:httpd-debuginfo-0:2.2.3-7.el5.i386", }, product_reference: "httpd-debuginfo-0:2.2.3-7.el5.i386", relates_to_product_reference: "5Client", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.2.3-7.el5.ia64 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)", product_id: "5Client:httpd-debuginfo-0:2.2.3-7.el5.ia64", }, product_reference: "httpd-debuginfo-0:2.2.3-7.el5.ia64", relates_to_product_reference: "5Client", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.2.3-7.el5.ppc as a component of Red Hat Enterprise Linux Desktop (v. 5 client)", product_id: "5Client:httpd-debuginfo-0:2.2.3-7.el5.ppc", }, product_reference: "httpd-debuginfo-0:2.2.3-7.el5.ppc", relates_to_product_reference: "5Client", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.2.3-7.el5.ppc64 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)", product_id: "5Client:httpd-debuginfo-0:2.2.3-7.el5.ppc64", }, product_reference: "httpd-debuginfo-0:2.2.3-7.el5.ppc64", relates_to_product_reference: "5Client", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.2.3-7.el5.s390 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)", product_id: "5Client:httpd-debuginfo-0:2.2.3-7.el5.s390", }, product_reference: "httpd-debuginfo-0:2.2.3-7.el5.s390", relates_to_product_reference: "5Client", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.2.3-7.el5.s390x as a component of Red Hat Enterprise Linux Desktop (v. 5 client)", product_id: "5Client:httpd-debuginfo-0:2.2.3-7.el5.s390x", }, product_reference: "httpd-debuginfo-0:2.2.3-7.el5.s390x", relates_to_product_reference: "5Client", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.2.3-7.el5.x86_64 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)", product_id: "5Client:httpd-debuginfo-0:2.2.3-7.el5.x86_64", }, product_reference: "httpd-debuginfo-0:2.2.3-7.el5.x86_64", relates_to_product_reference: "5Client", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.2.3-7.el5.i386 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)", product_id: "5Client:httpd-devel-0:2.2.3-7.el5.i386", }, product_reference: "httpd-devel-0:2.2.3-7.el5.i386", relates_to_product_reference: "5Client", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.2.3-7.el5.ia64 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)", product_id: "5Client:httpd-devel-0:2.2.3-7.el5.ia64", }, product_reference: "httpd-devel-0:2.2.3-7.el5.ia64", relates_to_product_reference: "5Client", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.2.3-7.el5.ppc as a component of Red Hat Enterprise Linux Desktop (v. 5 client)", product_id: "5Client:httpd-devel-0:2.2.3-7.el5.ppc", }, product_reference: "httpd-devel-0:2.2.3-7.el5.ppc", relates_to_product_reference: "5Client", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.2.3-7.el5.ppc64 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)", product_id: "5Client:httpd-devel-0:2.2.3-7.el5.ppc64", }, product_reference: "httpd-devel-0:2.2.3-7.el5.ppc64", relates_to_product_reference: "5Client", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.2.3-7.el5.s390 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)", product_id: "5Client:httpd-devel-0:2.2.3-7.el5.s390", }, product_reference: "httpd-devel-0:2.2.3-7.el5.s390", relates_to_product_reference: "5Client", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.2.3-7.el5.s390x as a component of Red Hat Enterprise Linux Desktop (v. 5 client)", product_id: "5Client:httpd-devel-0:2.2.3-7.el5.s390x", }, product_reference: "httpd-devel-0:2.2.3-7.el5.s390x", relates_to_product_reference: "5Client", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.2.3-7.el5.x86_64 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)", product_id: "5Client:httpd-devel-0:2.2.3-7.el5.x86_64", }, product_reference: "httpd-devel-0:2.2.3-7.el5.x86_64", relates_to_product_reference: "5Client", }, { category: "default_component_of", full_product_name: { name: "httpd-manual-0:2.2.3-7.el5.i386 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)", product_id: "5Client:httpd-manual-0:2.2.3-7.el5.i386", }, product_reference: "httpd-manual-0:2.2.3-7.el5.i386", relates_to_product_reference: "5Client", }, { category: "default_component_of", full_product_name: { name: "httpd-manual-0:2.2.3-7.el5.ia64 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)", product_id: "5Client:httpd-manual-0:2.2.3-7.el5.ia64", }, product_reference: "httpd-manual-0:2.2.3-7.el5.ia64", relates_to_product_reference: "5Client", }, { category: "default_component_of", full_product_name: { name: "httpd-manual-0:2.2.3-7.el5.ppc as a component of Red Hat Enterprise Linux Desktop (v. 5 client)", product_id: "5Client:httpd-manual-0:2.2.3-7.el5.ppc", }, product_reference: "httpd-manual-0:2.2.3-7.el5.ppc", relates_to_product_reference: "5Client", }, { category: "default_component_of", full_product_name: { name: "httpd-manual-0:2.2.3-7.el5.s390x as a component of Red Hat Enterprise Linux Desktop (v. 5 client)", product_id: "5Client:httpd-manual-0:2.2.3-7.el5.s390x", }, product_reference: "httpd-manual-0:2.2.3-7.el5.s390x", relates_to_product_reference: "5Client", }, { category: "default_component_of", full_product_name: { name: "httpd-manual-0:2.2.3-7.el5.x86_64 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)", product_id: "5Client:httpd-manual-0:2.2.3-7.el5.x86_64", }, product_reference: "httpd-manual-0:2.2.3-7.el5.x86_64", relates_to_product_reference: "5Client", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.2.3-7.el5.i386 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)", product_id: "5Client:mod_ssl-1:2.2.3-7.el5.i386", }, product_reference: "mod_ssl-1:2.2.3-7.el5.i386", relates_to_product_reference: "5Client", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.2.3-7.el5.ia64 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)", product_id: "5Client:mod_ssl-1:2.2.3-7.el5.ia64", }, product_reference: "mod_ssl-1:2.2.3-7.el5.ia64", relates_to_product_reference: "5Client", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.2.3-7.el5.ppc as a component of Red Hat Enterprise Linux Desktop (v. 5 client)", product_id: "5Client:mod_ssl-1:2.2.3-7.el5.ppc", }, product_reference: "mod_ssl-1:2.2.3-7.el5.ppc", relates_to_product_reference: "5Client", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.2.3-7.el5.s390x as a component of Red Hat Enterprise Linux Desktop (v. 5 client)", product_id: "5Client:mod_ssl-1:2.2.3-7.el5.s390x", }, product_reference: "mod_ssl-1:2.2.3-7.el5.s390x", relates_to_product_reference: "5Client", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.2.3-7.el5.x86_64 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)", product_id: "5Client:mod_ssl-1:2.2.3-7.el5.x86_64", }, product_reference: "mod_ssl-1:2.2.3-7.el5.x86_64", relates_to_product_reference: "5Client", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.2.3-7.el5.i386 as a component of Red Hat Enterprise Linux (v. 5 server)", product_id: "5Server:httpd-0:2.2.3-7.el5.i386", }, product_reference: "httpd-0:2.2.3-7.el5.i386", relates_to_product_reference: "5Server", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.2.3-7.el5.ia64 as a component of Red Hat Enterprise Linux (v. 5 server)", product_id: "5Server:httpd-0:2.2.3-7.el5.ia64", }, product_reference: "httpd-0:2.2.3-7.el5.ia64", relates_to_product_reference: "5Server", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.2.3-7.el5.ppc as a component of Red Hat Enterprise Linux (v. 5 server)", product_id: "5Server:httpd-0:2.2.3-7.el5.ppc", }, product_reference: "httpd-0:2.2.3-7.el5.ppc", relates_to_product_reference: "5Server", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.2.3-7.el5.s390x as a component of Red Hat Enterprise Linux (v. 5 server)", product_id: "5Server:httpd-0:2.2.3-7.el5.s390x", }, product_reference: "httpd-0:2.2.3-7.el5.s390x", relates_to_product_reference: "5Server", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.2.3-7.el5.src as a component of Red Hat Enterprise Linux (v. 5 server)", product_id: "5Server:httpd-0:2.2.3-7.el5.src", }, product_reference: "httpd-0:2.2.3-7.el5.src", relates_to_product_reference: "5Server", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.2.3-7.el5.x86_64 as a component of Red Hat Enterprise Linux (v. 5 server)", product_id: "5Server:httpd-0:2.2.3-7.el5.x86_64", }, product_reference: "httpd-0:2.2.3-7.el5.x86_64", relates_to_product_reference: "5Server", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.2.3-7.el5.i386 as a component of Red Hat Enterprise Linux (v. 5 server)", product_id: "5Server:httpd-debuginfo-0:2.2.3-7.el5.i386", }, product_reference: "httpd-debuginfo-0:2.2.3-7.el5.i386", relates_to_product_reference: "5Server", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.2.3-7.el5.ia64 as a component of Red Hat Enterprise Linux (v. 5 server)", product_id: "5Server:httpd-debuginfo-0:2.2.3-7.el5.ia64", }, product_reference: "httpd-debuginfo-0:2.2.3-7.el5.ia64", relates_to_product_reference: "5Server", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.2.3-7.el5.ppc as a component of Red Hat Enterprise Linux (v. 5 server)", product_id: "5Server:httpd-debuginfo-0:2.2.3-7.el5.ppc", }, product_reference: "httpd-debuginfo-0:2.2.3-7.el5.ppc", relates_to_product_reference: "5Server", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.2.3-7.el5.ppc64 as a component of Red Hat Enterprise Linux (v. 5 server)", product_id: "5Server:httpd-debuginfo-0:2.2.3-7.el5.ppc64", }, product_reference: "httpd-debuginfo-0:2.2.3-7.el5.ppc64", relates_to_product_reference: "5Server", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.2.3-7.el5.s390 as a component of Red Hat Enterprise Linux (v. 5 server)", product_id: "5Server:httpd-debuginfo-0:2.2.3-7.el5.s390", }, product_reference: "httpd-debuginfo-0:2.2.3-7.el5.s390", relates_to_product_reference: "5Server", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.2.3-7.el5.s390x as a component of Red Hat Enterprise Linux (v. 5 server)", product_id: "5Server:httpd-debuginfo-0:2.2.3-7.el5.s390x", }, product_reference: "httpd-debuginfo-0:2.2.3-7.el5.s390x", relates_to_product_reference: "5Server", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.2.3-7.el5.x86_64 as a component of Red Hat Enterprise Linux (v. 5 server)", product_id: "5Server:httpd-debuginfo-0:2.2.3-7.el5.x86_64", }, product_reference: "httpd-debuginfo-0:2.2.3-7.el5.x86_64", relates_to_product_reference: "5Server", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.2.3-7.el5.i386 as a component of Red Hat Enterprise Linux (v. 5 server)", product_id: "5Server:httpd-devel-0:2.2.3-7.el5.i386", }, product_reference: "httpd-devel-0:2.2.3-7.el5.i386", relates_to_product_reference: "5Server", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.2.3-7.el5.ia64 as a component of Red Hat Enterprise Linux (v. 5 server)", product_id: "5Server:httpd-devel-0:2.2.3-7.el5.ia64", }, product_reference: "httpd-devel-0:2.2.3-7.el5.ia64", relates_to_product_reference: "5Server", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.2.3-7.el5.ppc as a component of Red Hat Enterprise Linux (v. 5 server)", product_id: "5Server:httpd-devel-0:2.2.3-7.el5.ppc", }, product_reference: "httpd-devel-0:2.2.3-7.el5.ppc", relates_to_product_reference: "5Server", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.2.3-7.el5.ppc64 as a component of Red Hat Enterprise Linux (v. 5 server)", product_id: "5Server:httpd-devel-0:2.2.3-7.el5.ppc64", }, product_reference: "httpd-devel-0:2.2.3-7.el5.ppc64", relates_to_product_reference: "5Server", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.2.3-7.el5.s390 as a component of Red Hat Enterprise Linux (v. 5 server)", product_id: "5Server:httpd-devel-0:2.2.3-7.el5.s390", }, product_reference: "httpd-devel-0:2.2.3-7.el5.s390", relates_to_product_reference: "5Server", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.2.3-7.el5.s390x as a component of Red Hat Enterprise Linux (v. 5 server)", product_id: "5Server:httpd-devel-0:2.2.3-7.el5.s390x", }, product_reference: "httpd-devel-0:2.2.3-7.el5.s390x", relates_to_product_reference: "5Server", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.2.3-7.el5.x86_64 as a component of Red Hat Enterprise Linux (v. 5 server)", product_id: "5Server:httpd-devel-0:2.2.3-7.el5.x86_64", }, product_reference: "httpd-devel-0:2.2.3-7.el5.x86_64", relates_to_product_reference: "5Server", }, { category: "default_component_of", full_product_name: { name: "httpd-manual-0:2.2.3-7.el5.i386 as a component of Red Hat Enterprise Linux (v. 5 server)", product_id: "5Server:httpd-manual-0:2.2.3-7.el5.i386", }, product_reference: "httpd-manual-0:2.2.3-7.el5.i386", relates_to_product_reference: "5Server", }, { category: "default_component_of", full_product_name: { name: "httpd-manual-0:2.2.3-7.el5.ia64 as a component of Red Hat Enterprise Linux (v. 5 server)", product_id: "5Server:httpd-manual-0:2.2.3-7.el5.ia64", }, product_reference: "httpd-manual-0:2.2.3-7.el5.ia64", relates_to_product_reference: "5Server", }, { category: "default_component_of", full_product_name: { name: "httpd-manual-0:2.2.3-7.el5.ppc as a component of Red Hat Enterprise Linux (v. 5 server)", product_id: "5Server:httpd-manual-0:2.2.3-7.el5.ppc", }, product_reference: "httpd-manual-0:2.2.3-7.el5.ppc", relates_to_product_reference: "5Server", }, { category: "default_component_of", full_product_name: { name: "httpd-manual-0:2.2.3-7.el5.s390x as a component of Red Hat Enterprise Linux (v. 5 server)", product_id: "5Server:httpd-manual-0:2.2.3-7.el5.s390x", }, product_reference: "httpd-manual-0:2.2.3-7.el5.s390x", relates_to_product_reference: "5Server", }, { category: "default_component_of", full_product_name: { name: "httpd-manual-0:2.2.3-7.el5.x86_64 as a component of Red Hat Enterprise Linux (v. 5 server)", product_id: "5Server:httpd-manual-0:2.2.3-7.el5.x86_64", }, product_reference: "httpd-manual-0:2.2.3-7.el5.x86_64", relates_to_product_reference: "5Server", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.2.3-7.el5.i386 as a component of Red Hat Enterprise Linux (v. 5 server)", product_id: "5Server:mod_ssl-1:2.2.3-7.el5.i386", }, product_reference: "mod_ssl-1:2.2.3-7.el5.i386", relates_to_product_reference: "5Server", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.2.3-7.el5.ia64 as a component of Red Hat Enterprise Linux (v. 5 server)", product_id: "5Server:mod_ssl-1:2.2.3-7.el5.ia64", }, product_reference: "mod_ssl-1:2.2.3-7.el5.ia64", relates_to_product_reference: "5Server", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.2.3-7.el5.ppc as a component of Red Hat Enterprise Linux (v. 5 server)", product_id: "5Server:mod_ssl-1:2.2.3-7.el5.ppc", }, product_reference: "mod_ssl-1:2.2.3-7.el5.ppc", relates_to_product_reference: "5Server", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.2.3-7.el5.s390x as a component of Red Hat Enterprise Linux (v. 5 server)", product_id: "5Server:mod_ssl-1:2.2.3-7.el5.s390x", }, product_reference: "mod_ssl-1:2.2.3-7.el5.s390x", relates_to_product_reference: "5Server", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.2.3-7.el5.x86_64 as a component of Red Hat Enterprise Linux (v. 5 server)", product_id: "5Server:mod_ssl-1:2.2.3-7.el5.x86_64", }, product_reference: "mod_ssl-1:2.2.3-7.el5.x86_64", relates_to_product_reference: "5Server", }, ], }, vulnerabilities: [ { cve: "CVE-2006-5752", cwe: { id: "CWE-79", name: "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", }, discovery_date: "2007-06-20T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "245112", }, ], notes: [ { category: "description", text: "Cross-site scripting (XSS) vulnerability in mod_status.c in the mod_status module in Apache HTTP Server (httpd), when ExtendedStatus is enabled and a public server-status page is used, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors involving charsets with browsers that perform \"charset detection\" when the content-type is not specified.", title: "Vulnerability description", }, { category: "summary", text: "httpd mod_status XSS", title: "Vulnerability summary", }, ], product_status: { fixed: [ "5Client-Workstation:httpd-0:2.2.3-7.el5.i386", "5Client-Workstation:httpd-0:2.2.3-7.el5.ia64", "5Client-Workstation:httpd-0:2.2.3-7.el5.ppc", "5Client-Workstation:httpd-0:2.2.3-7.el5.s390x", "5Client-Workstation:httpd-0:2.2.3-7.el5.src", "5Client-Workstation:httpd-0:2.2.3-7.el5.x86_64", "5Client-Workstation:httpd-debuginfo-0:2.2.3-7.el5.i386", "5Client-Workstation:httpd-debuginfo-0:2.2.3-7.el5.ia64", "5Client-Workstation:httpd-debuginfo-0:2.2.3-7.el5.ppc", "5Client-Workstation:httpd-debuginfo-0:2.2.3-7.el5.ppc64", "5Client-Workstation:httpd-debuginfo-0:2.2.3-7.el5.s390", "5Client-Workstation:httpd-debuginfo-0:2.2.3-7.el5.s390x", "5Client-Workstation:httpd-debuginfo-0:2.2.3-7.el5.x86_64", "5Client-Workstation:httpd-devel-0:2.2.3-7.el5.i386", "5Client-Workstation:httpd-devel-0:2.2.3-7.el5.ia64", "5Client-Workstation:httpd-devel-0:2.2.3-7.el5.ppc", "5Client-Workstation:httpd-devel-0:2.2.3-7.el5.ppc64", "5Client-Workstation:httpd-devel-0:2.2.3-7.el5.s390", "5Client-Workstation:httpd-devel-0:2.2.3-7.el5.s390x", "5Client-Workstation:httpd-devel-0:2.2.3-7.el5.x86_64", "5Client-Workstation:httpd-manual-0:2.2.3-7.el5.i386", "5Client-Workstation:httpd-manual-0:2.2.3-7.el5.ia64", "5Client-Workstation:httpd-manual-0:2.2.3-7.el5.ppc", "5Client-Workstation:httpd-manual-0:2.2.3-7.el5.s390x", "5Client-Workstation:httpd-manual-0:2.2.3-7.el5.x86_64", "5Client-Workstation:mod_ssl-1:2.2.3-7.el5.i386", "5Client-Workstation:mod_ssl-1:2.2.3-7.el5.ia64", "5Client-Workstation:mod_ssl-1:2.2.3-7.el5.ppc", "5Client-Workstation:mod_ssl-1:2.2.3-7.el5.s390x", "5Client-Workstation:mod_ssl-1:2.2.3-7.el5.x86_64", "5Client:httpd-0:2.2.3-7.el5.i386", "5Client:httpd-0:2.2.3-7.el5.ia64", "5Client:httpd-0:2.2.3-7.el5.ppc", "5Client:httpd-0:2.2.3-7.el5.s390x", "5Client:httpd-0:2.2.3-7.el5.src", "5Client:httpd-0:2.2.3-7.el5.x86_64", "5Client:httpd-debuginfo-0:2.2.3-7.el5.i386", "5Client:httpd-debuginfo-0:2.2.3-7.el5.ia64", "5Client:httpd-debuginfo-0:2.2.3-7.el5.ppc", "5Client:httpd-debuginfo-0:2.2.3-7.el5.ppc64", "5Client:httpd-debuginfo-0:2.2.3-7.el5.s390", "5Client:httpd-debuginfo-0:2.2.3-7.el5.s390x", "5Client:httpd-debuginfo-0:2.2.3-7.el5.x86_64", "5Client:httpd-devel-0:2.2.3-7.el5.i386", "5Client:httpd-devel-0:2.2.3-7.el5.ia64", "5Client:httpd-devel-0:2.2.3-7.el5.ppc", "5Client:httpd-devel-0:2.2.3-7.el5.ppc64", "5Client:httpd-devel-0:2.2.3-7.el5.s390", "5Client:httpd-devel-0:2.2.3-7.el5.s390x", "5Client:httpd-devel-0:2.2.3-7.el5.x86_64", "5Client:httpd-manual-0:2.2.3-7.el5.i386", "5Client:httpd-manual-0:2.2.3-7.el5.ia64", "5Client:httpd-manual-0:2.2.3-7.el5.ppc", "5Client:httpd-manual-0:2.2.3-7.el5.s390x", "5Client:httpd-manual-0:2.2.3-7.el5.x86_64", "5Client:mod_ssl-1:2.2.3-7.el5.i386", "5Client:mod_ssl-1:2.2.3-7.el5.ia64", "5Client:mod_ssl-1:2.2.3-7.el5.ppc", "5Client:mod_ssl-1:2.2.3-7.el5.s390x", "5Client:mod_ssl-1:2.2.3-7.el5.x86_64", "5Server:httpd-0:2.2.3-7.el5.i386", "5Server:httpd-0:2.2.3-7.el5.ia64", "5Server:httpd-0:2.2.3-7.el5.ppc", "5Server:httpd-0:2.2.3-7.el5.s390x", "5Server:httpd-0:2.2.3-7.el5.src", "5Server:httpd-0:2.2.3-7.el5.x86_64", "5Server:httpd-debuginfo-0:2.2.3-7.el5.i386", "5Server:httpd-debuginfo-0:2.2.3-7.el5.ia64", "5Server:httpd-debuginfo-0:2.2.3-7.el5.ppc", "5Server:httpd-debuginfo-0:2.2.3-7.el5.ppc64", "5Server:httpd-debuginfo-0:2.2.3-7.el5.s390", "5Server:httpd-debuginfo-0:2.2.3-7.el5.s390x", "5Server:httpd-debuginfo-0:2.2.3-7.el5.x86_64", "5Server:httpd-devel-0:2.2.3-7.el5.i386", "5Server:httpd-devel-0:2.2.3-7.el5.ia64", "5Server:httpd-devel-0:2.2.3-7.el5.ppc", "5Server:httpd-devel-0:2.2.3-7.el5.ppc64", "5Server:httpd-devel-0:2.2.3-7.el5.s390", "5Server:httpd-devel-0:2.2.3-7.el5.s390x", "5Server:httpd-devel-0:2.2.3-7.el5.x86_64", "5Server:httpd-manual-0:2.2.3-7.el5.i386", "5Server:httpd-manual-0:2.2.3-7.el5.ia64", "5Server:httpd-manual-0:2.2.3-7.el5.ppc", "5Server:httpd-manual-0:2.2.3-7.el5.s390x", "5Server:httpd-manual-0:2.2.3-7.el5.x86_64", "5Server:mod_ssl-1:2.2.3-7.el5.i386", "5Server:mod_ssl-1:2.2.3-7.el5.ia64", "5Server:mod_ssl-1:2.2.3-7.el5.ppc", "5Server:mod_ssl-1:2.2.3-7.el5.s390x", "5Server:mod_ssl-1:2.2.3-7.el5.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2006-5752", }, { category: "external", summary: "RHBZ#245112", url: "https://bugzilla.redhat.com/show_bug.cgi?id=245112", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2006-5752", url: "https://www.cve.org/CVERecord?id=CVE-2006-5752", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2006-5752", url: "https://nvd.nist.gov/vuln/detail/CVE-2006-5752", }, ], release_date: "2007-06-20T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2007-06-26T15:22:00+00:00", details: "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied. \n\nThis update is available via Red Hat Network. Details on how to use \nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/FAQ_58_10188", product_ids: [ "5Client-Workstation:httpd-0:2.2.3-7.el5.i386", "5Client-Workstation:httpd-0:2.2.3-7.el5.ia64", "5Client-Workstation:httpd-0:2.2.3-7.el5.ppc", "5Client-Workstation:httpd-0:2.2.3-7.el5.s390x", "5Client-Workstation:httpd-0:2.2.3-7.el5.src", "5Client-Workstation:httpd-0:2.2.3-7.el5.x86_64", "5Client-Workstation:httpd-debuginfo-0:2.2.3-7.el5.i386", "5Client-Workstation:httpd-debuginfo-0:2.2.3-7.el5.ia64", "5Client-Workstation:httpd-debuginfo-0:2.2.3-7.el5.ppc", "5Client-Workstation:httpd-debuginfo-0:2.2.3-7.el5.ppc64", "5Client-Workstation:httpd-debuginfo-0:2.2.3-7.el5.s390", "5Client-Workstation:httpd-debuginfo-0:2.2.3-7.el5.s390x", "5Client-Workstation:httpd-debuginfo-0:2.2.3-7.el5.x86_64", "5Client-Workstation:httpd-devel-0:2.2.3-7.el5.i386", "5Client-Workstation:httpd-devel-0:2.2.3-7.el5.ia64", "5Client-Workstation:httpd-devel-0:2.2.3-7.el5.ppc", "5Client-Workstation:httpd-devel-0:2.2.3-7.el5.ppc64", "5Client-Workstation:httpd-devel-0:2.2.3-7.el5.s390", "5Client-Workstation:httpd-devel-0:2.2.3-7.el5.s390x", "5Client-Workstation:httpd-devel-0:2.2.3-7.el5.x86_64", "5Client-Workstation:httpd-manual-0:2.2.3-7.el5.i386", "5Client-Workstation:httpd-manual-0:2.2.3-7.el5.ia64", "5Client-Workstation:httpd-manual-0:2.2.3-7.el5.ppc", "5Client-Workstation:httpd-manual-0:2.2.3-7.el5.s390x", "5Client-Workstation:httpd-manual-0:2.2.3-7.el5.x86_64", "5Client-Workstation:mod_ssl-1:2.2.3-7.el5.i386", "5Client-Workstation:mod_ssl-1:2.2.3-7.el5.ia64", "5Client-Workstation:mod_ssl-1:2.2.3-7.el5.ppc", "5Client-Workstation:mod_ssl-1:2.2.3-7.el5.s390x", "5Client-Workstation:mod_ssl-1:2.2.3-7.el5.x86_64", "5Client:httpd-0:2.2.3-7.el5.i386", "5Client:httpd-0:2.2.3-7.el5.ia64", "5Client:httpd-0:2.2.3-7.el5.ppc", "5Client:httpd-0:2.2.3-7.el5.s390x", "5Client:httpd-0:2.2.3-7.el5.src", "5Client:httpd-0:2.2.3-7.el5.x86_64", "5Client:httpd-debuginfo-0:2.2.3-7.el5.i386", "5Client:httpd-debuginfo-0:2.2.3-7.el5.ia64", "5Client:httpd-debuginfo-0:2.2.3-7.el5.ppc", "5Client:httpd-debuginfo-0:2.2.3-7.el5.ppc64", "5Client:httpd-debuginfo-0:2.2.3-7.el5.s390", "5Client:httpd-debuginfo-0:2.2.3-7.el5.s390x", "5Client:httpd-debuginfo-0:2.2.3-7.el5.x86_64", "5Client:httpd-devel-0:2.2.3-7.el5.i386", "5Client:httpd-devel-0:2.2.3-7.el5.ia64", "5Client:httpd-devel-0:2.2.3-7.el5.ppc", "5Client:httpd-devel-0:2.2.3-7.el5.ppc64", "5Client:httpd-devel-0:2.2.3-7.el5.s390", "5Client:httpd-devel-0:2.2.3-7.el5.s390x", "5Client:httpd-devel-0:2.2.3-7.el5.x86_64", "5Client:httpd-manual-0:2.2.3-7.el5.i386", "5Client:httpd-manual-0:2.2.3-7.el5.ia64", "5Client:httpd-manual-0:2.2.3-7.el5.ppc", "5Client:httpd-manual-0:2.2.3-7.el5.s390x", "5Client:httpd-manual-0:2.2.3-7.el5.x86_64", "5Client:mod_ssl-1:2.2.3-7.el5.i386", "5Client:mod_ssl-1:2.2.3-7.el5.ia64", "5Client:mod_ssl-1:2.2.3-7.el5.ppc", "5Client:mod_ssl-1:2.2.3-7.el5.s390x", "5Client:mod_ssl-1:2.2.3-7.el5.x86_64", "5Server:httpd-0:2.2.3-7.el5.i386", "5Server:httpd-0:2.2.3-7.el5.ia64", "5Server:httpd-0:2.2.3-7.el5.ppc", "5Server:httpd-0:2.2.3-7.el5.s390x", "5Server:httpd-0:2.2.3-7.el5.src", "5Server:httpd-0:2.2.3-7.el5.x86_64", "5Server:httpd-debuginfo-0:2.2.3-7.el5.i386", "5Server:httpd-debuginfo-0:2.2.3-7.el5.ia64", "5Server:httpd-debuginfo-0:2.2.3-7.el5.ppc", "5Server:httpd-debuginfo-0:2.2.3-7.el5.ppc64", "5Server:httpd-debuginfo-0:2.2.3-7.el5.s390", "5Server:httpd-debuginfo-0:2.2.3-7.el5.s390x", "5Server:httpd-debuginfo-0:2.2.3-7.el5.x86_64", "5Server:httpd-devel-0:2.2.3-7.el5.i386", "5Server:httpd-devel-0:2.2.3-7.el5.ia64", "5Server:httpd-devel-0:2.2.3-7.el5.ppc", "5Server:httpd-devel-0:2.2.3-7.el5.ppc64", "5Server:httpd-devel-0:2.2.3-7.el5.s390", "5Server:httpd-devel-0:2.2.3-7.el5.s390x", "5Server:httpd-devel-0:2.2.3-7.el5.x86_64", "5Server:httpd-manual-0:2.2.3-7.el5.i386", "5Server:httpd-manual-0:2.2.3-7.el5.ia64", "5Server:httpd-manual-0:2.2.3-7.el5.ppc", "5Server:httpd-manual-0:2.2.3-7.el5.s390x", "5Server:httpd-manual-0:2.2.3-7.el5.x86_64", "5Server:mod_ssl-1:2.2.3-7.el5.i386", "5Server:mod_ssl-1:2.2.3-7.el5.ia64", "5Server:mod_ssl-1:2.2.3-7.el5.ppc", "5Server:mod_ssl-1:2.2.3-7.el5.s390x", "5Server:mod_ssl-1:2.2.3-7.el5.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2007:0556", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "httpd mod_status XSS", }, { cve: "CVE-2007-1863", discovery_date: "2007-05-02T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "244658", }, ], notes: [ { category: "description", text: "cache_util.c in the mod_cache module in Apache HTTP Server (httpd), when caching is enabled and a threaded Multi-Processing Module (MPM) is used, allows remote attackers to cause a denial of service (child processing handler crash) via a request with the (1) s-maxage, (2) max-age, (3) min-fresh, or (4) max-stale Cache-Control headers without a value.", title: "Vulnerability description", }, { category: "summary", text: "httpd mod_cache segfault", title: "Vulnerability summary", }, ], product_status: { fixed: [ "5Client-Workstation:httpd-0:2.2.3-7.el5.i386", "5Client-Workstation:httpd-0:2.2.3-7.el5.ia64", "5Client-Workstation:httpd-0:2.2.3-7.el5.ppc", "5Client-Workstation:httpd-0:2.2.3-7.el5.s390x", "5Client-Workstation:httpd-0:2.2.3-7.el5.src", "5Client-Workstation:httpd-0:2.2.3-7.el5.x86_64", "5Client-Workstation:httpd-debuginfo-0:2.2.3-7.el5.i386", "5Client-Workstation:httpd-debuginfo-0:2.2.3-7.el5.ia64", "5Client-Workstation:httpd-debuginfo-0:2.2.3-7.el5.ppc", "5Client-Workstation:httpd-debuginfo-0:2.2.3-7.el5.ppc64", "5Client-Workstation:httpd-debuginfo-0:2.2.3-7.el5.s390", "5Client-Workstation:httpd-debuginfo-0:2.2.3-7.el5.s390x", "5Client-Workstation:httpd-debuginfo-0:2.2.3-7.el5.x86_64", "5Client-Workstation:httpd-devel-0:2.2.3-7.el5.i386", "5Client-Workstation:httpd-devel-0:2.2.3-7.el5.ia64", "5Client-Workstation:httpd-devel-0:2.2.3-7.el5.ppc", "5Client-Workstation:httpd-devel-0:2.2.3-7.el5.ppc64", "5Client-Workstation:httpd-devel-0:2.2.3-7.el5.s390", "5Client-Workstation:httpd-devel-0:2.2.3-7.el5.s390x", "5Client-Workstation:httpd-devel-0:2.2.3-7.el5.x86_64", "5Client-Workstation:httpd-manual-0:2.2.3-7.el5.i386", "5Client-Workstation:httpd-manual-0:2.2.3-7.el5.ia64", "5Client-Workstation:httpd-manual-0:2.2.3-7.el5.ppc", "5Client-Workstation:httpd-manual-0:2.2.3-7.el5.s390x", "5Client-Workstation:httpd-manual-0:2.2.3-7.el5.x86_64", "5Client-Workstation:mod_ssl-1:2.2.3-7.el5.i386", "5Client-Workstation:mod_ssl-1:2.2.3-7.el5.ia64", "5Client-Workstation:mod_ssl-1:2.2.3-7.el5.ppc", "5Client-Workstation:mod_ssl-1:2.2.3-7.el5.s390x", "5Client-Workstation:mod_ssl-1:2.2.3-7.el5.x86_64", "5Client:httpd-0:2.2.3-7.el5.i386", "5Client:httpd-0:2.2.3-7.el5.ia64", "5Client:httpd-0:2.2.3-7.el5.ppc", "5Client:httpd-0:2.2.3-7.el5.s390x", "5Client:httpd-0:2.2.3-7.el5.src", "5Client:httpd-0:2.2.3-7.el5.x86_64", "5Client:httpd-debuginfo-0:2.2.3-7.el5.i386", "5Client:httpd-debuginfo-0:2.2.3-7.el5.ia64", "5Client:httpd-debuginfo-0:2.2.3-7.el5.ppc", "5Client:httpd-debuginfo-0:2.2.3-7.el5.ppc64", "5Client:httpd-debuginfo-0:2.2.3-7.el5.s390", "5Client:httpd-debuginfo-0:2.2.3-7.el5.s390x", "5Client:httpd-debuginfo-0:2.2.3-7.el5.x86_64", "5Client:httpd-devel-0:2.2.3-7.el5.i386", "5Client:httpd-devel-0:2.2.3-7.el5.ia64", "5Client:httpd-devel-0:2.2.3-7.el5.ppc", "5Client:httpd-devel-0:2.2.3-7.el5.ppc64", "5Client:httpd-devel-0:2.2.3-7.el5.s390", "5Client:httpd-devel-0:2.2.3-7.el5.s390x", "5Client:httpd-devel-0:2.2.3-7.el5.x86_64", "5Client:httpd-manual-0:2.2.3-7.el5.i386", "5Client:httpd-manual-0:2.2.3-7.el5.ia64", "5Client:httpd-manual-0:2.2.3-7.el5.ppc", "5Client:httpd-manual-0:2.2.3-7.el5.s390x", "5Client:httpd-manual-0:2.2.3-7.el5.x86_64", "5Client:mod_ssl-1:2.2.3-7.el5.i386", "5Client:mod_ssl-1:2.2.3-7.el5.ia64", "5Client:mod_ssl-1:2.2.3-7.el5.ppc", "5Client:mod_ssl-1:2.2.3-7.el5.s390x", "5Client:mod_ssl-1:2.2.3-7.el5.x86_64", "5Server:httpd-0:2.2.3-7.el5.i386", "5Server:httpd-0:2.2.3-7.el5.ia64", "5Server:httpd-0:2.2.3-7.el5.ppc", "5Server:httpd-0:2.2.3-7.el5.s390x", "5Server:httpd-0:2.2.3-7.el5.src", "5Server:httpd-0:2.2.3-7.el5.x86_64", "5Server:httpd-debuginfo-0:2.2.3-7.el5.i386", "5Server:httpd-debuginfo-0:2.2.3-7.el5.ia64", "5Server:httpd-debuginfo-0:2.2.3-7.el5.ppc", "5Server:httpd-debuginfo-0:2.2.3-7.el5.ppc64", "5Server:httpd-debuginfo-0:2.2.3-7.el5.s390", "5Server:httpd-debuginfo-0:2.2.3-7.el5.s390x", "5Server:httpd-debuginfo-0:2.2.3-7.el5.x86_64", "5Server:httpd-devel-0:2.2.3-7.el5.i386", "5Server:httpd-devel-0:2.2.3-7.el5.ia64", "5Server:httpd-devel-0:2.2.3-7.el5.ppc", "5Server:httpd-devel-0:2.2.3-7.el5.ppc64", "5Server:httpd-devel-0:2.2.3-7.el5.s390", "5Server:httpd-devel-0:2.2.3-7.el5.s390x", "5Server:httpd-devel-0:2.2.3-7.el5.x86_64", "5Server:httpd-manual-0:2.2.3-7.el5.i386", "5Server:httpd-manual-0:2.2.3-7.el5.ia64", "5Server:httpd-manual-0:2.2.3-7.el5.ppc", "5Server:httpd-manual-0:2.2.3-7.el5.s390x", "5Server:httpd-manual-0:2.2.3-7.el5.x86_64", "5Server:mod_ssl-1:2.2.3-7.el5.i386", "5Server:mod_ssl-1:2.2.3-7.el5.ia64", "5Server:mod_ssl-1:2.2.3-7.el5.ppc", "5Server:mod_ssl-1:2.2.3-7.el5.s390x", "5Server:mod_ssl-1:2.2.3-7.el5.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-1863", }, { category: "external", summary: "RHBZ#244658", url: "https://bugzilla.redhat.com/show_bug.cgi?id=244658", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-1863", url: "https://www.cve.org/CVERecord?id=CVE-2007-1863", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-1863", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-1863", }, ], release_date: "2007-05-02T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2007-06-26T15:22:00+00:00", details: "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied. \n\nThis update is available via Red Hat Network. Details on how to use \nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/FAQ_58_10188", product_ids: [ "5Client-Workstation:httpd-0:2.2.3-7.el5.i386", "5Client-Workstation:httpd-0:2.2.3-7.el5.ia64", "5Client-Workstation:httpd-0:2.2.3-7.el5.ppc", "5Client-Workstation:httpd-0:2.2.3-7.el5.s390x", "5Client-Workstation:httpd-0:2.2.3-7.el5.src", "5Client-Workstation:httpd-0:2.2.3-7.el5.x86_64", "5Client-Workstation:httpd-debuginfo-0:2.2.3-7.el5.i386", "5Client-Workstation:httpd-debuginfo-0:2.2.3-7.el5.ia64", "5Client-Workstation:httpd-debuginfo-0:2.2.3-7.el5.ppc", "5Client-Workstation:httpd-debuginfo-0:2.2.3-7.el5.ppc64", "5Client-Workstation:httpd-debuginfo-0:2.2.3-7.el5.s390", "5Client-Workstation:httpd-debuginfo-0:2.2.3-7.el5.s390x", "5Client-Workstation:httpd-debuginfo-0:2.2.3-7.el5.x86_64", "5Client-Workstation:httpd-devel-0:2.2.3-7.el5.i386", "5Client-Workstation:httpd-devel-0:2.2.3-7.el5.ia64", "5Client-Workstation:httpd-devel-0:2.2.3-7.el5.ppc", "5Client-Workstation:httpd-devel-0:2.2.3-7.el5.ppc64", "5Client-Workstation:httpd-devel-0:2.2.3-7.el5.s390", "5Client-Workstation:httpd-devel-0:2.2.3-7.el5.s390x", "5Client-Workstation:httpd-devel-0:2.2.3-7.el5.x86_64", "5Client-Workstation:httpd-manual-0:2.2.3-7.el5.i386", "5Client-Workstation:httpd-manual-0:2.2.3-7.el5.ia64", "5Client-Workstation:httpd-manual-0:2.2.3-7.el5.ppc", "5Client-Workstation:httpd-manual-0:2.2.3-7.el5.s390x", "5Client-Workstation:httpd-manual-0:2.2.3-7.el5.x86_64", "5Client-Workstation:mod_ssl-1:2.2.3-7.el5.i386", "5Client-Workstation:mod_ssl-1:2.2.3-7.el5.ia64", "5Client-Workstation:mod_ssl-1:2.2.3-7.el5.ppc", "5Client-Workstation:mod_ssl-1:2.2.3-7.el5.s390x", "5Client-Workstation:mod_ssl-1:2.2.3-7.el5.x86_64", "5Client:httpd-0:2.2.3-7.el5.i386", "5Client:httpd-0:2.2.3-7.el5.ia64", "5Client:httpd-0:2.2.3-7.el5.ppc", "5Client:httpd-0:2.2.3-7.el5.s390x", "5Client:httpd-0:2.2.3-7.el5.src", "5Client:httpd-0:2.2.3-7.el5.x86_64", "5Client:httpd-debuginfo-0:2.2.3-7.el5.i386", "5Client:httpd-debuginfo-0:2.2.3-7.el5.ia64", "5Client:httpd-debuginfo-0:2.2.3-7.el5.ppc", "5Client:httpd-debuginfo-0:2.2.3-7.el5.ppc64", "5Client:httpd-debuginfo-0:2.2.3-7.el5.s390", "5Client:httpd-debuginfo-0:2.2.3-7.el5.s390x", "5Client:httpd-debuginfo-0:2.2.3-7.el5.x86_64", "5Client:httpd-devel-0:2.2.3-7.el5.i386", "5Client:httpd-devel-0:2.2.3-7.el5.ia64", "5Client:httpd-devel-0:2.2.3-7.el5.ppc", "5Client:httpd-devel-0:2.2.3-7.el5.ppc64", "5Client:httpd-devel-0:2.2.3-7.el5.s390", "5Client:httpd-devel-0:2.2.3-7.el5.s390x", "5Client:httpd-devel-0:2.2.3-7.el5.x86_64", "5Client:httpd-manual-0:2.2.3-7.el5.i386", "5Client:httpd-manual-0:2.2.3-7.el5.ia64", "5Client:httpd-manual-0:2.2.3-7.el5.ppc", "5Client:httpd-manual-0:2.2.3-7.el5.s390x", "5Client:httpd-manual-0:2.2.3-7.el5.x86_64", "5Client:mod_ssl-1:2.2.3-7.el5.i386", "5Client:mod_ssl-1:2.2.3-7.el5.ia64", "5Client:mod_ssl-1:2.2.3-7.el5.ppc", "5Client:mod_ssl-1:2.2.3-7.el5.s390x", "5Client:mod_ssl-1:2.2.3-7.el5.x86_64", "5Server:httpd-0:2.2.3-7.el5.i386", "5Server:httpd-0:2.2.3-7.el5.ia64", "5Server:httpd-0:2.2.3-7.el5.ppc", "5Server:httpd-0:2.2.3-7.el5.s390x", "5Server:httpd-0:2.2.3-7.el5.src", "5Server:httpd-0:2.2.3-7.el5.x86_64", "5Server:httpd-debuginfo-0:2.2.3-7.el5.i386", "5Server:httpd-debuginfo-0:2.2.3-7.el5.ia64", "5Server:httpd-debuginfo-0:2.2.3-7.el5.ppc", "5Server:httpd-debuginfo-0:2.2.3-7.el5.ppc64", "5Server:httpd-debuginfo-0:2.2.3-7.el5.s390", "5Server:httpd-debuginfo-0:2.2.3-7.el5.s390x", "5Server:httpd-debuginfo-0:2.2.3-7.el5.x86_64", "5Server:httpd-devel-0:2.2.3-7.el5.i386", "5Server:httpd-devel-0:2.2.3-7.el5.ia64", "5Server:httpd-devel-0:2.2.3-7.el5.ppc", "5Server:httpd-devel-0:2.2.3-7.el5.ppc64", "5Server:httpd-devel-0:2.2.3-7.el5.s390", "5Server:httpd-devel-0:2.2.3-7.el5.s390x", "5Server:httpd-devel-0:2.2.3-7.el5.x86_64", "5Server:httpd-manual-0:2.2.3-7.el5.i386", "5Server:httpd-manual-0:2.2.3-7.el5.ia64", "5Server:httpd-manual-0:2.2.3-7.el5.ppc", "5Server:httpd-manual-0:2.2.3-7.el5.s390x", "5Server:httpd-manual-0:2.2.3-7.el5.x86_64", "5Server:mod_ssl-1:2.2.3-7.el5.i386", "5Server:mod_ssl-1:2.2.3-7.el5.ia64", "5Server:mod_ssl-1:2.2.3-7.el5.ppc", "5Server:mod_ssl-1:2.2.3-7.el5.s390x", "5Server:mod_ssl-1:2.2.3-7.el5.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2007:0556", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "httpd mod_cache segfault", }, { cve: "CVE-2007-3304", discovery_date: "2007-06-19T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "245111", }, ], notes: [ { category: "description", text: "Apache httpd 1.3.37, 2.0.59, and 2.2.4 with the Prefork MPM module, allows local users to cause a denial of service by modifying the worker_score and process_score arrays to reference an arbitrary process ID, which is sent a SIGUSR1 signal from the master process, aka \"SIGUSR1 killer.\"", title: "Vulnerability description", }, { category: "summary", text: "httpd scoreboard lack of PID protection", title: "Vulnerability summary", }, ], product_status: { fixed: [ "5Client-Workstation:httpd-0:2.2.3-7.el5.i386", "5Client-Workstation:httpd-0:2.2.3-7.el5.ia64", "5Client-Workstation:httpd-0:2.2.3-7.el5.ppc", "5Client-Workstation:httpd-0:2.2.3-7.el5.s390x", "5Client-Workstation:httpd-0:2.2.3-7.el5.src", "5Client-Workstation:httpd-0:2.2.3-7.el5.x86_64", "5Client-Workstation:httpd-debuginfo-0:2.2.3-7.el5.i386", "5Client-Workstation:httpd-debuginfo-0:2.2.3-7.el5.ia64", "5Client-Workstation:httpd-debuginfo-0:2.2.3-7.el5.ppc", "5Client-Workstation:httpd-debuginfo-0:2.2.3-7.el5.ppc64", "5Client-Workstation:httpd-debuginfo-0:2.2.3-7.el5.s390", "5Client-Workstation:httpd-debuginfo-0:2.2.3-7.el5.s390x", "5Client-Workstation:httpd-debuginfo-0:2.2.3-7.el5.x86_64", "5Client-Workstation:httpd-devel-0:2.2.3-7.el5.i386", "5Client-Workstation:httpd-devel-0:2.2.3-7.el5.ia64", "5Client-Workstation:httpd-devel-0:2.2.3-7.el5.ppc", "5Client-Workstation:httpd-devel-0:2.2.3-7.el5.ppc64", "5Client-Workstation:httpd-devel-0:2.2.3-7.el5.s390", "5Client-Workstation:httpd-devel-0:2.2.3-7.el5.s390x", "5Client-Workstation:httpd-devel-0:2.2.3-7.el5.x86_64", "5Client-Workstation:httpd-manual-0:2.2.3-7.el5.i386", "5Client-Workstation:httpd-manual-0:2.2.3-7.el5.ia64", "5Client-Workstation:httpd-manual-0:2.2.3-7.el5.ppc", "5Client-Workstation:httpd-manual-0:2.2.3-7.el5.s390x", "5Client-Workstation:httpd-manual-0:2.2.3-7.el5.x86_64", "5Client-Workstation:mod_ssl-1:2.2.3-7.el5.i386", "5Client-Workstation:mod_ssl-1:2.2.3-7.el5.ia64", "5Client-Workstation:mod_ssl-1:2.2.3-7.el5.ppc", "5Client-Workstation:mod_ssl-1:2.2.3-7.el5.s390x", "5Client-Workstation:mod_ssl-1:2.2.3-7.el5.x86_64", "5Client:httpd-0:2.2.3-7.el5.i386", "5Client:httpd-0:2.2.3-7.el5.ia64", "5Client:httpd-0:2.2.3-7.el5.ppc", "5Client:httpd-0:2.2.3-7.el5.s390x", "5Client:httpd-0:2.2.3-7.el5.src", "5Client:httpd-0:2.2.3-7.el5.x86_64", "5Client:httpd-debuginfo-0:2.2.3-7.el5.i386", "5Client:httpd-debuginfo-0:2.2.3-7.el5.ia64", "5Client:httpd-debuginfo-0:2.2.3-7.el5.ppc", "5Client:httpd-debuginfo-0:2.2.3-7.el5.ppc64", "5Client:httpd-debuginfo-0:2.2.3-7.el5.s390", "5Client:httpd-debuginfo-0:2.2.3-7.el5.s390x", "5Client:httpd-debuginfo-0:2.2.3-7.el5.x86_64", "5Client:httpd-devel-0:2.2.3-7.el5.i386", "5Client:httpd-devel-0:2.2.3-7.el5.ia64", "5Client:httpd-devel-0:2.2.3-7.el5.ppc", "5Client:httpd-devel-0:2.2.3-7.el5.ppc64", "5Client:httpd-devel-0:2.2.3-7.el5.s390", "5Client:httpd-devel-0:2.2.3-7.el5.s390x", "5Client:httpd-devel-0:2.2.3-7.el5.x86_64", "5Client:httpd-manual-0:2.2.3-7.el5.i386", "5Client:httpd-manual-0:2.2.3-7.el5.ia64", "5Client:httpd-manual-0:2.2.3-7.el5.ppc", "5Client:httpd-manual-0:2.2.3-7.el5.s390x", "5Client:httpd-manual-0:2.2.3-7.el5.x86_64", "5Client:mod_ssl-1:2.2.3-7.el5.i386", "5Client:mod_ssl-1:2.2.3-7.el5.ia64", "5Client:mod_ssl-1:2.2.3-7.el5.ppc", "5Client:mod_ssl-1:2.2.3-7.el5.s390x", "5Client:mod_ssl-1:2.2.3-7.el5.x86_64", "5Server:httpd-0:2.2.3-7.el5.i386", "5Server:httpd-0:2.2.3-7.el5.ia64", "5Server:httpd-0:2.2.3-7.el5.ppc", "5Server:httpd-0:2.2.3-7.el5.s390x", "5Server:httpd-0:2.2.3-7.el5.src", "5Server:httpd-0:2.2.3-7.el5.x86_64", "5Server:httpd-debuginfo-0:2.2.3-7.el5.i386", "5Server:httpd-debuginfo-0:2.2.3-7.el5.ia64", "5Server:httpd-debuginfo-0:2.2.3-7.el5.ppc", "5Server:httpd-debuginfo-0:2.2.3-7.el5.ppc64", "5Server:httpd-debuginfo-0:2.2.3-7.el5.s390", "5Server:httpd-debuginfo-0:2.2.3-7.el5.s390x", "5Server:httpd-debuginfo-0:2.2.3-7.el5.x86_64", "5Server:httpd-devel-0:2.2.3-7.el5.i386", "5Server:httpd-devel-0:2.2.3-7.el5.ia64", "5Server:httpd-devel-0:2.2.3-7.el5.ppc", "5Server:httpd-devel-0:2.2.3-7.el5.ppc64", "5Server:httpd-devel-0:2.2.3-7.el5.s390", "5Server:httpd-devel-0:2.2.3-7.el5.s390x", "5Server:httpd-devel-0:2.2.3-7.el5.x86_64", "5Server:httpd-manual-0:2.2.3-7.el5.i386", "5Server:httpd-manual-0:2.2.3-7.el5.ia64", "5Server:httpd-manual-0:2.2.3-7.el5.ppc", "5Server:httpd-manual-0:2.2.3-7.el5.s390x", "5Server:httpd-manual-0:2.2.3-7.el5.x86_64", "5Server:mod_ssl-1:2.2.3-7.el5.i386", "5Server:mod_ssl-1:2.2.3-7.el5.ia64", "5Server:mod_ssl-1:2.2.3-7.el5.ppc", "5Server:mod_ssl-1:2.2.3-7.el5.s390x", "5Server:mod_ssl-1:2.2.3-7.el5.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-3304", }, { category: "external", summary: "RHBZ#245111", url: "https://bugzilla.redhat.com/show_bug.cgi?id=245111", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-3304", url: "https://www.cve.org/CVERecord?id=CVE-2007-3304", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-3304", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-3304", }, ], release_date: "2007-06-19T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2007-06-26T15:22:00+00:00", details: "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied. \n\nThis update is available via Red Hat Network. Details on how to use \nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/FAQ_58_10188", product_ids: [ "5Client-Workstation:httpd-0:2.2.3-7.el5.i386", "5Client-Workstation:httpd-0:2.2.3-7.el5.ia64", "5Client-Workstation:httpd-0:2.2.3-7.el5.ppc", "5Client-Workstation:httpd-0:2.2.3-7.el5.s390x", "5Client-Workstation:httpd-0:2.2.3-7.el5.src", "5Client-Workstation:httpd-0:2.2.3-7.el5.x86_64", "5Client-Workstation:httpd-debuginfo-0:2.2.3-7.el5.i386", "5Client-Workstation:httpd-debuginfo-0:2.2.3-7.el5.ia64", "5Client-Workstation:httpd-debuginfo-0:2.2.3-7.el5.ppc", "5Client-Workstation:httpd-debuginfo-0:2.2.3-7.el5.ppc64", "5Client-Workstation:httpd-debuginfo-0:2.2.3-7.el5.s390", "5Client-Workstation:httpd-debuginfo-0:2.2.3-7.el5.s390x", "5Client-Workstation:httpd-debuginfo-0:2.2.3-7.el5.x86_64", "5Client-Workstation:httpd-devel-0:2.2.3-7.el5.i386", "5Client-Workstation:httpd-devel-0:2.2.3-7.el5.ia64", "5Client-Workstation:httpd-devel-0:2.2.3-7.el5.ppc", "5Client-Workstation:httpd-devel-0:2.2.3-7.el5.ppc64", "5Client-Workstation:httpd-devel-0:2.2.3-7.el5.s390", "5Client-Workstation:httpd-devel-0:2.2.3-7.el5.s390x", "5Client-Workstation:httpd-devel-0:2.2.3-7.el5.x86_64", "5Client-Workstation:httpd-manual-0:2.2.3-7.el5.i386", "5Client-Workstation:httpd-manual-0:2.2.3-7.el5.ia64", "5Client-Workstation:httpd-manual-0:2.2.3-7.el5.ppc", "5Client-Workstation:httpd-manual-0:2.2.3-7.el5.s390x", "5Client-Workstation:httpd-manual-0:2.2.3-7.el5.x86_64", "5Client-Workstation:mod_ssl-1:2.2.3-7.el5.i386", "5Client-Workstation:mod_ssl-1:2.2.3-7.el5.ia64", "5Client-Workstation:mod_ssl-1:2.2.3-7.el5.ppc", "5Client-Workstation:mod_ssl-1:2.2.3-7.el5.s390x", "5Client-Workstation:mod_ssl-1:2.2.3-7.el5.x86_64", "5Client:httpd-0:2.2.3-7.el5.i386", "5Client:httpd-0:2.2.3-7.el5.ia64", "5Client:httpd-0:2.2.3-7.el5.ppc", "5Client:httpd-0:2.2.3-7.el5.s390x", "5Client:httpd-0:2.2.3-7.el5.src", "5Client:httpd-0:2.2.3-7.el5.x86_64", "5Client:httpd-debuginfo-0:2.2.3-7.el5.i386", "5Client:httpd-debuginfo-0:2.2.3-7.el5.ia64", "5Client:httpd-debuginfo-0:2.2.3-7.el5.ppc", "5Client:httpd-debuginfo-0:2.2.3-7.el5.ppc64", "5Client:httpd-debuginfo-0:2.2.3-7.el5.s390", "5Client:httpd-debuginfo-0:2.2.3-7.el5.s390x", "5Client:httpd-debuginfo-0:2.2.3-7.el5.x86_64", "5Client:httpd-devel-0:2.2.3-7.el5.i386", "5Client:httpd-devel-0:2.2.3-7.el5.ia64", "5Client:httpd-devel-0:2.2.3-7.el5.ppc", "5Client:httpd-devel-0:2.2.3-7.el5.ppc64", "5Client:httpd-devel-0:2.2.3-7.el5.s390", "5Client:httpd-devel-0:2.2.3-7.el5.s390x", "5Client:httpd-devel-0:2.2.3-7.el5.x86_64", "5Client:httpd-manual-0:2.2.3-7.el5.i386", "5Client:httpd-manual-0:2.2.3-7.el5.ia64", "5Client:httpd-manual-0:2.2.3-7.el5.ppc", "5Client:httpd-manual-0:2.2.3-7.el5.s390x", "5Client:httpd-manual-0:2.2.3-7.el5.x86_64", "5Client:mod_ssl-1:2.2.3-7.el5.i386", "5Client:mod_ssl-1:2.2.3-7.el5.ia64", "5Client:mod_ssl-1:2.2.3-7.el5.ppc", "5Client:mod_ssl-1:2.2.3-7.el5.s390x", "5Client:mod_ssl-1:2.2.3-7.el5.x86_64", "5Server:httpd-0:2.2.3-7.el5.i386", "5Server:httpd-0:2.2.3-7.el5.ia64", "5Server:httpd-0:2.2.3-7.el5.ppc", "5Server:httpd-0:2.2.3-7.el5.s390x", "5Server:httpd-0:2.2.3-7.el5.src", "5Server:httpd-0:2.2.3-7.el5.x86_64", "5Server:httpd-debuginfo-0:2.2.3-7.el5.i386", "5Server:httpd-debuginfo-0:2.2.3-7.el5.ia64", "5Server:httpd-debuginfo-0:2.2.3-7.el5.ppc", "5Server:httpd-debuginfo-0:2.2.3-7.el5.ppc64", "5Server:httpd-debuginfo-0:2.2.3-7.el5.s390", "5Server:httpd-debuginfo-0:2.2.3-7.el5.s390x", "5Server:httpd-debuginfo-0:2.2.3-7.el5.x86_64", "5Server:httpd-devel-0:2.2.3-7.el5.i386", "5Server:httpd-devel-0:2.2.3-7.el5.ia64", "5Server:httpd-devel-0:2.2.3-7.el5.ppc", "5Server:httpd-devel-0:2.2.3-7.el5.ppc64", "5Server:httpd-devel-0:2.2.3-7.el5.s390", "5Server:httpd-devel-0:2.2.3-7.el5.s390x", "5Server:httpd-devel-0:2.2.3-7.el5.x86_64", "5Server:httpd-manual-0:2.2.3-7.el5.i386", "5Server:httpd-manual-0:2.2.3-7.el5.ia64", "5Server:httpd-manual-0:2.2.3-7.el5.ppc", "5Server:httpd-manual-0:2.2.3-7.el5.s390x", "5Server:httpd-manual-0:2.2.3-7.el5.x86_64", "5Server:mod_ssl-1:2.2.3-7.el5.i386", "5Server:mod_ssl-1:2.2.3-7.el5.ia64", "5Server:mod_ssl-1:2.2.3-7.el5.ppc", "5Server:mod_ssl-1:2.2.3-7.el5.s390x", "5Server:mod_ssl-1:2.2.3-7.el5.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2007:0556", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "httpd scoreboard lack of PID protection", }, ], }
rhsa-2008:0263
Vulnerability from csaf_redhat
Published
2008-05-20 14:14
Modified
2024-12-01 11:53
Summary
Red Hat Security Advisory: Red Hat Network Proxy Server security update
Notes
Topic
Red Hat Network Proxy Server version 5.0.2 is now available. This update
includes fixes for a number of security issues in Red Hat Network Proxy
Server components.
This update has been rated as having low security impact by the Red
Hat Security Response Team.
Details
The Red Hat Network Proxy Server 5.0.2 release corrects several security
vulnerabilities in several shipped components. In a typical operating
environment, these components are not exposed to users of Proxy Server in a
vulnerable manner. These security updates will reduce risk in unique Proxy
Server environments.
Multiple flaws were fixed in the Apache HTTPD server. These flaws could
result in a cross-site scripting or denial-of-service attack.
(CVE-2007-6388, CVE-2007-5000, CVE-2007-3304, CVE-2006-5752)
A denial-of-service flaw was fixed in mod_perl. (CVE-2007-1349)
A denial-of-service flaw was fixed in the jabberd server. (CVE-2006-1329)
Users of Red Hat Network Proxy Server 5.0 are advised to upgrade to 5.0.2,
which resolves these issues.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ document: { aggregate_severity: { namespace: "https://access.redhat.com/security/updates/classification/", text: "Low", }, category: "csaf_security_advisory", csaf_version: "2.0", distribution: { text: "Copyright © Red Hat, Inc. All rights reserved.", tlp: { label: "WHITE", url: "https://www.first.org/tlp/", }, }, lang: "en", notes: [ { category: "summary", text: "Red Hat Network Proxy Server version 5.0.2 is now available. This update\nincludes fixes for a number of security issues in Red Hat Network Proxy\nServer components.\n\nThis update has been rated as having low security impact by the Red\nHat Security Response Team.", title: "Topic", }, { category: "general", text: "The Red Hat Network Proxy Server 5.0.2 release corrects several security\nvulnerabilities in several shipped components. In a typical operating\nenvironment, these components are not exposed to users of Proxy Server in a\nvulnerable manner. These security updates will reduce risk in unique Proxy\nServer environments.\n\nMultiple flaws were fixed in the Apache HTTPD server. These flaws could\nresult in a cross-site scripting or denial-of-service attack.\n(CVE-2007-6388, CVE-2007-5000, CVE-2007-3304, CVE-2006-5752)\n\nA denial-of-service flaw was fixed in mod_perl. (CVE-2007-1349)\n\nA denial-of-service flaw was fixed in the jabberd server. (CVE-2006-1329)\n\nUsers of Red Hat Network Proxy Server 5.0 are advised to upgrade to 5.0.2,\nwhich resolves these issues.", title: "Details", }, { category: "legal_disclaimer", text: "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", title: "Terms of Use", }, ], publisher: { category: "vendor", contact_details: "https://access.redhat.com/security/team/contact/", issuing_authority: "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", name: "Red Hat Product Security", namespace: "https://www.redhat.com", }, references: [ { category: "self", summary: "https://access.redhat.com/errata/RHSA-2008:0263", url: "https://access.redhat.com/errata/RHSA-2008:0263", }, { category: "external", summary: "https://access.redhat.com/security/updates/classification/#low", url: "https://access.redhat.com/security/updates/classification/#low", }, { category: "external", summary: "240423", url: "https://bugzilla.redhat.com/show_bug.cgi?id=240423", }, { category: "external", summary: "245111", url: "https://bugzilla.redhat.com/show_bug.cgi?id=245111", }, { category: "external", summary: "245112", url: "https://bugzilla.redhat.com/show_bug.cgi?id=245112", }, { category: "external", summary: "419931", url: "https://bugzilla.redhat.com/show_bug.cgi?id=419931", }, { category: "external", summary: "427228", url: "https://bugzilla.redhat.com/show_bug.cgi?id=427228", }, { category: "external", summary: "429254", url: "https://bugzilla.redhat.com/show_bug.cgi?id=429254", }, { category: "self", summary: "Canonical URL", url: "https://security.access.redhat.com/data/csaf/v2/advisories/2008/rhsa-2008_0263.json", }, ], title: "Red Hat Security Advisory: Red Hat Network Proxy Server security update", tracking: { current_release_date: "2024-12-01T11:53:30+00:00", generator: { date: "2024-12-01T11:53:30+00:00", engine: { name: "Red Hat SDEngine", version: "4.2.1", }, }, id: "RHSA-2008:0263", initial_release_date: "2008-05-20T14:14:00+00:00", revision_history: [ { date: "2008-05-20T14:14:00+00:00", number: "1", summary: "Initial version", }, { date: "2008-05-20T10:14:27+00:00", number: "2", summary: "Last updated version", }, { date: "2024-12-01T11:53:30+00:00", number: "3", summary: "Last generated version", }, ], status: "final", version: "3", }, }, product_tree: { branches: [ { branches: [ { branches: [ { category: "product_name", name: "Red Hat Satellite Proxy v 5.0 (RHEL v.4 AS)", product: { name: "Red Hat Satellite Proxy v 5.0 (RHEL v.4 AS)", product_id: "4AS-RHNPROXY5.0", product_identification_helper: { cpe: "cpe:/a:redhat:network_proxy:5.0::el4", }, }, }, ], category: "product_family", name: "Red Hat Satellite Proxy", }, { branches: [ { category: "product_version", name: "jabberd-0:2.0s10-3.38.rhn.i386", product: { name: "jabberd-0:2.0s10-3.38.rhn.i386", product_id: "jabberd-0:2.0s10-3.38.rhn.i386", product_identification_helper: { purl: "pkg:rpm/redhat/jabberd@2.0s10-3.38.rhn?arch=i386", }, }, }, { category: "product_version", name: "rhn-apache-0:1.3.27-36.rhn.rhel4.i386", product: { name: "rhn-apache-0:1.3.27-36.rhn.rhel4.i386", product_id: "rhn-apache-0:1.3.27-36.rhn.rhel4.i386", product_identification_helper: { purl: "pkg:rpm/redhat/rhn-apache@1.3.27-36.rhn.rhel4?arch=i386", }, }, }, { category: "product_version", name: "rhn-modperl-0:1.29-16.rhel4.i386", product: { name: "rhn-modperl-0:1.29-16.rhel4.i386", product_id: "rhn-modperl-0:1.29-16.rhel4.i386", product_identification_helper: { purl: "pkg:rpm/redhat/rhn-modperl@1.29-16.rhel4?arch=i386", }, }, }, ], category: "architecture", name: "i386", }, ], category: "vendor", name: "Red Hat", }, ], relationships: [ { category: "default_component_of", full_product_name: { name: "jabberd-0:2.0s10-3.38.rhn.i386 as a component of Red Hat Satellite Proxy v 5.0 (RHEL v.4 AS)", product_id: "4AS-RHNPROXY5.0:jabberd-0:2.0s10-3.38.rhn.i386", }, product_reference: "jabberd-0:2.0s10-3.38.rhn.i386", relates_to_product_reference: "4AS-RHNPROXY5.0", }, { category: "default_component_of", full_product_name: { name: "rhn-apache-0:1.3.27-36.rhn.rhel4.i386 as a component of Red Hat Satellite Proxy v 5.0 (RHEL v.4 AS)", product_id: "4AS-RHNPROXY5.0:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", }, product_reference: "rhn-apache-0:1.3.27-36.rhn.rhel4.i386", relates_to_product_reference: "4AS-RHNPROXY5.0", }, { category: "default_component_of", full_product_name: { name: "rhn-modperl-0:1.29-16.rhel4.i386 as a component of Red Hat Satellite Proxy v 5.0 (RHEL v.4 AS)", product_id: "4AS-RHNPROXY5.0:rhn-modperl-0:1.29-16.rhel4.i386", }, product_reference: "rhn-modperl-0:1.29-16.rhel4.i386", relates_to_product_reference: "4AS-RHNPROXY5.0", }, ], }, vulnerabilities: [ { cve: "CVE-2006-1329", ids: [ { system_name: "Red Hat Bugzilla ID", text: "429254", }, ], notes: [ { category: "description", text: "The SASL negotiation in Jabber Studio jabberd before 2.0s11 allows remote attackers to cause a denial of service (\"c2s segfault\") by sending a \"response stanza before an auth stanza\".", title: "Vulnerability description", }, { category: "summary", text: "jabberd SASL DoS", title: "Vulnerability summary", }, ], product_status: { fixed: [ "4AS-RHNPROXY5.0:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNPROXY5.0:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNPROXY5.0:rhn-modperl-0:1.29-16.rhel4.i386", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2006-1329", }, { category: "external", summary: "RHBZ#429254", url: "https://bugzilla.redhat.com/show_bug.cgi?id=429254", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2006-1329", url: "https://www.cve.org/CVERecord?id=CVE-2006-1329", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2006-1329", url: "https://nvd.nist.gov/vuln/detail/CVE-2006-1329", }, ], release_date: "2006-03-09T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-05-20T14:14:00+00:00", details: "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.\n\nThis update is available via Red Hat Network. Details on how to use \nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/FAQ_58_10188", product_ids: [ "4AS-RHNPROXY5.0:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNPROXY5.0:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNPROXY5.0:rhn-modperl-0:1.29-16.rhel4.i386", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0263", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "jabberd SASL DoS", }, { cve: "CVE-2006-5752", cwe: { id: "CWE-79", name: "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", }, discovery_date: "2007-06-20T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "245112", }, ], notes: [ { category: "description", text: "Cross-site scripting (XSS) vulnerability in mod_status.c in the mod_status module in Apache HTTP Server (httpd), when ExtendedStatus is enabled and a public server-status page is used, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors involving charsets with browsers that perform \"charset detection\" when the content-type is not specified.", title: "Vulnerability description", }, { category: "summary", text: "httpd mod_status XSS", title: "Vulnerability summary", }, ], product_status: { fixed: [ "4AS-RHNPROXY5.0:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNPROXY5.0:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNPROXY5.0:rhn-modperl-0:1.29-16.rhel4.i386", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2006-5752", }, { category: "external", summary: "RHBZ#245112", url: "https://bugzilla.redhat.com/show_bug.cgi?id=245112", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2006-5752", url: "https://www.cve.org/CVERecord?id=CVE-2006-5752", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2006-5752", url: "https://nvd.nist.gov/vuln/detail/CVE-2006-5752", }, ], release_date: "2007-06-20T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-05-20T14:14:00+00:00", details: "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.\n\nThis update is available via Red Hat Network. Details on how to use \nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/FAQ_58_10188", product_ids: [ "4AS-RHNPROXY5.0:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNPROXY5.0:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNPROXY5.0:rhn-modperl-0:1.29-16.rhel4.i386", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0263", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "httpd mod_status XSS", }, { cve: "CVE-2007-1349", discovery_date: "2007-05-17T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "240423", }, ], notes: [ { category: "description", text: "PerlRun.pm in Apache mod_perl before 1.30, and RegistryCooker.pm in mod_perl 2.x, does not properly escape PATH_INFO before use in a regular expression, which allows remote attackers to cause a denial of service (resource consumption) via a crafted URI.", title: "Vulnerability description", }, { category: "summary", text: "mod_perl PerlRun denial of service", title: "Vulnerability summary", }, ], product_status: { fixed: [ "4AS-RHNPROXY5.0:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNPROXY5.0:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNPROXY5.0:rhn-modperl-0:1.29-16.rhel4.i386", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-1349", }, { category: "external", summary: "RHBZ#240423", url: "https://bugzilla.redhat.com/show_bug.cgi?id=240423", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-1349", url: "https://www.cve.org/CVERecord?id=CVE-2007-1349", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-1349", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-1349", }, ], release_date: "2007-03-22T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-05-20T14:14:00+00:00", details: "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.\n\nThis update is available via Red Hat Network. Details on how to use \nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/FAQ_58_10188", product_ids: [ "4AS-RHNPROXY5.0:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNPROXY5.0:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNPROXY5.0:rhn-modperl-0:1.29-16.rhel4.i386", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0263", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "mod_perl PerlRun denial of service", }, { cve: "CVE-2007-3304", discovery_date: "2007-06-19T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "245111", }, ], notes: [ { category: "description", text: "Apache httpd 1.3.37, 2.0.59, and 2.2.4 with the Prefork MPM module, allows local users to cause a denial of service by modifying the worker_score and process_score arrays to reference an arbitrary process ID, which is sent a SIGUSR1 signal from the master process, aka \"SIGUSR1 killer.\"", title: "Vulnerability description", }, { category: "summary", text: "httpd scoreboard lack of PID protection", title: "Vulnerability summary", }, ], product_status: { fixed: [ "4AS-RHNPROXY5.0:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNPROXY5.0:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNPROXY5.0:rhn-modperl-0:1.29-16.rhel4.i386", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-3304", }, { category: "external", summary: "RHBZ#245111", url: "https://bugzilla.redhat.com/show_bug.cgi?id=245111", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-3304", url: "https://www.cve.org/CVERecord?id=CVE-2007-3304", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-3304", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-3304", }, ], release_date: "2007-06-19T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-05-20T14:14:00+00:00", details: "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.\n\nThis update is available via Red Hat Network. Details on how to use \nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/FAQ_58_10188", product_ids: [ "4AS-RHNPROXY5.0:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNPROXY5.0:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNPROXY5.0:rhn-modperl-0:1.29-16.rhel4.i386", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0263", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "httpd scoreboard lack of PID protection", }, { cve: "CVE-2007-5000", cwe: { id: "CWE-79", name: "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", }, discovery_date: "2007-12-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "419931", }, ], notes: [ { category: "description", text: "Cross-site scripting (XSS) vulnerability in the (1) mod_imap module in the Apache HTTP Server 1.3.0 through 1.3.39 and 2.0.35 through 2.0.61 and the (2) mod_imagemap module in the Apache HTTP Server 2.2.0 through 2.2.6 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.", title: "Vulnerability description", }, { category: "summary", text: "httpd: mod_imagemap XSS", title: "Vulnerability summary", }, ], product_status: { fixed: [ "4AS-RHNPROXY5.0:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNPROXY5.0:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNPROXY5.0:rhn-modperl-0:1.29-16.rhel4.i386", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-5000", }, { category: "external", summary: "RHBZ#419931", url: "https://bugzilla.redhat.com/show_bug.cgi?id=419931", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-5000", url: "https://www.cve.org/CVERecord?id=CVE-2007-5000", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-5000", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-5000", }, ], release_date: "2007-12-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-05-20T14:14:00+00:00", details: "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.\n\nThis update is available via Red Hat Network. Details on how to use \nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/FAQ_58_10188", product_ids: [ "4AS-RHNPROXY5.0:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNPROXY5.0:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNPROXY5.0:rhn-modperl-0:1.29-16.rhel4.i386", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0263", }, ], threats: [ { category: "impact", details: "Low", }, ], title: "httpd: mod_imagemap XSS", }, { cve: "CVE-2007-6388", cwe: { id: "CWE-79", name: "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", }, discovery_date: "2008-01-02T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "427228", }, ], notes: [ { category: "description", text: "Cross-site scripting (XSS) vulnerability in mod_status in the Apache HTTP Server 2.2.0 through 2.2.6, 2.0.35 through 2.0.61, and 1.3.2 through 1.3.39, when the server-status page is enabled, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.", title: "Vulnerability description", }, { category: "summary", text: "apache mod_status cross-site scripting", title: "Vulnerability summary", }, ], product_status: { fixed: [ "4AS-RHNPROXY5.0:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNPROXY5.0:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNPROXY5.0:rhn-modperl-0:1.29-16.rhel4.i386", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-6388", }, { category: "external", summary: "RHBZ#427228", url: "https://bugzilla.redhat.com/show_bug.cgi?id=427228", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-6388", url: "https://www.cve.org/CVERecord?id=CVE-2007-6388", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-6388", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-6388", }, ], release_date: "2007-12-29T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-05-20T14:14:00+00:00", details: "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.\n\nThis update is available via Red Hat Network. Details on how to use \nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/FAQ_58_10188", product_ids: [ "4AS-RHNPROXY5.0:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNPROXY5.0:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNPROXY5.0:rhn-modperl-0:1.29-16.rhel4.i386", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0263", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "apache mod_status cross-site scripting", }, ], }
rhsa-2007_0532
Vulnerability from csaf_redhat
Published
2007-06-26 15:13
Modified
2024-12-01 11:53
Summary
Red Hat Security Advisory: apache security update
Notes
Topic
Updated Apache httpd packages that correct two security issues are now
available for Red Hat Enterprise Linux 2.1.
This update has been rated as having moderate security impact by the Red
Hat Security Response Team.
Details
The Apache HTTP Server is a popular Web server.
The Apache HTTP Server did not verify that a process was an Apache child
process before sending it signals. A local attacker who has the ability to
run scripts on the Apache HTTP Server could manipulate the scoreboard and
cause arbitrary processes to be terminated, which could lead to a denial of
service. (CVE-2007-3304)
A flaw was found in the Apache HTTP Server mod_status module. Sites with
the server-status page publicly accessible and ExtendedStatus enabled were
vulnerable to a cross-site scripting attack. On Red Hat Enterprise Linux
the server-status page is not enabled by default and it is best practice to
not make this publicly available. (CVE-2006-5752)
Users of Apache should upgrade to these updated packages, which contain
backported patches to correct these issues. Users should restart Apache
after installing this update.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ document: { aggregate_severity: { namespace: "https://access.redhat.com/security/updates/classification/", text: "Moderate", }, category: "csaf_security_advisory", csaf_version: "2.0", distribution: { text: "Copyright © Red Hat, Inc. All rights reserved.", tlp: { label: "WHITE", url: "https://www.first.org/tlp/", }, }, lang: "en", notes: [ { category: "summary", text: "Updated Apache httpd packages that correct two security issues are now\navailable for Red Hat Enterprise Linux 2.1.\n\nThis update has been rated as having moderate security impact by the Red\nHat Security Response Team.", title: "Topic", }, { category: "general", text: "The Apache HTTP Server is a popular Web server.\n\nThe Apache HTTP Server did not verify that a process was an Apache child\nprocess before sending it signals. A local attacker who has the ability to\nrun scripts on the Apache HTTP Server could manipulate the scoreboard and\ncause arbitrary processes to be terminated, which could lead to a denial of\nservice. (CVE-2007-3304) \n\nA flaw was found in the Apache HTTP Server mod_status module. Sites with\nthe server-status page publicly accessible and ExtendedStatus enabled were\nvulnerable to a cross-site scripting attack. On Red Hat Enterprise Linux\nthe server-status page is not enabled by default and it is best practice to\nnot make this publicly available. (CVE-2006-5752)\n\nUsers of Apache should upgrade to these updated packages, which contain\nbackported patches to correct these issues. Users should restart Apache\nafter installing this update.", title: "Details", }, { category: "legal_disclaimer", text: "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", title: "Terms of Use", }, ], publisher: { category: "vendor", contact_details: "https://access.redhat.com/security/team/contact/", issuing_authority: "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", name: "Red Hat Product Security", namespace: "https://www.redhat.com", }, references: [ { category: "self", summary: "https://access.redhat.com/errata/RHSA-2007:0532", url: "https://access.redhat.com/errata/RHSA-2007:0532", }, { category: "external", summary: "https://access.redhat.com/security/updates/classification/#moderate", url: "https://access.redhat.com/security/updates/classification/#moderate", }, { category: "external", summary: "245111", url: "https://bugzilla.redhat.com/show_bug.cgi?id=245111", }, { category: "external", summary: "245112", url: "https://bugzilla.redhat.com/show_bug.cgi?id=245112", }, { category: "self", summary: "Canonical URL", url: "https://security.access.redhat.com/data/csaf/v2/advisories/2007/rhsa-2007_0532.json", }, ], title: "Red Hat Security Advisory: apache security update", tracking: { current_release_date: "2024-12-01T11:53:04+00:00", generator: { date: "2024-12-01T11:53:04+00:00", engine: { name: "Red Hat SDEngine", version: "4.2.1", }, }, id: "RHSA-2007:0532", initial_release_date: "2007-06-26T15:13:00+00:00", revision_history: [ { date: "2007-06-26T15:13:00+00:00", number: "1", summary: "Initial version", }, { date: "2007-06-26T11:13:14+00:00", number: "2", summary: "Last updated version", }, { date: "2024-12-01T11:53:04+00:00", number: "3", summary: "Last generated version", }, ], status: "final", version: "3", }, }, product_tree: { branches: [ { branches: [ { branches: [ { category: "product_name", name: "Red Hat Enterprise Linux AS (Advanced Server) version 2.1 ", product: { name: "Red Hat Enterprise Linux AS (Advanced Server) version 2.1 ", product_id: "2.1AS", product_identification_helper: { cpe: "cpe:/o:redhat:enterprise_linux:2.1::as", }, }, }, { category: "product_name", name: "Red Hat Linux Advanced Workstation 2.1", product: { name: "Red Hat Linux Advanced Workstation 2.1", product_id: "2.1AW", product_identification_helper: { cpe: "cpe:/o:redhat:enterprise_linux:2.1::aw", }, }, }, { category: "product_name", name: "Red Hat Enterprise Linux ES version 2.1", product: { name: "Red Hat Enterprise Linux ES version 2.1", product_id: "2.1ES", product_identification_helper: { cpe: "cpe:/o:redhat:enterprise_linux:2.1::es", }, }, }, { category: "product_name", name: "Red Hat Enterprise Linux WS version 2.1", product: { name: "Red Hat Enterprise Linux WS version 2.1", product_id: "2.1WS", product_identification_helper: { cpe: "cpe:/o:redhat:enterprise_linux:2.1::ws", }, }, }, ], category: "product_family", name: "Red Hat Enterprise Linux", }, { branches: [ { category: "product_version", name: "apache-manual-0:1.3.27-12.ent.ia64", product: { name: "apache-manual-0:1.3.27-12.ent.ia64", product_id: "apache-manual-0:1.3.27-12.ent.ia64", product_identification_helper: { purl: "pkg:rpm/redhat/apache-manual@1.3.27-12.ent?arch=ia64", }, }, }, { category: "product_version", name: "apache-0:1.3.27-12.ent.ia64", product: { name: "apache-0:1.3.27-12.ent.ia64", product_id: "apache-0:1.3.27-12.ent.ia64", product_identification_helper: { purl: "pkg:rpm/redhat/apache@1.3.27-12.ent?arch=ia64", }, }, }, { category: "product_version", name: "apache-devel-0:1.3.27-12.ent.ia64", product: { name: "apache-devel-0:1.3.27-12.ent.ia64", product_id: "apache-devel-0:1.3.27-12.ent.ia64", product_identification_helper: { purl: "pkg:rpm/redhat/apache-devel@1.3.27-12.ent?arch=ia64", }, }, }, ], category: "architecture", name: "ia64", }, { branches: [ { category: "product_version", name: "apache-0:1.3.27-12.ent.src", product: { name: "apache-0:1.3.27-12.ent.src", product_id: "apache-0:1.3.27-12.ent.src", product_identification_helper: { purl: "pkg:rpm/redhat/apache@1.3.27-12.ent?arch=src", }, }, }, ], category: "architecture", name: "src", }, { branches: [ { category: "product_version", name: "apache-manual-0:1.3.27-12.ent.i386", product: { name: "apache-manual-0:1.3.27-12.ent.i386", product_id: "apache-manual-0:1.3.27-12.ent.i386", product_identification_helper: { purl: "pkg:rpm/redhat/apache-manual@1.3.27-12.ent?arch=i386", }, }, }, { category: "product_version", name: "apache-0:1.3.27-12.ent.i386", product: { name: "apache-0:1.3.27-12.ent.i386", product_id: "apache-0:1.3.27-12.ent.i386", product_identification_helper: { purl: "pkg:rpm/redhat/apache@1.3.27-12.ent?arch=i386", }, }, }, { category: "product_version", name: "apache-devel-0:1.3.27-12.ent.i386", product: { name: "apache-devel-0:1.3.27-12.ent.i386", product_id: "apache-devel-0:1.3.27-12.ent.i386", product_identification_helper: { purl: "pkg:rpm/redhat/apache-devel@1.3.27-12.ent?arch=i386", }, }, }, ], category: "architecture", name: "i386", }, ], category: "vendor", name: "Red Hat", }, ], relationships: [ { category: "default_component_of", full_product_name: { name: "apache-0:1.3.27-12.ent.i386 as a component of Red Hat Enterprise Linux AS (Advanced Server) version 2.1 ", product_id: "2.1AS:apache-0:1.3.27-12.ent.i386", }, product_reference: "apache-0:1.3.27-12.ent.i386", relates_to_product_reference: "2.1AS", }, { category: "default_component_of", full_product_name: { name: "apache-0:1.3.27-12.ent.ia64 as a component of Red Hat Enterprise Linux AS (Advanced Server) version 2.1 ", product_id: "2.1AS:apache-0:1.3.27-12.ent.ia64", }, product_reference: "apache-0:1.3.27-12.ent.ia64", relates_to_product_reference: "2.1AS", }, { category: "default_component_of", full_product_name: { name: "apache-0:1.3.27-12.ent.src as a component of Red Hat Enterprise Linux AS (Advanced Server) version 2.1 ", product_id: "2.1AS:apache-0:1.3.27-12.ent.src", }, product_reference: "apache-0:1.3.27-12.ent.src", relates_to_product_reference: "2.1AS", }, { category: "default_component_of", full_product_name: { name: "apache-devel-0:1.3.27-12.ent.i386 as a component of Red Hat Enterprise Linux AS (Advanced Server) version 2.1 ", product_id: "2.1AS:apache-devel-0:1.3.27-12.ent.i386", }, product_reference: "apache-devel-0:1.3.27-12.ent.i386", relates_to_product_reference: "2.1AS", }, { category: "default_component_of", full_product_name: { name: "apache-devel-0:1.3.27-12.ent.ia64 as a component of Red Hat Enterprise Linux AS (Advanced Server) version 2.1 ", product_id: "2.1AS:apache-devel-0:1.3.27-12.ent.ia64", }, product_reference: "apache-devel-0:1.3.27-12.ent.ia64", relates_to_product_reference: "2.1AS", }, { category: "default_component_of", full_product_name: { name: "apache-manual-0:1.3.27-12.ent.i386 as a component of Red Hat Enterprise Linux AS (Advanced Server) version 2.1 ", product_id: "2.1AS:apache-manual-0:1.3.27-12.ent.i386", }, product_reference: "apache-manual-0:1.3.27-12.ent.i386", relates_to_product_reference: "2.1AS", }, { category: "default_component_of", full_product_name: { name: "apache-manual-0:1.3.27-12.ent.ia64 as a component of Red Hat Enterprise Linux AS (Advanced Server) version 2.1 ", product_id: "2.1AS:apache-manual-0:1.3.27-12.ent.ia64", }, product_reference: "apache-manual-0:1.3.27-12.ent.ia64", relates_to_product_reference: "2.1AS", }, { category: "default_component_of", full_product_name: { name: "apache-0:1.3.27-12.ent.i386 as a component of Red Hat Linux Advanced Workstation 2.1", product_id: "2.1AW:apache-0:1.3.27-12.ent.i386", }, product_reference: "apache-0:1.3.27-12.ent.i386", relates_to_product_reference: "2.1AW", }, { category: "default_component_of", full_product_name: { name: "apache-0:1.3.27-12.ent.ia64 as a component of Red Hat Linux Advanced Workstation 2.1", product_id: "2.1AW:apache-0:1.3.27-12.ent.ia64", }, product_reference: "apache-0:1.3.27-12.ent.ia64", relates_to_product_reference: "2.1AW", }, { category: "default_component_of", full_product_name: { name: "apache-0:1.3.27-12.ent.src as a component of Red Hat Linux Advanced Workstation 2.1", product_id: "2.1AW:apache-0:1.3.27-12.ent.src", }, product_reference: "apache-0:1.3.27-12.ent.src", relates_to_product_reference: "2.1AW", }, { category: "default_component_of", full_product_name: { name: "apache-devel-0:1.3.27-12.ent.i386 as a component of Red Hat Linux Advanced Workstation 2.1", product_id: "2.1AW:apache-devel-0:1.3.27-12.ent.i386", }, product_reference: "apache-devel-0:1.3.27-12.ent.i386", relates_to_product_reference: "2.1AW", }, { category: "default_component_of", full_product_name: { name: "apache-devel-0:1.3.27-12.ent.ia64 as a component of Red Hat Linux Advanced Workstation 2.1", product_id: "2.1AW:apache-devel-0:1.3.27-12.ent.ia64", }, product_reference: "apache-devel-0:1.3.27-12.ent.ia64", relates_to_product_reference: "2.1AW", }, { category: "default_component_of", full_product_name: { name: "apache-manual-0:1.3.27-12.ent.i386 as a component of Red Hat Linux Advanced Workstation 2.1", product_id: "2.1AW:apache-manual-0:1.3.27-12.ent.i386", }, product_reference: "apache-manual-0:1.3.27-12.ent.i386", relates_to_product_reference: "2.1AW", }, { category: "default_component_of", full_product_name: { name: "apache-manual-0:1.3.27-12.ent.ia64 as a component of Red Hat Linux Advanced Workstation 2.1", product_id: "2.1AW:apache-manual-0:1.3.27-12.ent.ia64", }, product_reference: "apache-manual-0:1.3.27-12.ent.ia64", relates_to_product_reference: "2.1AW", }, { category: "default_component_of", full_product_name: { name: "apache-0:1.3.27-12.ent.i386 as a component of Red Hat Enterprise Linux ES version 2.1", product_id: "2.1ES:apache-0:1.3.27-12.ent.i386", }, product_reference: "apache-0:1.3.27-12.ent.i386", relates_to_product_reference: "2.1ES", }, { category: "default_component_of", full_product_name: { name: "apache-0:1.3.27-12.ent.ia64 as a component of Red Hat Enterprise Linux ES version 2.1", product_id: "2.1ES:apache-0:1.3.27-12.ent.ia64", }, product_reference: "apache-0:1.3.27-12.ent.ia64", relates_to_product_reference: "2.1ES", }, { category: "default_component_of", full_product_name: { name: "apache-0:1.3.27-12.ent.src as a component of Red Hat Enterprise Linux ES version 2.1", product_id: "2.1ES:apache-0:1.3.27-12.ent.src", }, product_reference: "apache-0:1.3.27-12.ent.src", relates_to_product_reference: "2.1ES", }, { category: "default_component_of", full_product_name: { name: "apache-devel-0:1.3.27-12.ent.i386 as a component of Red Hat Enterprise Linux ES version 2.1", product_id: "2.1ES:apache-devel-0:1.3.27-12.ent.i386", }, product_reference: "apache-devel-0:1.3.27-12.ent.i386", relates_to_product_reference: "2.1ES", }, { category: "default_component_of", full_product_name: { name: "apache-devel-0:1.3.27-12.ent.ia64 as a component of Red Hat Enterprise Linux ES version 2.1", product_id: "2.1ES:apache-devel-0:1.3.27-12.ent.ia64", }, product_reference: "apache-devel-0:1.3.27-12.ent.ia64", relates_to_product_reference: "2.1ES", }, { category: "default_component_of", full_product_name: { name: "apache-manual-0:1.3.27-12.ent.i386 as a component of Red Hat Enterprise Linux ES version 2.1", product_id: "2.1ES:apache-manual-0:1.3.27-12.ent.i386", }, product_reference: "apache-manual-0:1.3.27-12.ent.i386", relates_to_product_reference: "2.1ES", }, { category: "default_component_of", full_product_name: { name: "apache-manual-0:1.3.27-12.ent.ia64 as a component of Red Hat Enterprise Linux ES version 2.1", product_id: "2.1ES:apache-manual-0:1.3.27-12.ent.ia64", }, product_reference: "apache-manual-0:1.3.27-12.ent.ia64", relates_to_product_reference: "2.1ES", }, { category: "default_component_of", full_product_name: { name: "apache-0:1.3.27-12.ent.i386 as a component of Red Hat Enterprise Linux WS version 2.1", product_id: "2.1WS:apache-0:1.3.27-12.ent.i386", }, product_reference: "apache-0:1.3.27-12.ent.i386", relates_to_product_reference: "2.1WS", }, { category: "default_component_of", full_product_name: { name: "apache-0:1.3.27-12.ent.ia64 as a component of Red Hat Enterprise Linux WS version 2.1", product_id: "2.1WS:apache-0:1.3.27-12.ent.ia64", }, product_reference: "apache-0:1.3.27-12.ent.ia64", relates_to_product_reference: "2.1WS", }, { category: "default_component_of", full_product_name: { name: "apache-0:1.3.27-12.ent.src as a component of Red Hat Enterprise Linux WS version 2.1", product_id: "2.1WS:apache-0:1.3.27-12.ent.src", }, product_reference: "apache-0:1.3.27-12.ent.src", relates_to_product_reference: "2.1WS", }, { category: "default_component_of", full_product_name: { name: "apache-devel-0:1.3.27-12.ent.i386 as a component of Red Hat Enterprise Linux WS version 2.1", product_id: "2.1WS:apache-devel-0:1.3.27-12.ent.i386", }, product_reference: "apache-devel-0:1.3.27-12.ent.i386", relates_to_product_reference: "2.1WS", }, { category: "default_component_of", full_product_name: { name: "apache-devel-0:1.3.27-12.ent.ia64 as a component of Red Hat Enterprise Linux WS version 2.1", product_id: "2.1WS:apache-devel-0:1.3.27-12.ent.ia64", }, product_reference: "apache-devel-0:1.3.27-12.ent.ia64", relates_to_product_reference: "2.1WS", }, { category: "default_component_of", full_product_name: { name: "apache-manual-0:1.3.27-12.ent.i386 as a component of Red Hat Enterprise Linux WS version 2.1", product_id: "2.1WS:apache-manual-0:1.3.27-12.ent.i386", }, product_reference: "apache-manual-0:1.3.27-12.ent.i386", relates_to_product_reference: "2.1WS", }, { category: "default_component_of", full_product_name: { name: "apache-manual-0:1.3.27-12.ent.ia64 as a component of Red Hat Enterprise Linux WS version 2.1", product_id: "2.1WS:apache-manual-0:1.3.27-12.ent.ia64", }, product_reference: "apache-manual-0:1.3.27-12.ent.ia64", relates_to_product_reference: "2.1WS", }, ], }, vulnerabilities: [ { cve: "CVE-2006-5752", cwe: { id: "CWE-79", name: "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", }, discovery_date: "2007-06-20T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "245112", }, ], notes: [ { category: "description", text: "Cross-site scripting (XSS) vulnerability in mod_status.c in the mod_status module in Apache HTTP Server (httpd), when ExtendedStatus is enabled and a public server-status page is used, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors involving charsets with browsers that perform \"charset detection\" when the content-type is not specified.", title: "Vulnerability description", }, { category: "summary", text: "httpd mod_status XSS", title: "Vulnerability summary", }, ], product_status: { fixed: [ "2.1AS:apache-0:1.3.27-12.ent.i386", "2.1AS:apache-0:1.3.27-12.ent.ia64", "2.1AS:apache-0:1.3.27-12.ent.src", "2.1AS:apache-devel-0:1.3.27-12.ent.i386", "2.1AS:apache-devel-0:1.3.27-12.ent.ia64", "2.1AS:apache-manual-0:1.3.27-12.ent.i386", "2.1AS:apache-manual-0:1.3.27-12.ent.ia64", "2.1AW:apache-0:1.3.27-12.ent.i386", "2.1AW:apache-0:1.3.27-12.ent.ia64", "2.1AW:apache-0:1.3.27-12.ent.src", "2.1AW:apache-devel-0:1.3.27-12.ent.i386", "2.1AW:apache-devel-0:1.3.27-12.ent.ia64", "2.1AW:apache-manual-0:1.3.27-12.ent.i386", "2.1AW:apache-manual-0:1.3.27-12.ent.ia64", "2.1ES:apache-0:1.3.27-12.ent.i386", "2.1ES:apache-0:1.3.27-12.ent.ia64", "2.1ES:apache-0:1.3.27-12.ent.src", "2.1ES:apache-devel-0:1.3.27-12.ent.i386", "2.1ES:apache-devel-0:1.3.27-12.ent.ia64", "2.1ES:apache-manual-0:1.3.27-12.ent.i386", "2.1ES:apache-manual-0:1.3.27-12.ent.ia64", "2.1WS:apache-0:1.3.27-12.ent.i386", "2.1WS:apache-0:1.3.27-12.ent.ia64", "2.1WS:apache-0:1.3.27-12.ent.src", "2.1WS:apache-devel-0:1.3.27-12.ent.i386", "2.1WS:apache-devel-0:1.3.27-12.ent.ia64", "2.1WS:apache-manual-0:1.3.27-12.ent.i386", "2.1WS:apache-manual-0:1.3.27-12.ent.ia64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2006-5752", }, { category: "external", summary: "RHBZ#245112", url: "https://bugzilla.redhat.com/show_bug.cgi?id=245112", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2006-5752", url: "https://www.cve.org/CVERecord?id=CVE-2006-5752", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2006-5752", url: "https://nvd.nist.gov/vuln/detail/CVE-2006-5752", }, ], release_date: "2007-06-20T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2007-06-26T15:13:00+00:00", details: "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied. \n\nThis update is available via Red Hat Network. Details on how to use \nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/FAQ_58_10188", product_ids: [ "2.1AS:apache-0:1.3.27-12.ent.i386", "2.1AS:apache-0:1.3.27-12.ent.ia64", "2.1AS:apache-0:1.3.27-12.ent.src", "2.1AS:apache-devel-0:1.3.27-12.ent.i386", "2.1AS:apache-devel-0:1.3.27-12.ent.ia64", "2.1AS:apache-manual-0:1.3.27-12.ent.i386", "2.1AS:apache-manual-0:1.3.27-12.ent.ia64", "2.1AW:apache-0:1.3.27-12.ent.i386", "2.1AW:apache-0:1.3.27-12.ent.ia64", "2.1AW:apache-0:1.3.27-12.ent.src", "2.1AW:apache-devel-0:1.3.27-12.ent.i386", "2.1AW:apache-devel-0:1.3.27-12.ent.ia64", "2.1AW:apache-manual-0:1.3.27-12.ent.i386", "2.1AW:apache-manual-0:1.3.27-12.ent.ia64", "2.1ES:apache-0:1.3.27-12.ent.i386", "2.1ES:apache-0:1.3.27-12.ent.ia64", "2.1ES:apache-0:1.3.27-12.ent.src", "2.1ES:apache-devel-0:1.3.27-12.ent.i386", "2.1ES:apache-devel-0:1.3.27-12.ent.ia64", "2.1ES:apache-manual-0:1.3.27-12.ent.i386", "2.1ES:apache-manual-0:1.3.27-12.ent.ia64", "2.1WS:apache-0:1.3.27-12.ent.i386", "2.1WS:apache-0:1.3.27-12.ent.ia64", "2.1WS:apache-0:1.3.27-12.ent.src", "2.1WS:apache-devel-0:1.3.27-12.ent.i386", "2.1WS:apache-devel-0:1.3.27-12.ent.ia64", "2.1WS:apache-manual-0:1.3.27-12.ent.i386", "2.1WS:apache-manual-0:1.3.27-12.ent.ia64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2007:0532", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "httpd mod_status XSS", }, { cve: "CVE-2007-3304", discovery_date: "2007-06-19T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "245111", }, ], notes: [ { category: "description", text: "Apache httpd 1.3.37, 2.0.59, and 2.2.4 with the Prefork MPM module, allows local users to cause a denial of service by modifying the worker_score and process_score arrays to reference an arbitrary process ID, which is sent a SIGUSR1 signal from the master process, aka \"SIGUSR1 killer.\"", title: "Vulnerability description", }, { category: "summary", text: "httpd scoreboard lack of PID protection", title: "Vulnerability summary", }, ], product_status: { fixed: [ "2.1AS:apache-0:1.3.27-12.ent.i386", "2.1AS:apache-0:1.3.27-12.ent.ia64", "2.1AS:apache-0:1.3.27-12.ent.src", "2.1AS:apache-devel-0:1.3.27-12.ent.i386", "2.1AS:apache-devel-0:1.3.27-12.ent.ia64", "2.1AS:apache-manual-0:1.3.27-12.ent.i386", "2.1AS:apache-manual-0:1.3.27-12.ent.ia64", "2.1AW:apache-0:1.3.27-12.ent.i386", "2.1AW:apache-0:1.3.27-12.ent.ia64", "2.1AW:apache-0:1.3.27-12.ent.src", "2.1AW:apache-devel-0:1.3.27-12.ent.i386", "2.1AW:apache-devel-0:1.3.27-12.ent.ia64", "2.1AW:apache-manual-0:1.3.27-12.ent.i386", "2.1AW:apache-manual-0:1.3.27-12.ent.ia64", "2.1ES:apache-0:1.3.27-12.ent.i386", "2.1ES:apache-0:1.3.27-12.ent.ia64", "2.1ES:apache-0:1.3.27-12.ent.src", "2.1ES:apache-devel-0:1.3.27-12.ent.i386", "2.1ES:apache-devel-0:1.3.27-12.ent.ia64", "2.1ES:apache-manual-0:1.3.27-12.ent.i386", "2.1ES:apache-manual-0:1.3.27-12.ent.ia64", "2.1WS:apache-0:1.3.27-12.ent.i386", "2.1WS:apache-0:1.3.27-12.ent.ia64", "2.1WS:apache-0:1.3.27-12.ent.src", "2.1WS:apache-devel-0:1.3.27-12.ent.i386", "2.1WS:apache-devel-0:1.3.27-12.ent.ia64", "2.1WS:apache-manual-0:1.3.27-12.ent.i386", "2.1WS:apache-manual-0:1.3.27-12.ent.ia64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-3304", }, { category: "external", summary: "RHBZ#245111", url: "https://bugzilla.redhat.com/show_bug.cgi?id=245111", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-3304", url: "https://www.cve.org/CVERecord?id=CVE-2007-3304", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-3304", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-3304", }, ], release_date: "2007-06-19T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2007-06-26T15:13:00+00:00", details: "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied. \n\nThis update is available via Red Hat Network. Details on how to use \nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/FAQ_58_10188", product_ids: [ "2.1AS:apache-0:1.3.27-12.ent.i386", "2.1AS:apache-0:1.3.27-12.ent.ia64", "2.1AS:apache-0:1.3.27-12.ent.src", "2.1AS:apache-devel-0:1.3.27-12.ent.i386", "2.1AS:apache-devel-0:1.3.27-12.ent.ia64", "2.1AS:apache-manual-0:1.3.27-12.ent.i386", "2.1AS:apache-manual-0:1.3.27-12.ent.ia64", "2.1AW:apache-0:1.3.27-12.ent.i386", "2.1AW:apache-0:1.3.27-12.ent.ia64", "2.1AW:apache-0:1.3.27-12.ent.src", "2.1AW:apache-devel-0:1.3.27-12.ent.i386", "2.1AW:apache-devel-0:1.3.27-12.ent.ia64", "2.1AW:apache-manual-0:1.3.27-12.ent.i386", "2.1AW:apache-manual-0:1.3.27-12.ent.ia64", "2.1ES:apache-0:1.3.27-12.ent.i386", "2.1ES:apache-0:1.3.27-12.ent.ia64", "2.1ES:apache-0:1.3.27-12.ent.src", "2.1ES:apache-devel-0:1.3.27-12.ent.i386", "2.1ES:apache-devel-0:1.3.27-12.ent.ia64", "2.1ES:apache-manual-0:1.3.27-12.ent.i386", "2.1ES:apache-manual-0:1.3.27-12.ent.ia64", "2.1WS:apache-0:1.3.27-12.ent.i386", "2.1WS:apache-0:1.3.27-12.ent.ia64", "2.1WS:apache-0:1.3.27-12.ent.src", "2.1WS:apache-devel-0:1.3.27-12.ent.i386", "2.1WS:apache-devel-0:1.3.27-12.ent.ia64", "2.1WS:apache-manual-0:1.3.27-12.ent.i386", "2.1WS:apache-manual-0:1.3.27-12.ent.ia64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2007:0532", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "httpd scoreboard lack of PID protection", }, ], }
rhsa-2008:0261
Vulnerability from csaf_redhat
Published
2008-05-20 14:12
Modified
2025-01-26 19:35
Summary
Red Hat Security Advisory: Red Hat Network Satellite Server security update
Notes
Topic
Red Hat Network Satellite Server version 5.0.2 is now available. This
update includes fixes for a number of security issues in Red Hat Network
Satellite Server components.
This update has been rated as having moderate security impact by the Red
Hat Security Response Team.
Details
During an internal security review, a cross-site scripting flaw was found
that affected the Red Hat Network channel search feature. (CVE-2007-5961)
This release also corrects several security vulnerabilities in various
components shipped as part of the Red Hat Network Satellite Server. In a
typical operating environment, these components are not exposed to users of
Satellite Server in a vulnerable manner. These security updates will reduce
risk in unique Satellite Server environments.
Multiple flaws were fixed in the Apache HTTPD server. These flaws could
result in a cross-site scripting, denial-of-service, or information
disclosure attacks. (CVE-2004-0885, CVE-2006-5752, CVE-2006-7197,
CVE-2007-1860, CVE-2007-3304, CVE-2007-4465, CVE-2007-5000, CVE-2007-6388)
A denial-of-service flaw was fixed in mod_perl. (CVE-2007-1349)
A denial-of-service flaw was fixed in the jabberd server. (CVE-2006-1329)
Multiple cross-site scripting flaws were fixed in the image map feature in
the JFreeChart package. (CVE-2007-6306)
Multiple flaws were fixed in the IBM Java 1.4.2 Runtime. (CVE-2007-0243,
CVE-2007-2435, CVE-2007-2788, CVE-2007-2789)
Two arbitrary code execution flaws were fixed in the OpenMotif package.
(CVE-2005-3964, CVE-2005-0605)
A flaw which could result in weak encryption was fixed in the
perl-Crypt-CBC package. (CVE-2006-0898)
Multiple flaws were fixed in the Tomcat package. (CVE-2008-0128,
CVE-2007-5461, CVE-2007-3385, CVE-2007-3382, CVE-2007-1358, CVE-2007-1355,
CVE-2007-2450, CVE-2007-2449, CVE-2007-0450, CVE-2006-7196, CVE-2006-7195,
CVE-2006-3835, CVE-2006-0254, CVE-2005-2090, CVE-2005-4838, CVE-2005-3510)
Users of Red Hat Network Satellite Server 5.0 are advised to upgrade to
5.0.2, which resolves these issues.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ document: { aggregate_severity: { namespace: "https://access.redhat.com/security/updates/classification/", text: "Moderate", }, category: "csaf_security_advisory", csaf_version: "2.0", distribution: { text: "Copyright © Red Hat, Inc. All rights reserved.", tlp: { label: "WHITE", url: "https://www.first.org/tlp/", }, }, lang: "en", notes: [ { category: "summary", text: "Red Hat Network Satellite Server version 5.0.2 is now available. This\nupdate includes fixes for a number of security issues in Red Hat Network\nSatellite Server components.\n\nThis update has been rated as having moderate security impact by the Red\nHat Security Response Team.", title: "Topic", }, { category: "general", text: "During an internal security review, a cross-site scripting flaw was found\nthat affected the Red Hat Network channel search feature. (CVE-2007-5961)\n\nThis release also corrects several security vulnerabilities in various\ncomponents shipped as part of the Red Hat Network Satellite Server. In a\ntypical operating environment, these components are not exposed to users of\nSatellite Server in a vulnerable manner. These security updates will reduce\nrisk in unique Satellite Server environments.\n\nMultiple flaws were fixed in the Apache HTTPD server. These flaws could\nresult in a cross-site scripting, denial-of-service, or information\ndisclosure attacks. (CVE-2004-0885, CVE-2006-5752, CVE-2006-7197,\nCVE-2007-1860, CVE-2007-3304, CVE-2007-4465, CVE-2007-5000, CVE-2007-6388)\n\nA denial-of-service flaw was fixed in mod_perl. (CVE-2007-1349)\n\nA denial-of-service flaw was fixed in the jabberd server. (CVE-2006-1329)\n\nMultiple cross-site scripting flaws were fixed in the image map feature in\nthe JFreeChart package. (CVE-2007-6306)\n\nMultiple flaws were fixed in the IBM Java 1.4.2 Runtime. (CVE-2007-0243,\nCVE-2007-2435, CVE-2007-2788, CVE-2007-2789)\n\nTwo arbitrary code execution flaws were fixed in the OpenMotif package.\n(CVE-2005-3964, CVE-2005-0605)\n\nA flaw which could result in weak encryption was fixed in the\nperl-Crypt-CBC package. (CVE-2006-0898)\n\nMultiple flaws were fixed in the Tomcat package. (CVE-2008-0128,\nCVE-2007-5461, CVE-2007-3385, CVE-2007-3382, CVE-2007-1358, CVE-2007-1355,\nCVE-2007-2450, CVE-2007-2449, CVE-2007-0450, CVE-2006-7196, CVE-2006-7195,\nCVE-2006-3835, CVE-2006-0254, CVE-2005-2090, CVE-2005-4838, CVE-2005-3510)\n\nUsers of Red Hat Network Satellite Server 5.0 are advised to upgrade to\n5.0.2, which resolves these issues.", title: "Details", }, { category: "legal_disclaimer", text: "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", title: "Terms of Use", }, ], publisher: { category: "vendor", contact_details: "https://access.redhat.com/security/team/contact/", issuing_authority: "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", name: "Red Hat Product Security", namespace: "https://www.redhat.com", }, references: [ { category: "self", summary: "https://access.redhat.com/errata/RHSA-2008:0261", url: "https://access.redhat.com/errata/RHSA-2008:0261", }, { category: "external", summary: "https://access.redhat.com/security/updates/classification/#moderate", url: "https://access.redhat.com/security/updates/classification/#moderate", }, { category: "external", summary: "396641", url: "https://bugzilla.redhat.com/show_bug.cgi?id=396641", }, { category: "external", summary: "444136", url: "https://bugzilla.redhat.com/show_bug.cgi?id=444136", }, { category: "self", summary: "Canonical URL", url: "https://security.access.redhat.com/data/csaf/v2/advisories/2008/rhsa-2008_0261.json", }, ], title: "Red Hat Security Advisory: Red Hat Network Satellite Server security update", tracking: { current_release_date: "2025-01-26T19:35:50+00:00", generator: { date: "2025-01-26T19:35:50+00:00", engine: { name: "Red Hat SDEngine", version: "4.2.6", }, }, id: "RHSA-2008:0261", initial_release_date: "2008-05-20T14:12:00+00:00", revision_history: [ { date: "2008-05-20T14:12:00+00:00", number: "1", summary: "Initial version", }, { date: "2008-05-20T10:12:30+00:00", number: "2", summary: "Last updated version", }, { date: "2025-01-26T19:35:50+00:00", number: "3", summary: "Last generated version", }, ], status: "final", version: "3", }, }, product_tree: { branches: [ { branches: [ { branches: [ { category: "product_name", name: "Red Hat Satellite 5.0 (RHEL v.4 AS)", product: { name: "Red Hat Satellite 5.0 (RHEL v.4 AS)", product_id: "4AS-RHNSAT5", product_identification_helper: { cpe: "cpe:/a:redhat:network_satellite:5.0:el4", }, }, }, ], category: "product_family", name: "Red Hat Satellite", }, { branches: [ { category: "product_version", name: "rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", product: { name: "rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", product_id: "rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", product_identification_helper: { purl: "pkg:rpm/redhat/rhn-modssl@2.8.12-8.rhn.10.rhel4?arch=i386", }, }, }, { category: "product_version", name: "jabberd-0:2.0s10-3.38.rhn.i386", product: { name: "jabberd-0:2.0s10-3.38.rhn.i386", product_id: "jabberd-0:2.0s10-3.38.rhn.i386", product_identification_helper: { purl: "pkg:rpm/redhat/jabberd@2.0s10-3.38.rhn?arch=i386", }, }, }, { category: "product_version", name: "openmotif21-0:2.1.30-11.RHEL4.6.i386", product: { name: "openmotif21-0:2.1.30-11.RHEL4.6.i386", product_id: "openmotif21-0:2.1.30-11.RHEL4.6.i386", product_identification_helper: { purl: "pkg:rpm/redhat/openmotif21@2.1.30-11.RHEL4.6?arch=i386", }, }, }, { category: "product_version", name: "openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", product: { name: "openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", product_id: "openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", product_identification_helper: { purl: "pkg:rpm/redhat/openmotif21-debuginfo@2.1.30-11.RHEL4.6?arch=i386", }, }, }, { category: "product_version", name: "rhn-apache-0:1.3.27-36.rhn.rhel4.i386", product: { name: "rhn-apache-0:1.3.27-36.rhn.rhel4.i386", product_id: "rhn-apache-0:1.3.27-36.rhn.rhel4.i386", product_identification_helper: { purl: "pkg:rpm/redhat/rhn-apache@1.3.27-36.rhn.rhel4?arch=i386", }, }, }, { category: "product_version", name: "java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", product: { name: "java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", product_id: "java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", product_identification_helper: { purl: "pkg:rpm/redhat/java-1.4.2-ibm@1.4.2.10-1jpp.2.el4?arch=i386", }, }, }, { category: "product_version", name: "java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", product: { name: "java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", product_id: "java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", product_identification_helper: { purl: "pkg:rpm/redhat/java-1.4.2-ibm-devel@1.4.2.10-1jpp.2.el4?arch=i386", }, }, }, { category: "product_version", name: "rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", product: { name: "rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", product_id: "rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", product_identification_helper: { purl: "pkg:rpm/redhat/rhn-modjk-ap13@1.2.23-2rhn.rhel4?arch=i386", }, }, }, { category: "product_version", name: "rhn-modperl-0:1.29-16.rhel4.i386", product: { name: "rhn-modperl-0:1.29-16.rhel4.i386", product_id: "rhn-modperl-0:1.29-16.rhel4.i386", product_identification_helper: { purl: "pkg:rpm/redhat/rhn-modperl@1.29-16.rhel4?arch=i386", }, }, }, ], category: "architecture", name: "i386", }, { branches: [ { category: "product_version", name: "jfreechart-0:0.9.20-3.rhn.noarch", product: { name: "jfreechart-0:0.9.20-3.rhn.noarch", product_id: "jfreechart-0:0.9.20-3.rhn.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/jfreechart@0.9.20-3.rhn?arch=noarch", }, }, }, { category: "product_version", name: "tomcat5-0:5.0.30-0jpp_10rh.noarch", product: { name: "tomcat5-0:5.0.30-0jpp_10rh.noarch", product_id: "tomcat5-0:5.0.30-0jpp_10rh.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/tomcat5@5.0.30-0jpp_10rh?arch=noarch", }, }, }, { category: "product_version", name: "perl-Crypt-CBC-0:2.24-1.el4.noarch", product: { name: "perl-Crypt-CBC-0:2.24-1.el4.noarch", product_id: "perl-Crypt-CBC-0:2.24-1.el4.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/perl-Crypt-CBC@2.24-1.el4?arch=noarch", }, }, }, ], category: "architecture", name: "noarch", }, ], category: "vendor", name: "Red Hat", }, ], relationships: [ { category: "default_component_of", full_product_name: { name: "jabberd-0:2.0s10-3.38.rhn.i386 as a component of Red Hat Satellite 5.0 (RHEL v.4 AS)", product_id: "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", }, product_reference: "jabberd-0:2.0s10-3.38.rhn.i386", relates_to_product_reference: "4AS-RHNSAT5", }, { category: "default_component_of", full_product_name: { name: "java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386 as a component of Red Hat Satellite 5.0 (RHEL v.4 AS)", product_id: "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", }, product_reference: "java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", relates_to_product_reference: "4AS-RHNSAT5", }, { category: "default_component_of", full_product_name: { name: "java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386 as a component of Red Hat Satellite 5.0 (RHEL v.4 AS)", product_id: "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", }, product_reference: "java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", relates_to_product_reference: "4AS-RHNSAT5", }, { category: "default_component_of", full_product_name: { name: "jfreechart-0:0.9.20-3.rhn.noarch as a component of Red Hat Satellite 5.0 (RHEL v.4 AS)", product_id: "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", }, product_reference: "jfreechart-0:0.9.20-3.rhn.noarch", relates_to_product_reference: "4AS-RHNSAT5", }, { category: "default_component_of", full_product_name: { name: "openmotif21-0:2.1.30-11.RHEL4.6.i386 as a component of Red Hat Satellite 5.0 (RHEL v.4 AS)", product_id: "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", }, product_reference: "openmotif21-0:2.1.30-11.RHEL4.6.i386", relates_to_product_reference: "4AS-RHNSAT5", }, { category: "default_component_of", full_product_name: { name: "openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386 as a component of Red Hat Satellite 5.0 (RHEL v.4 AS)", product_id: "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", }, product_reference: "openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", relates_to_product_reference: "4AS-RHNSAT5", }, { category: "default_component_of", full_product_name: { name: "perl-Crypt-CBC-0:2.24-1.el4.noarch as a component of Red Hat Satellite 5.0 (RHEL v.4 AS)", product_id: "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", }, product_reference: "perl-Crypt-CBC-0:2.24-1.el4.noarch", relates_to_product_reference: "4AS-RHNSAT5", }, { category: "default_component_of", full_product_name: { name: "rhn-apache-0:1.3.27-36.rhn.rhel4.i386 as a component of Red Hat Satellite 5.0 (RHEL v.4 AS)", product_id: "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", }, product_reference: "rhn-apache-0:1.3.27-36.rhn.rhel4.i386", relates_to_product_reference: "4AS-RHNSAT5", }, { category: "default_component_of", full_product_name: { name: "rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386 as a component of Red Hat Satellite 5.0 (RHEL v.4 AS)", product_id: "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", }, product_reference: "rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", relates_to_product_reference: "4AS-RHNSAT5", }, { category: "default_component_of", full_product_name: { name: "rhn-modperl-0:1.29-16.rhel4.i386 as a component of Red Hat Satellite 5.0 (RHEL v.4 AS)", product_id: "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", }, product_reference: "rhn-modperl-0:1.29-16.rhel4.i386", relates_to_product_reference: "4AS-RHNSAT5", }, { category: "default_component_of", full_product_name: { name: "rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386 as a component of Red Hat Satellite 5.0 (RHEL v.4 AS)", product_id: "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", }, product_reference: "rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", relates_to_product_reference: "4AS-RHNSAT5", }, { category: "default_component_of", full_product_name: { name: "tomcat5-0:5.0.30-0jpp_10rh.noarch as a component of Red Hat Satellite 5.0 (RHEL v.4 AS)", product_id: "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", }, product_reference: "tomcat5-0:5.0.30-0jpp_10rh.noarch", relates_to_product_reference: "4AS-RHNSAT5", }, ], }, vulnerabilities: [ { cve: "CVE-2004-0885", ids: [ { system_name: "Red Hat Bugzilla ID", text: "430637", }, ], notes: [ { category: "description", text: "The mod_ssl module in Apache 2.0.35 through 2.0.52, when using the \"SSLCipherSuite\" directive in directory or location context, allows remote clients to bypass intended restrictions by using any cipher suite that is allowed by the virtual host configuration.", title: "Vulnerability description", }, { category: "summary", text: "mod_ssl SSLCipherSuite bypass", title: "Vulnerability summary", }, ], product_status: { fixed: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2004-0885", }, { category: "external", summary: "RHBZ#430637", url: "https://bugzilla.redhat.com/show_bug.cgi?id=430637", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2004-0885", url: "https://www.cve.org/CVERecord?id=CVE-2004-0885", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2004-0885", url: "https://nvd.nist.gov/vuln/detail/CVE-2004-0885", }, ], release_date: "2004-10-05T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-05-20T14:12:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0261", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "mod_ssl SSLCipherSuite bypass", }, { cve: "CVE-2005-0605", discovery_date: "2005-02-28T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "430520", }, ], notes: [ { category: "description", text: "scan.c for LibXPM may allow attackers to execute arbitrary code via a negative bitmap_unit value that leads to a buffer overflow.", title: "Vulnerability description", }, { category: "summary", text: "libxpm buffer overflow", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Enterprise Linux 5 is not vulnerable to this issue as it contains a backported patch.", title: "Statement", }, ], product_status: { fixed: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2005-0605", }, { category: "external", summary: "RHBZ#430520", url: "https://bugzilla.redhat.com/show_bug.cgi?id=430520", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2005-0605", url: "https://www.cve.org/CVERecord?id=CVE-2005-0605", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2005-0605", url: "https://nvd.nist.gov/vuln/detail/CVE-2005-0605", }, ], release_date: "2005-03-01T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-05-20T14:12:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0261", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "libxpm buffer overflow", }, { cve: "CVE-2005-2090", discovery_date: "2005-06-06T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "237079", }, ], notes: [ { category: "description", text: "Jakarta Tomcat 5.0.19 (Coyote/1.1) and Tomcat 4.1.24 (Coyote/1.0) allows remote attackers to poison the web cache, bypass web application firewall protection, and conduct XSS attacks via an HTTP request with both a \"Transfer-Encoding: chunked\" header and a Content-Length header, which causes Tomcat to incorrectly handle and forward the body of the request in a way that causes the receiving server to process it as a separate HTTP request, aka \"HTTP Request Smuggling.\"", title: "Vulnerability description", }, { category: "summary", text: "tomcat multiple content-length header poisioning", title: "Vulnerability summary", }, ], product_status: { fixed: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2005-2090", }, { category: "external", summary: "RHBZ#237079", url: "https://bugzilla.redhat.com/show_bug.cgi?id=237079", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2005-2090", url: "https://www.cve.org/CVERecord?id=CVE-2005-2090", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2005-2090", url: "https://nvd.nist.gov/vuln/detail/CVE-2005-2090", }, ], release_date: "2005-06-06T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-05-20T14:12:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0261", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "tomcat multiple content-length header poisioning", }, { cve: "CVE-2005-3510", discovery_date: "2005-11-07T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "237085", }, ], notes: [ { category: "description", text: "Apache Tomcat 5.5.0 to 5.5.11 allows remote attackers to cause a denial of service (CPU consumption) via a large number of simultaneous requests to list a web directory that has a large number of files.", title: "Vulnerability description", }, { category: "summary", text: "tomcat DoS", title: "Vulnerability summary", }, ], product_status: { fixed: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2005-3510", }, { category: "external", summary: "RHBZ#237085", url: "https://bugzilla.redhat.com/show_bug.cgi?id=237085", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2005-3510", url: "https://www.cve.org/CVERecord?id=CVE-2005-3510", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2005-3510", url: "https://nvd.nist.gov/vuln/detail/CVE-2005-3510", }, ], release_date: "2005-11-03T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-05-20T14:12:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0261", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "tomcat DoS", }, { cve: "CVE-2005-3964", discovery_date: "2005-12-02T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "430519", }, ], notes: [ { category: "description", text: "Multiple buffer overflows in libUil (libUil.so) in OpenMotif 2.2.3, and possibly other versions, allows attackers to execute arbitrary code via the (1) diag_issue_diagnostic function in UilDiags.c and (2) open_source_file function in UilSrcSrc.c.", title: "Vulnerability description", }, { category: "summary", text: "openmotif libUil buffer overflows", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Enterprise Linux 5 is not vulnerable to this issue as it contains a backported patch.", title: "Statement", }, ], product_status: { fixed: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2005-3964", }, { category: "external", summary: "RHBZ#430519", url: "https://bugzilla.redhat.com/show_bug.cgi?id=430519", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2005-3964", url: "https://www.cve.org/CVERecord?id=CVE-2005-3964", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2005-3964", url: "https://nvd.nist.gov/vuln/detail/CVE-2005-3964", }, ], release_date: "2005-12-02T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-05-20T14:12:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0261", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "openmotif libUil buffer overflows", }, { cve: "CVE-2005-4838", discovery_date: "2005-01-03T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "238401", }, ], notes: [ { category: "description", text: "Multiple cross-site scripting (XSS) vulnerabilities in the example web applications for Jakarta Tomcat 5.5.6 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) el/functions.jsp, (2) el/implicit-objects.jsp, and (3) jspx/textRotate.jspx in examples/jsp2/, as demonstrated via script in a request to snp/snoop.jsp. NOTE: other XSS issues in the manager were simultaneously reported, but these require admin access and do not cross privilege boundaries.", title: "Vulnerability description", }, { category: "summary", text: "tomcat manager example DoS", title: "Vulnerability summary", }, ], product_status: { fixed: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2005-4838", }, { category: "external", summary: "RHBZ#238401", url: "https://bugzilla.redhat.com/show_bug.cgi?id=238401", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2005-4838", url: "https://www.cve.org/CVERecord?id=CVE-2005-4838", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2005-4838", url: "https://nvd.nist.gov/vuln/detail/CVE-2005-4838", }, ], release_date: "2005-01-03T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-05-20T14:12:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0261", }, ], threats: [ { category: "impact", details: "Low", }, ], title: "tomcat manager example DoS", }, { cve: "CVE-2006-0254", cwe: { id: "CWE-79", name: "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", }, discovery_date: "2006-01-17T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "430646", }, ], notes: [ { category: "description", text: "Multiple cross-site scripting (XSS) vulnerabilities in Apache Geronimo 1.0 allow remote attackers to inject arbitrary web script or HTML via the (1) time parameter to cal2.jsp and (2) any invalid parameter, which causes an XSS when the log file is viewed by the Web-Access-Log viewer.", title: "Vulnerability description", }, { category: "summary", text: "tomcat examples XSS", title: "Vulnerability summary", }, ], product_status: { fixed: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2006-0254", }, { category: "external", summary: "RHBZ#430646", url: "https://bugzilla.redhat.com/show_bug.cgi?id=430646", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2006-0254", url: "https://www.cve.org/CVERecord?id=CVE-2006-0254", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2006-0254", url: "https://nvd.nist.gov/vuln/detail/CVE-2006-0254", }, ], release_date: "2006-01-15T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-05-20T14:12:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0261", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "tomcat examples XSS", }, { cve: "CVE-2006-0898", ids: [ { system_name: "Red Hat Bugzilla ID", text: "430522", }, ], notes: [ { category: "description", text: "Crypt::CBC Perl module 2.16 and earlier, when running in RandomIV mode, uses an initialization vector (IV) of 8 bytes, which results in weaker encryption when used with a cipher that requires a larger block size than 8 bytes, such as Rijndael.", title: "Vulnerability description", }, { category: "summary", text: "perl-Crypt-CBC weaker encryption with some ciphers", title: "Vulnerability summary", }, ], product_status: { fixed: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2006-0898", }, { category: "external", summary: "RHBZ#430522", url: "https://bugzilla.redhat.com/show_bug.cgi?id=430522", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2006-0898", url: "https://www.cve.org/CVERecord?id=CVE-2006-0898", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2006-0898", url: "https://nvd.nist.gov/vuln/detail/CVE-2006-0898", }, ], release_date: "2006-02-23T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-05-20T14:12:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0261", }, ], threats: [ { category: "impact", details: "Low", }, ], title: "perl-Crypt-CBC weaker encryption with some ciphers", }, { cve: "CVE-2006-1329", ids: [ { system_name: "Red Hat Bugzilla ID", text: "429254", }, ], notes: [ { category: "description", text: "The SASL negotiation in Jabber Studio jabberd before 2.0s11 allows remote attackers to cause a denial of service (\"c2s segfault\") by sending a \"response stanza before an auth stanza\".", title: "Vulnerability description", }, { category: "summary", text: "jabberd SASL DoS", title: "Vulnerability summary", }, ], product_status: { fixed: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2006-1329", }, { category: "external", summary: "RHBZ#429254", url: "https://bugzilla.redhat.com/show_bug.cgi?id=429254", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2006-1329", url: "https://www.cve.org/CVERecord?id=CVE-2006-1329", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2006-1329", url: "https://nvd.nist.gov/vuln/detail/CVE-2006-1329", }, ], release_date: "2006-03-09T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-05-20T14:12:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0261", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "jabberd SASL DoS", }, { cve: "CVE-2006-3835", discovery_date: "2006-07-21T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "237084", }, ], notes: [ { category: "description", text: "Apache Tomcat 5 before 5.5.17 allows remote attackers to list directories via a semicolon (;) preceding a filename with a mapped extension, as demonstrated by URLs ending with /;index.jsp and /;help.do.", title: "Vulnerability description", }, { category: "summary", text: "tomcat directory listing issue", title: "Vulnerability summary", }, { category: "other", text: "This issue is not a security issue in Tomcat itself, but is caused when directory listings are enabled.\n\nDetails on how to disable directory listings are available at: http://tomcat.apache.org/faq/misc.html#listing", title: "Statement", }, ], product_status: { fixed: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2006-3835", }, { category: "external", summary: "RHBZ#237084", url: "https://bugzilla.redhat.com/show_bug.cgi?id=237084", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2006-3835", url: "https://www.cve.org/CVERecord?id=CVE-2006-3835", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2006-3835", url: "https://nvd.nist.gov/vuln/detail/CVE-2006-3835", }, ], release_date: "2006-07-21T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-05-20T14:12:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0261", }, ], threats: [ { category: "impact", details: "Low", }, ], title: "tomcat directory listing issue", }, { cve: "CVE-2006-5752", cwe: { id: "CWE-79", name: "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", }, discovery_date: "2007-06-20T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "245112", }, ], notes: [ { category: "description", text: "Cross-site scripting (XSS) vulnerability in mod_status.c in the mod_status module in Apache HTTP Server (httpd), when ExtendedStatus is enabled and a public server-status page is used, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors involving charsets with browsers that perform \"charset detection\" when the content-type is not specified.", title: "Vulnerability description", }, { category: "summary", text: "httpd mod_status XSS", title: "Vulnerability summary", }, ], product_status: { fixed: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2006-5752", }, { category: "external", summary: "RHBZ#245112", url: "https://bugzilla.redhat.com/show_bug.cgi?id=245112", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2006-5752", url: "https://www.cve.org/CVERecord?id=CVE-2006-5752", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2006-5752", url: "https://nvd.nist.gov/vuln/detail/CVE-2006-5752", }, ], release_date: "2007-06-20T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-05-20T14:12:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0261", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "httpd mod_status XSS", }, { cve: "CVE-2006-7195", cwe: { id: "CWE-79", name: "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", }, discovery_date: "2007-04-19T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "237081", }, ], notes: [ { category: "description", text: "Cross-site scripting (XSS) vulnerability in implicit-objects.jsp in Apache Tomcat 5.0.0 through 5.0.30 and 5.5.0 through 5.5.17 allows remote attackers to inject arbitrary web script or HTML via certain header values.", title: "Vulnerability description", }, { category: "summary", text: "tomcat XSS in example webapps", title: "Vulnerability summary", }, ], product_status: { fixed: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2006-7195", }, { category: "external", summary: "RHBZ#237081", url: "https://bugzilla.redhat.com/show_bug.cgi?id=237081", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2006-7195", url: "https://www.cve.org/CVERecord?id=CVE-2006-7195", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2006-7195", url: "https://nvd.nist.gov/vuln/detail/CVE-2006-7195", }, ], release_date: "2007-04-19T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-05-20T14:12:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0261", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "tomcat XSS in example webapps", }, { cve: "CVE-2006-7196", cwe: { id: "CWE-79", name: "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", }, discovery_date: "2007-04-26T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "238131", }, ], notes: [ { category: "description", text: "Cross-site scripting (XSS) vulnerability in the calendar application example in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0 through 4.1.31, 5.0.0 through 5.0.30, and 5.5.0 through 5.5.15 allows remote attackers to inject arbitrary web script or HTML via the time parameter to cal2.jsp and possibly unspecified other vectors. NOTE: this may be related to CVE-2006-0254.1.", title: "Vulnerability description", }, { category: "summary", text: "tomcat XSS in example webapps", title: "Vulnerability summary", }, ], product_status: { fixed: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2006-7196", }, { category: "external", summary: "RHBZ#238131", url: "https://bugzilla.redhat.com/show_bug.cgi?id=238131", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2006-7196", url: "https://www.cve.org/CVERecord?id=CVE-2006-7196", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2006-7196", url: "https://nvd.nist.gov/vuln/detail/CVE-2006-7196", }, ], release_date: "2007-04-26T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-05-20T14:12:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0261", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "tomcat XSS in example webapps", }, { cve: "CVE-2006-7197", ids: [ { system_name: "Red Hat Bugzilla ID", text: "430642", }, ], notes: [ { category: "description", text: "The AJP connector in Apache Tomcat 5.5.15 uses an incorrect length for chunks, which can cause a buffer over-read in the ajp_process_callback in mod_jk, which allows remote attackers to read portions of sensitive memory.", title: "Vulnerability description", }, { category: "summary", text: "mod_jk chunk too long", title: "Vulnerability summary", }, ], product_status: { fixed: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2006-7197", }, { category: "external", summary: "RHBZ#430642", url: "https://bugzilla.redhat.com/show_bug.cgi?id=430642", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2006-7197", url: "https://www.cve.org/CVERecord?id=CVE-2006-7197", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2006-7197", url: "https://nvd.nist.gov/vuln/detail/CVE-2006-7197", }, ], release_date: "2006-03-05T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-05-20T14:12:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0261", }, ], threats: [ { category: "impact", details: "Important", }, ], title: "mod_jk chunk too long", }, { cve: "CVE-2007-0243", discovery_date: "2007-04-17T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "325941", }, ], notes: [ { category: "description", text: "Buffer overflow in Sun JDK and Java Runtime Environment (JRE) 5.0 Update 9 and earlier, SDK and JRE 1.4.2_12 and earlier, and SDK and JRE 1.3.1_18 and earlier allows applets to gain privileges via a GIF image with a block with a 0 width field, which triggers memory corruption.", title: "Vulnerability description", }, { category: "summary", text: "java-jre: GIF buffer overflow", title: "Vulnerability summary", }, ], product_status: { fixed: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-0243", }, { category: "external", summary: "RHBZ#325941", url: "https://bugzilla.redhat.com/show_bug.cgi?id=325941", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-0243", url: "https://www.cve.org/CVERecord?id=CVE-2007-0243", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-0243", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-0243", }, ], release_date: "2007-01-17T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-05-20T14:12:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0261", }, ], threats: [ { category: "impact", details: "Important", }, ], title: "java-jre: GIF buffer overflow", }, { cve: "CVE-2007-0450", discovery_date: "2007-03-14T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "237080", }, ], notes: [ { category: "description", text: "Directory traversal vulnerability in Apache HTTP Server and Tomcat 5.x before 5.5.22 and 6.x before 6.0.10, when using certain proxy modules (mod_proxy, mod_rewrite, mod_jk), allows remote attackers to read arbitrary files via a .. (dot dot) sequence with combinations of (1) \"/\" (slash), (2) \"\\\" (backslash), and (3) URL-encoded backslash (%5C) characters in the URL, which are valid separators in Tomcat but not in Apache.", title: "Vulnerability description", }, { category: "summary", text: "tomcat directory traversal", title: "Vulnerability summary", }, ], product_status: { fixed: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-0450", }, { category: "external", summary: "RHBZ#237080", url: "https://bugzilla.redhat.com/show_bug.cgi?id=237080", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-0450", url: "https://www.cve.org/CVERecord?id=CVE-2007-0450", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-0450", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-0450", }, ], release_date: "2007-03-14T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-05-20T14:12:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0261", }, ], threats: [ { category: "impact", details: "Important", }, ], title: "tomcat directory traversal", }, { cve: "CVE-2007-1349", discovery_date: "2007-05-17T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "240423", }, ], notes: [ { category: "description", text: "PerlRun.pm in Apache mod_perl before 1.30, and RegistryCooker.pm in mod_perl 2.x, does not properly escape PATH_INFO before use in a regular expression, which allows remote attackers to cause a denial of service (resource consumption) via a crafted URI.", title: "Vulnerability description", }, { category: "summary", text: "mod_perl PerlRun denial of service", title: "Vulnerability summary", }, ], product_status: { fixed: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-1349", }, { category: "external", summary: "RHBZ#240423", url: "https://bugzilla.redhat.com/show_bug.cgi?id=240423", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-1349", url: "https://www.cve.org/CVERecord?id=CVE-2007-1349", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-1349", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-1349", }, ], release_date: "2007-03-22T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-05-20T14:12:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0261", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "mod_perl PerlRun denial of service", }, { cve: "CVE-2007-1355", cwe: { id: "CWE-79", name: "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", }, discovery_date: "2007-05-19T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "253166", }, ], notes: [ { category: "description", text: "Multiple cross-site scripting (XSS) vulnerabilities in the appdev/sample/web/hello.jsp example application in Tomcat 4.0.0 through 4.0.6, 4.1.0 through 4.1.36, 5.0.0 through 5.0.30, 5.5.0 through 5.5.23, and 6.0.0 through 6.0.10 allow remote attackers to inject arbitrary web script or HTML via the test parameter and unspecified vectors.", title: "Vulnerability description", }, { category: "summary", text: "tomcat XSS in samples", title: "Vulnerability summary", }, ], product_status: { fixed: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-1355", }, { category: "external", summary: "RHBZ#253166", url: "https://bugzilla.redhat.com/show_bug.cgi?id=253166", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-1355", url: "https://www.cve.org/CVERecord?id=CVE-2007-1355", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-1355", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-1355", }, ], release_date: "2007-05-19T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-05-20T14:12:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0261", }, ], threats: [ { category: "impact", details: "Low", }, ], title: "tomcat XSS in samples", }, { cve: "CVE-2007-1358", cwe: { id: "CWE-79", name: "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", }, discovery_date: "2007-04-10T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "244803", }, ], notes: [ { category: "description", text: "Cross-site scripting (XSS) vulnerability in certain applications using Apache Tomcat 4.0.0 through 4.0.6 and 4.1.0 through 4.1.34 allows remote attackers to inject arbitrary web script or HTML via crafted \"Accept-Language headers that do not conform to RFC 2616\".", title: "Vulnerability description", }, { category: "summary", text: "tomcat accept-language xss flaw", title: "Vulnerability summary", }, ], product_status: { fixed: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-1358", }, { category: "external", summary: "RHBZ#244803", url: "https://bugzilla.redhat.com/show_bug.cgi?id=244803", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-1358", url: "https://www.cve.org/CVERecord?id=CVE-2007-1358", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-1358", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-1358", }, ], release_date: "2007-06-06T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-05-20T14:12:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0261", }, ], threats: [ { category: "impact", details: "Low", }, ], title: "tomcat accept-language xss flaw", }, { cve: "CVE-2007-1860", discovery_date: "2007-04-20T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "237656", }, ], notes: [ { category: "description", text: "mod_jk in Apache Tomcat JK Web Server Connector 1.2.x before 1.2.23 decodes request URLs within the Apache HTTP Server before passing the URL to Tomcat, which allows remote attackers to access protected pages via a crafted prefix JkMount, possibly involving double-encoded .. (dot dot) sequences and directory traversal, a related issue to CVE-2007-0450.", title: "Vulnerability description", }, { category: "summary", text: "mod_jk sends decoded URL to tomcat", title: "Vulnerability summary", }, ], product_status: { fixed: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-1860", }, { category: "external", summary: "RHBZ#237656", url: "https://bugzilla.redhat.com/show_bug.cgi?id=237656", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-1860", url: "https://www.cve.org/CVERecord?id=CVE-2007-1860", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-1860", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-1860", }, ], release_date: "2007-05-21T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-05-20T14:12:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0261", }, ], threats: [ { category: "impact", details: "Important", }, ], title: "mod_jk sends decoded URL to tomcat", }, { cve: "CVE-2007-2435", discovery_date: "2007-05-01T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "239660", }, ], notes: [ { category: "description", text: "Sun Java Web Start in JDK and JRE 5.0 Update 10 and earlier, and Java Web Start in SDK and JRE 1.4.2_13 and earlier, allows remote attackers to perform unauthorized actions via an application that grants privileges to itself, related to \"Incorrect Use of System Classes\" and probably related to support for JNLP files.", title: "Vulnerability description", }, { category: "summary", text: "javaws vulnerabilities", title: "Vulnerability summary", }, ], product_status: { fixed: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-2435", }, { category: "external", summary: "RHBZ#239660", url: "https://bugzilla.redhat.com/show_bug.cgi?id=239660", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-2435", url: "https://www.cve.org/CVERecord?id=CVE-2007-2435", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-2435", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-2435", }, ], release_date: "2007-04-30T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-05-20T14:12:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0261", }, ], threats: [ { category: "impact", details: "Critical", }, ], title: "javaws vulnerabilities", }, { cve: "CVE-2007-2449", cwe: { id: "CWE-79", name: "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", }, discovery_date: "2007-05-24T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "244804", }, ], notes: [ { category: "description", text: "Multiple cross-site scripting (XSS) vulnerabilities in certain JSP files in the examples web application in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0 through 4.1.36, 5.0.0 through 5.0.30, 5.5.0 through 5.5.24, and 6.0.0 through 6.0.13 allow remote attackers to inject arbitrary web script or HTML via the portion of the URI after the ';' character, as demonstrated by a URI containing a \"snp/snoop.jsp;\" sequence.", title: "Vulnerability description", }, { category: "summary", text: "tomcat examples jsp XSS", title: "Vulnerability summary", }, ], product_status: { fixed: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-2449", }, { category: "external", summary: "RHBZ#244804", url: "https://bugzilla.redhat.com/show_bug.cgi?id=244804", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-2449", url: "https://www.cve.org/CVERecord?id=CVE-2007-2449", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-2449", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-2449", }, ], release_date: "2007-06-13T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-05-20T14:12:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0261", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "tomcat examples jsp XSS", }, { cve: "CVE-2007-2450", cwe: { id: "CWE-79", name: "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", }, discovery_date: "2007-05-24T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "244808", }, ], notes: [ { category: "description", text: "Multiple cross-site scripting (XSS) vulnerabilities in the (1) Manager and (2) Host Manager web applications in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0 through 4.1.36, 5.0.0 through 5.0.30, 5.5.0 through 5.5.24, and 6.0.0 through 6.0.13 allow remote authenticated users to inject arbitrary web script or HTML via a parameter name to manager/html/upload, and other unspecified vectors.", title: "Vulnerability description", }, { category: "summary", text: "tomcat host manager XSS", title: "Vulnerability summary", }, ], product_status: { fixed: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-2450", }, { category: "external", summary: "RHBZ#244808", url: "https://bugzilla.redhat.com/show_bug.cgi?id=244808", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-2450", url: "https://www.cve.org/CVERecord?id=CVE-2007-2450", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-2450", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-2450", }, ], release_date: "2007-06-13T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-05-20T14:12:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0261", }, ], threats: [ { category: "impact", details: "Low", }, ], title: "tomcat host manager XSS", }, { cve: "CVE-2007-2788", cwe: { id: "CWE-190", name: "Integer Overflow or Wraparound", }, discovery_date: "2007-05-21T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "250725", }, ], notes: [ { category: "description", text: "Integer overflow in the embedded ICC profile image parser in Sun Java Development Kit (JDK) before 1.5.0_11-b03 and 1.6.x before 1.6.0_01-b06, and Sun Java Runtime Environment in JDK and JRE 6, JDK and JRE 5.0 Update 10 and earlier, SDK and JRE 1.4.2_14 and earlier, and SDK and JRE 1.3.1_20 and earlier, allows remote attackers to execute arbitrary code or cause a denial of service (JVM crash) via a crafted JPEG or BMP file that triggers a buffer overflow.", title: "Vulnerability description", }, { category: "summary", text: "Integer overflow in the embedded ICC profile image parser in Sun Java Development Kit", title: "Vulnerability summary", }, ], product_status: { fixed: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-2788", }, { category: "external", summary: "RHBZ#250725", url: "https://bugzilla.redhat.com/show_bug.cgi?id=250725", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-2788", url: "https://www.cve.org/CVERecord?id=CVE-2007-2788", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-2788", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-2788", }, ], release_date: "2007-05-21T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-05-20T14:12:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0261", }, ], threats: [ { category: "impact", details: "Critical", }, ], title: "Integer overflow in the embedded ICC profile image parser in Sun Java Development Kit", }, { cve: "CVE-2007-2789", discovery_date: "2007-05-21T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "250729", }, ], notes: [ { category: "description", text: "The BMP image parser in Sun Java Development Kit (JDK) before 1.5.0_11-b03 and 1.6.x before 1.6.0_01-b06, and Sun Java Runtime Environment in JDK and JRE 6, JDK and JRE 5.0 Update 10 and earlier, SDK and JRE 1.4.2_14 and earlier, and SDK and JRE 1.3.1_19 and earlier, when running on Unix/Linux systems, allows remote attackers to cause a denial of service (JVM hang) via untrusted applets or applications that open arbitrary local files via a crafted BMP file, such as /dev/tty.", title: "Vulnerability description", }, { category: "summary", text: "BMP image parser vulnerability", title: "Vulnerability summary", }, ], product_status: { fixed: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-2789", }, { category: "external", summary: "RHBZ#250729", url: "https://bugzilla.redhat.com/show_bug.cgi?id=250729", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-2789", url: "https://www.cve.org/CVERecord?id=CVE-2007-2789", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-2789", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-2789", }, ], release_date: "2007-05-21T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-05-20T14:12:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0261", }, ], threats: [ { category: "impact", details: "Critical", }, ], title: "BMP image parser vulnerability", }, { cve: "CVE-2007-3304", discovery_date: "2007-06-19T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "245111", }, ], notes: [ { category: "description", text: "Apache httpd 1.3.37, 2.0.59, and 2.2.4 with the Prefork MPM module, allows local users to cause a denial of service by modifying the worker_score and process_score arrays to reference an arbitrary process ID, which is sent a SIGUSR1 signal from the master process, aka \"SIGUSR1 killer.\"", title: "Vulnerability description", }, { category: "summary", text: "httpd scoreboard lack of PID protection", title: "Vulnerability summary", }, ], product_status: { fixed: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-3304", }, { category: "external", summary: "RHBZ#245111", url: "https://bugzilla.redhat.com/show_bug.cgi?id=245111", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-3304", url: "https://www.cve.org/CVERecord?id=CVE-2007-3304", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-3304", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-3304", }, ], release_date: "2007-06-19T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-05-20T14:12:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0261", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "httpd scoreboard lack of PID protection", }, { cve: "CVE-2007-3382", discovery_date: "2007-07-12T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "247972", }, ], notes: [ { category: "description", text: "Apache Tomcat 6.0.0 to 6.0.13, 5.5.0 to 5.5.24, 5.0.0 to 5.0.30, 4.1.0 to 4.1.36, and 3.3 to 3.3.2 treats single quotes (\"'\") as delimiters in cookies, which might cause sensitive information such as session IDs to be leaked and allow remote attackers to conduct session hijacking attacks.", title: "Vulnerability description", }, { category: "summary", text: "tomcat handling of cookies", title: "Vulnerability summary", }, ], product_status: { fixed: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-3382", }, { category: "external", summary: "RHBZ#247972", url: "https://bugzilla.redhat.com/show_bug.cgi?id=247972", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-3382", url: "https://www.cve.org/CVERecord?id=CVE-2007-3382", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-3382", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-3382", }, ], release_date: "2007-08-14T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-05-20T14:12:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0261", }, ], threats: [ { category: "impact", details: "Low", }, ], title: "tomcat handling of cookies", }, { cve: "CVE-2007-3385", discovery_date: "2007-07-12T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "247976", }, ], notes: [ { category: "description", text: "Apache Tomcat 6.0.0 to 6.0.13, 5.5.0 to 5.5.24, 5.0.0 to 5.0.30, 4.1.0 to 4.1.36, and 3.3 to 3.3.2 does not properly handle the \\\" character sequence in a cookie value, which might cause sensitive information such as session IDs to be leaked to remote attackers and enable session hijacking attacks.", title: "Vulnerability description", }, { category: "summary", text: "tomcat handling of cookie values", title: "Vulnerability summary", }, ], product_status: { fixed: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-3385", }, { category: "external", summary: "RHBZ#247976", url: "https://bugzilla.redhat.com/show_bug.cgi?id=247976", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-3385", url: "https://www.cve.org/CVERecord?id=CVE-2007-3385", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-3385", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-3385", }, ], release_date: "2007-08-14T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-05-20T14:12:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0261", }, ], threats: [ { category: "impact", details: "Low", }, ], title: "tomcat handling of cookie values", }, { cve: "CVE-2007-4465", cwe: { id: "CWE-79", name: "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", }, discovery_date: "2007-09-13T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "289511", }, ], notes: [ { category: "description", text: "Cross-site scripting (XSS) vulnerability in mod_autoindex.c in the Apache HTTP Server before 2.2.6, when the charset on a server-generated page is not defined, allows remote attackers to inject arbitrary web script or HTML via the P parameter using the UTF-7 charset. NOTE: it could be argued that this issue is due to a design limitation of browsers that attempt to perform automatic content type detection.", title: "Vulnerability description", }, { category: "summary", text: "mod_autoindex XSS", title: "Vulnerability summary", }, { category: "other", text: "This is actually a flaw in browsers that do not derive the response character set as required by RFC 2616. This does not affect the default configuration of Apache httpd in Red Hat products and will only affect customers who have removed the \"AddDefaultCharset\" directive and are using directory indexes. The Red Hat Product Security has rated this issue as having low security impact, a future update may address this flaw.", title: "Statement", }, ], product_status: { fixed: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-4465", }, { category: "external", summary: "RHBZ#289511", url: "https://bugzilla.redhat.com/show_bug.cgi?id=289511", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-4465", url: "https://www.cve.org/CVERecord?id=CVE-2007-4465", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-4465", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-4465", }, ], release_date: "2007-09-13T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-05-20T14:12:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0261", }, ], threats: [ { category: "impact", details: "Low", }, ], title: "mod_autoindex XSS", }, { cve: "CVE-2007-5000", cwe: { id: "CWE-79", name: "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", }, discovery_date: "2007-12-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "419931", }, ], notes: [ { category: "description", text: "Cross-site scripting (XSS) vulnerability in the (1) mod_imap module in the Apache HTTP Server 1.3.0 through 1.3.39 and 2.0.35 through 2.0.61 and the (2) mod_imagemap module in the Apache HTTP Server 2.2.0 through 2.2.6 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.", title: "Vulnerability description", }, { category: "summary", text: "httpd: mod_imagemap XSS", title: "Vulnerability summary", }, ], product_status: { fixed: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-5000", }, { category: "external", summary: "RHBZ#419931", url: "https://bugzilla.redhat.com/show_bug.cgi?id=419931", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-5000", url: "https://www.cve.org/CVERecord?id=CVE-2007-5000", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-5000", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-5000", }, ], release_date: "2007-12-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-05-20T14:12:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0261", }, ], threats: [ { category: "impact", details: "Low", }, ], title: "httpd: mod_imagemap XSS", }, { cve: "CVE-2007-5461", discovery_date: "2007-10-14T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "333791", }, ], notes: [ { category: "description", text: "Absolute path traversal vulnerability in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0, 5.0.0, 5.5.0 through 5.5.25, and 6.0.0 through 6.0.14, under certain configurations, allows remote authenticated users to read arbitrary files via a WebDAV write request that specifies an entity with a SYSTEM tag.", title: "Vulnerability description", }, { category: "summary", text: "Absolute path traversal Apache Tomcat WEBDAV", title: "Vulnerability summary", }, ], product_status: { fixed: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-5461", }, { category: "external", summary: "RHBZ#333791", url: "https://bugzilla.redhat.com/show_bug.cgi?id=333791", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-5461", url: "https://www.cve.org/CVERecord?id=CVE-2007-5461", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-5461", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-5461", }, ], release_date: "2007-10-14T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-05-20T14:12:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0261", }, ], threats: [ { category: "impact", details: "Important", }, ], title: "Absolute path traversal Apache Tomcat WEBDAV", }, { cve: "CVE-2007-5961", cwe: { id: "CWE-79", name: "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", }, discovery_date: "2007-09-26T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "396641", }, ], notes: [ { category: "description", text: "Cross-site scripting (XSS) vulnerability in the Red Hat Network channel search feature, as used in RHN and Red Hat Network Satellite before 5.0.2, allows remote attackers to inject arbitrary web script or HTML via unknown vectors.", title: "Vulnerability description", }, { category: "summary", text: "RHN XSS flaw", title: "Vulnerability summary", }, ], product_status: { fixed: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-5961", }, { category: "external", summary: "RHBZ#396641", url: "https://bugzilla.redhat.com/show_bug.cgi?id=396641", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-5961", url: "https://www.cve.org/CVERecord?id=CVE-2007-5961", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-5961", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-5961", }, ], release_date: "2008-05-20T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-05-20T14:12:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0261", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "RHN XSS flaw", }, { cve: "CVE-2007-6306", cwe: { id: "CWE-79", name: "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", }, discovery_date: "2007-12-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "421081", }, ], notes: [ { category: "description", text: "Multiple cross-site scripting (XSS) vulnerabilities in the image map feature in JFreeChart 1.0.8 allow remote attackers to inject arbitrary web script or HTML via the (1) chart name or (2) chart tool tip text; or the (3) href, (4) shape, or (5) coords attribute of a chart area.", title: "Vulnerability description", }, { category: "summary", text: "JFreeChart: XSS vulnerabilities in the image map feature", title: "Vulnerability summary", }, ], product_status: { fixed: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-6306", }, { category: "external", summary: "RHBZ#421081", url: "https://bugzilla.redhat.com/show_bug.cgi?id=421081", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-6306", url: "https://www.cve.org/CVERecord?id=CVE-2007-6306", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-6306", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-6306", }, ], release_date: "2007-12-06T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-05-20T14:12:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0261", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "JFreeChart: XSS vulnerabilities in the image map feature", }, { cve: "CVE-2007-6388", cwe: { id: "CWE-79", name: "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", }, discovery_date: "2008-01-02T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "427228", }, ], notes: [ { category: "description", text: "Cross-site scripting (XSS) vulnerability in mod_status in the Apache HTTP Server 2.2.0 through 2.2.6, 2.0.35 through 2.0.61, and 1.3.2 through 1.3.39, when the server-status page is enabled, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.", title: "Vulnerability description", }, { category: "summary", text: "apache mod_status cross-site scripting", title: "Vulnerability summary", }, ], product_status: { fixed: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-6388", }, { category: "external", summary: "RHBZ#427228", url: "https://bugzilla.redhat.com/show_bug.cgi?id=427228", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-6388", url: "https://www.cve.org/CVERecord?id=CVE-2007-6388", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-6388", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-6388", }, ], release_date: "2007-12-29T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-05-20T14:12:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0261", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "apache mod_status cross-site scripting", }, { cve: "CVE-2008-0128", discovery_date: "2008-01-23T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "429821", }, ], notes: [ { category: "description", text: "The SingleSignOn Valve (org.apache.catalina.authenticator.SingleSignOn) in Apache Tomcat before 5.5.21 does not set the secure flag for the JSESSIONIDSSO cookie in an https session, which can cause the cookie to be sent in http requests and make it easier for remote attackers to capture this cookie.", title: "Vulnerability description", }, { category: "summary", text: "tomcat5 SSO cookie login information disclosure", title: "Vulnerability summary", }, ], product_status: { fixed: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2008-0128", }, { category: "external", summary: "RHBZ#429821", url: "https://bugzilla.redhat.com/show_bug.cgi?id=429821", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2008-0128", url: "https://www.cve.org/CVERecord?id=CVE-2008-0128", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2008-0128", url: "https://nvd.nist.gov/vuln/detail/CVE-2008-0128", }, ], release_date: "2006-12-20T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-05-20T14:12:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0261", }, ], threats: [ { category: "impact", details: "Low", }, ], title: "tomcat5 SSO cookie login information disclosure", }, ], }
RHSA-2007:0556
Vulnerability from csaf_redhat
Published
2007-06-26 15:22
Modified
2024-12-01 11:53
Summary
Red Hat Security Advisory: httpd security update
Notes
Topic
Updated Apache httpd packages that correct three security issues are now
available for Red Hat Enterprise Linux 5.
This update has been rated as having moderate security impact by the Red
Hat Security Response Team.
Details
The Apache HTTP Server is a popular Web server.
The Apache HTTP Server did not verify that a process was an Apache child
process before sending it signals. A local attacker with the ability to run
scripts on the Apache HTTP Server could manipulate the scoreboard and cause
arbitrary processes to be terminated which could lead to a denial of
service (CVE-2007-3304). This issue is not exploitable on Red Hat
Enterprise Linux 5 if using the default SELinux targeted policy.
A flaw was found in the Apache HTTP Server mod_status module. On sites
where the server-status page is publicly accessible and ExtendedStatus is
enabled this could lead to a cross-site scripting attack. On Red Hat
Enterprise Linux the server-status page is not enabled by default and it is
best practice to not make this publicly available. (CVE-2006-5752)
A bug was found in the Apache HTTP Server mod_cache module. On sites where
caching is enabled, a remote attacker could send a carefully crafted
request that would cause the Apache child process handling that request to
crash. This could lead to a denial of service if using a threaded
Multi-Processing Module. (CVE-2007-1863)
Users of httpd should upgrade to these updated packages, which contain
backported patches to correct these issues. Users should restart Apache
after installing this update.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ document: { aggregate_severity: { namespace: "https://access.redhat.com/security/updates/classification/", text: "Moderate", }, category: "csaf_security_advisory", csaf_version: "2.0", distribution: { text: "Copyright © Red Hat, Inc. All rights reserved.", tlp: { label: "WHITE", url: "https://www.first.org/tlp/", }, }, lang: "en", notes: [ { category: "summary", text: "Updated Apache httpd packages that correct three security issues are now\navailable for Red Hat Enterprise Linux 5.\n\nThis update has been rated as having moderate security impact by the Red\nHat Security Response Team.", title: "Topic", }, { category: "general", text: "The Apache HTTP Server is a popular Web server.\n\nThe Apache HTTP Server did not verify that a process was an Apache child\nprocess before sending it signals. A local attacker with the ability to run\nscripts on the Apache HTTP Server could manipulate the scoreboard and cause\narbitrary processes to be terminated which could lead to a denial of\nservice (CVE-2007-3304). This issue is not exploitable on Red Hat\nEnterprise Linux 5 if using the default SELinux targeted policy.\n\nA flaw was found in the Apache HTTP Server mod_status module. On sites\nwhere the server-status page is publicly accessible and ExtendedStatus is\nenabled this could lead to a cross-site scripting attack. On Red Hat\nEnterprise Linux the server-status page is not enabled by default and it is\nbest practice to not make this publicly available. (CVE-2006-5752)\n\nA bug was found in the Apache HTTP Server mod_cache module. On sites where\ncaching is enabled, a remote attacker could send a carefully crafted\nrequest that would cause the Apache child process handling that request to\ncrash. This could lead to a denial of service if using a threaded\nMulti-Processing Module. (CVE-2007-1863)\n\nUsers of httpd should upgrade to these updated packages, which contain\nbackported patches to correct these issues. Users should restart Apache\nafter installing this update.", title: "Details", }, { category: "legal_disclaimer", text: "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", title: "Terms of Use", }, ], publisher: { category: "vendor", contact_details: "https://access.redhat.com/security/team/contact/", issuing_authority: "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", name: "Red Hat Product Security", namespace: "https://www.redhat.com", }, references: [ { category: "self", summary: "https://access.redhat.com/errata/RHSA-2007:0556", url: "https://access.redhat.com/errata/RHSA-2007:0556", }, { category: "external", summary: "http://www.redhat.com/security/updates/classification/#moderate", url: "http://www.redhat.com/security/updates/classification/#moderate", }, { category: "external", summary: "244658", url: "https://bugzilla.redhat.com/show_bug.cgi?id=244658", }, { category: "external", summary: "245111", url: "https://bugzilla.redhat.com/show_bug.cgi?id=245111", }, { category: "external", summary: "245112", url: "https://bugzilla.redhat.com/show_bug.cgi?id=245112", }, { category: "self", summary: "Canonical URL", url: "https://security.access.redhat.com/data/csaf/v2/advisories/2007/rhsa-2007_0556.json", }, ], title: "Red Hat Security Advisory: httpd security update", tracking: { current_release_date: "2024-12-01T11:53:16+00:00", generator: { date: "2024-12-01T11:53:16+00:00", engine: { name: "Red Hat SDEngine", version: "4.2.1", }, }, id: "RHSA-2007:0556", initial_release_date: "2007-06-26T15:22:00+00:00", revision_history: [ { date: "2007-06-26T15:22:00+00:00", number: "1", summary: "Initial version", }, { date: "2007-06-26T11:22:15+00:00", number: "2", summary: "Last updated version", }, { date: "2024-12-01T11:53:16+00:00", number: "3", summary: "Last generated version", }, ], status: "final", version: "3", }, }, product_tree: { branches: [ { branches: [ { branches: [ { category: "product_name", name: "Red Hat Enterprise Linux Desktop (v. 5 client)", product: { name: "Red Hat Enterprise Linux Desktop (v. 5 client)", product_id: "5Client", product_identification_helper: { cpe: "cpe:/o:redhat:enterprise_linux:5::client", }, }, }, { category: "product_name", name: "Red Hat Enterprise Linux Desktop Workstation (v. 5 client)", product: { name: "Red Hat Enterprise Linux Desktop Workstation (v. 5 client)", product_id: "5Client-Workstation", product_identification_helper: { cpe: "cpe:/o:redhat:enterprise_linux:5::client_workstation", }, }, }, { category: "product_name", name: "Red Hat Enterprise Linux (v. 5 server)", product: { name: "Red Hat Enterprise Linux (v. 5 server)", product_id: "5Server", product_identification_helper: { cpe: "cpe:/o:redhat:enterprise_linux:5::server", }, }, }, ], category: "product_family", name: "Red Hat Enterprise Linux", }, { branches: [ { category: "product_version", name: "httpd-devel-0:2.2.3-7.el5.x86_64", product: { name: "httpd-devel-0:2.2.3-7.el5.x86_64", product_id: "httpd-devel-0:2.2.3-7.el5.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-devel@2.2.3-7.el5?arch=x86_64", }, }, }, { category: "product_version", name: "httpd-debuginfo-0:2.2.3-7.el5.x86_64", product: { name: "httpd-debuginfo-0:2.2.3-7.el5.x86_64", product_id: "httpd-debuginfo-0:2.2.3-7.el5.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-debuginfo@2.2.3-7.el5?arch=x86_64", }, }, }, { category: "product_version", name: "httpd-manual-0:2.2.3-7.el5.x86_64", product: { name: "httpd-manual-0:2.2.3-7.el5.x86_64", product_id: "httpd-manual-0:2.2.3-7.el5.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-manual@2.2.3-7.el5?arch=x86_64", }, }, }, { category: "product_version", name: "mod_ssl-1:2.2.3-7.el5.x86_64", product: { name: "mod_ssl-1:2.2.3-7.el5.x86_64", product_id: "mod_ssl-1:2.2.3-7.el5.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/mod_ssl@2.2.3-7.el5?arch=x86_64&epoch=1", }, }, }, { category: "product_version", name: "httpd-0:2.2.3-7.el5.x86_64", product: { name: "httpd-0:2.2.3-7.el5.x86_64", product_id: "httpd-0:2.2.3-7.el5.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/httpd@2.2.3-7.el5?arch=x86_64", }, }, }, ], category: "architecture", name: "x86_64", }, { branches: [ { category: "product_version", name: "httpd-devel-0:2.2.3-7.el5.i386", product: { name: "httpd-devel-0:2.2.3-7.el5.i386", product_id: "httpd-devel-0:2.2.3-7.el5.i386", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-devel@2.2.3-7.el5?arch=i386", }, }, }, { category: "product_version", name: "httpd-debuginfo-0:2.2.3-7.el5.i386", product: { name: "httpd-debuginfo-0:2.2.3-7.el5.i386", product_id: "httpd-debuginfo-0:2.2.3-7.el5.i386", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-debuginfo@2.2.3-7.el5?arch=i386", }, }, }, { category: "product_version", name: "httpd-manual-0:2.2.3-7.el5.i386", product: { name: "httpd-manual-0:2.2.3-7.el5.i386", product_id: "httpd-manual-0:2.2.3-7.el5.i386", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-manual@2.2.3-7.el5?arch=i386", }, }, }, { category: "product_version", name: "mod_ssl-1:2.2.3-7.el5.i386", product: { name: "mod_ssl-1:2.2.3-7.el5.i386", product_id: "mod_ssl-1:2.2.3-7.el5.i386", product_identification_helper: { purl: "pkg:rpm/redhat/mod_ssl@2.2.3-7.el5?arch=i386&epoch=1", }, }, }, { category: "product_version", name: "httpd-0:2.2.3-7.el5.i386", product: { name: "httpd-0:2.2.3-7.el5.i386", product_id: "httpd-0:2.2.3-7.el5.i386", product_identification_helper: { purl: "pkg:rpm/redhat/httpd@2.2.3-7.el5?arch=i386", }, }, }, ], category: "architecture", name: "i386", }, { branches: [ { category: "product_version", name: "httpd-0:2.2.3-7.el5.src", product: { name: "httpd-0:2.2.3-7.el5.src", product_id: "httpd-0:2.2.3-7.el5.src", product_identification_helper: { purl: "pkg:rpm/redhat/httpd@2.2.3-7.el5?arch=src", }, }, }, ], category: "architecture", name: "src", }, { branches: [ { category: "product_version", name: "mod_ssl-1:2.2.3-7.el5.ia64", product: { name: "mod_ssl-1:2.2.3-7.el5.ia64", product_id: "mod_ssl-1:2.2.3-7.el5.ia64", product_identification_helper: { purl: "pkg:rpm/redhat/mod_ssl@2.2.3-7.el5?arch=ia64&epoch=1", }, }, }, { category: "product_version", name: "httpd-devel-0:2.2.3-7.el5.ia64", product: { name: "httpd-devel-0:2.2.3-7.el5.ia64", product_id: "httpd-devel-0:2.2.3-7.el5.ia64", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-devel@2.2.3-7.el5?arch=ia64", }, }, }, { category: "product_version", name: "httpd-debuginfo-0:2.2.3-7.el5.ia64", product: { name: "httpd-debuginfo-0:2.2.3-7.el5.ia64", product_id: "httpd-debuginfo-0:2.2.3-7.el5.ia64", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-debuginfo@2.2.3-7.el5?arch=ia64", }, }, }, { category: "product_version", name: "httpd-manual-0:2.2.3-7.el5.ia64", product: { name: "httpd-manual-0:2.2.3-7.el5.ia64", product_id: "httpd-manual-0:2.2.3-7.el5.ia64", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-manual@2.2.3-7.el5?arch=ia64", }, }, }, { category: "product_version", name: "httpd-0:2.2.3-7.el5.ia64", product: { name: "httpd-0:2.2.3-7.el5.ia64", product_id: "httpd-0:2.2.3-7.el5.ia64", product_identification_helper: { purl: "pkg:rpm/redhat/httpd@2.2.3-7.el5?arch=ia64", }, }, }, ], category: "architecture", name: "ia64", }, { branches: [ { category: "product_version", name: "mod_ssl-1:2.2.3-7.el5.ppc", product: { name: "mod_ssl-1:2.2.3-7.el5.ppc", product_id: "mod_ssl-1:2.2.3-7.el5.ppc", product_identification_helper: { purl: "pkg:rpm/redhat/mod_ssl@2.2.3-7.el5?arch=ppc&epoch=1", }, }, }, { category: "product_version", name: "httpd-devel-0:2.2.3-7.el5.ppc", product: { name: "httpd-devel-0:2.2.3-7.el5.ppc", product_id: "httpd-devel-0:2.2.3-7.el5.ppc", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-devel@2.2.3-7.el5?arch=ppc", }, }, }, { category: "product_version", name: "httpd-debuginfo-0:2.2.3-7.el5.ppc", product: { name: "httpd-debuginfo-0:2.2.3-7.el5.ppc", product_id: "httpd-debuginfo-0:2.2.3-7.el5.ppc", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-debuginfo@2.2.3-7.el5?arch=ppc", }, }, }, { category: "product_version", name: "httpd-manual-0:2.2.3-7.el5.ppc", product: { name: "httpd-manual-0:2.2.3-7.el5.ppc", product_id: "httpd-manual-0:2.2.3-7.el5.ppc", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-manual@2.2.3-7.el5?arch=ppc", }, }, }, { category: "product_version", name: "httpd-0:2.2.3-7.el5.ppc", product: { name: "httpd-0:2.2.3-7.el5.ppc", product_id: "httpd-0:2.2.3-7.el5.ppc", product_identification_helper: { purl: "pkg:rpm/redhat/httpd@2.2.3-7.el5?arch=ppc", }, }, }, ], category: "architecture", name: "ppc", }, { branches: [ { category: "product_version", name: "httpd-devel-0:2.2.3-7.el5.ppc64", product: { name: "httpd-devel-0:2.2.3-7.el5.ppc64", product_id: "httpd-devel-0:2.2.3-7.el5.ppc64", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-devel@2.2.3-7.el5?arch=ppc64", }, }, }, { category: "product_version", name: "httpd-debuginfo-0:2.2.3-7.el5.ppc64", product: { name: "httpd-debuginfo-0:2.2.3-7.el5.ppc64", product_id: "httpd-debuginfo-0:2.2.3-7.el5.ppc64", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-debuginfo@2.2.3-7.el5?arch=ppc64", }, }, }, ], category: "architecture", name: "ppc64", }, { branches: [ { category: "product_version", name: "mod_ssl-1:2.2.3-7.el5.s390x", product: { name: "mod_ssl-1:2.2.3-7.el5.s390x", product_id: "mod_ssl-1:2.2.3-7.el5.s390x", product_identification_helper: { purl: "pkg:rpm/redhat/mod_ssl@2.2.3-7.el5?arch=s390x&epoch=1", }, }, }, { category: "product_version", name: "httpd-devel-0:2.2.3-7.el5.s390x", product: { name: "httpd-devel-0:2.2.3-7.el5.s390x", product_id: "httpd-devel-0:2.2.3-7.el5.s390x", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-devel@2.2.3-7.el5?arch=s390x", }, }, }, { category: "product_version", name: "httpd-debuginfo-0:2.2.3-7.el5.s390x", product: { name: "httpd-debuginfo-0:2.2.3-7.el5.s390x", product_id: "httpd-debuginfo-0:2.2.3-7.el5.s390x", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-debuginfo@2.2.3-7.el5?arch=s390x", }, }, }, { category: "product_version", name: "httpd-manual-0:2.2.3-7.el5.s390x", product: { name: "httpd-manual-0:2.2.3-7.el5.s390x", product_id: "httpd-manual-0:2.2.3-7.el5.s390x", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-manual@2.2.3-7.el5?arch=s390x", }, }, }, { category: "product_version", name: "httpd-0:2.2.3-7.el5.s390x", product: { name: "httpd-0:2.2.3-7.el5.s390x", product_id: "httpd-0:2.2.3-7.el5.s390x", product_identification_helper: { purl: "pkg:rpm/redhat/httpd@2.2.3-7.el5?arch=s390x", }, }, }, ], category: "architecture", name: "s390x", }, { branches: [ { category: "product_version", name: "httpd-devel-0:2.2.3-7.el5.s390", product: { name: "httpd-devel-0:2.2.3-7.el5.s390", product_id: "httpd-devel-0:2.2.3-7.el5.s390", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-devel@2.2.3-7.el5?arch=s390", }, }, }, { category: "product_version", name: "httpd-debuginfo-0:2.2.3-7.el5.s390", product: { name: "httpd-debuginfo-0:2.2.3-7.el5.s390", product_id: "httpd-debuginfo-0:2.2.3-7.el5.s390", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-debuginfo@2.2.3-7.el5?arch=s390", }, }, }, ], category: "architecture", name: "s390", }, ], category: "vendor", name: "Red Hat", }, ], relationships: [ { category: "default_component_of", full_product_name: { name: "httpd-0:2.2.3-7.el5.i386 as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)", product_id: "5Client-Workstation:httpd-0:2.2.3-7.el5.i386", }, product_reference: "httpd-0:2.2.3-7.el5.i386", relates_to_product_reference: "5Client-Workstation", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.2.3-7.el5.ia64 as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)", product_id: "5Client-Workstation:httpd-0:2.2.3-7.el5.ia64", }, product_reference: "httpd-0:2.2.3-7.el5.ia64", relates_to_product_reference: "5Client-Workstation", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.2.3-7.el5.ppc as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)", product_id: "5Client-Workstation:httpd-0:2.2.3-7.el5.ppc", }, product_reference: "httpd-0:2.2.3-7.el5.ppc", relates_to_product_reference: "5Client-Workstation", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.2.3-7.el5.s390x as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)", product_id: "5Client-Workstation:httpd-0:2.2.3-7.el5.s390x", }, product_reference: "httpd-0:2.2.3-7.el5.s390x", relates_to_product_reference: "5Client-Workstation", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.2.3-7.el5.src as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)", product_id: "5Client-Workstation:httpd-0:2.2.3-7.el5.src", }, product_reference: "httpd-0:2.2.3-7.el5.src", relates_to_product_reference: "5Client-Workstation", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.2.3-7.el5.x86_64 as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)", product_id: "5Client-Workstation:httpd-0:2.2.3-7.el5.x86_64", }, product_reference: "httpd-0:2.2.3-7.el5.x86_64", relates_to_product_reference: "5Client-Workstation", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.2.3-7.el5.i386 as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)", product_id: "5Client-Workstation:httpd-debuginfo-0:2.2.3-7.el5.i386", }, product_reference: "httpd-debuginfo-0:2.2.3-7.el5.i386", relates_to_product_reference: "5Client-Workstation", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.2.3-7.el5.ia64 as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)", product_id: "5Client-Workstation:httpd-debuginfo-0:2.2.3-7.el5.ia64", }, product_reference: "httpd-debuginfo-0:2.2.3-7.el5.ia64", relates_to_product_reference: "5Client-Workstation", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.2.3-7.el5.ppc as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)", product_id: "5Client-Workstation:httpd-debuginfo-0:2.2.3-7.el5.ppc", }, product_reference: "httpd-debuginfo-0:2.2.3-7.el5.ppc", relates_to_product_reference: "5Client-Workstation", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.2.3-7.el5.ppc64 as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)", product_id: "5Client-Workstation:httpd-debuginfo-0:2.2.3-7.el5.ppc64", }, product_reference: "httpd-debuginfo-0:2.2.3-7.el5.ppc64", relates_to_product_reference: "5Client-Workstation", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.2.3-7.el5.s390 as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)", product_id: "5Client-Workstation:httpd-debuginfo-0:2.2.3-7.el5.s390", }, product_reference: "httpd-debuginfo-0:2.2.3-7.el5.s390", relates_to_product_reference: "5Client-Workstation", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.2.3-7.el5.s390x as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)", product_id: "5Client-Workstation:httpd-debuginfo-0:2.2.3-7.el5.s390x", }, product_reference: "httpd-debuginfo-0:2.2.3-7.el5.s390x", relates_to_product_reference: "5Client-Workstation", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.2.3-7.el5.x86_64 as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)", product_id: "5Client-Workstation:httpd-debuginfo-0:2.2.3-7.el5.x86_64", }, product_reference: "httpd-debuginfo-0:2.2.3-7.el5.x86_64", relates_to_product_reference: "5Client-Workstation", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.2.3-7.el5.i386 as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)", product_id: "5Client-Workstation:httpd-devel-0:2.2.3-7.el5.i386", }, product_reference: "httpd-devel-0:2.2.3-7.el5.i386", relates_to_product_reference: "5Client-Workstation", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.2.3-7.el5.ia64 as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)", product_id: "5Client-Workstation:httpd-devel-0:2.2.3-7.el5.ia64", }, product_reference: "httpd-devel-0:2.2.3-7.el5.ia64", relates_to_product_reference: "5Client-Workstation", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.2.3-7.el5.ppc as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)", product_id: "5Client-Workstation:httpd-devel-0:2.2.3-7.el5.ppc", }, product_reference: "httpd-devel-0:2.2.3-7.el5.ppc", relates_to_product_reference: "5Client-Workstation", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.2.3-7.el5.ppc64 as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)", product_id: "5Client-Workstation:httpd-devel-0:2.2.3-7.el5.ppc64", }, product_reference: "httpd-devel-0:2.2.3-7.el5.ppc64", relates_to_product_reference: "5Client-Workstation", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.2.3-7.el5.s390 as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)", product_id: "5Client-Workstation:httpd-devel-0:2.2.3-7.el5.s390", }, product_reference: "httpd-devel-0:2.2.3-7.el5.s390", relates_to_product_reference: "5Client-Workstation", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.2.3-7.el5.s390x as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)", product_id: "5Client-Workstation:httpd-devel-0:2.2.3-7.el5.s390x", }, product_reference: "httpd-devel-0:2.2.3-7.el5.s390x", relates_to_product_reference: "5Client-Workstation", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.2.3-7.el5.x86_64 as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)", product_id: "5Client-Workstation:httpd-devel-0:2.2.3-7.el5.x86_64", }, product_reference: "httpd-devel-0:2.2.3-7.el5.x86_64", relates_to_product_reference: "5Client-Workstation", }, { category: "default_component_of", full_product_name: { name: "httpd-manual-0:2.2.3-7.el5.i386 as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)", product_id: "5Client-Workstation:httpd-manual-0:2.2.3-7.el5.i386", }, product_reference: "httpd-manual-0:2.2.3-7.el5.i386", relates_to_product_reference: "5Client-Workstation", }, { category: "default_component_of", full_product_name: { name: "httpd-manual-0:2.2.3-7.el5.ia64 as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)", product_id: "5Client-Workstation:httpd-manual-0:2.2.3-7.el5.ia64", }, product_reference: "httpd-manual-0:2.2.3-7.el5.ia64", relates_to_product_reference: "5Client-Workstation", }, { category: "default_component_of", full_product_name: { name: "httpd-manual-0:2.2.3-7.el5.ppc as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)", product_id: "5Client-Workstation:httpd-manual-0:2.2.3-7.el5.ppc", }, product_reference: "httpd-manual-0:2.2.3-7.el5.ppc", relates_to_product_reference: "5Client-Workstation", }, { category: "default_component_of", full_product_name: { name: "httpd-manual-0:2.2.3-7.el5.s390x as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)", product_id: "5Client-Workstation:httpd-manual-0:2.2.3-7.el5.s390x", }, product_reference: "httpd-manual-0:2.2.3-7.el5.s390x", relates_to_product_reference: "5Client-Workstation", }, { category: "default_component_of", full_product_name: { name: "httpd-manual-0:2.2.3-7.el5.x86_64 as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)", product_id: "5Client-Workstation:httpd-manual-0:2.2.3-7.el5.x86_64", }, product_reference: "httpd-manual-0:2.2.3-7.el5.x86_64", relates_to_product_reference: "5Client-Workstation", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.2.3-7.el5.i386 as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)", product_id: "5Client-Workstation:mod_ssl-1:2.2.3-7.el5.i386", }, product_reference: "mod_ssl-1:2.2.3-7.el5.i386", relates_to_product_reference: "5Client-Workstation", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.2.3-7.el5.ia64 as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)", product_id: "5Client-Workstation:mod_ssl-1:2.2.3-7.el5.ia64", }, product_reference: "mod_ssl-1:2.2.3-7.el5.ia64", relates_to_product_reference: "5Client-Workstation", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.2.3-7.el5.ppc as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)", product_id: "5Client-Workstation:mod_ssl-1:2.2.3-7.el5.ppc", }, product_reference: "mod_ssl-1:2.2.3-7.el5.ppc", relates_to_product_reference: "5Client-Workstation", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.2.3-7.el5.s390x as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)", product_id: "5Client-Workstation:mod_ssl-1:2.2.3-7.el5.s390x", }, product_reference: "mod_ssl-1:2.2.3-7.el5.s390x", relates_to_product_reference: "5Client-Workstation", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.2.3-7.el5.x86_64 as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)", product_id: "5Client-Workstation:mod_ssl-1:2.2.3-7.el5.x86_64", }, product_reference: "mod_ssl-1:2.2.3-7.el5.x86_64", relates_to_product_reference: "5Client-Workstation", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.2.3-7.el5.i386 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)", product_id: "5Client:httpd-0:2.2.3-7.el5.i386", }, product_reference: "httpd-0:2.2.3-7.el5.i386", relates_to_product_reference: "5Client", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.2.3-7.el5.ia64 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)", product_id: "5Client:httpd-0:2.2.3-7.el5.ia64", }, product_reference: "httpd-0:2.2.3-7.el5.ia64", relates_to_product_reference: "5Client", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.2.3-7.el5.ppc as a component of Red Hat Enterprise Linux Desktop (v. 5 client)", product_id: "5Client:httpd-0:2.2.3-7.el5.ppc", }, product_reference: "httpd-0:2.2.3-7.el5.ppc", relates_to_product_reference: "5Client", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.2.3-7.el5.s390x as a component of Red Hat Enterprise Linux Desktop (v. 5 client)", product_id: "5Client:httpd-0:2.2.3-7.el5.s390x", }, product_reference: "httpd-0:2.2.3-7.el5.s390x", relates_to_product_reference: "5Client", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.2.3-7.el5.src as a component of Red Hat Enterprise Linux Desktop (v. 5 client)", product_id: "5Client:httpd-0:2.2.3-7.el5.src", }, product_reference: "httpd-0:2.2.3-7.el5.src", relates_to_product_reference: "5Client", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.2.3-7.el5.x86_64 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)", product_id: "5Client:httpd-0:2.2.3-7.el5.x86_64", }, product_reference: "httpd-0:2.2.3-7.el5.x86_64", relates_to_product_reference: "5Client", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.2.3-7.el5.i386 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)", product_id: "5Client:httpd-debuginfo-0:2.2.3-7.el5.i386", }, product_reference: "httpd-debuginfo-0:2.2.3-7.el5.i386", relates_to_product_reference: "5Client", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.2.3-7.el5.ia64 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)", product_id: "5Client:httpd-debuginfo-0:2.2.3-7.el5.ia64", }, product_reference: "httpd-debuginfo-0:2.2.3-7.el5.ia64", relates_to_product_reference: "5Client", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.2.3-7.el5.ppc as a component of Red Hat Enterprise Linux Desktop (v. 5 client)", product_id: "5Client:httpd-debuginfo-0:2.2.3-7.el5.ppc", }, product_reference: "httpd-debuginfo-0:2.2.3-7.el5.ppc", relates_to_product_reference: "5Client", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.2.3-7.el5.ppc64 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)", product_id: "5Client:httpd-debuginfo-0:2.2.3-7.el5.ppc64", }, product_reference: "httpd-debuginfo-0:2.2.3-7.el5.ppc64", relates_to_product_reference: "5Client", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.2.3-7.el5.s390 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)", product_id: "5Client:httpd-debuginfo-0:2.2.3-7.el5.s390", }, product_reference: "httpd-debuginfo-0:2.2.3-7.el5.s390", relates_to_product_reference: "5Client", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.2.3-7.el5.s390x as a component of Red Hat Enterprise Linux Desktop (v. 5 client)", product_id: "5Client:httpd-debuginfo-0:2.2.3-7.el5.s390x", }, product_reference: "httpd-debuginfo-0:2.2.3-7.el5.s390x", relates_to_product_reference: "5Client", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.2.3-7.el5.x86_64 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)", product_id: "5Client:httpd-debuginfo-0:2.2.3-7.el5.x86_64", }, product_reference: "httpd-debuginfo-0:2.2.3-7.el5.x86_64", relates_to_product_reference: "5Client", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.2.3-7.el5.i386 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)", product_id: "5Client:httpd-devel-0:2.2.3-7.el5.i386", }, product_reference: "httpd-devel-0:2.2.3-7.el5.i386", relates_to_product_reference: "5Client", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.2.3-7.el5.ia64 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)", product_id: "5Client:httpd-devel-0:2.2.3-7.el5.ia64", }, product_reference: "httpd-devel-0:2.2.3-7.el5.ia64", relates_to_product_reference: "5Client", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.2.3-7.el5.ppc as a component of Red Hat Enterprise Linux Desktop (v. 5 client)", product_id: "5Client:httpd-devel-0:2.2.3-7.el5.ppc", }, product_reference: "httpd-devel-0:2.2.3-7.el5.ppc", relates_to_product_reference: "5Client", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.2.3-7.el5.ppc64 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)", product_id: "5Client:httpd-devel-0:2.2.3-7.el5.ppc64", }, product_reference: "httpd-devel-0:2.2.3-7.el5.ppc64", relates_to_product_reference: "5Client", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.2.3-7.el5.s390 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)", product_id: "5Client:httpd-devel-0:2.2.3-7.el5.s390", }, product_reference: "httpd-devel-0:2.2.3-7.el5.s390", relates_to_product_reference: "5Client", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.2.3-7.el5.s390x as a component of Red Hat Enterprise Linux Desktop (v. 5 client)", product_id: "5Client:httpd-devel-0:2.2.3-7.el5.s390x", }, product_reference: "httpd-devel-0:2.2.3-7.el5.s390x", relates_to_product_reference: "5Client", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.2.3-7.el5.x86_64 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)", product_id: "5Client:httpd-devel-0:2.2.3-7.el5.x86_64", }, product_reference: "httpd-devel-0:2.2.3-7.el5.x86_64", relates_to_product_reference: "5Client", }, { category: "default_component_of", full_product_name: { name: "httpd-manual-0:2.2.3-7.el5.i386 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)", product_id: "5Client:httpd-manual-0:2.2.3-7.el5.i386", }, product_reference: "httpd-manual-0:2.2.3-7.el5.i386", relates_to_product_reference: "5Client", }, { category: "default_component_of", full_product_name: { name: "httpd-manual-0:2.2.3-7.el5.ia64 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)", product_id: "5Client:httpd-manual-0:2.2.3-7.el5.ia64", }, product_reference: "httpd-manual-0:2.2.3-7.el5.ia64", relates_to_product_reference: "5Client", }, { category: "default_component_of", full_product_name: { name: "httpd-manual-0:2.2.3-7.el5.ppc as a component of Red Hat Enterprise Linux Desktop (v. 5 client)", product_id: "5Client:httpd-manual-0:2.2.3-7.el5.ppc", }, product_reference: "httpd-manual-0:2.2.3-7.el5.ppc", relates_to_product_reference: "5Client", }, { category: "default_component_of", full_product_name: { name: "httpd-manual-0:2.2.3-7.el5.s390x as a component of Red Hat Enterprise Linux Desktop (v. 5 client)", product_id: "5Client:httpd-manual-0:2.2.3-7.el5.s390x", }, product_reference: "httpd-manual-0:2.2.3-7.el5.s390x", relates_to_product_reference: "5Client", }, { category: "default_component_of", full_product_name: { name: "httpd-manual-0:2.2.3-7.el5.x86_64 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)", product_id: "5Client:httpd-manual-0:2.2.3-7.el5.x86_64", }, product_reference: "httpd-manual-0:2.2.3-7.el5.x86_64", relates_to_product_reference: "5Client", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.2.3-7.el5.i386 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)", product_id: "5Client:mod_ssl-1:2.2.3-7.el5.i386", }, product_reference: "mod_ssl-1:2.2.3-7.el5.i386", relates_to_product_reference: "5Client", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.2.3-7.el5.ia64 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)", product_id: "5Client:mod_ssl-1:2.2.3-7.el5.ia64", }, product_reference: "mod_ssl-1:2.2.3-7.el5.ia64", relates_to_product_reference: "5Client", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.2.3-7.el5.ppc as a component of Red Hat Enterprise Linux Desktop (v. 5 client)", product_id: "5Client:mod_ssl-1:2.2.3-7.el5.ppc", }, product_reference: "mod_ssl-1:2.2.3-7.el5.ppc", relates_to_product_reference: "5Client", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.2.3-7.el5.s390x as a component of Red Hat Enterprise Linux Desktop (v. 5 client)", product_id: "5Client:mod_ssl-1:2.2.3-7.el5.s390x", }, product_reference: "mod_ssl-1:2.2.3-7.el5.s390x", relates_to_product_reference: "5Client", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.2.3-7.el5.x86_64 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)", product_id: "5Client:mod_ssl-1:2.2.3-7.el5.x86_64", }, product_reference: "mod_ssl-1:2.2.3-7.el5.x86_64", relates_to_product_reference: "5Client", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.2.3-7.el5.i386 as a component of Red Hat Enterprise Linux (v. 5 server)", product_id: "5Server:httpd-0:2.2.3-7.el5.i386", }, product_reference: "httpd-0:2.2.3-7.el5.i386", relates_to_product_reference: "5Server", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.2.3-7.el5.ia64 as a component of Red Hat Enterprise Linux (v. 5 server)", product_id: "5Server:httpd-0:2.2.3-7.el5.ia64", }, product_reference: "httpd-0:2.2.3-7.el5.ia64", relates_to_product_reference: "5Server", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.2.3-7.el5.ppc as a component of Red Hat Enterprise Linux (v. 5 server)", product_id: "5Server:httpd-0:2.2.3-7.el5.ppc", }, product_reference: "httpd-0:2.2.3-7.el5.ppc", relates_to_product_reference: "5Server", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.2.3-7.el5.s390x as a component of Red Hat Enterprise Linux (v. 5 server)", product_id: "5Server:httpd-0:2.2.3-7.el5.s390x", }, product_reference: "httpd-0:2.2.3-7.el5.s390x", relates_to_product_reference: "5Server", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.2.3-7.el5.src as a component of Red Hat Enterprise Linux (v. 5 server)", product_id: "5Server:httpd-0:2.2.3-7.el5.src", }, product_reference: "httpd-0:2.2.3-7.el5.src", relates_to_product_reference: "5Server", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.2.3-7.el5.x86_64 as a component of Red Hat Enterprise Linux (v. 5 server)", product_id: "5Server:httpd-0:2.2.3-7.el5.x86_64", }, product_reference: "httpd-0:2.2.3-7.el5.x86_64", relates_to_product_reference: "5Server", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.2.3-7.el5.i386 as a component of Red Hat Enterprise Linux (v. 5 server)", product_id: "5Server:httpd-debuginfo-0:2.2.3-7.el5.i386", }, product_reference: "httpd-debuginfo-0:2.2.3-7.el5.i386", relates_to_product_reference: "5Server", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.2.3-7.el5.ia64 as a component of Red Hat Enterprise Linux (v. 5 server)", product_id: "5Server:httpd-debuginfo-0:2.2.3-7.el5.ia64", }, product_reference: "httpd-debuginfo-0:2.2.3-7.el5.ia64", relates_to_product_reference: "5Server", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.2.3-7.el5.ppc as a component of Red Hat Enterprise Linux (v. 5 server)", product_id: "5Server:httpd-debuginfo-0:2.2.3-7.el5.ppc", }, product_reference: "httpd-debuginfo-0:2.2.3-7.el5.ppc", relates_to_product_reference: "5Server", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.2.3-7.el5.ppc64 as a component of Red Hat Enterprise Linux (v. 5 server)", product_id: "5Server:httpd-debuginfo-0:2.2.3-7.el5.ppc64", }, product_reference: "httpd-debuginfo-0:2.2.3-7.el5.ppc64", relates_to_product_reference: "5Server", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.2.3-7.el5.s390 as a component of Red Hat Enterprise Linux (v. 5 server)", product_id: "5Server:httpd-debuginfo-0:2.2.3-7.el5.s390", }, product_reference: "httpd-debuginfo-0:2.2.3-7.el5.s390", relates_to_product_reference: "5Server", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.2.3-7.el5.s390x as a component of Red Hat Enterprise Linux (v. 5 server)", product_id: "5Server:httpd-debuginfo-0:2.2.3-7.el5.s390x", }, product_reference: "httpd-debuginfo-0:2.2.3-7.el5.s390x", relates_to_product_reference: "5Server", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.2.3-7.el5.x86_64 as a component of Red Hat Enterprise Linux (v. 5 server)", product_id: "5Server:httpd-debuginfo-0:2.2.3-7.el5.x86_64", }, product_reference: "httpd-debuginfo-0:2.2.3-7.el5.x86_64", relates_to_product_reference: "5Server", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.2.3-7.el5.i386 as a component of Red Hat Enterprise Linux (v. 5 server)", product_id: "5Server:httpd-devel-0:2.2.3-7.el5.i386", }, product_reference: "httpd-devel-0:2.2.3-7.el5.i386", relates_to_product_reference: "5Server", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.2.3-7.el5.ia64 as a component of Red Hat Enterprise Linux (v. 5 server)", product_id: "5Server:httpd-devel-0:2.2.3-7.el5.ia64", }, product_reference: "httpd-devel-0:2.2.3-7.el5.ia64", relates_to_product_reference: "5Server", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.2.3-7.el5.ppc as a component of Red Hat Enterprise Linux (v. 5 server)", product_id: "5Server:httpd-devel-0:2.2.3-7.el5.ppc", }, product_reference: "httpd-devel-0:2.2.3-7.el5.ppc", relates_to_product_reference: "5Server", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.2.3-7.el5.ppc64 as a component of Red Hat Enterprise Linux (v. 5 server)", product_id: "5Server:httpd-devel-0:2.2.3-7.el5.ppc64", }, product_reference: "httpd-devel-0:2.2.3-7.el5.ppc64", relates_to_product_reference: "5Server", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.2.3-7.el5.s390 as a component of Red Hat Enterprise Linux (v. 5 server)", product_id: "5Server:httpd-devel-0:2.2.3-7.el5.s390", }, product_reference: "httpd-devel-0:2.2.3-7.el5.s390", relates_to_product_reference: "5Server", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.2.3-7.el5.s390x as a component of Red Hat Enterprise Linux (v. 5 server)", product_id: "5Server:httpd-devel-0:2.2.3-7.el5.s390x", }, product_reference: "httpd-devel-0:2.2.3-7.el5.s390x", relates_to_product_reference: "5Server", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.2.3-7.el5.x86_64 as a component of Red Hat Enterprise Linux (v. 5 server)", product_id: "5Server:httpd-devel-0:2.2.3-7.el5.x86_64", }, product_reference: "httpd-devel-0:2.2.3-7.el5.x86_64", relates_to_product_reference: "5Server", }, { category: "default_component_of", full_product_name: { name: "httpd-manual-0:2.2.3-7.el5.i386 as a component of Red Hat Enterprise Linux (v. 5 server)", product_id: "5Server:httpd-manual-0:2.2.3-7.el5.i386", }, product_reference: "httpd-manual-0:2.2.3-7.el5.i386", relates_to_product_reference: "5Server", }, { category: "default_component_of", full_product_name: { name: "httpd-manual-0:2.2.3-7.el5.ia64 as a component of Red Hat Enterprise Linux (v. 5 server)", product_id: "5Server:httpd-manual-0:2.2.3-7.el5.ia64", }, product_reference: "httpd-manual-0:2.2.3-7.el5.ia64", relates_to_product_reference: "5Server", }, { category: "default_component_of", full_product_name: { name: "httpd-manual-0:2.2.3-7.el5.ppc as a component of Red Hat Enterprise Linux (v. 5 server)", product_id: "5Server:httpd-manual-0:2.2.3-7.el5.ppc", }, product_reference: "httpd-manual-0:2.2.3-7.el5.ppc", relates_to_product_reference: "5Server", }, { category: "default_component_of", full_product_name: { name: "httpd-manual-0:2.2.3-7.el5.s390x as a component of Red Hat Enterprise Linux (v. 5 server)", product_id: "5Server:httpd-manual-0:2.2.3-7.el5.s390x", }, product_reference: "httpd-manual-0:2.2.3-7.el5.s390x", relates_to_product_reference: "5Server", }, { category: "default_component_of", full_product_name: { name: "httpd-manual-0:2.2.3-7.el5.x86_64 as a component of Red Hat Enterprise Linux (v. 5 server)", product_id: "5Server:httpd-manual-0:2.2.3-7.el5.x86_64", }, product_reference: "httpd-manual-0:2.2.3-7.el5.x86_64", relates_to_product_reference: "5Server", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.2.3-7.el5.i386 as a component of Red Hat Enterprise Linux (v. 5 server)", product_id: "5Server:mod_ssl-1:2.2.3-7.el5.i386", }, product_reference: "mod_ssl-1:2.2.3-7.el5.i386", relates_to_product_reference: "5Server", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.2.3-7.el5.ia64 as a component of Red Hat Enterprise Linux (v. 5 server)", product_id: "5Server:mod_ssl-1:2.2.3-7.el5.ia64", }, product_reference: "mod_ssl-1:2.2.3-7.el5.ia64", relates_to_product_reference: "5Server", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.2.3-7.el5.ppc as a component of Red Hat Enterprise Linux (v. 5 server)", product_id: "5Server:mod_ssl-1:2.2.3-7.el5.ppc", }, product_reference: "mod_ssl-1:2.2.3-7.el5.ppc", relates_to_product_reference: "5Server", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.2.3-7.el5.s390x as a component of Red Hat Enterprise Linux (v. 5 server)", product_id: "5Server:mod_ssl-1:2.2.3-7.el5.s390x", }, product_reference: "mod_ssl-1:2.2.3-7.el5.s390x", relates_to_product_reference: "5Server", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.2.3-7.el5.x86_64 as a component of Red Hat Enterprise Linux (v. 5 server)", product_id: "5Server:mod_ssl-1:2.2.3-7.el5.x86_64", }, product_reference: "mod_ssl-1:2.2.3-7.el5.x86_64", relates_to_product_reference: "5Server", }, ], }, vulnerabilities: [ { cve: "CVE-2006-5752", cwe: { id: "CWE-79", name: "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", }, discovery_date: "2007-06-20T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "245112", }, ], notes: [ { category: "description", text: "Cross-site scripting (XSS) vulnerability in mod_status.c in the mod_status module in Apache HTTP Server (httpd), when ExtendedStatus is enabled and a public server-status page is used, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors involving charsets with browsers that perform \"charset detection\" when the content-type is not specified.", title: "Vulnerability description", }, { category: "summary", text: "httpd mod_status XSS", title: "Vulnerability summary", }, ], product_status: { fixed: [ "5Client-Workstation:httpd-0:2.2.3-7.el5.i386", "5Client-Workstation:httpd-0:2.2.3-7.el5.ia64", "5Client-Workstation:httpd-0:2.2.3-7.el5.ppc", "5Client-Workstation:httpd-0:2.2.3-7.el5.s390x", "5Client-Workstation:httpd-0:2.2.3-7.el5.src", "5Client-Workstation:httpd-0:2.2.3-7.el5.x86_64", "5Client-Workstation:httpd-debuginfo-0:2.2.3-7.el5.i386", "5Client-Workstation:httpd-debuginfo-0:2.2.3-7.el5.ia64", "5Client-Workstation:httpd-debuginfo-0:2.2.3-7.el5.ppc", "5Client-Workstation:httpd-debuginfo-0:2.2.3-7.el5.ppc64", "5Client-Workstation:httpd-debuginfo-0:2.2.3-7.el5.s390", "5Client-Workstation:httpd-debuginfo-0:2.2.3-7.el5.s390x", "5Client-Workstation:httpd-debuginfo-0:2.2.3-7.el5.x86_64", "5Client-Workstation:httpd-devel-0:2.2.3-7.el5.i386", "5Client-Workstation:httpd-devel-0:2.2.3-7.el5.ia64", "5Client-Workstation:httpd-devel-0:2.2.3-7.el5.ppc", "5Client-Workstation:httpd-devel-0:2.2.3-7.el5.ppc64", "5Client-Workstation:httpd-devel-0:2.2.3-7.el5.s390", "5Client-Workstation:httpd-devel-0:2.2.3-7.el5.s390x", "5Client-Workstation:httpd-devel-0:2.2.3-7.el5.x86_64", "5Client-Workstation:httpd-manual-0:2.2.3-7.el5.i386", "5Client-Workstation:httpd-manual-0:2.2.3-7.el5.ia64", "5Client-Workstation:httpd-manual-0:2.2.3-7.el5.ppc", "5Client-Workstation:httpd-manual-0:2.2.3-7.el5.s390x", "5Client-Workstation:httpd-manual-0:2.2.3-7.el5.x86_64", "5Client-Workstation:mod_ssl-1:2.2.3-7.el5.i386", "5Client-Workstation:mod_ssl-1:2.2.3-7.el5.ia64", "5Client-Workstation:mod_ssl-1:2.2.3-7.el5.ppc", "5Client-Workstation:mod_ssl-1:2.2.3-7.el5.s390x", "5Client-Workstation:mod_ssl-1:2.2.3-7.el5.x86_64", "5Client:httpd-0:2.2.3-7.el5.i386", "5Client:httpd-0:2.2.3-7.el5.ia64", "5Client:httpd-0:2.2.3-7.el5.ppc", "5Client:httpd-0:2.2.3-7.el5.s390x", "5Client:httpd-0:2.2.3-7.el5.src", "5Client:httpd-0:2.2.3-7.el5.x86_64", "5Client:httpd-debuginfo-0:2.2.3-7.el5.i386", "5Client:httpd-debuginfo-0:2.2.3-7.el5.ia64", "5Client:httpd-debuginfo-0:2.2.3-7.el5.ppc", "5Client:httpd-debuginfo-0:2.2.3-7.el5.ppc64", "5Client:httpd-debuginfo-0:2.2.3-7.el5.s390", "5Client:httpd-debuginfo-0:2.2.3-7.el5.s390x", "5Client:httpd-debuginfo-0:2.2.3-7.el5.x86_64", "5Client:httpd-devel-0:2.2.3-7.el5.i386", "5Client:httpd-devel-0:2.2.3-7.el5.ia64", "5Client:httpd-devel-0:2.2.3-7.el5.ppc", "5Client:httpd-devel-0:2.2.3-7.el5.ppc64", "5Client:httpd-devel-0:2.2.3-7.el5.s390", "5Client:httpd-devel-0:2.2.3-7.el5.s390x", "5Client:httpd-devel-0:2.2.3-7.el5.x86_64", "5Client:httpd-manual-0:2.2.3-7.el5.i386", "5Client:httpd-manual-0:2.2.3-7.el5.ia64", "5Client:httpd-manual-0:2.2.3-7.el5.ppc", "5Client:httpd-manual-0:2.2.3-7.el5.s390x", "5Client:httpd-manual-0:2.2.3-7.el5.x86_64", "5Client:mod_ssl-1:2.2.3-7.el5.i386", "5Client:mod_ssl-1:2.2.3-7.el5.ia64", "5Client:mod_ssl-1:2.2.3-7.el5.ppc", "5Client:mod_ssl-1:2.2.3-7.el5.s390x", "5Client:mod_ssl-1:2.2.3-7.el5.x86_64", "5Server:httpd-0:2.2.3-7.el5.i386", "5Server:httpd-0:2.2.3-7.el5.ia64", "5Server:httpd-0:2.2.3-7.el5.ppc", "5Server:httpd-0:2.2.3-7.el5.s390x", "5Server:httpd-0:2.2.3-7.el5.src", "5Server:httpd-0:2.2.3-7.el5.x86_64", "5Server:httpd-debuginfo-0:2.2.3-7.el5.i386", "5Server:httpd-debuginfo-0:2.2.3-7.el5.ia64", "5Server:httpd-debuginfo-0:2.2.3-7.el5.ppc", "5Server:httpd-debuginfo-0:2.2.3-7.el5.ppc64", "5Server:httpd-debuginfo-0:2.2.3-7.el5.s390", "5Server:httpd-debuginfo-0:2.2.3-7.el5.s390x", "5Server:httpd-debuginfo-0:2.2.3-7.el5.x86_64", "5Server:httpd-devel-0:2.2.3-7.el5.i386", "5Server:httpd-devel-0:2.2.3-7.el5.ia64", "5Server:httpd-devel-0:2.2.3-7.el5.ppc", "5Server:httpd-devel-0:2.2.3-7.el5.ppc64", "5Server:httpd-devel-0:2.2.3-7.el5.s390", "5Server:httpd-devel-0:2.2.3-7.el5.s390x", "5Server:httpd-devel-0:2.2.3-7.el5.x86_64", "5Server:httpd-manual-0:2.2.3-7.el5.i386", "5Server:httpd-manual-0:2.2.3-7.el5.ia64", "5Server:httpd-manual-0:2.2.3-7.el5.ppc", "5Server:httpd-manual-0:2.2.3-7.el5.s390x", "5Server:httpd-manual-0:2.2.3-7.el5.x86_64", "5Server:mod_ssl-1:2.2.3-7.el5.i386", "5Server:mod_ssl-1:2.2.3-7.el5.ia64", "5Server:mod_ssl-1:2.2.3-7.el5.ppc", "5Server:mod_ssl-1:2.2.3-7.el5.s390x", "5Server:mod_ssl-1:2.2.3-7.el5.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2006-5752", }, { category: "external", summary: "RHBZ#245112", url: "https://bugzilla.redhat.com/show_bug.cgi?id=245112", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2006-5752", url: "https://www.cve.org/CVERecord?id=CVE-2006-5752", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2006-5752", url: "https://nvd.nist.gov/vuln/detail/CVE-2006-5752", }, ], release_date: "2007-06-20T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2007-06-26T15:22:00+00:00", details: "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied. \n\nThis update is available via Red Hat Network. Details on how to use \nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/FAQ_58_10188", product_ids: [ "5Client-Workstation:httpd-0:2.2.3-7.el5.i386", "5Client-Workstation:httpd-0:2.2.3-7.el5.ia64", "5Client-Workstation:httpd-0:2.2.3-7.el5.ppc", "5Client-Workstation:httpd-0:2.2.3-7.el5.s390x", "5Client-Workstation:httpd-0:2.2.3-7.el5.src", "5Client-Workstation:httpd-0:2.2.3-7.el5.x86_64", "5Client-Workstation:httpd-debuginfo-0:2.2.3-7.el5.i386", "5Client-Workstation:httpd-debuginfo-0:2.2.3-7.el5.ia64", "5Client-Workstation:httpd-debuginfo-0:2.2.3-7.el5.ppc", "5Client-Workstation:httpd-debuginfo-0:2.2.3-7.el5.ppc64", "5Client-Workstation:httpd-debuginfo-0:2.2.3-7.el5.s390", "5Client-Workstation:httpd-debuginfo-0:2.2.3-7.el5.s390x", "5Client-Workstation:httpd-debuginfo-0:2.2.3-7.el5.x86_64", "5Client-Workstation:httpd-devel-0:2.2.3-7.el5.i386", "5Client-Workstation:httpd-devel-0:2.2.3-7.el5.ia64", "5Client-Workstation:httpd-devel-0:2.2.3-7.el5.ppc", "5Client-Workstation:httpd-devel-0:2.2.3-7.el5.ppc64", "5Client-Workstation:httpd-devel-0:2.2.3-7.el5.s390", "5Client-Workstation:httpd-devel-0:2.2.3-7.el5.s390x", "5Client-Workstation:httpd-devel-0:2.2.3-7.el5.x86_64", "5Client-Workstation:httpd-manual-0:2.2.3-7.el5.i386", "5Client-Workstation:httpd-manual-0:2.2.3-7.el5.ia64", "5Client-Workstation:httpd-manual-0:2.2.3-7.el5.ppc", "5Client-Workstation:httpd-manual-0:2.2.3-7.el5.s390x", "5Client-Workstation:httpd-manual-0:2.2.3-7.el5.x86_64", "5Client-Workstation:mod_ssl-1:2.2.3-7.el5.i386", "5Client-Workstation:mod_ssl-1:2.2.3-7.el5.ia64", "5Client-Workstation:mod_ssl-1:2.2.3-7.el5.ppc", "5Client-Workstation:mod_ssl-1:2.2.3-7.el5.s390x", "5Client-Workstation:mod_ssl-1:2.2.3-7.el5.x86_64", "5Client:httpd-0:2.2.3-7.el5.i386", "5Client:httpd-0:2.2.3-7.el5.ia64", "5Client:httpd-0:2.2.3-7.el5.ppc", "5Client:httpd-0:2.2.3-7.el5.s390x", "5Client:httpd-0:2.2.3-7.el5.src", "5Client:httpd-0:2.2.3-7.el5.x86_64", "5Client:httpd-debuginfo-0:2.2.3-7.el5.i386", "5Client:httpd-debuginfo-0:2.2.3-7.el5.ia64", "5Client:httpd-debuginfo-0:2.2.3-7.el5.ppc", "5Client:httpd-debuginfo-0:2.2.3-7.el5.ppc64", "5Client:httpd-debuginfo-0:2.2.3-7.el5.s390", "5Client:httpd-debuginfo-0:2.2.3-7.el5.s390x", "5Client:httpd-debuginfo-0:2.2.3-7.el5.x86_64", "5Client:httpd-devel-0:2.2.3-7.el5.i386", "5Client:httpd-devel-0:2.2.3-7.el5.ia64", "5Client:httpd-devel-0:2.2.3-7.el5.ppc", "5Client:httpd-devel-0:2.2.3-7.el5.ppc64", "5Client:httpd-devel-0:2.2.3-7.el5.s390", "5Client:httpd-devel-0:2.2.3-7.el5.s390x", "5Client:httpd-devel-0:2.2.3-7.el5.x86_64", "5Client:httpd-manual-0:2.2.3-7.el5.i386", "5Client:httpd-manual-0:2.2.3-7.el5.ia64", "5Client:httpd-manual-0:2.2.3-7.el5.ppc", "5Client:httpd-manual-0:2.2.3-7.el5.s390x", "5Client:httpd-manual-0:2.2.3-7.el5.x86_64", "5Client:mod_ssl-1:2.2.3-7.el5.i386", "5Client:mod_ssl-1:2.2.3-7.el5.ia64", "5Client:mod_ssl-1:2.2.3-7.el5.ppc", "5Client:mod_ssl-1:2.2.3-7.el5.s390x", "5Client:mod_ssl-1:2.2.3-7.el5.x86_64", "5Server:httpd-0:2.2.3-7.el5.i386", "5Server:httpd-0:2.2.3-7.el5.ia64", "5Server:httpd-0:2.2.3-7.el5.ppc", "5Server:httpd-0:2.2.3-7.el5.s390x", "5Server:httpd-0:2.2.3-7.el5.src", "5Server:httpd-0:2.2.3-7.el5.x86_64", "5Server:httpd-debuginfo-0:2.2.3-7.el5.i386", "5Server:httpd-debuginfo-0:2.2.3-7.el5.ia64", "5Server:httpd-debuginfo-0:2.2.3-7.el5.ppc", "5Server:httpd-debuginfo-0:2.2.3-7.el5.ppc64", "5Server:httpd-debuginfo-0:2.2.3-7.el5.s390", "5Server:httpd-debuginfo-0:2.2.3-7.el5.s390x", "5Server:httpd-debuginfo-0:2.2.3-7.el5.x86_64", "5Server:httpd-devel-0:2.2.3-7.el5.i386", "5Server:httpd-devel-0:2.2.3-7.el5.ia64", "5Server:httpd-devel-0:2.2.3-7.el5.ppc", "5Server:httpd-devel-0:2.2.3-7.el5.ppc64", "5Server:httpd-devel-0:2.2.3-7.el5.s390", "5Server:httpd-devel-0:2.2.3-7.el5.s390x", "5Server:httpd-devel-0:2.2.3-7.el5.x86_64", "5Server:httpd-manual-0:2.2.3-7.el5.i386", "5Server:httpd-manual-0:2.2.3-7.el5.ia64", "5Server:httpd-manual-0:2.2.3-7.el5.ppc", "5Server:httpd-manual-0:2.2.3-7.el5.s390x", "5Server:httpd-manual-0:2.2.3-7.el5.x86_64", "5Server:mod_ssl-1:2.2.3-7.el5.i386", "5Server:mod_ssl-1:2.2.3-7.el5.ia64", "5Server:mod_ssl-1:2.2.3-7.el5.ppc", "5Server:mod_ssl-1:2.2.3-7.el5.s390x", "5Server:mod_ssl-1:2.2.3-7.el5.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2007:0556", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "httpd mod_status XSS", }, { cve: "CVE-2007-1863", discovery_date: "2007-05-02T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "244658", }, ], notes: [ { category: "description", text: "cache_util.c in the mod_cache module in Apache HTTP Server (httpd), when caching is enabled and a threaded Multi-Processing Module (MPM) is used, allows remote attackers to cause a denial of service (child processing handler crash) via a request with the (1) s-maxage, (2) max-age, (3) min-fresh, or (4) max-stale Cache-Control headers without a value.", title: "Vulnerability description", }, { category: "summary", text: "httpd mod_cache segfault", title: "Vulnerability summary", }, ], product_status: { fixed: [ "5Client-Workstation:httpd-0:2.2.3-7.el5.i386", "5Client-Workstation:httpd-0:2.2.3-7.el5.ia64", "5Client-Workstation:httpd-0:2.2.3-7.el5.ppc", "5Client-Workstation:httpd-0:2.2.3-7.el5.s390x", "5Client-Workstation:httpd-0:2.2.3-7.el5.src", "5Client-Workstation:httpd-0:2.2.3-7.el5.x86_64", "5Client-Workstation:httpd-debuginfo-0:2.2.3-7.el5.i386", "5Client-Workstation:httpd-debuginfo-0:2.2.3-7.el5.ia64", "5Client-Workstation:httpd-debuginfo-0:2.2.3-7.el5.ppc", "5Client-Workstation:httpd-debuginfo-0:2.2.3-7.el5.ppc64", "5Client-Workstation:httpd-debuginfo-0:2.2.3-7.el5.s390", "5Client-Workstation:httpd-debuginfo-0:2.2.3-7.el5.s390x", "5Client-Workstation:httpd-debuginfo-0:2.2.3-7.el5.x86_64", "5Client-Workstation:httpd-devel-0:2.2.3-7.el5.i386", "5Client-Workstation:httpd-devel-0:2.2.3-7.el5.ia64", "5Client-Workstation:httpd-devel-0:2.2.3-7.el5.ppc", "5Client-Workstation:httpd-devel-0:2.2.3-7.el5.ppc64", "5Client-Workstation:httpd-devel-0:2.2.3-7.el5.s390", "5Client-Workstation:httpd-devel-0:2.2.3-7.el5.s390x", "5Client-Workstation:httpd-devel-0:2.2.3-7.el5.x86_64", "5Client-Workstation:httpd-manual-0:2.2.3-7.el5.i386", "5Client-Workstation:httpd-manual-0:2.2.3-7.el5.ia64", "5Client-Workstation:httpd-manual-0:2.2.3-7.el5.ppc", "5Client-Workstation:httpd-manual-0:2.2.3-7.el5.s390x", "5Client-Workstation:httpd-manual-0:2.2.3-7.el5.x86_64", "5Client-Workstation:mod_ssl-1:2.2.3-7.el5.i386", "5Client-Workstation:mod_ssl-1:2.2.3-7.el5.ia64", "5Client-Workstation:mod_ssl-1:2.2.3-7.el5.ppc", "5Client-Workstation:mod_ssl-1:2.2.3-7.el5.s390x", "5Client-Workstation:mod_ssl-1:2.2.3-7.el5.x86_64", "5Client:httpd-0:2.2.3-7.el5.i386", "5Client:httpd-0:2.2.3-7.el5.ia64", "5Client:httpd-0:2.2.3-7.el5.ppc", "5Client:httpd-0:2.2.3-7.el5.s390x", "5Client:httpd-0:2.2.3-7.el5.src", "5Client:httpd-0:2.2.3-7.el5.x86_64", "5Client:httpd-debuginfo-0:2.2.3-7.el5.i386", "5Client:httpd-debuginfo-0:2.2.3-7.el5.ia64", "5Client:httpd-debuginfo-0:2.2.3-7.el5.ppc", "5Client:httpd-debuginfo-0:2.2.3-7.el5.ppc64", "5Client:httpd-debuginfo-0:2.2.3-7.el5.s390", "5Client:httpd-debuginfo-0:2.2.3-7.el5.s390x", "5Client:httpd-debuginfo-0:2.2.3-7.el5.x86_64", "5Client:httpd-devel-0:2.2.3-7.el5.i386", "5Client:httpd-devel-0:2.2.3-7.el5.ia64", "5Client:httpd-devel-0:2.2.3-7.el5.ppc", "5Client:httpd-devel-0:2.2.3-7.el5.ppc64", "5Client:httpd-devel-0:2.2.3-7.el5.s390", "5Client:httpd-devel-0:2.2.3-7.el5.s390x", "5Client:httpd-devel-0:2.2.3-7.el5.x86_64", "5Client:httpd-manual-0:2.2.3-7.el5.i386", "5Client:httpd-manual-0:2.2.3-7.el5.ia64", "5Client:httpd-manual-0:2.2.3-7.el5.ppc", "5Client:httpd-manual-0:2.2.3-7.el5.s390x", "5Client:httpd-manual-0:2.2.3-7.el5.x86_64", "5Client:mod_ssl-1:2.2.3-7.el5.i386", "5Client:mod_ssl-1:2.2.3-7.el5.ia64", "5Client:mod_ssl-1:2.2.3-7.el5.ppc", "5Client:mod_ssl-1:2.2.3-7.el5.s390x", "5Client:mod_ssl-1:2.2.3-7.el5.x86_64", "5Server:httpd-0:2.2.3-7.el5.i386", "5Server:httpd-0:2.2.3-7.el5.ia64", "5Server:httpd-0:2.2.3-7.el5.ppc", "5Server:httpd-0:2.2.3-7.el5.s390x", "5Server:httpd-0:2.2.3-7.el5.src", "5Server:httpd-0:2.2.3-7.el5.x86_64", "5Server:httpd-debuginfo-0:2.2.3-7.el5.i386", "5Server:httpd-debuginfo-0:2.2.3-7.el5.ia64", "5Server:httpd-debuginfo-0:2.2.3-7.el5.ppc", "5Server:httpd-debuginfo-0:2.2.3-7.el5.ppc64", "5Server:httpd-debuginfo-0:2.2.3-7.el5.s390", "5Server:httpd-debuginfo-0:2.2.3-7.el5.s390x", "5Server:httpd-debuginfo-0:2.2.3-7.el5.x86_64", "5Server:httpd-devel-0:2.2.3-7.el5.i386", "5Server:httpd-devel-0:2.2.3-7.el5.ia64", "5Server:httpd-devel-0:2.2.3-7.el5.ppc", "5Server:httpd-devel-0:2.2.3-7.el5.ppc64", "5Server:httpd-devel-0:2.2.3-7.el5.s390", "5Server:httpd-devel-0:2.2.3-7.el5.s390x", "5Server:httpd-devel-0:2.2.3-7.el5.x86_64", "5Server:httpd-manual-0:2.2.3-7.el5.i386", "5Server:httpd-manual-0:2.2.3-7.el5.ia64", "5Server:httpd-manual-0:2.2.3-7.el5.ppc", "5Server:httpd-manual-0:2.2.3-7.el5.s390x", "5Server:httpd-manual-0:2.2.3-7.el5.x86_64", "5Server:mod_ssl-1:2.2.3-7.el5.i386", "5Server:mod_ssl-1:2.2.3-7.el5.ia64", "5Server:mod_ssl-1:2.2.3-7.el5.ppc", "5Server:mod_ssl-1:2.2.3-7.el5.s390x", "5Server:mod_ssl-1:2.2.3-7.el5.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-1863", }, { category: "external", summary: "RHBZ#244658", url: "https://bugzilla.redhat.com/show_bug.cgi?id=244658", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-1863", url: "https://www.cve.org/CVERecord?id=CVE-2007-1863", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-1863", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-1863", }, ], release_date: "2007-05-02T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2007-06-26T15:22:00+00:00", details: "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied. \n\nThis update is available via Red Hat Network. Details on how to use \nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/FAQ_58_10188", product_ids: [ "5Client-Workstation:httpd-0:2.2.3-7.el5.i386", "5Client-Workstation:httpd-0:2.2.3-7.el5.ia64", "5Client-Workstation:httpd-0:2.2.3-7.el5.ppc", "5Client-Workstation:httpd-0:2.2.3-7.el5.s390x", "5Client-Workstation:httpd-0:2.2.3-7.el5.src", "5Client-Workstation:httpd-0:2.2.3-7.el5.x86_64", "5Client-Workstation:httpd-debuginfo-0:2.2.3-7.el5.i386", "5Client-Workstation:httpd-debuginfo-0:2.2.3-7.el5.ia64", "5Client-Workstation:httpd-debuginfo-0:2.2.3-7.el5.ppc", "5Client-Workstation:httpd-debuginfo-0:2.2.3-7.el5.ppc64", "5Client-Workstation:httpd-debuginfo-0:2.2.3-7.el5.s390", "5Client-Workstation:httpd-debuginfo-0:2.2.3-7.el5.s390x", "5Client-Workstation:httpd-debuginfo-0:2.2.3-7.el5.x86_64", "5Client-Workstation:httpd-devel-0:2.2.3-7.el5.i386", "5Client-Workstation:httpd-devel-0:2.2.3-7.el5.ia64", "5Client-Workstation:httpd-devel-0:2.2.3-7.el5.ppc", "5Client-Workstation:httpd-devel-0:2.2.3-7.el5.ppc64", "5Client-Workstation:httpd-devel-0:2.2.3-7.el5.s390", "5Client-Workstation:httpd-devel-0:2.2.3-7.el5.s390x", "5Client-Workstation:httpd-devel-0:2.2.3-7.el5.x86_64", "5Client-Workstation:httpd-manual-0:2.2.3-7.el5.i386", "5Client-Workstation:httpd-manual-0:2.2.3-7.el5.ia64", "5Client-Workstation:httpd-manual-0:2.2.3-7.el5.ppc", "5Client-Workstation:httpd-manual-0:2.2.3-7.el5.s390x", "5Client-Workstation:httpd-manual-0:2.2.3-7.el5.x86_64", "5Client-Workstation:mod_ssl-1:2.2.3-7.el5.i386", "5Client-Workstation:mod_ssl-1:2.2.3-7.el5.ia64", "5Client-Workstation:mod_ssl-1:2.2.3-7.el5.ppc", "5Client-Workstation:mod_ssl-1:2.2.3-7.el5.s390x", "5Client-Workstation:mod_ssl-1:2.2.3-7.el5.x86_64", "5Client:httpd-0:2.2.3-7.el5.i386", "5Client:httpd-0:2.2.3-7.el5.ia64", "5Client:httpd-0:2.2.3-7.el5.ppc", "5Client:httpd-0:2.2.3-7.el5.s390x", "5Client:httpd-0:2.2.3-7.el5.src", "5Client:httpd-0:2.2.3-7.el5.x86_64", "5Client:httpd-debuginfo-0:2.2.3-7.el5.i386", "5Client:httpd-debuginfo-0:2.2.3-7.el5.ia64", "5Client:httpd-debuginfo-0:2.2.3-7.el5.ppc", "5Client:httpd-debuginfo-0:2.2.3-7.el5.ppc64", "5Client:httpd-debuginfo-0:2.2.3-7.el5.s390", "5Client:httpd-debuginfo-0:2.2.3-7.el5.s390x", "5Client:httpd-debuginfo-0:2.2.3-7.el5.x86_64", "5Client:httpd-devel-0:2.2.3-7.el5.i386", "5Client:httpd-devel-0:2.2.3-7.el5.ia64", "5Client:httpd-devel-0:2.2.3-7.el5.ppc", "5Client:httpd-devel-0:2.2.3-7.el5.ppc64", "5Client:httpd-devel-0:2.2.3-7.el5.s390", "5Client:httpd-devel-0:2.2.3-7.el5.s390x", "5Client:httpd-devel-0:2.2.3-7.el5.x86_64", "5Client:httpd-manual-0:2.2.3-7.el5.i386", "5Client:httpd-manual-0:2.2.3-7.el5.ia64", "5Client:httpd-manual-0:2.2.3-7.el5.ppc", "5Client:httpd-manual-0:2.2.3-7.el5.s390x", "5Client:httpd-manual-0:2.2.3-7.el5.x86_64", "5Client:mod_ssl-1:2.2.3-7.el5.i386", "5Client:mod_ssl-1:2.2.3-7.el5.ia64", "5Client:mod_ssl-1:2.2.3-7.el5.ppc", "5Client:mod_ssl-1:2.2.3-7.el5.s390x", "5Client:mod_ssl-1:2.2.3-7.el5.x86_64", "5Server:httpd-0:2.2.3-7.el5.i386", "5Server:httpd-0:2.2.3-7.el5.ia64", "5Server:httpd-0:2.2.3-7.el5.ppc", "5Server:httpd-0:2.2.3-7.el5.s390x", "5Server:httpd-0:2.2.3-7.el5.src", "5Server:httpd-0:2.2.3-7.el5.x86_64", "5Server:httpd-debuginfo-0:2.2.3-7.el5.i386", "5Server:httpd-debuginfo-0:2.2.3-7.el5.ia64", "5Server:httpd-debuginfo-0:2.2.3-7.el5.ppc", "5Server:httpd-debuginfo-0:2.2.3-7.el5.ppc64", "5Server:httpd-debuginfo-0:2.2.3-7.el5.s390", "5Server:httpd-debuginfo-0:2.2.3-7.el5.s390x", "5Server:httpd-debuginfo-0:2.2.3-7.el5.x86_64", "5Server:httpd-devel-0:2.2.3-7.el5.i386", "5Server:httpd-devel-0:2.2.3-7.el5.ia64", "5Server:httpd-devel-0:2.2.3-7.el5.ppc", "5Server:httpd-devel-0:2.2.3-7.el5.ppc64", "5Server:httpd-devel-0:2.2.3-7.el5.s390", "5Server:httpd-devel-0:2.2.3-7.el5.s390x", "5Server:httpd-devel-0:2.2.3-7.el5.x86_64", "5Server:httpd-manual-0:2.2.3-7.el5.i386", "5Server:httpd-manual-0:2.2.3-7.el5.ia64", "5Server:httpd-manual-0:2.2.3-7.el5.ppc", "5Server:httpd-manual-0:2.2.3-7.el5.s390x", "5Server:httpd-manual-0:2.2.3-7.el5.x86_64", "5Server:mod_ssl-1:2.2.3-7.el5.i386", "5Server:mod_ssl-1:2.2.3-7.el5.ia64", "5Server:mod_ssl-1:2.2.3-7.el5.ppc", "5Server:mod_ssl-1:2.2.3-7.el5.s390x", "5Server:mod_ssl-1:2.2.3-7.el5.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2007:0556", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "httpd mod_cache segfault", }, { cve: "CVE-2007-3304", discovery_date: "2007-06-19T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "245111", }, ], notes: [ { category: "description", text: "Apache httpd 1.3.37, 2.0.59, and 2.2.4 with the Prefork MPM module, allows local users to cause a denial of service by modifying the worker_score and process_score arrays to reference an arbitrary process ID, which is sent a SIGUSR1 signal from the master process, aka \"SIGUSR1 killer.\"", title: "Vulnerability description", }, { category: "summary", text: "httpd scoreboard lack of PID protection", title: "Vulnerability summary", }, ], product_status: { fixed: [ "5Client-Workstation:httpd-0:2.2.3-7.el5.i386", "5Client-Workstation:httpd-0:2.2.3-7.el5.ia64", "5Client-Workstation:httpd-0:2.2.3-7.el5.ppc", "5Client-Workstation:httpd-0:2.2.3-7.el5.s390x", "5Client-Workstation:httpd-0:2.2.3-7.el5.src", "5Client-Workstation:httpd-0:2.2.3-7.el5.x86_64", "5Client-Workstation:httpd-debuginfo-0:2.2.3-7.el5.i386", "5Client-Workstation:httpd-debuginfo-0:2.2.3-7.el5.ia64", "5Client-Workstation:httpd-debuginfo-0:2.2.3-7.el5.ppc", "5Client-Workstation:httpd-debuginfo-0:2.2.3-7.el5.ppc64", "5Client-Workstation:httpd-debuginfo-0:2.2.3-7.el5.s390", "5Client-Workstation:httpd-debuginfo-0:2.2.3-7.el5.s390x", "5Client-Workstation:httpd-debuginfo-0:2.2.3-7.el5.x86_64", "5Client-Workstation:httpd-devel-0:2.2.3-7.el5.i386", "5Client-Workstation:httpd-devel-0:2.2.3-7.el5.ia64", "5Client-Workstation:httpd-devel-0:2.2.3-7.el5.ppc", "5Client-Workstation:httpd-devel-0:2.2.3-7.el5.ppc64", "5Client-Workstation:httpd-devel-0:2.2.3-7.el5.s390", "5Client-Workstation:httpd-devel-0:2.2.3-7.el5.s390x", "5Client-Workstation:httpd-devel-0:2.2.3-7.el5.x86_64", "5Client-Workstation:httpd-manual-0:2.2.3-7.el5.i386", "5Client-Workstation:httpd-manual-0:2.2.3-7.el5.ia64", "5Client-Workstation:httpd-manual-0:2.2.3-7.el5.ppc", "5Client-Workstation:httpd-manual-0:2.2.3-7.el5.s390x", "5Client-Workstation:httpd-manual-0:2.2.3-7.el5.x86_64", "5Client-Workstation:mod_ssl-1:2.2.3-7.el5.i386", "5Client-Workstation:mod_ssl-1:2.2.3-7.el5.ia64", "5Client-Workstation:mod_ssl-1:2.2.3-7.el5.ppc", "5Client-Workstation:mod_ssl-1:2.2.3-7.el5.s390x", "5Client-Workstation:mod_ssl-1:2.2.3-7.el5.x86_64", "5Client:httpd-0:2.2.3-7.el5.i386", "5Client:httpd-0:2.2.3-7.el5.ia64", "5Client:httpd-0:2.2.3-7.el5.ppc", "5Client:httpd-0:2.2.3-7.el5.s390x", "5Client:httpd-0:2.2.3-7.el5.src", "5Client:httpd-0:2.2.3-7.el5.x86_64", "5Client:httpd-debuginfo-0:2.2.3-7.el5.i386", "5Client:httpd-debuginfo-0:2.2.3-7.el5.ia64", "5Client:httpd-debuginfo-0:2.2.3-7.el5.ppc", "5Client:httpd-debuginfo-0:2.2.3-7.el5.ppc64", "5Client:httpd-debuginfo-0:2.2.3-7.el5.s390", "5Client:httpd-debuginfo-0:2.2.3-7.el5.s390x", "5Client:httpd-debuginfo-0:2.2.3-7.el5.x86_64", "5Client:httpd-devel-0:2.2.3-7.el5.i386", "5Client:httpd-devel-0:2.2.3-7.el5.ia64", "5Client:httpd-devel-0:2.2.3-7.el5.ppc", "5Client:httpd-devel-0:2.2.3-7.el5.ppc64", "5Client:httpd-devel-0:2.2.3-7.el5.s390", "5Client:httpd-devel-0:2.2.3-7.el5.s390x", "5Client:httpd-devel-0:2.2.3-7.el5.x86_64", "5Client:httpd-manual-0:2.2.3-7.el5.i386", "5Client:httpd-manual-0:2.2.3-7.el5.ia64", "5Client:httpd-manual-0:2.2.3-7.el5.ppc", "5Client:httpd-manual-0:2.2.3-7.el5.s390x", "5Client:httpd-manual-0:2.2.3-7.el5.x86_64", "5Client:mod_ssl-1:2.2.3-7.el5.i386", "5Client:mod_ssl-1:2.2.3-7.el5.ia64", "5Client:mod_ssl-1:2.2.3-7.el5.ppc", "5Client:mod_ssl-1:2.2.3-7.el5.s390x", "5Client:mod_ssl-1:2.2.3-7.el5.x86_64", "5Server:httpd-0:2.2.3-7.el5.i386", "5Server:httpd-0:2.2.3-7.el5.ia64", "5Server:httpd-0:2.2.3-7.el5.ppc", "5Server:httpd-0:2.2.3-7.el5.s390x", "5Server:httpd-0:2.2.3-7.el5.src", "5Server:httpd-0:2.2.3-7.el5.x86_64", "5Server:httpd-debuginfo-0:2.2.3-7.el5.i386", "5Server:httpd-debuginfo-0:2.2.3-7.el5.ia64", "5Server:httpd-debuginfo-0:2.2.3-7.el5.ppc", "5Server:httpd-debuginfo-0:2.2.3-7.el5.ppc64", "5Server:httpd-debuginfo-0:2.2.3-7.el5.s390", "5Server:httpd-debuginfo-0:2.2.3-7.el5.s390x", "5Server:httpd-debuginfo-0:2.2.3-7.el5.x86_64", "5Server:httpd-devel-0:2.2.3-7.el5.i386", "5Server:httpd-devel-0:2.2.3-7.el5.ia64", "5Server:httpd-devel-0:2.2.3-7.el5.ppc", "5Server:httpd-devel-0:2.2.3-7.el5.ppc64", "5Server:httpd-devel-0:2.2.3-7.el5.s390", "5Server:httpd-devel-0:2.2.3-7.el5.s390x", "5Server:httpd-devel-0:2.2.3-7.el5.x86_64", "5Server:httpd-manual-0:2.2.3-7.el5.i386", "5Server:httpd-manual-0:2.2.3-7.el5.ia64", "5Server:httpd-manual-0:2.2.3-7.el5.ppc", "5Server:httpd-manual-0:2.2.3-7.el5.s390x", "5Server:httpd-manual-0:2.2.3-7.el5.x86_64", "5Server:mod_ssl-1:2.2.3-7.el5.i386", "5Server:mod_ssl-1:2.2.3-7.el5.ia64", "5Server:mod_ssl-1:2.2.3-7.el5.ppc", "5Server:mod_ssl-1:2.2.3-7.el5.s390x", "5Server:mod_ssl-1:2.2.3-7.el5.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-3304", }, { category: "external", summary: "RHBZ#245111", url: "https://bugzilla.redhat.com/show_bug.cgi?id=245111", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-3304", url: "https://www.cve.org/CVERecord?id=CVE-2007-3304", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-3304", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-3304", }, ], release_date: "2007-06-19T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2007-06-26T15:22:00+00:00", details: "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied. \n\nThis update is available via Red Hat Network. Details on how to use \nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/FAQ_58_10188", product_ids: [ "5Client-Workstation:httpd-0:2.2.3-7.el5.i386", "5Client-Workstation:httpd-0:2.2.3-7.el5.ia64", "5Client-Workstation:httpd-0:2.2.3-7.el5.ppc", "5Client-Workstation:httpd-0:2.2.3-7.el5.s390x", "5Client-Workstation:httpd-0:2.2.3-7.el5.src", "5Client-Workstation:httpd-0:2.2.3-7.el5.x86_64", "5Client-Workstation:httpd-debuginfo-0:2.2.3-7.el5.i386", "5Client-Workstation:httpd-debuginfo-0:2.2.3-7.el5.ia64", "5Client-Workstation:httpd-debuginfo-0:2.2.3-7.el5.ppc", "5Client-Workstation:httpd-debuginfo-0:2.2.3-7.el5.ppc64", "5Client-Workstation:httpd-debuginfo-0:2.2.3-7.el5.s390", "5Client-Workstation:httpd-debuginfo-0:2.2.3-7.el5.s390x", "5Client-Workstation:httpd-debuginfo-0:2.2.3-7.el5.x86_64", "5Client-Workstation:httpd-devel-0:2.2.3-7.el5.i386", "5Client-Workstation:httpd-devel-0:2.2.3-7.el5.ia64", "5Client-Workstation:httpd-devel-0:2.2.3-7.el5.ppc", "5Client-Workstation:httpd-devel-0:2.2.3-7.el5.ppc64", "5Client-Workstation:httpd-devel-0:2.2.3-7.el5.s390", "5Client-Workstation:httpd-devel-0:2.2.3-7.el5.s390x", "5Client-Workstation:httpd-devel-0:2.2.3-7.el5.x86_64", "5Client-Workstation:httpd-manual-0:2.2.3-7.el5.i386", "5Client-Workstation:httpd-manual-0:2.2.3-7.el5.ia64", "5Client-Workstation:httpd-manual-0:2.2.3-7.el5.ppc", "5Client-Workstation:httpd-manual-0:2.2.3-7.el5.s390x", "5Client-Workstation:httpd-manual-0:2.2.3-7.el5.x86_64", "5Client-Workstation:mod_ssl-1:2.2.3-7.el5.i386", "5Client-Workstation:mod_ssl-1:2.2.3-7.el5.ia64", "5Client-Workstation:mod_ssl-1:2.2.3-7.el5.ppc", "5Client-Workstation:mod_ssl-1:2.2.3-7.el5.s390x", "5Client-Workstation:mod_ssl-1:2.2.3-7.el5.x86_64", "5Client:httpd-0:2.2.3-7.el5.i386", "5Client:httpd-0:2.2.3-7.el5.ia64", "5Client:httpd-0:2.2.3-7.el5.ppc", "5Client:httpd-0:2.2.3-7.el5.s390x", "5Client:httpd-0:2.2.3-7.el5.src", "5Client:httpd-0:2.2.3-7.el5.x86_64", "5Client:httpd-debuginfo-0:2.2.3-7.el5.i386", "5Client:httpd-debuginfo-0:2.2.3-7.el5.ia64", "5Client:httpd-debuginfo-0:2.2.3-7.el5.ppc", "5Client:httpd-debuginfo-0:2.2.3-7.el5.ppc64", "5Client:httpd-debuginfo-0:2.2.3-7.el5.s390", "5Client:httpd-debuginfo-0:2.2.3-7.el5.s390x", "5Client:httpd-debuginfo-0:2.2.3-7.el5.x86_64", "5Client:httpd-devel-0:2.2.3-7.el5.i386", "5Client:httpd-devel-0:2.2.3-7.el5.ia64", "5Client:httpd-devel-0:2.2.3-7.el5.ppc", "5Client:httpd-devel-0:2.2.3-7.el5.ppc64", "5Client:httpd-devel-0:2.2.3-7.el5.s390", "5Client:httpd-devel-0:2.2.3-7.el5.s390x", "5Client:httpd-devel-0:2.2.3-7.el5.x86_64", "5Client:httpd-manual-0:2.2.3-7.el5.i386", "5Client:httpd-manual-0:2.2.3-7.el5.ia64", "5Client:httpd-manual-0:2.2.3-7.el5.ppc", "5Client:httpd-manual-0:2.2.3-7.el5.s390x", "5Client:httpd-manual-0:2.2.3-7.el5.x86_64", "5Client:mod_ssl-1:2.2.3-7.el5.i386", "5Client:mod_ssl-1:2.2.3-7.el5.ia64", "5Client:mod_ssl-1:2.2.3-7.el5.ppc", "5Client:mod_ssl-1:2.2.3-7.el5.s390x", "5Client:mod_ssl-1:2.2.3-7.el5.x86_64", "5Server:httpd-0:2.2.3-7.el5.i386", "5Server:httpd-0:2.2.3-7.el5.ia64", "5Server:httpd-0:2.2.3-7.el5.ppc", "5Server:httpd-0:2.2.3-7.el5.s390x", "5Server:httpd-0:2.2.3-7.el5.src", "5Server:httpd-0:2.2.3-7.el5.x86_64", "5Server:httpd-debuginfo-0:2.2.3-7.el5.i386", "5Server:httpd-debuginfo-0:2.2.3-7.el5.ia64", "5Server:httpd-debuginfo-0:2.2.3-7.el5.ppc", "5Server:httpd-debuginfo-0:2.2.3-7.el5.ppc64", "5Server:httpd-debuginfo-0:2.2.3-7.el5.s390", "5Server:httpd-debuginfo-0:2.2.3-7.el5.s390x", "5Server:httpd-debuginfo-0:2.2.3-7.el5.x86_64", "5Server:httpd-devel-0:2.2.3-7.el5.i386", "5Server:httpd-devel-0:2.2.3-7.el5.ia64", "5Server:httpd-devel-0:2.2.3-7.el5.ppc", "5Server:httpd-devel-0:2.2.3-7.el5.ppc64", "5Server:httpd-devel-0:2.2.3-7.el5.s390", "5Server:httpd-devel-0:2.2.3-7.el5.s390x", "5Server:httpd-devel-0:2.2.3-7.el5.x86_64", "5Server:httpd-manual-0:2.2.3-7.el5.i386", "5Server:httpd-manual-0:2.2.3-7.el5.ia64", "5Server:httpd-manual-0:2.2.3-7.el5.ppc", "5Server:httpd-manual-0:2.2.3-7.el5.s390x", "5Server:httpd-manual-0:2.2.3-7.el5.x86_64", "5Server:mod_ssl-1:2.2.3-7.el5.i386", "5Server:mod_ssl-1:2.2.3-7.el5.ia64", "5Server:mod_ssl-1:2.2.3-7.el5.ppc", "5Server:mod_ssl-1:2.2.3-7.el5.s390x", "5Server:mod_ssl-1:2.2.3-7.el5.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2007:0556", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "httpd scoreboard lack of PID protection", }, ], }
RHSA-2008:0263
Vulnerability from csaf_redhat
Published
2008-05-20 14:14
Modified
2024-12-01 11:53
Summary
Red Hat Security Advisory: Red Hat Network Proxy Server security update
Notes
Topic
Red Hat Network Proxy Server version 5.0.2 is now available. This update
includes fixes for a number of security issues in Red Hat Network Proxy
Server components.
This update has been rated as having low security impact by the Red
Hat Security Response Team.
Details
The Red Hat Network Proxy Server 5.0.2 release corrects several security
vulnerabilities in several shipped components. In a typical operating
environment, these components are not exposed to users of Proxy Server in a
vulnerable manner. These security updates will reduce risk in unique Proxy
Server environments.
Multiple flaws were fixed in the Apache HTTPD server. These flaws could
result in a cross-site scripting or denial-of-service attack.
(CVE-2007-6388, CVE-2007-5000, CVE-2007-3304, CVE-2006-5752)
A denial-of-service flaw was fixed in mod_perl. (CVE-2007-1349)
A denial-of-service flaw was fixed in the jabberd server. (CVE-2006-1329)
Users of Red Hat Network Proxy Server 5.0 are advised to upgrade to 5.0.2,
which resolves these issues.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ document: { aggregate_severity: { namespace: "https://access.redhat.com/security/updates/classification/", text: "Low", }, category: "csaf_security_advisory", csaf_version: "2.0", distribution: { text: "Copyright © Red Hat, Inc. All rights reserved.", tlp: { label: "WHITE", url: "https://www.first.org/tlp/", }, }, lang: "en", notes: [ { category: "summary", text: "Red Hat Network Proxy Server version 5.0.2 is now available. This update\nincludes fixes for a number of security issues in Red Hat Network Proxy\nServer components.\n\nThis update has been rated as having low security impact by the Red\nHat Security Response Team.", title: "Topic", }, { category: "general", text: "The Red Hat Network Proxy Server 5.0.2 release corrects several security\nvulnerabilities in several shipped components. In a typical operating\nenvironment, these components are not exposed to users of Proxy Server in a\nvulnerable manner. These security updates will reduce risk in unique Proxy\nServer environments.\n\nMultiple flaws were fixed in the Apache HTTPD server. These flaws could\nresult in a cross-site scripting or denial-of-service attack.\n(CVE-2007-6388, CVE-2007-5000, CVE-2007-3304, CVE-2006-5752)\n\nA denial-of-service flaw was fixed in mod_perl. (CVE-2007-1349)\n\nA denial-of-service flaw was fixed in the jabberd server. (CVE-2006-1329)\n\nUsers of Red Hat Network Proxy Server 5.0 are advised to upgrade to 5.0.2,\nwhich resolves these issues.", title: "Details", }, { category: "legal_disclaimer", text: "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", title: "Terms of Use", }, ], publisher: { category: "vendor", contact_details: "https://access.redhat.com/security/team/contact/", issuing_authority: "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", name: "Red Hat Product Security", namespace: "https://www.redhat.com", }, references: [ { category: "self", summary: "https://access.redhat.com/errata/RHSA-2008:0263", url: "https://access.redhat.com/errata/RHSA-2008:0263", }, { category: "external", summary: "https://access.redhat.com/security/updates/classification/#low", url: "https://access.redhat.com/security/updates/classification/#low", }, { category: "external", summary: "240423", url: "https://bugzilla.redhat.com/show_bug.cgi?id=240423", }, { category: "external", summary: "245111", url: "https://bugzilla.redhat.com/show_bug.cgi?id=245111", }, { category: "external", summary: "245112", url: "https://bugzilla.redhat.com/show_bug.cgi?id=245112", }, { category: "external", summary: "419931", url: "https://bugzilla.redhat.com/show_bug.cgi?id=419931", }, { category: "external", summary: "427228", url: "https://bugzilla.redhat.com/show_bug.cgi?id=427228", }, { category: "external", summary: "429254", url: "https://bugzilla.redhat.com/show_bug.cgi?id=429254", }, { category: "self", summary: "Canonical URL", url: "https://security.access.redhat.com/data/csaf/v2/advisories/2008/rhsa-2008_0263.json", }, ], title: "Red Hat Security Advisory: Red Hat Network Proxy Server security update", tracking: { current_release_date: "2024-12-01T11:53:30+00:00", generator: { date: "2024-12-01T11:53:30+00:00", engine: { name: "Red Hat SDEngine", version: "4.2.1", }, }, id: "RHSA-2008:0263", initial_release_date: "2008-05-20T14:14:00+00:00", revision_history: [ { date: "2008-05-20T14:14:00+00:00", number: "1", summary: "Initial version", }, { date: "2008-05-20T10:14:27+00:00", number: "2", summary: "Last updated version", }, { date: "2024-12-01T11:53:30+00:00", number: "3", summary: "Last generated version", }, ], status: "final", version: "3", }, }, product_tree: { branches: [ { branches: [ { branches: [ { category: "product_name", name: "Red Hat Satellite Proxy v 5.0 (RHEL v.4 AS)", product: { name: "Red Hat Satellite Proxy v 5.0 (RHEL v.4 AS)", product_id: "4AS-RHNPROXY5.0", product_identification_helper: { cpe: "cpe:/a:redhat:network_proxy:5.0::el4", }, }, }, ], category: "product_family", name: "Red Hat Satellite Proxy", }, { branches: [ { category: "product_version", name: "jabberd-0:2.0s10-3.38.rhn.i386", product: { name: "jabberd-0:2.0s10-3.38.rhn.i386", product_id: "jabberd-0:2.0s10-3.38.rhn.i386", product_identification_helper: { purl: "pkg:rpm/redhat/jabberd@2.0s10-3.38.rhn?arch=i386", }, }, }, { category: "product_version", name: "rhn-apache-0:1.3.27-36.rhn.rhel4.i386", product: { name: "rhn-apache-0:1.3.27-36.rhn.rhel4.i386", product_id: "rhn-apache-0:1.3.27-36.rhn.rhel4.i386", product_identification_helper: { purl: "pkg:rpm/redhat/rhn-apache@1.3.27-36.rhn.rhel4?arch=i386", }, }, }, { category: "product_version", name: "rhn-modperl-0:1.29-16.rhel4.i386", product: { name: "rhn-modperl-0:1.29-16.rhel4.i386", product_id: "rhn-modperl-0:1.29-16.rhel4.i386", product_identification_helper: { purl: "pkg:rpm/redhat/rhn-modperl@1.29-16.rhel4?arch=i386", }, }, }, ], category: "architecture", name: "i386", }, ], category: "vendor", name: "Red Hat", }, ], relationships: [ { category: "default_component_of", full_product_name: { name: "jabberd-0:2.0s10-3.38.rhn.i386 as a component of Red Hat Satellite Proxy v 5.0 (RHEL v.4 AS)", product_id: "4AS-RHNPROXY5.0:jabberd-0:2.0s10-3.38.rhn.i386", }, product_reference: "jabberd-0:2.0s10-3.38.rhn.i386", relates_to_product_reference: "4AS-RHNPROXY5.0", }, { category: "default_component_of", full_product_name: { name: "rhn-apache-0:1.3.27-36.rhn.rhel4.i386 as a component of Red Hat Satellite Proxy v 5.0 (RHEL v.4 AS)", product_id: "4AS-RHNPROXY5.0:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", }, product_reference: "rhn-apache-0:1.3.27-36.rhn.rhel4.i386", relates_to_product_reference: "4AS-RHNPROXY5.0", }, { category: "default_component_of", full_product_name: { name: "rhn-modperl-0:1.29-16.rhel4.i386 as a component of Red Hat Satellite Proxy v 5.0 (RHEL v.4 AS)", product_id: "4AS-RHNPROXY5.0:rhn-modperl-0:1.29-16.rhel4.i386", }, product_reference: "rhn-modperl-0:1.29-16.rhel4.i386", relates_to_product_reference: "4AS-RHNPROXY5.0", }, ], }, vulnerabilities: [ { cve: "CVE-2006-1329", ids: [ { system_name: "Red Hat Bugzilla ID", text: "429254", }, ], notes: [ { category: "description", text: "The SASL negotiation in Jabber Studio jabberd before 2.0s11 allows remote attackers to cause a denial of service (\"c2s segfault\") by sending a \"response stanza before an auth stanza\".", title: "Vulnerability description", }, { category: "summary", text: "jabberd SASL DoS", title: "Vulnerability summary", }, ], product_status: { fixed: [ "4AS-RHNPROXY5.0:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNPROXY5.0:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNPROXY5.0:rhn-modperl-0:1.29-16.rhel4.i386", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2006-1329", }, { category: "external", summary: "RHBZ#429254", url: "https://bugzilla.redhat.com/show_bug.cgi?id=429254", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2006-1329", url: "https://www.cve.org/CVERecord?id=CVE-2006-1329", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2006-1329", url: "https://nvd.nist.gov/vuln/detail/CVE-2006-1329", }, ], release_date: "2006-03-09T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-05-20T14:14:00+00:00", details: "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.\n\nThis update is available via Red Hat Network. Details on how to use \nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/FAQ_58_10188", product_ids: [ "4AS-RHNPROXY5.0:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNPROXY5.0:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNPROXY5.0:rhn-modperl-0:1.29-16.rhel4.i386", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0263", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "jabberd SASL DoS", }, { cve: "CVE-2006-5752", cwe: { id: "CWE-79", name: "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", }, discovery_date: "2007-06-20T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "245112", }, ], notes: [ { category: "description", text: "Cross-site scripting (XSS) vulnerability in mod_status.c in the mod_status module in Apache HTTP Server (httpd), when ExtendedStatus is enabled and a public server-status page is used, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors involving charsets with browsers that perform \"charset detection\" when the content-type is not specified.", title: "Vulnerability description", }, { category: "summary", text: "httpd mod_status XSS", title: "Vulnerability summary", }, ], product_status: { fixed: [ "4AS-RHNPROXY5.0:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNPROXY5.0:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNPROXY5.0:rhn-modperl-0:1.29-16.rhel4.i386", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2006-5752", }, { category: "external", summary: "RHBZ#245112", url: "https://bugzilla.redhat.com/show_bug.cgi?id=245112", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2006-5752", url: "https://www.cve.org/CVERecord?id=CVE-2006-5752", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2006-5752", url: "https://nvd.nist.gov/vuln/detail/CVE-2006-5752", }, ], release_date: "2007-06-20T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-05-20T14:14:00+00:00", details: "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.\n\nThis update is available via Red Hat Network. Details on how to use \nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/FAQ_58_10188", product_ids: [ "4AS-RHNPROXY5.0:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNPROXY5.0:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNPROXY5.0:rhn-modperl-0:1.29-16.rhel4.i386", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0263", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "httpd mod_status XSS", }, { cve: "CVE-2007-1349", discovery_date: "2007-05-17T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "240423", }, ], notes: [ { category: "description", text: "PerlRun.pm in Apache mod_perl before 1.30, and RegistryCooker.pm in mod_perl 2.x, does not properly escape PATH_INFO before use in a regular expression, which allows remote attackers to cause a denial of service (resource consumption) via a crafted URI.", title: "Vulnerability description", }, { category: "summary", text: "mod_perl PerlRun denial of service", title: "Vulnerability summary", }, ], product_status: { fixed: [ "4AS-RHNPROXY5.0:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNPROXY5.0:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNPROXY5.0:rhn-modperl-0:1.29-16.rhel4.i386", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-1349", }, { category: "external", summary: "RHBZ#240423", url: "https://bugzilla.redhat.com/show_bug.cgi?id=240423", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-1349", url: "https://www.cve.org/CVERecord?id=CVE-2007-1349", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-1349", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-1349", }, ], release_date: "2007-03-22T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-05-20T14:14:00+00:00", details: "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.\n\nThis update is available via Red Hat Network. Details on how to use \nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/FAQ_58_10188", product_ids: [ "4AS-RHNPROXY5.0:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNPROXY5.0:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNPROXY5.0:rhn-modperl-0:1.29-16.rhel4.i386", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0263", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "mod_perl PerlRun denial of service", }, { cve: "CVE-2007-3304", discovery_date: "2007-06-19T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "245111", }, ], notes: [ { category: "description", text: "Apache httpd 1.3.37, 2.0.59, and 2.2.4 with the Prefork MPM module, allows local users to cause a denial of service by modifying the worker_score and process_score arrays to reference an arbitrary process ID, which is sent a SIGUSR1 signal from the master process, aka \"SIGUSR1 killer.\"", title: "Vulnerability description", }, { category: "summary", text: "httpd scoreboard lack of PID protection", title: "Vulnerability summary", }, ], product_status: { fixed: [ "4AS-RHNPROXY5.0:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNPROXY5.0:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNPROXY5.0:rhn-modperl-0:1.29-16.rhel4.i386", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-3304", }, { category: "external", summary: "RHBZ#245111", url: "https://bugzilla.redhat.com/show_bug.cgi?id=245111", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-3304", url: "https://www.cve.org/CVERecord?id=CVE-2007-3304", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-3304", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-3304", }, ], release_date: "2007-06-19T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-05-20T14:14:00+00:00", details: "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.\n\nThis update is available via Red Hat Network. Details on how to use \nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/FAQ_58_10188", product_ids: [ "4AS-RHNPROXY5.0:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNPROXY5.0:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNPROXY5.0:rhn-modperl-0:1.29-16.rhel4.i386", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0263", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "httpd scoreboard lack of PID protection", }, { cve: "CVE-2007-5000", cwe: { id: "CWE-79", name: "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", }, discovery_date: "2007-12-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "419931", }, ], notes: [ { category: "description", text: "Cross-site scripting (XSS) vulnerability in the (1) mod_imap module in the Apache HTTP Server 1.3.0 through 1.3.39 and 2.0.35 through 2.0.61 and the (2) mod_imagemap module in the Apache HTTP Server 2.2.0 through 2.2.6 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.", title: "Vulnerability description", }, { category: "summary", text: "httpd: mod_imagemap XSS", title: "Vulnerability summary", }, ], product_status: { fixed: [ "4AS-RHNPROXY5.0:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNPROXY5.0:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNPROXY5.0:rhn-modperl-0:1.29-16.rhel4.i386", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-5000", }, { category: "external", summary: "RHBZ#419931", url: "https://bugzilla.redhat.com/show_bug.cgi?id=419931", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-5000", url: "https://www.cve.org/CVERecord?id=CVE-2007-5000", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-5000", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-5000", }, ], release_date: "2007-12-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-05-20T14:14:00+00:00", details: "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.\n\nThis update is available via Red Hat Network. Details on how to use \nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/FAQ_58_10188", product_ids: [ "4AS-RHNPROXY5.0:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNPROXY5.0:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNPROXY5.0:rhn-modperl-0:1.29-16.rhel4.i386", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0263", }, ], threats: [ { category: "impact", details: "Low", }, ], title: "httpd: mod_imagemap XSS", }, { cve: "CVE-2007-6388", cwe: { id: "CWE-79", name: "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", }, discovery_date: "2008-01-02T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "427228", }, ], notes: [ { category: "description", text: "Cross-site scripting (XSS) vulnerability in mod_status in the Apache HTTP Server 2.2.0 through 2.2.6, 2.0.35 through 2.0.61, and 1.3.2 through 1.3.39, when the server-status page is enabled, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.", title: "Vulnerability description", }, { category: "summary", text: "apache mod_status cross-site scripting", title: "Vulnerability summary", }, ], product_status: { fixed: [ "4AS-RHNPROXY5.0:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNPROXY5.0:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNPROXY5.0:rhn-modperl-0:1.29-16.rhel4.i386", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-6388", }, { category: "external", summary: "RHBZ#427228", url: "https://bugzilla.redhat.com/show_bug.cgi?id=427228", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-6388", url: "https://www.cve.org/CVERecord?id=CVE-2007-6388", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-6388", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-6388", }, ], release_date: "2007-12-29T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-05-20T14:14:00+00:00", details: "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.\n\nThis update is available via Red Hat Network. Details on how to use \nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/FAQ_58_10188", product_ids: [ "4AS-RHNPROXY5.0:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNPROXY5.0:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNPROXY5.0:rhn-modperl-0:1.29-16.rhel4.i386", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0263", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "apache mod_status cross-site scripting", }, ], }
rhsa-2010:0602
Vulnerability from csaf_redhat
Published
2010-08-04 21:30
Modified
2024-12-15 18:14
Summary
Red Hat Security Advisory: Red Hat Certificate System 7.3 security update
Notes
Topic
Updated packages that fix multiple security issues and rebase various
components are now available for Red Hat Certificate System 7.3.
The Red Hat Security Response Team has rated this update as having moderate
security impact. Common Vulnerability Scoring System (CVSS) base scores,
which give detailed severity ratings, are available for each vulnerability
from the CVE links in the References section.
Details
Red Hat Certificate System (RHCS) is an enterprise software system designed
to manage enterprise Public Key Infrastructure (PKI) deployments.
Multiple buffer overflow flaws were discovered in the way the pcscd daemon,
a resource manager that coordinates communications with smart card readers
and smart cards connected to the system, handled client requests. A local
user could create a specially-crafted request that would cause the pcscd
daemon to crash or, possibly, execute arbitrary code. (CVE-2010-0407,
CVE-2009-4901)
This erratum updates the Tomcat component shipped as part of Red Hat
Certificate System to version 5.5.23, to address multiple security issues.
In a typical operating environment, Tomcat is not exposed to users of
Certificate System in a vulnerable manner. These security updates will
reduce risk in unique Certificate System environments. (CVE-2005-2090,
CVE-2005-3510, CVE-2006-3835, CVE-2007-0450, CVE-2007-1358, CVE-2007-3382,
CVE-2007-3385, CVE-2007-5461, CVE-2007-5333, CVE-2008-0128, CVE-2008-1232,
CVE-2008-2370, CVE-2008-5515, CVE-2009-0033, CVE-2009-0580)
This erratum provides updated versions of the following components,
required by the updated Tomcat version: ant, avalon-logkit, axis,
classpathx-jaf, classpathx-mail, geronimo-specs, jakarta-commons-modeler,
log4j, mx4j, xerces-j2, and xml-commons.
A number of components have been updated to fix security issues for users
of Red Hat Certificate System for the Solaris operating system. These fixes
are for apr issue CVE-2009-2412; apr-util issues CVE-2009-0023,
CVE-2009-1955, CVE-2009-1956, and CVE-2009-2412; httpd issues
CVE-2006-3918, CVE-2006-5752, CVE-2007-1863, CVE-2007-3304, CVE-2007-3847,
CVE-2007-4465, CVE-2007-5000, CVE-2007-6388, CVE-2008-0005, CVE-2008-2364,
CVE-2008-2939, CVE-2009-1891, CVE-2009-3094, CVE-2009-3095, and
CVE-2010-0434; mod_perl issue CVE-2007-1349; and perl issues CVE-2007-5116
and CVE-2008-1927.
Note: Updated apr, apr-util, httpd, mod_perl, and perl packages were
previously available to users of Red Hat Certificate System for Red Hat
Enterprise Linux via the Red Hat Enterprise Linux 4 channels on the Red Hat
Network.
Additionally, the rhpki-ca, rhpki-kra, rhpki-ocsp, rhpki-tks,
rhpki-java-tools, and rhpki-native-tools packages were updated to address
some anomalous behavior on the Solaris operating system. (BZ#600513,
BZ#605760)
As well, this update provides an updated rhpki-manage package, which
includes installation and uninstall scripts for Red Hat Certificate System
that have been updated with the list of packages required by the Tomcat
component, and an updated dependency on the NSS and NSPR packages.
All users of Red Hat Certificate System are advised to upgrade to these
updated packages, which correct these issues. Refer to the Red Hat
Certificate System Administration Guide, linked to in the References, for
details on how to install the updated packages on the Solaris operating
system. After installing this update, all Red Hat Certificate System
subsystems must be restarted ("/etc/init.d/[instance-name] restart") for
the update to take effect.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ document: { aggregate_severity: { namespace: "https://access.redhat.com/security/updates/classification/", text: "Moderate", }, category: "csaf_security_advisory", csaf_version: "2.0", distribution: { text: "Copyright © Red Hat, Inc. All rights reserved.", tlp: { label: "WHITE", url: "https://www.first.org/tlp/", }, }, lang: "en", notes: [ { category: "summary", text: "Updated packages that fix multiple security issues and rebase various\ncomponents are now available for Red Hat Certificate System 7.3.\n\nThe Red Hat Security Response Team has rated this update as having moderate\nsecurity impact. Common Vulnerability Scoring System (CVSS) base scores,\nwhich give detailed severity ratings, are available for each vulnerability\nfrom the CVE links in the References section.", title: "Topic", }, { category: "general", text: "Red Hat Certificate System (RHCS) is an enterprise software system designed\nto manage enterprise Public Key Infrastructure (PKI) deployments.\n\nMultiple buffer overflow flaws were discovered in the way the pcscd daemon,\na resource manager that coordinates communications with smart card readers\nand smart cards connected to the system, handled client requests. A local\nuser could create a specially-crafted request that would cause the pcscd\ndaemon to crash or, possibly, execute arbitrary code. (CVE-2010-0407,\nCVE-2009-4901)\n\nThis erratum updates the Tomcat component shipped as part of Red Hat\nCertificate System to version 5.5.23, to address multiple security issues.\nIn a typical operating environment, Tomcat is not exposed to users of\nCertificate System in a vulnerable manner. These security updates will\nreduce risk in unique Certificate System environments. (CVE-2005-2090,\nCVE-2005-3510, CVE-2006-3835, CVE-2007-0450, CVE-2007-1358, CVE-2007-3382,\nCVE-2007-3385, CVE-2007-5461, CVE-2007-5333, CVE-2008-0128, CVE-2008-1232,\nCVE-2008-2370, CVE-2008-5515, CVE-2009-0033, CVE-2009-0580)\n\nThis erratum provides updated versions of the following components,\nrequired by the updated Tomcat version: ant, avalon-logkit, axis,\nclasspathx-jaf, classpathx-mail, geronimo-specs, jakarta-commons-modeler,\nlog4j, mx4j, xerces-j2, and xml-commons.\n\nA number of components have been updated to fix security issues for users\nof Red Hat Certificate System for the Solaris operating system. These fixes\nare for apr issue CVE-2009-2412; apr-util issues CVE-2009-0023,\nCVE-2009-1955, CVE-2009-1956, and CVE-2009-2412; httpd issues\nCVE-2006-3918, CVE-2006-5752, CVE-2007-1863, CVE-2007-3304, CVE-2007-3847,\nCVE-2007-4465, CVE-2007-5000, CVE-2007-6388, CVE-2008-0005, CVE-2008-2364,\nCVE-2008-2939, CVE-2009-1891, CVE-2009-3094, CVE-2009-3095, and\nCVE-2010-0434; mod_perl issue CVE-2007-1349; and perl issues CVE-2007-5116\nand CVE-2008-1927.\n\nNote: Updated apr, apr-util, httpd, mod_perl, and perl packages were\npreviously available to users of Red Hat Certificate System for Red Hat\nEnterprise Linux via the Red Hat Enterprise Linux 4 channels on the Red Hat\nNetwork.\n\nAdditionally, the rhpki-ca, rhpki-kra, rhpki-ocsp, rhpki-tks,\nrhpki-java-tools, and rhpki-native-tools packages were updated to address\nsome anomalous behavior on the Solaris operating system. (BZ#600513,\nBZ#605760)\n\nAs well, this update provides an updated rhpki-manage package, which\nincludes installation and uninstall scripts for Red Hat Certificate System\nthat have been updated with the list of packages required by the Tomcat\ncomponent, and an updated dependency on the NSS and NSPR packages.\n\nAll users of Red Hat Certificate System are advised to upgrade to these\nupdated packages, which correct these issues. Refer to the Red Hat\nCertificate System Administration Guide, linked to in the References, for\ndetails on how to install the updated packages on the Solaris operating\nsystem. After installing this update, all Red Hat Certificate System\nsubsystems must be restarted (\"/etc/init.d/[instance-name] restart\") for\nthe update to take effect.", title: "Details", }, { category: "legal_disclaimer", text: "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", title: "Terms of Use", }, ], publisher: { category: "vendor", contact_details: "https://access.redhat.com/security/team/contact/", issuing_authority: "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", name: "Red Hat Product Security", namespace: "https://www.redhat.com", }, references: [ { category: "self", summary: "https://access.redhat.com/errata/RHSA-2010:0602", url: "https://access.redhat.com/errata/RHSA-2010:0602", }, { category: "external", summary: "http://www.redhat.com/security/updates/classification/#moderate", url: "http://www.redhat.com/security/updates/classification/#moderate", }, { category: "external", summary: "http://www.redhat.com/docs/manuals/cert-system/7.3/html/Administration_Guide/Administration_Guide-Updating_Certificate_System_Packages-Updating_a_Solaris_9_system_using_pkgrm_and_pkgadd.html", url: "http://www.redhat.com/docs/manuals/cert-system/7.3/html/Administration_Guide/Administration_Guide-Updating_Certificate_System_Packages-Updating_a_Solaris_9_system_using_pkgrm_and_pkgadd.html", }, { category: "external", summary: "200732", url: "https://bugzilla.redhat.com/show_bug.cgi?id=200732", }, { category: "external", summary: "237079", url: "https://bugzilla.redhat.com/show_bug.cgi?id=237079", }, { category: "external", summary: "237080", url: "https://bugzilla.redhat.com/show_bug.cgi?id=237080", }, { category: "external", summary: "237084", url: "https://bugzilla.redhat.com/show_bug.cgi?id=237084", }, { category: "external", summary: "237085", url: "https://bugzilla.redhat.com/show_bug.cgi?id=237085", }, { category: "external", summary: "240423", url: "https://bugzilla.redhat.com/show_bug.cgi?id=240423", }, { category: "external", summary: "244658", url: "https://bugzilla.redhat.com/show_bug.cgi?id=244658", }, { category: "external", summary: "244803", url: "https://bugzilla.redhat.com/show_bug.cgi?id=244803", }, { category: "external", summary: "245111", url: "https://bugzilla.redhat.com/show_bug.cgi?id=245111", }, { category: "external", summary: "245112", url: "https://bugzilla.redhat.com/show_bug.cgi?id=245112", }, { category: "external", summary: "247972", url: "https://bugzilla.redhat.com/show_bug.cgi?id=247972", }, { category: "external", summary: "247976", url: "https://bugzilla.redhat.com/show_bug.cgi?id=247976", }, { category: "external", summary: "250731", url: "https://bugzilla.redhat.com/show_bug.cgi?id=250731", }, { category: "external", summary: "289511", url: "https://bugzilla.redhat.com/show_bug.cgi?id=289511", }, { category: "external", summary: "323571", url: "https://bugzilla.redhat.com/show_bug.cgi?id=323571", }, { category: "external", summary: "333791", url: "https://bugzilla.redhat.com/show_bug.cgi?id=333791", }, { category: "external", summary: "419931", url: "https://bugzilla.redhat.com/show_bug.cgi?id=419931", }, { category: "external", summary: "427228", url: "https://bugzilla.redhat.com/show_bug.cgi?id=427228", }, { category: "external", summary: "427739", url: "https://bugzilla.redhat.com/show_bug.cgi?id=427739", }, { category: "external", summary: "427766", url: "https://bugzilla.redhat.com/show_bug.cgi?id=427766", }, { category: "external", summary: "429821", url: "https://bugzilla.redhat.com/show_bug.cgi?id=429821", }, { category: "external", summary: "443928", url: "https://bugzilla.redhat.com/show_bug.cgi?id=443928", }, { category: "external", summary: "451615", url: "https://bugzilla.redhat.com/show_bug.cgi?id=451615", }, { category: "external", summary: "457597", url: "https://bugzilla.redhat.com/show_bug.cgi?id=457597", }, { category: "external", summary: "457934", url: "https://bugzilla.redhat.com/show_bug.cgi?id=457934", }, { category: "external", summary: "458250", url: "https://bugzilla.redhat.com/show_bug.cgi?id=458250", }, { category: "external", summary: "493381", url: "https://bugzilla.redhat.com/show_bug.cgi?id=493381", }, { category: "external", summary: "503928", url: "https://bugzilla.redhat.com/show_bug.cgi?id=503928", }, { category: "external", summary: "503978", url: "https://bugzilla.redhat.com/show_bug.cgi?id=503978", }, { category: "external", summary: "504390", url: "https://bugzilla.redhat.com/show_bug.cgi?id=504390", }, { category: "external", summary: "504555", url: "https://bugzilla.redhat.com/show_bug.cgi?id=504555", }, { category: "external", summary: "504753", url: "https://bugzilla.redhat.com/show_bug.cgi?id=504753", }, { category: "external", summary: "509125", url: "https://bugzilla.redhat.com/show_bug.cgi?id=509125", }, { category: "external", summary: "515698", url: "https://bugzilla.redhat.com/show_bug.cgi?id=515698", }, { category: "external", summary: "521619", url: "https://bugzilla.redhat.com/show_bug.cgi?id=521619", }, { category: "external", summary: "522209", url: "https://bugzilla.redhat.com/show_bug.cgi?id=522209", }, { category: "external", summary: "570171", url: "https://bugzilla.redhat.com/show_bug.cgi?id=570171", }, { category: "external", summary: "596426", url: "https://bugzilla.redhat.com/show_bug.cgi?id=596426", }, { category: "self", summary: "Canonical URL", url: "https://security.access.redhat.com/data/csaf/v2/advisories/2010/rhsa-2010_0602.json", }, ], title: "Red Hat Security Advisory: Red Hat Certificate System 7.3 security update", tracking: { current_release_date: "2024-12-15T18:14:44+00:00", generator: { date: "2024-12-15T18:14:44+00:00", engine: { name: "Red Hat SDEngine", version: "4.2.3", }, }, id: "RHSA-2010:0602", initial_release_date: "2010-08-04T21:30:00+00:00", revision_history: [ { date: "2010-08-04T21:30:00+00:00", number: "1", summary: "Initial version", }, { date: "2010-08-05T10:04:51+00:00", number: "2", summary: "Last updated version", }, { date: "2024-12-15T18:14:44+00:00", number: "3", summary: "Last generated version", }, ], status: "final", version: "3", }, }, product_tree: { branches: [ { branches: [ { branches: [ { category: "product_name", name: "Red Hat Certificate System 7.3 for 4AS", product: { name: "Red Hat Certificate System 7.3 for 4AS", product_id: "4AS-CERT-7.3", product_identification_helper: { cpe: "cpe:/a:redhat:certificate_system:7.3", }, }, }, { category: "product_name", name: "Red Hat Certificate System 7.3 for 4ES", product: { name: "Red Hat Certificate System 7.3 for 4ES", product_id: "4ES-CERT-7.3", product_identification_helper: { cpe: "cpe:/a:redhat:certificate_system:7.3", }, }, }, ], category: "product_family", name: "Red Hat Certificate System", }, { branches: [ { category: "product_version", name: "xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", product: { name: "xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", product_id: "xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/xml-commons-apis@1.3.02-2jpp_1rh?arch=noarch", }, }, }, { category: "product_version", name: "xml-commons-0:1.3.02-2jpp_1rh.noarch", product: { name: "xml-commons-0:1.3.02-2jpp_1rh.noarch", product_id: "xml-commons-0:1.3.02-2jpp_1rh.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/xml-commons@1.3.02-2jpp_1rh?arch=noarch", }, }, }, { category: "product_version", name: "xerces-j2-0:2.7.1-1jpp_1rh.noarch", product: { name: "xerces-j2-0:2.7.1-1jpp_1rh.noarch", product_id: "xerces-j2-0:2.7.1-1jpp_1rh.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/xerces-j2@2.7.1-1jpp_1rh?arch=noarch", }, }, }, { category: "product_version", name: "ant-0:1.6.5-1jpp_1rh.noarch", product: { name: "ant-0:1.6.5-1jpp_1rh.noarch", product_id: "ant-0:1.6.5-1jpp_1rh.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/ant@1.6.5-1jpp_1rh?arch=noarch", }, }, }, { category: "product_version", name: "avalon-logkit-0:1.2-2jpp_4rh.noarch", product: { name: "avalon-logkit-0:1.2-2jpp_4rh.noarch", product_id: "avalon-logkit-0:1.2-2jpp_4rh.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/avalon-logkit@1.2-2jpp_4rh?arch=noarch", }, }, }, { category: "product_version", name: "axis-0:1.2.1-1jpp_3rh.noarch", product: { name: "axis-0:1.2.1-1jpp_3rh.noarch", product_id: "axis-0:1.2.1-1jpp_3rh.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/axis@1.2.1-1jpp_3rh?arch=noarch", }, }, }, { category: "product_version", name: "classpathx-jaf-0:1.0-2jpp_6rh.noarch", product: { name: "classpathx-jaf-0:1.0-2jpp_6rh.noarch", product_id: "classpathx-jaf-0:1.0-2jpp_6rh.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/classpathx-jaf@1.0-2jpp_6rh?arch=noarch", }, }, }, { category: "product_version", name: "classpathx-mail-0:1.1.1-2jpp_8rh.noarch", product: { name: "classpathx-mail-0:1.1.1-2jpp_8rh.noarch", product_id: "classpathx-mail-0:1.1.1-2jpp_8rh.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/classpathx-mail@1.1.1-2jpp_8rh?arch=noarch", }, }, }, { category: "product_version", name: "log4j-0:1.2.12-1jpp_1rh.noarch", product: { name: "log4j-0:1.2.12-1jpp_1rh.noarch", product_id: "log4j-0:1.2.12-1jpp_1rh.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/log4j@1.2.12-1jpp_1rh?arch=noarch", }, }, }, { category: "product_version", name: "mx4j-1:3.0.1-1jpp_4rh.noarch", product: { name: "mx4j-1:3.0.1-1jpp_4rh.noarch", product_id: "mx4j-1:3.0.1-1jpp_4rh.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/mx4j@3.0.1-1jpp_4rh?arch=noarch&epoch=1", }, }, }, { category: "product_version", name: "jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", product: { name: "jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", product_id: "jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/jakarta-commons-modeler@2.0-3jpp_2rh?arch=noarch", }, }, }, { category: "product_version", name: "tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", product: { name: "tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", product_id: "tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/tomcat5-jsp-2.0-api@5.5.23-0jpp_4rh.16?arch=noarch", }, }, }, { category: "product_version", name: "tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", product: { name: "tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", product_id: "tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/tomcat5-servlet-2.4-api@5.5.23-0jpp_4rh.16?arch=noarch", }, }, }, { category: "product_version", name: "tomcat5-0:5.5.23-0jpp_4rh.16.noarch", product: { name: "tomcat5-0:5.5.23-0jpp_4rh.16.noarch", product_id: "tomcat5-0:5.5.23-0jpp_4rh.16.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/tomcat5@5.5.23-0jpp_4rh.16?arch=noarch", }, }, }, { category: "product_version", name: "tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", product: { name: "tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", product_id: "tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/tomcat5-common-lib@5.5.23-0jpp_4rh.16?arch=noarch", }, }, }, { category: "product_version", name: "tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", product: { name: "tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", product_id: "tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/tomcat5-jasper@5.5.23-0jpp_4rh.16?arch=noarch", }, }, }, { category: "product_version", name: "tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", product: { name: "tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", product_id: "tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/tomcat5-server-lib@5.5.23-0jpp_4rh.16?arch=noarch", }, }, }, { category: "product_version", name: "rhpki-manage-0:7.3.0-19.el4.noarch", product: { name: "rhpki-manage-0:7.3.0-19.el4.noarch", product_id: "rhpki-manage-0:7.3.0-19.el4.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/rhpki-manage@7.3.0-19.el4?arch=noarch", }, }, }, { category: "product_version", name: "rhpki-ca-0:7.3.0-20.el4.noarch", product: { name: "rhpki-ca-0:7.3.0-20.el4.noarch", product_id: "rhpki-ca-0:7.3.0-20.el4.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/rhpki-ca@7.3.0-20.el4?arch=noarch", }, }, }, { category: "product_version", name: "rhpki-kra-0:7.3.0-14.el4.noarch", product: { name: "rhpki-kra-0:7.3.0-14.el4.noarch", product_id: "rhpki-kra-0:7.3.0-14.el4.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/rhpki-kra@7.3.0-14.el4?arch=noarch", }, }, }, { category: "product_version", name: "rhpki-tks-0:7.3.0-13.el4.noarch", product: { name: "rhpki-tks-0:7.3.0-13.el4.noarch", product_id: "rhpki-tks-0:7.3.0-13.el4.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/rhpki-tks@7.3.0-13.el4?arch=noarch", }, }, }, { category: "product_version", name: "rhpki-ocsp-0:7.3.0-13.el4.noarch", product: { name: "rhpki-ocsp-0:7.3.0-13.el4.noarch", product_id: "rhpki-ocsp-0:7.3.0-13.el4.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/rhpki-ocsp@7.3.0-13.el4?arch=noarch", }, }, }, { category: "product_version", name: "rhpki-java-tools-0:7.3.0-10.el4.noarch", product: { name: "rhpki-java-tools-0:7.3.0-10.el4.noarch", product_id: "rhpki-java-tools-0:7.3.0-10.el4.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/rhpki-java-tools@7.3.0-10.el4?arch=noarch", }, }, }, { category: "product_version", name: "geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", product: { name: "geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", product_id: "geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/geronimo-specs@1.0-0.M4.1jpp_10rh?arch=noarch", }, }, }, { category: "product_version", name: "geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", product: { name: "geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", product_id: "geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/geronimo-jms-1.1-api@1.0-0.M4.1jpp_10rh?arch=noarch", }, }, }, { category: "product_version", name: "geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", product: { name: "geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", product_id: "geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/geronimo-jta-1.0.1B-api@1.0-0.M4.1jpp_10rh?arch=noarch", }, }, }, { category: "product_version", name: "geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", product: { name: "geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", product_id: "geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/geronimo-j2ee-deployment-1.1-api@1.0-0.M4.1jpp_10rh?arch=noarch", }, }, }, { category: "product_version", name: "geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", product: { name: "geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", product_id: "geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/geronimo-ejb-2.1-api@1.0-0.M4.1jpp_10rh?arch=noarch", }, }, }, { category: "product_version", name: "geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", product: { name: "geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", product_id: "geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/geronimo-servlet-2.4-api@1.0-0.M4.1jpp_10rh?arch=noarch", }, }, }, { category: "product_version", name: "geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", product: { name: "geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", product_id: "geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/geronimo-specs-javadoc@1.0-0.M4.1jpp_10rh?arch=noarch", }, }, }, { category: "product_version", name: "geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", product: { name: "geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", product_id: "geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/geronimo-j2ee-1.4-apis@1.0-0.M4.1jpp_10rh?arch=noarch", }, }, }, { category: "product_version", name: "geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", product: { name: "geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", product_id: "geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/geronimo-j2ee-connector-1.5-api@1.0-0.M4.1jpp_10rh?arch=noarch", }, }, }, { category: "product_version", name: "geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", product: { name: "geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", product_id: "geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/geronimo-jsp-2.0-api@1.0-0.M4.1jpp_10rh?arch=noarch", }, }, }, { category: "product_version", name: "geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", product: { name: "geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", product_id: "geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/geronimo-j2ee-management-1.0-api@1.0-0.M4.1jpp_10rh?arch=noarch", }, }, }, ], category: "architecture", name: "noarch", }, { branches: [ { category: "product_version", name: "xml-commons-0:1.3.02-2jpp_1rh.src", product: { name: "xml-commons-0:1.3.02-2jpp_1rh.src", product_id: "xml-commons-0:1.3.02-2jpp_1rh.src", product_identification_helper: { purl: "pkg:rpm/redhat/xml-commons@1.3.02-2jpp_1rh?arch=src", }, }, }, { category: "product_version", name: "xerces-j2-0:2.7.1-1jpp_1rh.src", product: { name: "xerces-j2-0:2.7.1-1jpp_1rh.src", product_id: "xerces-j2-0:2.7.1-1jpp_1rh.src", product_identification_helper: { purl: "pkg:rpm/redhat/xerces-j2@2.7.1-1jpp_1rh?arch=src", }, }, }, { category: "product_version", name: "ant-0:1.6.5-1jpp_1rh.src", product: { name: "ant-0:1.6.5-1jpp_1rh.src", product_id: "ant-0:1.6.5-1jpp_1rh.src", product_identification_helper: { purl: "pkg:rpm/redhat/ant@1.6.5-1jpp_1rh?arch=src", }, }, }, { category: "product_version", name: "avalon-logkit-0:1.2-2jpp_4rh.src", product: { name: "avalon-logkit-0:1.2-2jpp_4rh.src", product_id: "avalon-logkit-0:1.2-2jpp_4rh.src", product_identification_helper: { purl: "pkg:rpm/redhat/avalon-logkit@1.2-2jpp_4rh?arch=src", }, }, }, { category: "product_version", name: "axis-0:1.2.1-1jpp_3rh.src", product: { name: "axis-0:1.2.1-1jpp_3rh.src", product_id: "axis-0:1.2.1-1jpp_3rh.src", product_identification_helper: { purl: "pkg:rpm/redhat/axis@1.2.1-1jpp_3rh?arch=src", }, }, }, { category: "product_version", name: "classpathx-jaf-0:1.0-2jpp_6rh.src", product: { name: "classpathx-jaf-0:1.0-2jpp_6rh.src", product_id: "classpathx-jaf-0:1.0-2jpp_6rh.src", product_identification_helper: { purl: "pkg:rpm/redhat/classpathx-jaf@1.0-2jpp_6rh?arch=src", }, }, }, { category: "product_version", name: "classpathx-mail-0:1.1.1-2jpp_8rh.src", product: { name: "classpathx-mail-0:1.1.1-2jpp_8rh.src", product_id: "classpathx-mail-0:1.1.1-2jpp_8rh.src", product_identification_helper: { purl: "pkg:rpm/redhat/classpathx-mail@1.1.1-2jpp_8rh?arch=src", }, }, }, { category: "product_version", name: "log4j-0:1.2.12-1jpp_1rh.src", product: { name: "log4j-0:1.2.12-1jpp_1rh.src", product_id: "log4j-0:1.2.12-1jpp_1rh.src", product_identification_helper: { purl: "pkg:rpm/redhat/log4j@1.2.12-1jpp_1rh?arch=src", }, }, }, { category: "product_version", name: "mx4j-1:3.0.1-1jpp_4rh.src", product: { name: "mx4j-1:3.0.1-1jpp_4rh.src", product_id: "mx4j-1:3.0.1-1jpp_4rh.src", product_identification_helper: { purl: "pkg:rpm/redhat/mx4j@3.0.1-1jpp_4rh?arch=src&epoch=1", }, }, }, { category: "product_version", name: "jakarta-commons-modeler-0:2.0-3jpp_2rh.src", product: { name: "jakarta-commons-modeler-0:2.0-3jpp_2rh.src", product_id: "jakarta-commons-modeler-0:2.0-3jpp_2rh.src", product_identification_helper: { purl: "pkg:rpm/redhat/jakarta-commons-modeler@2.0-3jpp_2rh?arch=src", }, }, }, { category: "product_version", name: "tomcat5-0:5.5.23-0jpp_4rh.16.src", product: { name: "tomcat5-0:5.5.23-0jpp_4rh.16.src", product_id: "tomcat5-0:5.5.23-0jpp_4rh.16.src", product_identification_helper: { purl: "pkg:rpm/redhat/tomcat5@5.5.23-0jpp_4rh.16?arch=src", }, }, }, { category: "product_version", name: "pcsc-lite-0:1.3.3-3.el4.src", product: { name: "pcsc-lite-0:1.3.3-3.el4.src", product_id: "pcsc-lite-0:1.3.3-3.el4.src", product_identification_helper: { purl: "pkg:rpm/redhat/pcsc-lite@1.3.3-3.el4?arch=src", }, }, }, { category: "product_version", name: "geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", product: { name: "geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", product_id: "geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", product_identification_helper: { purl: "pkg:rpm/redhat/geronimo-specs@1.0-0.M4.1jpp_10rh?arch=src", }, }, }, ], category: "architecture", name: "src", }, { branches: [ { category: "product_version", name: "rhpki-native-tools-0:7.3.0-6.el4.x86_64", product: { name: "rhpki-native-tools-0:7.3.0-6.el4.x86_64", product_id: "rhpki-native-tools-0:7.3.0-6.el4.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/rhpki-native-tools@7.3.0-6.el4?arch=x86_64", }, }, }, { category: "product_version", name: "pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", product: { name: "pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", product_id: "pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/pcsc-lite-debuginfo@1.3.3-3.el4?arch=x86_64", }, }, }, { category: "product_version", name: "pcsc-lite-doc-0:1.3.3-3.el4.x86_64", product: { name: "pcsc-lite-doc-0:1.3.3-3.el4.x86_64", product_id: "pcsc-lite-doc-0:1.3.3-3.el4.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/pcsc-lite-doc@1.3.3-3.el4?arch=x86_64", }, }, }, { category: "product_version", name: "pcsc-lite-0:1.3.3-3.el4.x86_64", product: { name: "pcsc-lite-0:1.3.3-3.el4.x86_64", product_id: "pcsc-lite-0:1.3.3-3.el4.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/pcsc-lite@1.3.3-3.el4?arch=x86_64", }, }, }, { category: "product_version", name: "pcsc-lite-libs-0:1.3.3-3.el4.x86_64", product: { name: "pcsc-lite-libs-0:1.3.3-3.el4.x86_64", product_id: "pcsc-lite-libs-0:1.3.3-3.el4.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/pcsc-lite-libs@1.3.3-3.el4?arch=x86_64", }, }, }, ], category: "architecture", name: "x86_64", }, { branches: [ { category: "product_version", name: "rhpki-native-tools-0:7.3.0-6.el4.i386", product: { name: "rhpki-native-tools-0:7.3.0-6.el4.i386", product_id: "rhpki-native-tools-0:7.3.0-6.el4.i386", product_identification_helper: { purl: "pkg:rpm/redhat/rhpki-native-tools@7.3.0-6.el4?arch=i386", }, }, }, { category: "product_version", name: "pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", product: { name: "pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", product_id: "pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", product_identification_helper: { purl: "pkg:rpm/redhat/pcsc-lite-debuginfo@1.3.3-3.el4?arch=i386", }, }, }, { category: "product_version", name: "pcsc-lite-doc-0:1.3.3-3.el4.i386", product: { name: "pcsc-lite-doc-0:1.3.3-3.el4.i386", product_id: "pcsc-lite-doc-0:1.3.3-3.el4.i386", product_identification_helper: { purl: "pkg:rpm/redhat/pcsc-lite-doc@1.3.3-3.el4?arch=i386", }, }, }, { category: "product_version", name: "pcsc-lite-0:1.3.3-3.el4.i386", product: { name: "pcsc-lite-0:1.3.3-3.el4.i386", product_id: "pcsc-lite-0:1.3.3-3.el4.i386", product_identification_helper: { purl: "pkg:rpm/redhat/pcsc-lite@1.3.3-3.el4?arch=i386", }, }, }, { category: "product_version", name: "pcsc-lite-libs-0:1.3.3-3.el4.i386", product: { name: "pcsc-lite-libs-0:1.3.3-3.el4.i386", product_id: "pcsc-lite-libs-0:1.3.3-3.el4.i386", product_identification_helper: { purl: "pkg:rpm/redhat/pcsc-lite-libs@1.3.3-3.el4?arch=i386", }, }, }, ], category: "architecture", name: "i386", }, ], category: "vendor", name: "Red Hat", }, ], relationships: [ { category: "default_component_of", full_product_name: { name: "ant-0:1.6.5-1jpp_1rh.noarch as a component of Red Hat Certificate System 7.3 for 4AS", product_id: "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", }, product_reference: "ant-0:1.6.5-1jpp_1rh.noarch", relates_to_product_reference: "4AS-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "ant-0:1.6.5-1jpp_1rh.src as a component of Red Hat Certificate System 7.3 for 4AS", product_id: "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", }, product_reference: "ant-0:1.6.5-1jpp_1rh.src", relates_to_product_reference: "4AS-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "avalon-logkit-0:1.2-2jpp_4rh.noarch as a component of Red Hat Certificate System 7.3 for 4AS", product_id: "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", }, product_reference: "avalon-logkit-0:1.2-2jpp_4rh.noarch", relates_to_product_reference: "4AS-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "avalon-logkit-0:1.2-2jpp_4rh.src as a component of Red Hat Certificate System 7.3 for 4AS", product_id: "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", }, product_reference: "avalon-logkit-0:1.2-2jpp_4rh.src", relates_to_product_reference: "4AS-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "axis-0:1.2.1-1jpp_3rh.noarch as a component of Red Hat Certificate System 7.3 for 4AS", product_id: "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", }, product_reference: "axis-0:1.2.1-1jpp_3rh.noarch", relates_to_product_reference: "4AS-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "axis-0:1.2.1-1jpp_3rh.src as a component of Red Hat Certificate System 7.3 for 4AS", product_id: "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", }, product_reference: "axis-0:1.2.1-1jpp_3rh.src", relates_to_product_reference: "4AS-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "classpathx-jaf-0:1.0-2jpp_6rh.noarch as a component of Red Hat Certificate System 7.3 for 4AS", product_id: "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", }, product_reference: "classpathx-jaf-0:1.0-2jpp_6rh.noarch", relates_to_product_reference: "4AS-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "classpathx-jaf-0:1.0-2jpp_6rh.src as a component of Red Hat Certificate System 7.3 for 4AS", product_id: "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", }, product_reference: "classpathx-jaf-0:1.0-2jpp_6rh.src", relates_to_product_reference: "4AS-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "classpathx-mail-0:1.1.1-2jpp_8rh.noarch as a component of Red Hat Certificate System 7.3 for 4AS", product_id: "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", }, product_reference: "classpathx-mail-0:1.1.1-2jpp_8rh.noarch", relates_to_product_reference: "4AS-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "classpathx-mail-0:1.1.1-2jpp_8rh.src as a component of Red Hat Certificate System 7.3 for 4AS", product_id: "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", }, product_reference: "classpathx-mail-0:1.1.1-2jpp_8rh.src", relates_to_product_reference: "4AS-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch as a component of Red Hat Certificate System 7.3 for 4AS", product_id: "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", }, product_reference: "geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", relates_to_product_reference: "4AS-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch as a component of Red Hat Certificate System 7.3 for 4AS", product_id: "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", }, product_reference: "geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", relates_to_product_reference: "4AS-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch as a component of Red Hat Certificate System 7.3 for 4AS", product_id: "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", }, product_reference: "geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", relates_to_product_reference: "4AS-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch as a component of Red Hat Certificate System 7.3 for 4AS", product_id: "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", }, product_reference: "geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", relates_to_product_reference: "4AS-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch as a component of Red Hat Certificate System 7.3 for 4AS", product_id: "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", }, product_reference: "geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", relates_to_product_reference: "4AS-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch as a component of Red Hat Certificate System 7.3 for 4AS", product_id: "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", }, product_reference: "geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", relates_to_product_reference: "4AS-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch as a component of Red Hat Certificate System 7.3 for 4AS", product_id: "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", }, product_reference: "geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", relates_to_product_reference: "4AS-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch as a component of Red Hat Certificate System 7.3 for 4AS", product_id: "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", }, product_reference: "geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", relates_to_product_reference: "4AS-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch as a component of Red Hat Certificate System 7.3 for 4AS", product_id: "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", }, product_reference: "geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", relates_to_product_reference: "4AS-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch as a component of Red Hat Certificate System 7.3 for 4AS", product_id: "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", }, product_reference: "geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", relates_to_product_reference: "4AS-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "geronimo-specs-0:1.0-0.M4.1jpp_10rh.src as a component of Red Hat Certificate System 7.3 for 4AS", product_id: "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", }, product_reference: "geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", relates_to_product_reference: "4AS-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch as a component of Red Hat Certificate System 7.3 for 4AS", product_id: "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", }, product_reference: "geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", relates_to_product_reference: "4AS-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch as a component of Red Hat Certificate System 7.3 for 4AS", product_id: "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", }, product_reference: "jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", relates_to_product_reference: "4AS-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "jakarta-commons-modeler-0:2.0-3jpp_2rh.src as a component of Red Hat Certificate System 7.3 for 4AS", product_id: "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", }, product_reference: "jakarta-commons-modeler-0:2.0-3jpp_2rh.src", relates_to_product_reference: "4AS-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "log4j-0:1.2.12-1jpp_1rh.noarch as a component of Red Hat Certificate System 7.3 for 4AS", product_id: "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", }, product_reference: "log4j-0:1.2.12-1jpp_1rh.noarch", relates_to_product_reference: "4AS-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "log4j-0:1.2.12-1jpp_1rh.src as a component of Red Hat Certificate System 7.3 for 4AS", product_id: "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", }, product_reference: "log4j-0:1.2.12-1jpp_1rh.src", relates_to_product_reference: "4AS-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "mx4j-1:3.0.1-1jpp_4rh.noarch as a component of Red Hat Certificate System 7.3 for 4AS", product_id: "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", }, product_reference: "mx4j-1:3.0.1-1jpp_4rh.noarch", relates_to_product_reference: "4AS-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "mx4j-1:3.0.1-1jpp_4rh.src as a component of Red Hat Certificate System 7.3 for 4AS", product_id: "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", }, product_reference: "mx4j-1:3.0.1-1jpp_4rh.src", relates_to_product_reference: "4AS-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "pcsc-lite-0:1.3.3-3.el4.i386 as a component of Red Hat Certificate System 7.3 for 4AS", product_id: "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", }, product_reference: "pcsc-lite-0:1.3.3-3.el4.i386", relates_to_product_reference: "4AS-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "pcsc-lite-0:1.3.3-3.el4.src as a component of Red Hat Certificate System 7.3 for 4AS", product_id: "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", }, product_reference: "pcsc-lite-0:1.3.3-3.el4.src", relates_to_product_reference: "4AS-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "pcsc-lite-0:1.3.3-3.el4.x86_64 as a component of Red Hat Certificate System 7.3 for 4AS", product_id: "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", }, product_reference: "pcsc-lite-0:1.3.3-3.el4.x86_64", relates_to_product_reference: "4AS-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "pcsc-lite-debuginfo-0:1.3.3-3.el4.i386 as a component of Red Hat Certificate System 7.3 for 4AS", product_id: "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", }, product_reference: "pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", relates_to_product_reference: "4AS-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64 as a component of Red Hat Certificate System 7.3 for 4AS", product_id: "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", }, product_reference: "pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", relates_to_product_reference: "4AS-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "pcsc-lite-doc-0:1.3.3-3.el4.i386 as a component of Red Hat Certificate System 7.3 for 4AS", product_id: "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", }, product_reference: "pcsc-lite-doc-0:1.3.3-3.el4.i386", relates_to_product_reference: "4AS-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "pcsc-lite-doc-0:1.3.3-3.el4.x86_64 as a component of Red Hat Certificate System 7.3 for 4AS", product_id: "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", }, product_reference: "pcsc-lite-doc-0:1.3.3-3.el4.x86_64", relates_to_product_reference: "4AS-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "pcsc-lite-libs-0:1.3.3-3.el4.i386 as a component of Red Hat Certificate System 7.3 for 4AS", product_id: "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", }, product_reference: "pcsc-lite-libs-0:1.3.3-3.el4.i386", relates_to_product_reference: "4AS-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "pcsc-lite-libs-0:1.3.3-3.el4.x86_64 as a component of Red Hat Certificate System 7.3 for 4AS", product_id: "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", }, product_reference: "pcsc-lite-libs-0:1.3.3-3.el4.x86_64", relates_to_product_reference: "4AS-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "rhpki-ca-0:7.3.0-20.el4.noarch as a component of Red Hat Certificate System 7.3 for 4AS", product_id: "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", }, product_reference: "rhpki-ca-0:7.3.0-20.el4.noarch", relates_to_product_reference: "4AS-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "rhpki-java-tools-0:7.3.0-10.el4.noarch as a component of Red Hat Certificate System 7.3 for 4AS", product_id: "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", }, product_reference: "rhpki-java-tools-0:7.3.0-10.el4.noarch", relates_to_product_reference: "4AS-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "rhpki-kra-0:7.3.0-14.el4.noarch as a component of Red Hat Certificate System 7.3 for 4AS", product_id: "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", }, product_reference: "rhpki-kra-0:7.3.0-14.el4.noarch", relates_to_product_reference: "4AS-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "rhpki-manage-0:7.3.0-19.el4.noarch as a component of Red Hat Certificate System 7.3 for 4AS", product_id: "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", }, product_reference: "rhpki-manage-0:7.3.0-19.el4.noarch", relates_to_product_reference: "4AS-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "rhpki-native-tools-0:7.3.0-6.el4.i386 as a component of Red Hat Certificate System 7.3 for 4AS", product_id: "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", }, product_reference: "rhpki-native-tools-0:7.3.0-6.el4.i386", relates_to_product_reference: "4AS-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "rhpki-native-tools-0:7.3.0-6.el4.x86_64 as a component of Red Hat Certificate System 7.3 for 4AS", product_id: "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", }, product_reference: "rhpki-native-tools-0:7.3.0-6.el4.x86_64", relates_to_product_reference: "4AS-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "rhpki-ocsp-0:7.3.0-13.el4.noarch as a component of Red Hat Certificate System 7.3 for 4AS", product_id: "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", }, product_reference: "rhpki-ocsp-0:7.3.0-13.el4.noarch", relates_to_product_reference: "4AS-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "rhpki-tks-0:7.3.0-13.el4.noarch as a component of Red Hat Certificate System 7.3 for 4AS", product_id: "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", }, product_reference: "rhpki-tks-0:7.3.0-13.el4.noarch", relates_to_product_reference: "4AS-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "tomcat5-0:5.5.23-0jpp_4rh.16.noarch as a component of Red Hat Certificate System 7.3 for 4AS", product_id: "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", }, product_reference: "tomcat5-0:5.5.23-0jpp_4rh.16.noarch", relates_to_product_reference: "4AS-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "tomcat5-0:5.5.23-0jpp_4rh.16.src as a component of Red Hat Certificate System 7.3 for 4AS", product_id: "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", }, product_reference: "tomcat5-0:5.5.23-0jpp_4rh.16.src", relates_to_product_reference: "4AS-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch as a component of Red Hat Certificate System 7.3 for 4AS", product_id: "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", }, product_reference: "tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", relates_to_product_reference: "4AS-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch as a component of Red Hat Certificate System 7.3 for 4AS", product_id: "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", }, product_reference: "tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", relates_to_product_reference: "4AS-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch as a component of Red Hat Certificate System 7.3 for 4AS", product_id: "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", }, product_reference: "tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", relates_to_product_reference: "4AS-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch as a component of Red Hat Certificate System 7.3 for 4AS", product_id: "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", }, product_reference: "tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", relates_to_product_reference: "4AS-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch as a component of Red Hat Certificate System 7.3 for 4AS", product_id: "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", }, product_reference: "tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", relates_to_product_reference: "4AS-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "xerces-j2-0:2.7.1-1jpp_1rh.noarch as a component of Red Hat Certificate System 7.3 for 4AS", product_id: "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", }, product_reference: "xerces-j2-0:2.7.1-1jpp_1rh.noarch", relates_to_product_reference: "4AS-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "xerces-j2-0:2.7.1-1jpp_1rh.src as a component of Red Hat Certificate System 7.3 for 4AS", product_id: "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", }, product_reference: "xerces-j2-0:2.7.1-1jpp_1rh.src", relates_to_product_reference: "4AS-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "xml-commons-0:1.3.02-2jpp_1rh.noarch as a component of Red Hat Certificate System 7.3 for 4AS", product_id: "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", }, product_reference: "xml-commons-0:1.3.02-2jpp_1rh.noarch", relates_to_product_reference: "4AS-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "xml-commons-0:1.3.02-2jpp_1rh.src as a component of Red Hat Certificate System 7.3 for 4AS", product_id: "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", }, product_reference: "xml-commons-0:1.3.02-2jpp_1rh.src", relates_to_product_reference: "4AS-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "xml-commons-apis-0:1.3.02-2jpp_1rh.noarch as a component of Red Hat Certificate System 7.3 for 4AS", product_id: "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", }, product_reference: "xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", relates_to_product_reference: "4AS-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "ant-0:1.6.5-1jpp_1rh.noarch as a component of Red Hat Certificate System 7.3 for 4ES", product_id: "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", }, product_reference: "ant-0:1.6.5-1jpp_1rh.noarch", relates_to_product_reference: "4ES-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "ant-0:1.6.5-1jpp_1rh.src as a component of Red Hat Certificate System 7.3 for 4ES", product_id: "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", }, product_reference: "ant-0:1.6.5-1jpp_1rh.src", relates_to_product_reference: "4ES-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "avalon-logkit-0:1.2-2jpp_4rh.noarch as a component of Red Hat Certificate System 7.3 for 4ES", product_id: "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", }, product_reference: "avalon-logkit-0:1.2-2jpp_4rh.noarch", relates_to_product_reference: "4ES-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "avalon-logkit-0:1.2-2jpp_4rh.src as a component of Red Hat Certificate System 7.3 for 4ES", product_id: "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", }, product_reference: "avalon-logkit-0:1.2-2jpp_4rh.src", relates_to_product_reference: "4ES-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "axis-0:1.2.1-1jpp_3rh.noarch as a component of Red Hat Certificate System 7.3 for 4ES", product_id: "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", }, product_reference: "axis-0:1.2.1-1jpp_3rh.noarch", relates_to_product_reference: "4ES-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "axis-0:1.2.1-1jpp_3rh.src as a component of Red Hat Certificate System 7.3 for 4ES", product_id: "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", }, product_reference: "axis-0:1.2.1-1jpp_3rh.src", relates_to_product_reference: "4ES-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "classpathx-jaf-0:1.0-2jpp_6rh.noarch as a component of Red Hat Certificate System 7.3 for 4ES", product_id: "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", }, product_reference: "classpathx-jaf-0:1.0-2jpp_6rh.noarch", relates_to_product_reference: "4ES-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "classpathx-jaf-0:1.0-2jpp_6rh.src as a component of Red Hat Certificate System 7.3 for 4ES", product_id: "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", }, product_reference: "classpathx-jaf-0:1.0-2jpp_6rh.src", relates_to_product_reference: "4ES-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "classpathx-mail-0:1.1.1-2jpp_8rh.noarch as a component of Red Hat Certificate System 7.3 for 4ES", product_id: "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", }, product_reference: "classpathx-mail-0:1.1.1-2jpp_8rh.noarch", relates_to_product_reference: "4ES-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "classpathx-mail-0:1.1.1-2jpp_8rh.src as a component of Red Hat Certificate System 7.3 for 4ES", product_id: "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", }, product_reference: "classpathx-mail-0:1.1.1-2jpp_8rh.src", relates_to_product_reference: "4ES-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch as a component of Red Hat Certificate System 7.3 for 4ES", product_id: "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", }, product_reference: "geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", relates_to_product_reference: "4ES-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch as a component of Red Hat Certificate System 7.3 for 4ES", product_id: "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", }, product_reference: "geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", relates_to_product_reference: "4ES-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch as a component of Red Hat Certificate System 7.3 for 4ES", product_id: "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", }, product_reference: "geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", relates_to_product_reference: "4ES-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch as a component of Red Hat Certificate System 7.3 for 4ES", product_id: "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", }, product_reference: "geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", relates_to_product_reference: "4ES-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch as a component of Red Hat Certificate System 7.3 for 4ES", product_id: "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", }, product_reference: "geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", relates_to_product_reference: "4ES-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch as a component of Red Hat Certificate System 7.3 for 4ES", product_id: "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", }, product_reference: "geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", relates_to_product_reference: "4ES-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch as a component of Red Hat Certificate System 7.3 for 4ES", product_id: "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", }, product_reference: "geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", relates_to_product_reference: "4ES-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch as a component of Red Hat Certificate System 7.3 for 4ES", product_id: "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", }, product_reference: "geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", relates_to_product_reference: "4ES-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch as a component of Red Hat Certificate System 7.3 for 4ES", product_id: "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", }, product_reference: "geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", relates_to_product_reference: "4ES-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch as a component of Red Hat Certificate System 7.3 for 4ES", product_id: "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", }, product_reference: "geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", relates_to_product_reference: "4ES-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "geronimo-specs-0:1.0-0.M4.1jpp_10rh.src as a component of Red Hat Certificate System 7.3 for 4ES", product_id: "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", }, product_reference: "geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", relates_to_product_reference: "4ES-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch as a component of Red Hat Certificate System 7.3 for 4ES", product_id: "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", }, product_reference: "geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", relates_to_product_reference: "4ES-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch as a component of Red Hat Certificate System 7.3 for 4ES", product_id: "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", }, product_reference: "jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", relates_to_product_reference: "4ES-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "jakarta-commons-modeler-0:2.0-3jpp_2rh.src as a component of Red Hat Certificate System 7.3 for 4ES", product_id: "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", }, product_reference: "jakarta-commons-modeler-0:2.0-3jpp_2rh.src", relates_to_product_reference: "4ES-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "log4j-0:1.2.12-1jpp_1rh.noarch as a component of Red Hat Certificate System 7.3 for 4ES", product_id: "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", }, product_reference: "log4j-0:1.2.12-1jpp_1rh.noarch", relates_to_product_reference: "4ES-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "log4j-0:1.2.12-1jpp_1rh.src as a component of Red Hat Certificate System 7.3 for 4ES", product_id: "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", }, product_reference: "log4j-0:1.2.12-1jpp_1rh.src", relates_to_product_reference: "4ES-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "mx4j-1:3.0.1-1jpp_4rh.noarch as a component of Red Hat Certificate System 7.3 for 4ES", product_id: "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", }, product_reference: "mx4j-1:3.0.1-1jpp_4rh.noarch", relates_to_product_reference: "4ES-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "mx4j-1:3.0.1-1jpp_4rh.src as a component of Red Hat Certificate System 7.3 for 4ES", product_id: "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", }, product_reference: "mx4j-1:3.0.1-1jpp_4rh.src", relates_to_product_reference: "4ES-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "pcsc-lite-0:1.3.3-3.el4.i386 as a component of Red Hat Certificate System 7.3 for 4ES", product_id: "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", }, product_reference: "pcsc-lite-0:1.3.3-3.el4.i386", relates_to_product_reference: "4ES-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "pcsc-lite-0:1.3.3-3.el4.src as a component of Red Hat Certificate System 7.3 for 4ES", product_id: "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", }, product_reference: "pcsc-lite-0:1.3.3-3.el4.src", relates_to_product_reference: "4ES-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "pcsc-lite-0:1.3.3-3.el4.x86_64 as a component of Red Hat Certificate System 7.3 for 4ES", product_id: "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", }, product_reference: "pcsc-lite-0:1.3.3-3.el4.x86_64", relates_to_product_reference: "4ES-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "pcsc-lite-debuginfo-0:1.3.3-3.el4.i386 as a component of Red Hat Certificate System 7.3 for 4ES", product_id: "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", }, product_reference: "pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", relates_to_product_reference: "4ES-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64 as a component of Red Hat Certificate System 7.3 for 4ES", product_id: "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", }, product_reference: "pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", relates_to_product_reference: "4ES-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "pcsc-lite-doc-0:1.3.3-3.el4.i386 as a component of Red Hat Certificate System 7.3 for 4ES", product_id: "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", }, product_reference: "pcsc-lite-doc-0:1.3.3-3.el4.i386", relates_to_product_reference: "4ES-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "pcsc-lite-doc-0:1.3.3-3.el4.x86_64 as a component of Red Hat Certificate System 7.3 for 4ES", product_id: "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", }, product_reference: "pcsc-lite-doc-0:1.3.3-3.el4.x86_64", relates_to_product_reference: "4ES-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "pcsc-lite-libs-0:1.3.3-3.el4.i386 as a component of Red Hat Certificate System 7.3 for 4ES", product_id: "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", }, product_reference: "pcsc-lite-libs-0:1.3.3-3.el4.i386", relates_to_product_reference: "4ES-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "pcsc-lite-libs-0:1.3.3-3.el4.x86_64 as a component of Red Hat Certificate System 7.3 for 4ES", product_id: "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", }, product_reference: "pcsc-lite-libs-0:1.3.3-3.el4.x86_64", relates_to_product_reference: "4ES-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "rhpki-ca-0:7.3.0-20.el4.noarch as a component of Red Hat Certificate System 7.3 for 4ES", product_id: "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", }, product_reference: "rhpki-ca-0:7.3.0-20.el4.noarch", relates_to_product_reference: "4ES-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "rhpki-java-tools-0:7.3.0-10.el4.noarch as a component of Red Hat Certificate System 7.3 for 4ES", product_id: "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", }, product_reference: "rhpki-java-tools-0:7.3.0-10.el4.noarch", relates_to_product_reference: "4ES-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "rhpki-kra-0:7.3.0-14.el4.noarch as a component of Red Hat Certificate System 7.3 for 4ES", product_id: "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", }, product_reference: "rhpki-kra-0:7.3.0-14.el4.noarch", relates_to_product_reference: "4ES-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "rhpki-manage-0:7.3.0-19.el4.noarch as a component of Red Hat Certificate System 7.3 for 4ES", product_id: "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", }, product_reference: "rhpki-manage-0:7.3.0-19.el4.noarch", relates_to_product_reference: "4ES-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "rhpki-native-tools-0:7.3.0-6.el4.i386 as a component of Red Hat Certificate System 7.3 for 4ES", product_id: "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", }, product_reference: "rhpki-native-tools-0:7.3.0-6.el4.i386", relates_to_product_reference: "4ES-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "rhpki-native-tools-0:7.3.0-6.el4.x86_64 as a component of Red Hat Certificate System 7.3 for 4ES", product_id: "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", }, product_reference: "rhpki-native-tools-0:7.3.0-6.el4.x86_64", relates_to_product_reference: "4ES-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "rhpki-ocsp-0:7.3.0-13.el4.noarch as a component of Red Hat Certificate System 7.3 for 4ES", product_id: "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", }, product_reference: "rhpki-ocsp-0:7.3.0-13.el4.noarch", relates_to_product_reference: "4ES-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "rhpki-tks-0:7.3.0-13.el4.noarch as a component of Red Hat Certificate System 7.3 for 4ES", product_id: "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", }, product_reference: "rhpki-tks-0:7.3.0-13.el4.noarch", relates_to_product_reference: "4ES-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "tomcat5-0:5.5.23-0jpp_4rh.16.noarch as a component of Red Hat Certificate System 7.3 for 4ES", product_id: "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", }, product_reference: "tomcat5-0:5.5.23-0jpp_4rh.16.noarch", relates_to_product_reference: "4ES-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "tomcat5-0:5.5.23-0jpp_4rh.16.src as a component of Red Hat Certificate System 7.3 for 4ES", product_id: "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", }, product_reference: "tomcat5-0:5.5.23-0jpp_4rh.16.src", relates_to_product_reference: "4ES-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch as a component of Red Hat Certificate System 7.3 for 4ES", product_id: "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", }, product_reference: "tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", relates_to_product_reference: "4ES-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch as a component of Red Hat Certificate System 7.3 for 4ES", product_id: "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", }, product_reference: "tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", relates_to_product_reference: "4ES-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch as a component of Red Hat Certificate System 7.3 for 4ES", product_id: "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", }, product_reference: "tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", relates_to_product_reference: "4ES-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch as a component of Red Hat Certificate System 7.3 for 4ES", product_id: "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", }, product_reference: "tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", relates_to_product_reference: "4ES-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch as a component of Red Hat Certificate System 7.3 for 4ES", product_id: "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", }, product_reference: "tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", relates_to_product_reference: "4ES-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "xerces-j2-0:2.7.1-1jpp_1rh.noarch as a component of Red Hat Certificate System 7.3 for 4ES", product_id: "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", }, product_reference: "xerces-j2-0:2.7.1-1jpp_1rh.noarch", relates_to_product_reference: "4ES-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "xerces-j2-0:2.7.1-1jpp_1rh.src as a component of Red Hat Certificate System 7.3 for 4ES", product_id: "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", }, product_reference: "xerces-j2-0:2.7.1-1jpp_1rh.src", relates_to_product_reference: "4ES-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "xml-commons-0:1.3.02-2jpp_1rh.noarch as a component of Red Hat Certificate System 7.3 for 4ES", product_id: "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", }, product_reference: "xml-commons-0:1.3.02-2jpp_1rh.noarch", relates_to_product_reference: "4ES-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "xml-commons-0:1.3.02-2jpp_1rh.src as a component of Red Hat Certificate System 7.3 for 4ES", product_id: "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", }, product_reference: "xml-commons-0:1.3.02-2jpp_1rh.src", relates_to_product_reference: "4ES-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "xml-commons-apis-0:1.3.02-2jpp_1rh.noarch as a component of Red Hat Certificate System 7.3 for 4ES", product_id: "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", }, product_reference: "xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", relates_to_product_reference: "4ES-CERT-7.3", }, ], }, vulnerabilities: [ { cve: "CVE-2005-2090", discovery_date: "2005-06-06T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "237079", }, ], notes: [ { category: "description", text: "Jakarta Tomcat 5.0.19 (Coyote/1.1) and Tomcat 4.1.24 (Coyote/1.0) allows remote attackers to poison the web cache, bypass web application firewall protection, and conduct XSS attacks via an HTTP request with both a \"Transfer-Encoding: chunked\" header and a Content-Length header, which causes Tomcat to incorrectly handle and forward the body of the request in a way that causes the receiving server to process it as a separate HTTP request, aka \"HTTP Request Smuggling.\"", title: "Vulnerability description", }, { category: "summary", text: "tomcat multiple content-length header poisioning", title: "Vulnerability summary", }, ], product_status: { fixed: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2005-2090", }, { category: "external", summary: "RHBZ#237079", url: "https://bugzilla.redhat.com/show_bug.cgi?id=237079", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2005-2090", url: "https://www.cve.org/CVERecord?id=CVE-2005-2090", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2005-2090", url: "https://nvd.nist.gov/vuln/detail/CVE-2005-2090", }, ], release_date: "2005-06-06T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2010-08-04T21:30:00+00:00", details: "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259", product_ids: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2010:0602", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "tomcat multiple content-length header poisioning", }, { cve: "CVE-2005-3510", discovery_date: "2005-11-07T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "237085", }, ], notes: [ { category: "description", text: "Apache Tomcat 5.5.0 to 5.5.11 allows remote attackers to cause a denial of service (CPU consumption) via a large number of simultaneous requests to list a web directory that has a large number of files.", title: "Vulnerability description", }, { category: "summary", text: "tomcat DoS", title: "Vulnerability summary", }, ], product_status: { fixed: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2005-3510", }, { category: "external", summary: "RHBZ#237085", url: "https://bugzilla.redhat.com/show_bug.cgi?id=237085", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2005-3510", url: "https://www.cve.org/CVERecord?id=CVE-2005-3510", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2005-3510", url: "https://nvd.nist.gov/vuln/detail/CVE-2005-3510", }, ], release_date: "2005-11-03T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2010-08-04T21:30:00+00:00", details: "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259", product_ids: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2010:0602", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "tomcat DoS", }, { cve: "CVE-2006-3835", discovery_date: "2006-07-21T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "237084", }, ], notes: [ { category: "description", text: "Apache Tomcat 5 before 5.5.17 allows remote attackers to list directories via a semicolon (;) preceding a filename with a mapped extension, as demonstrated by URLs ending with /;index.jsp and /;help.do.", title: "Vulnerability description", }, { category: "summary", text: "tomcat directory listing issue", title: "Vulnerability summary", }, { category: "other", text: "This issue is not a security issue in Tomcat itself, but is caused when directory listings are enabled.\n\nDetails on how to disable directory listings are available at: http://tomcat.apache.org/faq/misc.html#listing", title: "Statement", }, ], product_status: { fixed: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2006-3835", }, { category: "external", summary: "RHBZ#237084", url: "https://bugzilla.redhat.com/show_bug.cgi?id=237084", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2006-3835", url: "https://www.cve.org/CVERecord?id=CVE-2006-3835", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2006-3835", url: "https://nvd.nist.gov/vuln/detail/CVE-2006-3835", }, ], release_date: "2006-07-21T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2010-08-04T21:30:00+00:00", details: "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259", product_ids: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2010:0602", }, ], threats: [ { category: "impact", details: "Low", }, ], title: "tomcat directory listing issue", }, { cve: "CVE-2006-3918", cwe: { id: "CWE-79", name: "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", }, discovery_date: "2006-07-31T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "200732", }, ], notes: [ { category: "description", text: "http_protocol.c in (1) IBM HTTP Server 6.0 before 6.0.2.13 and 6.1 before 6.1.0.1, and (2) Apache HTTP Server 1.3 before 1.3.35, 2.0 before 2.0.58, and 2.2 before 2.2.2, does not sanitize the Expect header from an HTTP request when it is reflected back in an error message, which might allow cross-site scripting (XSS) style attacks using web client components that can send arbitrary headers in requests, as demonstrated using a Flash SWF file.", title: "Vulnerability description", }, { category: "summary", text: "httpd: Expect header XSS", title: "Vulnerability summary", }, ], product_status: { fixed: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2006-3918", }, { category: "external", summary: "RHBZ#200732", url: "https://bugzilla.redhat.com/show_bug.cgi?id=200732", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2006-3918", url: "https://www.cve.org/CVERecord?id=CVE-2006-3918", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2006-3918", url: "https://nvd.nist.gov/vuln/detail/CVE-2006-3918", }, ], release_date: "2006-05-08T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2010-08-04T21:30:00+00:00", details: "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259", product_ids: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2010:0602", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "httpd: Expect header XSS", }, { cve: "CVE-2006-5752", cwe: { id: "CWE-79", name: "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", }, discovery_date: "2007-06-20T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "245112", }, ], notes: [ { category: "description", text: "Cross-site scripting (XSS) vulnerability in mod_status.c in the mod_status module in Apache HTTP Server (httpd), when ExtendedStatus is enabled and a public server-status page is used, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors involving charsets with browsers that perform \"charset detection\" when the content-type is not specified.", title: "Vulnerability description", }, { category: "summary", text: "httpd mod_status XSS", title: "Vulnerability summary", }, ], product_status: { fixed: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2006-5752", }, { category: "external", summary: "RHBZ#245112", url: "https://bugzilla.redhat.com/show_bug.cgi?id=245112", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2006-5752", url: "https://www.cve.org/CVERecord?id=CVE-2006-5752", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2006-5752", url: "https://nvd.nist.gov/vuln/detail/CVE-2006-5752", }, ], release_date: "2007-06-20T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2010-08-04T21:30:00+00:00", details: "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259", product_ids: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2010:0602", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "httpd mod_status XSS", }, { cve: "CVE-2007-0450", discovery_date: "2007-03-14T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "237080", }, ], notes: [ { category: "description", text: "Directory traversal vulnerability in Apache HTTP Server and Tomcat 5.x before 5.5.22 and 6.x before 6.0.10, when using certain proxy modules (mod_proxy, mod_rewrite, mod_jk), allows remote attackers to read arbitrary files via a .. (dot dot) sequence with combinations of (1) \"/\" (slash), (2) \"\\\" (backslash), and (3) URL-encoded backslash (%5C) characters in the URL, which are valid separators in Tomcat but not in Apache.", title: "Vulnerability description", }, { category: "summary", text: "tomcat directory traversal", title: "Vulnerability summary", }, ], product_status: { fixed: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-0450", }, { category: "external", summary: "RHBZ#237080", url: "https://bugzilla.redhat.com/show_bug.cgi?id=237080", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-0450", url: "https://www.cve.org/CVERecord?id=CVE-2007-0450", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-0450", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-0450", }, ], release_date: "2007-03-14T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2010-08-04T21:30:00+00:00", details: "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259", product_ids: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2010:0602", }, ], threats: [ { category: "impact", details: "Important", }, ], title: "tomcat directory traversal", }, { cve: "CVE-2007-1349", discovery_date: "2007-05-17T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "240423", }, ], notes: [ { category: "description", text: "PerlRun.pm in Apache mod_perl before 1.30, and RegistryCooker.pm in mod_perl 2.x, does not properly escape PATH_INFO before use in a regular expression, which allows remote attackers to cause a denial of service (resource consumption) via a crafted URI.", title: "Vulnerability description", }, { category: "summary", text: "mod_perl PerlRun denial of service", title: "Vulnerability summary", }, ], product_status: { fixed: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-1349", }, { category: "external", summary: "RHBZ#240423", url: "https://bugzilla.redhat.com/show_bug.cgi?id=240423", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-1349", url: "https://www.cve.org/CVERecord?id=CVE-2007-1349", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-1349", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-1349", }, ], release_date: "2007-03-22T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2010-08-04T21:30:00+00:00", details: "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259", product_ids: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2010:0602", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "mod_perl PerlRun denial of service", }, { cve: "CVE-2007-1358", cwe: { id: "CWE-79", name: "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", }, discovery_date: "2007-04-10T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "244803", }, ], notes: [ { category: "description", text: "Cross-site scripting (XSS) vulnerability in certain applications using Apache Tomcat 4.0.0 through 4.0.6 and 4.1.0 through 4.1.34 allows remote attackers to inject arbitrary web script or HTML via crafted \"Accept-Language headers that do not conform to RFC 2616\".", title: "Vulnerability description", }, { category: "summary", text: "tomcat accept-language xss flaw", title: "Vulnerability summary", }, ], product_status: { fixed: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-1358", }, { category: "external", summary: "RHBZ#244803", url: "https://bugzilla.redhat.com/show_bug.cgi?id=244803", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-1358", url: "https://www.cve.org/CVERecord?id=CVE-2007-1358", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-1358", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-1358", }, ], release_date: "2007-06-06T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2010-08-04T21:30:00+00:00", details: "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259", product_ids: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2010:0602", }, ], threats: [ { category: "impact", details: "Low", }, ], title: "tomcat accept-language xss flaw", }, { cve: "CVE-2007-1863", discovery_date: "2007-05-02T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "244658", }, ], notes: [ { category: "description", text: "cache_util.c in the mod_cache module in Apache HTTP Server (httpd), when caching is enabled and a threaded Multi-Processing Module (MPM) is used, allows remote attackers to cause a denial of service (child processing handler crash) via a request with the (1) s-maxage, (2) max-age, (3) min-fresh, or (4) max-stale Cache-Control headers without a value.", title: "Vulnerability description", }, { category: "summary", text: "httpd mod_cache segfault", title: "Vulnerability summary", }, ], product_status: { fixed: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-1863", }, { category: "external", summary: "RHBZ#244658", url: "https://bugzilla.redhat.com/show_bug.cgi?id=244658", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-1863", url: "https://www.cve.org/CVERecord?id=CVE-2007-1863", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-1863", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-1863", }, ], release_date: "2007-05-02T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2010-08-04T21:30:00+00:00", details: "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259", product_ids: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2010:0602", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "httpd mod_cache segfault", }, { cve: "CVE-2007-3304", discovery_date: "2007-06-19T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "245111", }, ], notes: [ { category: "description", text: "Apache httpd 1.3.37, 2.0.59, and 2.2.4 with the Prefork MPM module, allows local users to cause a denial of service by modifying the worker_score and process_score arrays to reference an arbitrary process ID, which is sent a SIGUSR1 signal from the master process, aka \"SIGUSR1 killer.\"", title: "Vulnerability description", }, { category: "summary", text: "httpd scoreboard lack of PID protection", title: "Vulnerability summary", }, ], product_status: { fixed: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-3304", }, { category: "external", summary: "RHBZ#245111", url: "https://bugzilla.redhat.com/show_bug.cgi?id=245111", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-3304", url: "https://www.cve.org/CVERecord?id=CVE-2007-3304", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-3304", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-3304", }, ], release_date: "2007-06-19T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2010-08-04T21:30:00+00:00", details: "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259", product_ids: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2010:0602", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "httpd scoreboard lack of PID protection", }, { cve: "CVE-2007-3382", discovery_date: "2007-07-12T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "247972", }, ], notes: [ { category: "description", text: "Apache Tomcat 6.0.0 to 6.0.13, 5.5.0 to 5.5.24, 5.0.0 to 5.0.30, 4.1.0 to 4.1.36, and 3.3 to 3.3.2 treats single quotes (\"'\") as delimiters in cookies, which might cause sensitive information such as session IDs to be leaked and allow remote attackers to conduct session hijacking attacks.", title: "Vulnerability description", }, { category: "summary", text: "tomcat handling of cookies", title: "Vulnerability summary", }, ], product_status: { fixed: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-3382", }, { category: "external", summary: "RHBZ#247972", url: "https://bugzilla.redhat.com/show_bug.cgi?id=247972", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-3382", url: "https://www.cve.org/CVERecord?id=CVE-2007-3382", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-3382", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-3382", }, ], release_date: "2007-08-14T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2010-08-04T21:30:00+00:00", details: "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259", product_ids: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2010:0602", }, ], threats: [ { category: "impact", details: "Low", }, ], title: "tomcat handling of cookies", }, { cve: "CVE-2007-3385", discovery_date: "2007-07-12T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "247976", }, ], notes: [ { category: "description", text: "Apache Tomcat 6.0.0 to 6.0.13, 5.5.0 to 5.5.24, 5.0.0 to 5.0.30, 4.1.0 to 4.1.36, and 3.3 to 3.3.2 does not properly handle the \\\" character sequence in a cookie value, which might cause sensitive information such as session IDs to be leaked to remote attackers and enable session hijacking attacks.", title: "Vulnerability description", }, { category: "summary", text: "tomcat handling of cookie values", title: "Vulnerability summary", }, ], product_status: { fixed: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-3385", }, { category: "external", summary: "RHBZ#247976", url: "https://bugzilla.redhat.com/show_bug.cgi?id=247976", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-3385", url: "https://www.cve.org/CVERecord?id=CVE-2007-3385", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-3385", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-3385", }, ], release_date: "2007-08-14T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2010-08-04T21:30:00+00:00", details: "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259", product_ids: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2010:0602", }, ], threats: [ { category: "impact", details: "Low", }, ], title: "tomcat handling of cookie values", }, { cve: "CVE-2007-3847", cwe: { id: "CWE-125", name: "Out-of-bounds Read", }, discovery_date: "2007-08-01T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "250731", }, ], notes: [ { category: "description", text: "The date handling code in modules/proxy/proxy_util.c (mod_proxy) in Apache 2.3.0, when using a threaded MPM, allows remote origin servers to cause a denial of service (caching forward proxy process crash) via crafted date headers that trigger a buffer over-read.", title: "Vulnerability description", }, { category: "summary", text: "httpd: out of bounds read", title: "Vulnerability summary", }, ], product_status: { fixed: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-3847", }, { category: "external", summary: "RHBZ#250731", url: "https://bugzilla.redhat.com/show_bug.cgi?id=250731", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-3847", url: "https://www.cve.org/CVERecord?id=CVE-2007-3847", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-3847", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-3847", }, ], release_date: "2007-08-01T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2010-08-04T21:30:00+00:00", details: "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259", product_ids: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2010:0602", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "httpd: out of bounds read", }, { cve: "CVE-2007-4465", cwe: { id: "CWE-79", name: "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", }, discovery_date: "2007-09-13T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "289511", }, ], notes: [ { category: "description", text: "Cross-site scripting (XSS) vulnerability in mod_autoindex.c in the Apache HTTP Server before 2.2.6, when the charset on a server-generated page is not defined, allows remote attackers to inject arbitrary web script or HTML via the P parameter using the UTF-7 charset. NOTE: it could be argued that this issue is due to a design limitation of browsers that attempt to perform automatic content type detection.", title: "Vulnerability description", }, { category: "summary", text: "mod_autoindex XSS", title: "Vulnerability summary", }, { category: "other", text: "This is actually a flaw in browsers that do not derive the response character set as required by RFC 2616. This does not affect the default configuration of Apache httpd in Red Hat products and will only affect customers who have removed the \"AddDefaultCharset\" directive and are using directory indexes. The Red Hat Product Security has rated this issue as having low security impact, a future update may address this flaw.", title: "Statement", }, ], product_status: { fixed: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-4465", }, { category: "external", summary: "RHBZ#289511", url: "https://bugzilla.redhat.com/show_bug.cgi?id=289511", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-4465", url: "https://www.cve.org/CVERecord?id=CVE-2007-4465", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-4465", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-4465", }, ], release_date: "2007-09-13T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2010-08-04T21:30:00+00:00", details: "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259", product_ids: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2010:0602", }, ], threats: [ { category: "impact", details: "Low", }, ], title: "mod_autoindex XSS", }, { cve: "CVE-2007-5000", cwe: { id: "CWE-79", name: "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", }, discovery_date: "2007-12-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "419931", }, ], notes: [ { category: "description", text: "Cross-site scripting (XSS) vulnerability in the (1) mod_imap module in the Apache HTTP Server 1.3.0 through 1.3.39 and 2.0.35 through 2.0.61 and the (2) mod_imagemap module in the Apache HTTP Server 2.2.0 through 2.2.6 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.", title: "Vulnerability description", }, { category: "summary", text: "httpd: mod_imagemap XSS", title: "Vulnerability summary", }, ], product_status: { fixed: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-5000", }, { category: "external", summary: "RHBZ#419931", url: "https://bugzilla.redhat.com/show_bug.cgi?id=419931", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-5000", url: "https://www.cve.org/CVERecord?id=CVE-2007-5000", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-5000", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-5000", }, ], release_date: "2007-12-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2010-08-04T21:30:00+00:00", details: "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259", product_ids: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2010:0602", }, ], threats: [ { category: "impact", details: "Low", }, ], title: "httpd: mod_imagemap XSS", }, { acknowledgments: [ { names: [ "Tavis Ormandy", "Will Drewry", ], }, ], cve: "CVE-2007-5116", discovery_date: "2007-09-26T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "323571", }, ], notes: [ { category: "description", text: "Buffer overflow in the polymorphic opcode support in the Regular Expression Engine (regcomp.c) in Perl 5.8 allows context-dependent attackers to execute arbitrary code by switching from byte to Unicode (UTF) characters in a regular expression.", title: "Vulnerability description", }, { category: "summary", text: "perl regular expression UTF parsing errors", title: "Vulnerability summary", }, ], product_status: { fixed: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-5116", }, { category: "external", summary: "RHBZ#323571", url: "https://bugzilla.redhat.com/show_bug.cgi?id=323571", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-5116", url: "https://www.cve.org/CVERecord?id=CVE-2007-5116", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-5116", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-5116", }, ], release_date: "2007-11-05T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2010-08-04T21:30:00+00:00", details: "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259", product_ids: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2010:0602", }, ], threats: [ { category: "impact", details: "Important", }, ], title: "perl regular expression UTF parsing errors", }, { cve: "CVE-2007-5333", discovery_date: "2008-01-07T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "427766", }, ], notes: [ { category: "description", text: "Apache Tomcat 6.0.0 through 6.0.14, 5.5.0 through 5.5.25, and 4.1.0 through 4.1.36 does not properly handle (1) double quote (\") characters or (2) %5C (encoded backslash) sequences in a cookie value, which might cause sensitive information such as session IDs to be leaked to remote attackers and enable session hijacking attacks. NOTE: this issue exists because of an incomplete fix for CVE-2007-3385.", title: "Vulnerability description", }, { category: "summary", text: "Improve cookie parsing for tomcat5", title: "Vulnerability summary", }, { category: "other", text: "Red Hat is aware of this issue and is tracking it via the following bug: https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=CVE-2007-5333\n\nThe Red Hat Product Security has rated this issue as having low security impact, a future update may address this flaw.", title: "Statement", }, ], product_status: { fixed: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-5333", }, { category: "external", summary: "RHBZ#427766", url: "https://bugzilla.redhat.com/show_bug.cgi?id=427766", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-5333", url: "https://www.cve.org/CVERecord?id=CVE-2007-5333", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-5333", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-5333", }, ], release_date: "2008-02-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2010-08-04T21:30:00+00:00", details: "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259", product_ids: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2010:0602", }, ], threats: [ { category: "impact", details: "Low", }, ], title: "Improve cookie parsing for tomcat5", }, { cve: "CVE-2007-5461", discovery_date: "2007-10-14T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "333791", }, ], notes: [ { category: "description", text: "Absolute path traversal vulnerability in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0, 5.0.0, 5.5.0 through 5.5.25, and 6.0.0 through 6.0.14, under certain configurations, allows remote authenticated users to read arbitrary files via a WebDAV write request that specifies an entity with a SYSTEM tag.", title: "Vulnerability description", }, { category: "summary", text: "Absolute path traversal Apache Tomcat WEBDAV", title: "Vulnerability summary", }, ], product_status: { fixed: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-5461", }, { category: "external", summary: "RHBZ#333791", url: "https://bugzilla.redhat.com/show_bug.cgi?id=333791", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-5461", url: "https://www.cve.org/CVERecord?id=CVE-2007-5461", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-5461", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-5461", }, ], release_date: "2007-10-14T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2010-08-04T21:30:00+00:00", details: "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259", product_ids: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2010:0602", }, ], threats: [ { category: "impact", details: "Important", }, ], title: "Absolute path traversal Apache Tomcat WEBDAV", }, { cve: "CVE-2007-6388", cwe: { id: "CWE-79", name: "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", }, discovery_date: "2008-01-02T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "427228", }, ], notes: [ { category: "description", text: "Cross-site scripting (XSS) vulnerability in mod_status in the Apache HTTP Server 2.2.0 through 2.2.6, 2.0.35 through 2.0.61, and 1.3.2 through 1.3.39, when the server-status page is enabled, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.", title: "Vulnerability description", }, { category: "summary", text: "apache mod_status cross-site scripting", title: "Vulnerability summary", }, ], product_status: { fixed: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-6388", }, { category: "external", summary: "RHBZ#427228", url: "https://bugzilla.redhat.com/show_bug.cgi?id=427228", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-6388", url: "https://www.cve.org/CVERecord?id=CVE-2007-6388", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-6388", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-6388", }, ], release_date: "2007-12-29T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2010-08-04T21:30:00+00:00", details: "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259", product_ids: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2010:0602", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "apache mod_status cross-site scripting", }, { cve: "CVE-2008-0005", cwe: { id: "CWE-79", name: "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", }, discovery_date: "2008-01-02T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "427739", }, ], notes: [ { category: "description", text: "mod_proxy_ftp in Apache 2.2.x before 2.2.7-dev, 2.0.x before 2.0.62-dev, and 1.3.x before 1.3.40-dev does not define a charset, which allows remote attackers to conduct cross-site scripting (XSS) attacks using UTF-7 encoding.", title: "Vulnerability description", }, { category: "summary", text: "mod_proxy_ftp XSS", title: "Vulnerability summary", }, ], product_status: { fixed: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2008-0005", }, { category: "external", summary: "RHBZ#427739", url: "https://bugzilla.redhat.com/show_bug.cgi?id=427739", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2008-0005", url: "https://www.cve.org/CVERecord?id=CVE-2008-0005", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2008-0005", url: "https://nvd.nist.gov/vuln/detail/CVE-2008-0005", }, ], release_date: "2008-01-02T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2010-08-04T21:30:00+00:00", details: "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259", product_ids: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2010:0602", }, ], threats: [ { category: "impact", details: "Low", }, ], title: "mod_proxy_ftp XSS", }, { cve: "CVE-2008-0128", discovery_date: "2008-01-23T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "429821", }, ], notes: [ { category: "description", text: "The SingleSignOn Valve (org.apache.catalina.authenticator.SingleSignOn) in Apache Tomcat before 5.5.21 does not set the secure flag for the JSESSIONIDSSO cookie in an https session, which can cause the cookie to be sent in http requests and make it easier for remote attackers to capture this cookie.", title: "Vulnerability description", }, { category: "summary", text: "tomcat5 SSO cookie login information disclosure", title: "Vulnerability summary", }, ], product_status: { fixed: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2008-0128", }, { category: "external", summary: "RHBZ#429821", url: "https://bugzilla.redhat.com/show_bug.cgi?id=429821", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2008-0128", url: "https://www.cve.org/CVERecord?id=CVE-2008-0128", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2008-0128", url: "https://nvd.nist.gov/vuln/detail/CVE-2008-0128", }, ], release_date: "2006-12-20T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2010-08-04T21:30:00+00:00", details: "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259", product_ids: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2010:0602", }, ], threats: [ { category: "impact", details: "Low", }, ], title: "tomcat5 SSO cookie login information disclosure", }, { cve: "CVE-2008-1232", cwe: { id: "CWE-79", name: "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", }, discovery_date: "2008-08-01T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "457597", }, ], notes: [ { category: "description", text: "Cross-site scripting (XSS) vulnerability in Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16 allows remote attackers to inject arbitrary web script or HTML via a crafted string that is used in the message argument to the HttpServletResponse.sendError method.", title: "Vulnerability description", }, { category: "summary", text: "tomcat: Cross-Site-Scripting enabled by sendError call", title: "Vulnerability summary", }, ], product_status: { fixed: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2008-1232", }, { category: "external", summary: "RHBZ#457597", url: "https://bugzilla.redhat.com/show_bug.cgi?id=457597", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2008-1232", url: "https://www.cve.org/CVERecord?id=CVE-2008-1232", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2008-1232", url: "https://nvd.nist.gov/vuln/detail/CVE-2008-1232", }, ], release_date: "2008-08-01T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2010-08-04T21:30:00+00:00", details: "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259", product_ids: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2010:0602", }, ], threats: [ { category: "impact", details: "Low", }, ], title: "tomcat: Cross-Site-Scripting enabled by sendError call", }, { cve: "CVE-2008-1927", discovery_date: "2008-04-20T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "443928", }, ], notes: [ { category: "description", text: "Double free vulnerability in Perl 5.8.8 allows context-dependent attackers to cause a denial of service (memory corruption and crash) via a crafted regular expression containing UTF8 characters. NOTE: this issue might only be present on certain operating systems.", title: "Vulnerability description", }, { category: "summary", text: "perl: heap corruption by regular expressions with utf8 characters", title: "Vulnerability summary", }, ], product_status: { fixed: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2008-1927", }, { category: "external", summary: "RHBZ#443928", url: "https://bugzilla.redhat.com/show_bug.cgi?id=443928", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2008-1927", url: "https://www.cve.org/CVERecord?id=CVE-2008-1927", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2008-1927", url: "https://nvd.nist.gov/vuln/detail/CVE-2008-1927", }, ], release_date: "2007-12-04T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2010-08-04T21:30:00+00:00", details: "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259", product_ids: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2010:0602", }, ], threats: [ { category: "impact", details: "Important", }, ], title: "perl: heap corruption by regular expressions with utf8 characters", }, { cve: "CVE-2008-2364", discovery_date: "2008-05-29T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "451615", }, ], notes: [ { category: "description", text: "The ap_proxy_http_process_response function in mod_proxy_http.c in the mod_proxy module in the Apache HTTP Server 2.0.63 and 2.2.8 does not limit the number of forwarded interim responses, which allows remote HTTP servers to cause a denial of service (memory consumption) via a large number of interim responses.", title: "Vulnerability description", }, { category: "summary", text: "httpd: mod_proxy_http DoS via excessive interim responses from the origin server", title: "Vulnerability summary", }, { category: "other", text: "Red Hat is aware of this issue and is tracking it via the following bug: https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=CVE-2008-2364\n\nThe Red Hat Product Security has rated this issue as having moderate security impact, a future update may address this flaw. More information regarding issue severity can be found here: https://access.redhat.com/security/updates/classification/", title: "Statement", }, ], product_status: { fixed: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2008-2364", }, { category: "external", summary: "RHBZ#451615", url: "https://bugzilla.redhat.com/show_bug.cgi?id=451615", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2008-2364", url: "https://www.cve.org/CVERecord?id=CVE-2008-2364", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2008-2364", url: "https://nvd.nist.gov/vuln/detail/CVE-2008-2364", }, ], release_date: "2008-06-10T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2010-08-04T21:30:00+00:00", details: "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259", product_ids: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2010:0602", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "httpd: mod_proxy_http DoS via excessive interim responses from the origin server", }, { cve: "CVE-2008-2370", discovery_date: "2008-08-01T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "457934", }, ], notes: [ { category: "description", text: "Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16, when a RequestDispatcher is used, performs path normalization before removing the query string from the URI, which allows remote attackers to conduct directory traversal attacks and read arbitrary files via a .. (dot dot) in a request parameter.", title: "Vulnerability description", }, { category: "summary", text: "tomcat RequestDispatcher information disclosure vulnerability", title: "Vulnerability summary", }, ], product_status: { fixed: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2008-2370", }, { category: "external", summary: "RHBZ#457934", url: "https://bugzilla.redhat.com/show_bug.cgi?id=457934", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2008-2370", url: "https://www.cve.org/CVERecord?id=CVE-2008-2370", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2008-2370", url: "https://nvd.nist.gov/vuln/detail/CVE-2008-2370", }, ], release_date: "2008-08-01T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2010-08-04T21:30:00+00:00", details: "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259", product_ids: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2010:0602", }, ], threats: [ { category: "impact", details: "Important", }, ], title: "tomcat RequestDispatcher information disclosure vulnerability", }, { cve: "CVE-2008-2939", cwe: { id: "CWE-79", name: "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", }, discovery_date: "2008-08-05T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "458250", }, ], notes: [ { category: "description", text: "Cross-site scripting (XSS) vulnerability in proxy_ftp.c in the mod_proxy_ftp module in Apache 2.0.63 and earlier, and mod_proxy_ftp.c in the mod_proxy_ftp module in Apache 2.2.9 and earlier 2.2 versions, allows remote attackers to inject arbitrary web script or HTML via a wildcard in the last directory component in the pathname in an FTP URI.", title: "Vulnerability description", }, { category: "summary", text: "httpd: mod_proxy_ftp globbing XSS", title: "Vulnerability summary", }, ], product_status: { fixed: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2008-2939", }, { category: "external", summary: "RHBZ#458250", url: "https://bugzilla.redhat.com/show_bug.cgi?id=458250", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2008-2939", url: "https://www.cve.org/CVERecord?id=CVE-2008-2939", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2008-2939", url: "https://nvd.nist.gov/vuln/detail/CVE-2008-2939", }, ], release_date: "2008-08-05T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2010-08-04T21:30:00+00:00", details: "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259", product_ids: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2010:0602", }, ], threats: [ { category: "impact", details: "Low", }, ], title: "httpd: mod_proxy_ftp globbing XSS", }, { cve: "CVE-2008-5515", discovery_date: "2009-06-08T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "504753", }, ], notes: [ { category: "description", text: "Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, 6.0.0 through 6.0.18, and possibly earlier versions normalizes the target pathname before filtering the query string when using the RequestDispatcher method, which allows remote attackers to bypass intended access restrictions and conduct directory traversal attacks via .. (dot dot) sequences and the WEB-INF directory in a Request.", title: "Vulnerability description", }, { category: "summary", text: "tomcat request dispatcher information disclosure vulnerability", title: "Vulnerability summary", }, ], product_status: { fixed: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2008-5515", }, { category: "external", summary: "RHBZ#504753", url: "https://bugzilla.redhat.com/show_bug.cgi?id=504753", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2008-5515", url: "https://www.cve.org/CVERecord?id=CVE-2008-5515", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2008-5515", url: "https://nvd.nist.gov/vuln/detail/CVE-2008-5515", }, ], release_date: "2009-06-08T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2010-08-04T21:30:00+00:00", details: "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259", product_ids: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2010:0602", }, ], threats: [ { category: "impact", details: "Important", }, ], title: "tomcat request dispatcher information disclosure vulnerability", }, { cve: "CVE-2009-0023", discovery_date: "2009-06-03T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "503928", }, ], notes: [ { category: "description", text: "The apr_strmatch_precompile function in strmatch/apr_strmatch.c in Apache APR-util before 1.3.5 allows remote attackers to cause a denial of service (daemon crash) via crafted input involving (1) a .htaccess file used with the Apache HTTP Server, (2) the SVNMasterURI directive in the mod_dav_svn module in the Apache HTTP Server, (3) the mod_apreq2 module for the Apache HTTP Server, or (4) an application that uses the libapreq2 library, which triggers a heap-based buffer underflow.", title: "Vulnerability description", }, { category: "summary", text: "apr-util heap buffer underwrite", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2009-0023", }, { category: "external", summary: "RHBZ#503928", url: "https://bugzilla.redhat.com/show_bug.cgi?id=503928", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2009-0023", url: "https://www.cve.org/CVERecord?id=CVE-2009-0023", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2009-0023", url: "https://nvd.nist.gov/vuln/detail/CVE-2009-0023", }, ], release_date: "2009-06-03T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2010-08-04T21:30:00+00:00", details: "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259", product_ids: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2010:0602", }, ], scores: [ { cvss_v2: { accessComplexity: "LOW", accessVector: "LOCAL", authentication: "SINGLE", availabilityImpact: "PARTIAL", baseScore: 4.3, confidentialityImpact: "PARTIAL", integrityImpact: "PARTIAL", vectorString: "AV:L/AC:L/Au:S/C:P/I:P/A:P", version: "2.0", }, products: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "apr-util heap buffer underwrite", }, { cve: "CVE-2009-0033", discovery_date: "2009-01-26T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "493381", }, ], notes: [ { category: "description", text: "Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18, when the Java AJP connector and mod_jk load balancing are used, allows remote attackers to cause a denial of service (application outage) via a crafted request with invalid headers, related to temporary blocking of connectors that have encountered errors, as demonstrated by an error involving a malformed HTTP Host header.", title: "Vulnerability description", }, { category: "summary", text: "tomcat6 Denial-Of-Service with AJP connection", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2009-0033", }, { category: "external", summary: "RHBZ#493381", url: "https://bugzilla.redhat.com/show_bug.cgi?id=493381", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2009-0033", url: "https://www.cve.org/CVERecord?id=CVE-2009-0033", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2009-0033", url: "https://nvd.nist.gov/vuln/detail/CVE-2009-0033", }, ], release_date: "2009-06-03T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2010-08-04T21:30:00+00:00", details: "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259", product_ids: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2010:0602", }, ], scores: [ { cvss_v2: { accessComplexity: "LOW", accessVector: "NETWORK", authentication: "NONE", availabilityImpact: "PARTIAL", baseScore: 5, confidentialityImpact: "NONE", integrityImpact: "NONE", vectorString: "AV:N/AC:L/Au:N/C:N/I:N/A:P", version: "2.0", }, products: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "tomcat6 Denial-Of-Service with AJP connection", }, { cve: "CVE-2009-0580", discovery_date: "2009-06-03T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "503978", }, ], notes: [ { category: "description", text: "Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18, when FORM authentication is used, allows remote attackers to enumerate valid usernames via requests to /j_security_check with malformed URL encoding of passwords, related to improper error checking in the (1) MemoryRealm, (2) DataSourceRealm, and (3) JDBCRealm authentication realms, as demonstrated by a % (percent) value for the j_password parameter.", title: "Vulnerability description", }, { category: "summary", text: "tomcat6 Information disclosure in authentication classes", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2009-0580", }, { category: "external", summary: "RHBZ#503978", url: "https://bugzilla.redhat.com/show_bug.cgi?id=503978", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2009-0580", url: "https://www.cve.org/CVERecord?id=CVE-2009-0580", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2009-0580", url: "https://nvd.nist.gov/vuln/detail/CVE-2009-0580", }, ], release_date: "2009-06-03T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2010-08-04T21:30:00+00:00", details: "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259", product_ids: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2010:0602", }, ], scores: [ { cvss_v2: { accessComplexity: "LOW", accessVector: "NETWORK", authentication: "NONE", availabilityImpact: "NONE", baseScore: 5, confidentialityImpact: "PARTIAL", integrityImpact: "NONE", vectorString: "AV:N/AC:L/Au:N/C:P/I:N/A:N", version: "2.0", }, products: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], }, ], threats: [ { category: "impact", details: "Low", }, ], title: "tomcat6 Information disclosure in authentication classes", }, { cve: "CVE-2009-1891", discovery_date: "2009-06-26T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "509125", }, ], notes: [ { category: "description", text: "The mod_deflate module in Apache httpd 2.2.11 and earlier compresses large files until completion even after the associated network connection is closed, which allows remote attackers to cause a denial of service (CPU consumption).", title: "Vulnerability description", }, { category: "summary", text: "httpd: possible temporary DoS (CPU consumption) in mod_deflate", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2009-1891", }, { category: "external", summary: "RHBZ#509125", url: "https://bugzilla.redhat.com/show_bug.cgi?id=509125", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2009-1891", url: "https://www.cve.org/CVERecord?id=CVE-2009-1891", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2009-1891", url: "https://nvd.nist.gov/vuln/detail/CVE-2009-1891", }, ], release_date: "2009-06-26T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2010-08-04T21:30:00+00:00", details: "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259", product_ids: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2010:0602", }, ], scores: [ { cvss_v2: { accessComplexity: "HIGH", accessVector: "NETWORK", authentication: "NONE", availabilityImpact: "PARTIAL", baseScore: 2.6, confidentialityImpact: "NONE", integrityImpact: "NONE", vectorString: "AV:N/AC:H/Au:N/C:N/I:N/A:P", version: "2.0", }, products: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], }, ], threats: [ { category: "impact", details: "Low", }, ], title: "httpd: possible temporary DoS (CPU consumption) in mod_deflate", }, { cve: "CVE-2009-1955", discovery_date: "2009-06-01T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "504555", }, ], notes: [ { category: "description", text: "The expat XML parser in the apr_xml_* interface in xml/apr_xml.c in Apache APR-util before 1.3.7, as used in the mod_dav and mod_dav_svn modules in the Apache HTTP Server, allows remote attackers to cause a denial of service (memory consumption) via a crafted XML document containing a large number of nested entity references, as demonstrated by a PROPFIND request, a similar issue to CVE-2003-1564.", title: "Vulnerability description", }, { category: "summary", text: "apr-util billion laughs attack", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2009-1955", }, { category: "external", summary: "RHBZ#504555", url: "https://bugzilla.redhat.com/show_bug.cgi?id=504555", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2009-1955", url: "https://www.cve.org/CVERecord?id=CVE-2009-1955", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2009-1955", url: "https://nvd.nist.gov/vuln/detail/CVE-2009-1955", }, ], release_date: "2009-06-01T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2010-08-04T21:30:00+00:00", details: "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259", product_ids: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2010:0602", }, ], scores: [ { cvss_v2: { accessComplexity: "LOW", accessVector: "NETWORK", authentication: "NONE", availabilityImpact: "PARTIAL", baseScore: 5, confidentialityImpact: "NONE", integrityImpact: "NONE", vectorString: "AV:N/AC:L/Au:N/C:N/I:N/A:P", version: "2.0", }, products: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "apr-util billion laughs attack", }, { cve: "CVE-2009-1956", discovery_date: "2009-06-05T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "504390", }, ], notes: [ { category: "description", text: "Off-by-one error in the apr_brigade_vprintf function in Apache APR-util before 1.3.5 on big-endian platforms allows remote attackers to obtain sensitive information or cause a denial of service (application crash) via crafted input.", title: "Vulnerability description", }, { category: "summary", text: "apr-util single NULL byte buffer overflow", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2009-1956", }, { category: "external", summary: "RHBZ#504390", url: "https://bugzilla.redhat.com/show_bug.cgi?id=504390", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2009-1956", url: "https://www.cve.org/CVERecord?id=CVE-2009-1956", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2009-1956", url: "https://nvd.nist.gov/vuln/detail/CVE-2009-1956", }, ], release_date: "2009-04-24T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2010-08-04T21:30:00+00:00", details: "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259", product_ids: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2010:0602", }, ], scores: [ { cvss_v2: { accessComplexity: "MEDIUM", accessVector: "NETWORK", authentication: "NONE", availabilityImpact: "NONE", baseScore: 4.3, confidentialityImpact: "PARTIAL", integrityImpact: "NONE", vectorString: "AV:N/AC:M/Au:N/C:P/I:N/A:N", version: "2.0", }, products: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "apr-util single NULL byte buffer overflow", }, { cve: "CVE-2009-2412", cwe: { id: "CWE-190", name: "Integer Overflow or Wraparound", }, discovery_date: "2009-07-30T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "515698", }, ], notes: [ { category: "description", text: "Multiple integer overflows in the Apache Portable Runtime (APR) library and the Apache Portable Utility library (aka APR-util) 0.9.x and 1.3.x allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via vectors that trigger crafted calls to the (1) allocator_alloc or (2) apr_palloc function in memory/unix/apr_pools.c in APR; or crafted calls to the (3) apr_rmm_malloc, (4) apr_rmm_calloc, or (5) apr_rmm_realloc function in misc/apr_rmm.c in APR-util; leading to buffer overflows. NOTE: some of these details are obtained from third party information.", title: "Vulnerability description", }, { category: "summary", text: "apr-util: Integer overflows in memory pool (apr) and relocatable memory (apr-util) management", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2009-2412", }, { category: "external", summary: "RHBZ#515698", url: "https://bugzilla.redhat.com/show_bug.cgi?id=515698", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2009-2412", url: "https://www.cve.org/CVERecord?id=CVE-2009-2412", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2009-2412", url: "https://nvd.nist.gov/vuln/detail/CVE-2009-2412", }, ], release_date: "2009-08-04T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2010-08-04T21:30:00+00:00", details: "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259", product_ids: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2010:0602", }, ], scores: [ { cvss_v2: { accessComplexity: "MEDIUM", accessVector: "NETWORK", authentication: "NONE", availabilityImpact: "PARTIAL", baseScore: 6.8, confidentialityImpact: "PARTIAL", integrityImpact: "PARTIAL", vectorString: "AV:N/AC:M/Au:N/C:P/I:P/A:P", version: "2.0", }, products: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "apr-util: Integer overflows in memory pool (apr) and relocatable memory (apr-util) management", }, { cve: "CVE-2009-3094", discovery_date: "2009-09-04T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "521619", }, ], notes: [ { category: "description", text: "The ap_proxy_ftp_handler function in modules/proxy/proxy_ftp.c in the mod_proxy_ftp module in the Apache HTTP Server 2.0.63 and 2.2.13 allows remote FTP servers to cause a denial of service (NULL pointer dereference and child process crash) via a malformed reply to an EPSV command.", title: "Vulnerability description", }, { category: "summary", text: "httpd: NULL pointer defer in mod_proxy_ftp caused by crafted EPSV and PASV reply", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2009-3094", }, { category: "external", summary: "RHBZ#521619", url: "https://bugzilla.redhat.com/show_bug.cgi?id=521619", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2009-3094", url: "https://www.cve.org/CVERecord?id=CVE-2009-3094", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2009-3094", url: "https://nvd.nist.gov/vuln/detail/CVE-2009-3094", }, ], release_date: "2009-09-02T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2010-08-04T21:30:00+00:00", details: "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259", product_ids: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2010:0602", }, ], scores: [ { cvss_v2: { accessComplexity: "HIGH", accessVector: "NETWORK", authentication: "NONE", availabilityImpact: "PARTIAL", baseScore: 2.6, confidentialityImpact: "NONE", integrityImpact: "NONE", vectorString: "AV:N/AC:H/Au:N/C:N/I:N/A:P", version: "2.0", }, products: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], }, ], threats: [ { category: "impact", details: "Low", }, ], title: "httpd: NULL pointer defer in mod_proxy_ftp caused by crafted EPSV and PASV reply", }, { cve: "CVE-2009-3095", discovery_date: "2009-09-03T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "522209", }, ], notes: [ { category: "description", text: "The mod_proxy_ftp module in the Apache HTTP Server allows remote attackers to bypass intended access restrictions and send arbitrary commands to an FTP server via vectors related to the embedding of these commands in the Authorization HTTP header, as demonstrated by a certain module in VulnDisco Pack Professional 8.11.", title: "Vulnerability description", }, { category: "summary", text: "httpd: mod_proxy_ftp FTP command injection via Authorization HTTP header", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2009-3095", }, { category: "external", summary: "RHBZ#522209", url: "https://bugzilla.redhat.com/show_bug.cgi?id=522209", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2009-3095", url: "https://www.cve.org/CVERecord?id=CVE-2009-3095", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2009-3095", url: "https://nvd.nist.gov/vuln/detail/CVE-2009-3095", }, ], release_date: "2009-09-03T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2010-08-04T21:30:00+00:00", details: "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259", product_ids: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2010:0602", }, ], scores: [ { cvss_v2: { accessComplexity: "HIGH", accessVector: "NETWORK", authentication: "NONE", availabilityImpact: "NONE", baseScore: 2.6, confidentialityImpact: "NONE", integrityImpact: "PARTIAL", vectorString: "AV:N/AC:H/Au:N/C:N/I:P/A:N", version: "2.0", }, products: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], }, ], threats: [ { category: "impact", details: "Low", }, ], title: "httpd: mod_proxy_ftp FTP command injection via Authorization HTTP header", }, { cve: "CVE-2009-4901", cwe: { id: "CWE-119", name: "Improper Restriction of Operations within the Bounds of a Memory Buffer", }, discovery_date: "2010-05-26T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "596426", }, ], notes: [ { category: "description", text: "The MSGFunctionDemarshall function in winscard_svc.c in the PC/SC Smart Card daemon (aka PCSCD) in MUSCLE PCSC-Lite before 1.5.4 might allow local users to cause a denial of service (daemon crash) via crafted SCARD_SET_ATTRIB message data, which is improperly demarshalled and triggers a buffer over-read, a related issue to CVE-2010-0407.", title: "Vulnerability description", }, { category: "summary", text: "pcsc-lite: Privilege escalation via specially-crafted client to PC/SC Smart Card daemon messages", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2009-4901", }, { category: "external", summary: "RHBZ#596426", url: "https://bugzilla.redhat.com/show_bug.cgi?id=596426", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2009-4901", url: "https://www.cve.org/CVERecord?id=CVE-2009-4901", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2009-4901", url: "https://nvd.nist.gov/vuln/detail/CVE-2009-4901", }, ], release_date: "2010-06-10T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2010-08-04T21:30:00+00:00", details: "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259", product_ids: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2010:0602", }, ], scores: [ { cvss_v2: { accessComplexity: "LOW", accessVector: "LOCAL", authentication: "NONE", availabilityImpact: "COMPLETE", baseScore: 7.2, confidentialityImpact: "COMPLETE", integrityImpact: "COMPLETE", vectorString: "AV:L/AC:L/Au:N/C:C/I:C/A:C", version: "2.0", }, products: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "pcsc-lite: Privilege escalation via specially-crafted client to PC/SC Smart Card daemon messages", }, { cve: "CVE-2010-0407", cwe: { id: "CWE-119", name: "Improper Restriction of Operations within the Bounds of a Memory Buffer", }, discovery_date: "2010-05-26T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "596426", }, ], notes: [ { category: "description", text: "Multiple buffer overflows in the MSGFunctionDemarshall function in winscard_svc.c in the PC/SC Smart Card daemon (aka PCSCD) in MUSCLE PCSC-Lite before 1.5.4 allow local users to gain privileges via crafted message data, which is improperly demarshalled.", title: "Vulnerability description", }, { category: "summary", text: "pcsc-lite: Privilege escalation via specially-crafted client to PC/SC Smart Card daemon messages", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2010-0407", }, { category: "external", summary: "RHBZ#596426", url: "https://bugzilla.redhat.com/show_bug.cgi?id=596426", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2010-0407", url: "https://www.cve.org/CVERecord?id=CVE-2010-0407", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2010-0407", url: "https://nvd.nist.gov/vuln/detail/CVE-2010-0407", }, ], release_date: "2010-06-10T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2010-08-04T21:30:00+00:00", details: "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259", product_ids: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2010:0602", }, ], scores: [ { cvss_v2: { accessComplexity: "LOW", accessVector: "LOCAL", authentication: "NONE", availabilityImpact: "COMPLETE", baseScore: 7.2, confidentialityImpact: "COMPLETE", integrityImpact: "COMPLETE", vectorString: "AV:L/AC:L/Au:N/C:C/I:C/A:C", version: "2.0", }, products: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "pcsc-lite: Privilege escalation via specially-crafted client to PC/SC Smart Card daemon messages", }, { cve: "CVE-2010-0434", discovery_date: "2010-03-03T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "570171", }, ], notes: [ { category: "description", text: "The ap_read_request function in server/protocol.c in the Apache HTTP Server 2.2.x before 2.2.15, when a multithreaded MPM is used, does not properly handle headers in subrequests in certain circumstances involving a parent request that has a body, which might allow remote attackers to obtain sensitive information via a crafted request that triggers access to memory locations associated with an earlier request.", title: "Vulnerability description", }, { category: "summary", text: "httpd: request header information leak", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2010-0434", }, { category: "external", summary: "RHBZ#570171", url: "https://bugzilla.redhat.com/show_bug.cgi?id=570171", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2010-0434", url: "https://www.cve.org/CVERecord?id=CVE-2010-0434", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2010-0434", url: "https://nvd.nist.gov/vuln/detail/CVE-2010-0434", }, ], release_date: "2009-12-09T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2010-08-04T21:30:00+00:00", details: "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259", product_ids: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2010:0602", }, ], scores: [ { cvss_v2: { accessComplexity: "HIGH", accessVector: "NETWORK", authentication: "NONE", availabilityImpact: "NONE", baseScore: 2.6, confidentialityImpact: "PARTIAL", integrityImpact: "NONE", vectorString: "AV:N/AC:H/Au:N/C:P/I:N/A:N", version: "2.0", }, products: [ "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4AS-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4AS-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4AS-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4AS-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4AS-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4AS-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4AS-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4AS-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4AS-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4AS-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4AS-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4AS-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4AS-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4AS-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4AS-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4AS-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4AS-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4AS-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4AS-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4AS-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4AS-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.noarch", "4ES-CERT-7.3:ant-0:1.6.5-1jpp_1rh.src", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.noarch", "4ES-CERT-7.3:avalon-logkit-0:1.2-2jpp_4rh.src", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.noarch", "4ES-CERT-7.3:axis-0:1.2.1-1jpp_3rh.src", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.noarch", "4ES-CERT-7.3:classpathx-jaf-0:1.0-2jpp_6rh.src", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.noarch", "4ES-CERT-7.3:classpathx-mail-0:1.1.1-2jpp_8rh.src", "4ES-CERT-7.3:geronimo-ejb-2.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-1.4-apis-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-connector-1.5-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-deployment-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-j2ee-management-1.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jms-1.1-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jsp-2.0-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-jta-1.0.1B-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-servlet-2.4-api-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:geronimo-specs-0:1.0-0.M4.1jpp_10rh.src", "4ES-CERT-7.3:geronimo-specs-javadoc-0:1.0-0.M4.1jpp_10rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.noarch", "4ES-CERT-7.3:jakarta-commons-modeler-0:2.0-3jpp_2rh.src", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.noarch", "4ES-CERT-7.3:log4j-0:1.2.12-1jpp_1rh.src", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.noarch", "4ES-CERT-7.3:mx4j-1:3.0.1-1jpp_4rh.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.src", "4ES-CERT-7.3:pcsc-lite-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-debuginfo-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-doc-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.i386", "4ES-CERT-7.3:pcsc-lite-libs-0:1.3.3-3.el4.x86_64", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-20.el4.noarch", "4ES-CERT-7.3:rhpki-java-tools-0:7.3.0-10.el4.noarch", "4ES-CERT-7.3:rhpki-kra-0:7.3.0-14.el4.noarch", "4ES-CERT-7.3:rhpki-manage-0:7.3.0-19.el4.noarch", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.i386", "4ES-CERT-7.3:rhpki-native-tools-0:7.3.0-6.el4.x86_64", "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:rhpki-tks-0:7.3.0-13.el4.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-0:5.5.23-0jpp_4rh.16.src", "4ES-CERT-7.3:tomcat5-common-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jasper-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-server-lib-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.16.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.noarch", "4ES-CERT-7.3:xerces-j2-0:2.7.1-1jpp_1rh.src", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.noarch", "4ES-CERT-7.3:xml-commons-0:1.3.02-2jpp_1rh.src", "4ES-CERT-7.3:xml-commons-apis-0:1.3.02-2jpp_1rh.noarch", ], }, ], threats: [ { category: "impact", details: "Low", }, ], title: "httpd: request header information leak", }, ], }
rhsa-2008:0523
Vulnerability from csaf_redhat
Published
2008-06-30 15:29
Modified
2025-01-26 19:35
Summary
Red Hat Security Advisory: Red Hat Network Proxy Server security update
Notes
Topic
Red Hat Network Proxy Server version 4.2.3 is now available. This update
includes fixes for a number of security issues in Red Hat Network Proxy
Server components.
This update has been rated as having low security impact by the Red
Hat Security Response Team.
Details
The Red Hat Network Proxy Server 4.2.3 release corrects several security
vulnerabilities in several shipped components. In a typical operating
environment, these components are not exposed to users of Proxy Server in a
vulnerable manner. These security updates will reduce risk in unique Proxy
Server environments.
Multiple flaws were fixed in the Apache HTTPD server. These flaws could
result in a cross-site scripting or denial-of-service attack.
(CVE-2007-6388, CVE-2007-5000, CVE-2007-4465, CVE-2007-3304, CVE-2006-5752,
CVE-2006-3918, CVE-2005-3352)
A denial-of-service flaw was fixed in mod_perl. (CVE-2007-1349)
Multiple flaws in mod_ssl. (CVE-2004-0488, CVE-2004-0700, CVE-2004-0885)
A denial-of-service flaw was fixed in the jabberd server. (CVE-2006-1329)
Users of Red Hat Network Proxy Server 4.2 are advised to upgrade to 4.2.3,
which resolves these issues.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ document: { aggregate_severity: { namespace: "https://access.redhat.com/security/updates/classification/", text: "Low", }, category: "csaf_security_advisory", csaf_version: "2.0", distribution: { text: "Copyright © Red Hat, Inc. All rights reserved.", tlp: { label: "WHITE", url: "https://www.first.org/tlp/", }, }, lang: "en", notes: [ { category: "summary", text: "Red Hat Network Proxy Server version 4.2.3 is now available. This update\nincludes fixes for a number of security issues in Red Hat Network Proxy\nServer components.\n\nThis update has been rated as having low security impact by the Red\nHat Security Response Team.", title: "Topic", }, { category: "general", text: "The Red Hat Network Proxy Server 4.2.3 release corrects several security\nvulnerabilities in several shipped components. In a typical operating\nenvironment, these components are not exposed to users of Proxy Server in a\nvulnerable manner. These security updates will reduce risk in unique Proxy\nServer environments.\n\nMultiple flaws were fixed in the Apache HTTPD server. These flaws could\nresult in a cross-site scripting or denial-of-service attack.\n(CVE-2007-6388, CVE-2007-5000, CVE-2007-4465, CVE-2007-3304, CVE-2006-5752,\nCVE-2006-3918, CVE-2005-3352)\n\nA denial-of-service flaw was fixed in mod_perl. (CVE-2007-1349)\n\nMultiple flaws in mod_ssl. (CVE-2004-0488, CVE-2004-0700, CVE-2004-0885)\n\nA denial-of-service flaw was fixed in the jabberd server. (CVE-2006-1329)\n\nUsers of Red Hat Network Proxy Server 4.2 are advised to upgrade to 4.2.3,\nwhich resolves these issues.", title: "Details", }, { category: "legal_disclaimer", text: "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", title: "Terms of Use", }, ], publisher: { category: "vendor", contact_details: "https://access.redhat.com/security/team/contact/", issuing_authority: "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", name: "Red Hat Product Security", namespace: "https://www.redhat.com", }, references: [ { category: "self", summary: "https://access.redhat.com/errata/RHSA-2008:0523", url: "https://access.redhat.com/errata/RHSA-2008:0523", }, { category: "external", summary: "https://access.redhat.com/security/updates/classification/#low", url: "https://access.redhat.com/security/updates/classification/#low", }, { category: "external", summary: "449336", url: "https://bugzilla.redhat.com/show_bug.cgi?id=449336", }, { category: "self", summary: "Canonical URL", url: "https://security.access.redhat.com/data/csaf/v2/advisories/2008/rhsa-2008_0523.json", }, ], title: "Red Hat Security Advisory: Red Hat Network Proxy Server security update", tracking: { current_release_date: "2025-01-26T19:35:55+00:00", generator: { date: "2025-01-26T19:35:55+00:00", engine: { name: "Red Hat SDEngine", version: "4.2.6", }, }, id: "RHSA-2008:0523", initial_release_date: "2008-06-30T15:29:00+00:00", revision_history: [ { date: "2008-06-30T15:29:00+00:00", number: "1", summary: "Initial version", }, { date: "2008-06-30T11:32:56+00:00", number: "2", summary: "Last updated version", }, { date: "2025-01-26T19:35:55+00:00", number: "3", summary: "Last generated version", }, ], status: "final", version: "3", }, }, product_tree: { branches: [ { branches: [ { branches: [ { category: "product_name", name: "Red Hat Satellite Proxy v 4.2 (RHEL v.3 AS)", product: { name: "Red Hat Satellite Proxy v 4.2 (RHEL v.3 AS)", product_id: "3AS-RHNPROXY4.2", product_identification_helper: { cpe: "cpe:/a:redhat:network_proxy:4.2::el3", }, }, }, { category: "product_name", name: "Red Hat Satellite Proxy v 4.2 (RHEL v.4 AS)", product: { name: "Red Hat Satellite Proxy v 4.2 (RHEL v.4 AS)", product_id: "4AS-RHNPROXY4.2", product_identification_helper: { cpe: "cpe:/a:redhat:network_proxy:4.2::el4", }, }, }, ], category: "product_family", name: "Red Hat Satellite Proxy", }, { branches: [ { category: "product_version", name: "jabberd-0:2.0s10-3.37.rhn.i386", product: { name: "jabberd-0:2.0s10-3.37.rhn.i386", product_id: "jabberd-0:2.0s10-3.37.rhn.i386", product_identification_helper: { purl: "pkg:rpm/redhat/jabberd@2.0s10-3.37.rhn?arch=i386", }, }, }, { category: "product_version", name: "rhn-apache-0:1.3.27-36.rhn.rhel3.i386", product: { name: "rhn-apache-0:1.3.27-36.rhn.rhel3.i386", product_id: "rhn-apache-0:1.3.27-36.rhn.rhel3.i386", product_identification_helper: { purl: "pkg:rpm/redhat/rhn-apache@1.3.27-36.rhn.rhel3?arch=i386", }, }, }, { category: "product_version", name: "rhn-modperl-0:1.29-16.rhel3.i386", product: { name: "rhn-modperl-0:1.29-16.rhel3.i386", product_id: "rhn-modperl-0:1.29-16.rhel3.i386", product_identification_helper: { purl: "pkg:rpm/redhat/rhn-modperl@1.29-16.rhel3?arch=i386", }, }, }, { category: "product_version", name: "jabberd-0:2.0s10-3.38.rhn.i386", product: { name: "jabberd-0:2.0s10-3.38.rhn.i386", product_id: "jabberd-0:2.0s10-3.38.rhn.i386", product_identification_helper: { purl: "pkg:rpm/redhat/jabberd@2.0s10-3.38.rhn?arch=i386", }, }, }, { category: "product_version", name: "rhn-apache-0:1.3.27-36.rhn.rhel4.i386", product: { name: "rhn-apache-0:1.3.27-36.rhn.rhel4.i386", product_id: "rhn-apache-0:1.3.27-36.rhn.rhel4.i386", product_identification_helper: { purl: "pkg:rpm/redhat/rhn-apache@1.3.27-36.rhn.rhel4?arch=i386", }, }, }, { category: "product_version", name: "rhn-modperl-0:1.29-16.rhel4.i386", product: { name: "rhn-modperl-0:1.29-16.rhel4.i386", product_id: "rhn-modperl-0:1.29-16.rhel4.i386", product_identification_helper: { purl: "pkg:rpm/redhat/rhn-modperl@1.29-16.rhel4?arch=i386", }, }, }, ], category: "architecture", name: "i386", }, ], category: "vendor", name: "Red Hat", }, ], relationships: [ { category: "default_component_of", full_product_name: { name: "jabberd-0:2.0s10-3.37.rhn.i386 as a component of Red Hat Satellite Proxy v 4.2 (RHEL v.3 AS)", product_id: "3AS-RHNPROXY4.2:jabberd-0:2.0s10-3.37.rhn.i386", }, product_reference: "jabberd-0:2.0s10-3.37.rhn.i386", relates_to_product_reference: "3AS-RHNPROXY4.2", }, { category: "default_component_of", full_product_name: { name: "rhn-apache-0:1.3.27-36.rhn.rhel3.i386 as a component of Red Hat Satellite Proxy v 4.2 (RHEL v.3 AS)", product_id: "3AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", }, product_reference: "rhn-apache-0:1.3.27-36.rhn.rhel3.i386", relates_to_product_reference: "3AS-RHNPROXY4.2", }, { category: "default_component_of", full_product_name: { name: "rhn-modperl-0:1.29-16.rhel3.i386 as a component of Red Hat Satellite Proxy v 4.2 (RHEL v.3 AS)", product_id: "3AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel3.i386", }, product_reference: "rhn-modperl-0:1.29-16.rhel3.i386", relates_to_product_reference: "3AS-RHNPROXY4.2", }, { category: "default_component_of", full_product_name: { name: "jabberd-0:2.0s10-3.38.rhn.i386 as a component of Red Hat Satellite Proxy v 4.2 (RHEL v.4 AS)", product_id: "4AS-RHNPROXY4.2:jabberd-0:2.0s10-3.38.rhn.i386", }, product_reference: "jabberd-0:2.0s10-3.38.rhn.i386", relates_to_product_reference: "4AS-RHNPROXY4.2", }, { category: "default_component_of", full_product_name: { name: "rhn-apache-0:1.3.27-36.rhn.rhel4.i386 as a component of Red Hat Satellite Proxy v 4.2 (RHEL v.4 AS)", product_id: "4AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", }, product_reference: "rhn-apache-0:1.3.27-36.rhn.rhel4.i386", relates_to_product_reference: "4AS-RHNPROXY4.2", }, { category: "default_component_of", full_product_name: { name: "rhn-modperl-0:1.29-16.rhel4.i386 as a component of Red Hat Satellite Proxy v 4.2 (RHEL v.4 AS)", product_id: "4AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel4.i386", }, product_reference: "rhn-modperl-0:1.29-16.rhel4.i386", relates_to_product_reference: "4AS-RHNPROXY4.2", }, ], }, vulnerabilities: [ { cve: "CVE-2004-0488", ids: [ { system_name: "Red Hat Bugzilla ID", text: "430867", }, ], notes: [ { category: "description", text: "Stack-based buffer overflow in the ssl_util_uuencode_binary function in ssl_util.c for Apache mod_ssl, when mod_ssl is configured to trust the issuing CA, may allow remote attackers to execute arbitrary code via a client certificate with a long subject DN.", title: "Vulnerability description", }, { category: "summary", text: "mod_ssl ssl_util_uuencode_binary CA issue", title: "Vulnerability summary", }, ], product_status: { fixed: [ "3AS-RHNPROXY4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel3.i386", "4AS-RHNPROXY4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel4.i386", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2004-0488", }, { category: "external", summary: "RHBZ#430867", url: "https://bugzilla.redhat.com/show_bug.cgi?id=430867", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2004-0488", url: "https://www.cve.org/CVERecord?id=CVE-2004-0488", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2004-0488", url: "https://nvd.nist.gov/vuln/detail/CVE-2004-0488", }, ], release_date: "2004-05-17T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-06-30T15:29:00+00:00", details: "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.\n\nThis update is available via Red Hat Network. Details on how to use \nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/FAQ_58_10188", product_ids: [ "3AS-RHNPROXY4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel3.i386", "4AS-RHNPROXY4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel4.i386", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0523", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "mod_ssl ssl_util_uuencode_binary CA issue", }, { cve: "CVE-2004-0700", ids: [ { system_name: "Red Hat Bugzilla ID", text: "430866", }, ], notes: [ { category: "description", text: "Format string vulnerability in the mod_proxy hook functions function in ssl_engine_log.c in mod_ssl before 2.8.19 for Apache before 1.3.31 may allow remote attackers to execute arbitrary messages via format string specifiers in certain log messages for HTTPS that are handled by the ssl_log function.", title: "Vulnerability description", }, { category: "summary", text: "mod_proxy hook format string", title: "Vulnerability summary", }, ], product_status: { fixed: [ "3AS-RHNPROXY4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel3.i386", "4AS-RHNPROXY4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel4.i386", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2004-0700", }, { category: "external", summary: "RHBZ#430866", url: "https://bugzilla.redhat.com/show_bug.cgi?id=430866", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2004-0700", url: "https://www.cve.org/CVERecord?id=CVE-2004-0700", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2004-0700", url: "https://nvd.nist.gov/vuln/detail/CVE-2004-0700", }, ], release_date: "2004-07-16T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-06-30T15:29:00+00:00", details: "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.\n\nThis update is available via Red Hat Network. Details on how to use \nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/FAQ_58_10188", product_ids: [ "3AS-RHNPROXY4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel3.i386", "4AS-RHNPROXY4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel4.i386", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0523", }, ], threats: [ { category: "impact", details: "Important", }, ], title: "mod_proxy hook format string", }, { cve: "CVE-2004-0885", ids: [ { system_name: "Red Hat Bugzilla ID", text: "430637", }, ], notes: [ { category: "description", text: "The mod_ssl module in Apache 2.0.35 through 2.0.52, when using the \"SSLCipherSuite\" directive in directory or location context, allows remote clients to bypass intended restrictions by using any cipher suite that is allowed by the virtual host configuration.", title: "Vulnerability description", }, { category: "summary", text: "mod_ssl SSLCipherSuite bypass", title: "Vulnerability summary", }, ], product_status: { fixed: [ "3AS-RHNPROXY4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel3.i386", "4AS-RHNPROXY4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel4.i386", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2004-0885", }, { category: "external", summary: "RHBZ#430637", url: "https://bugzilla.redhat.com/show_bug.cgi?id=430637", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2004-0885", url: "https://www.cve.org/CVERecord?id=CVE-2004-0885", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2004-0885", url: "https://nvd.nist.gov/vuln/detail/CVE-2004-0885", }, ], release_date: "2004-10-05T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-06-30T15:29:00+00:00", details: "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.\n\nThis update is available via Red Hat Network. Details on how to use \nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/FAQ_58_10188", product_ids: [ "3AS-RHNPROXY4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel3.i386", "4AS-RHNPROXY4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel4.i386", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0523", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "mod_ssl SSLCipherSuite bypass", }, { cve: "CVE-2005-3352", cwe: { id: "CWE-79", name: "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", }, discovery_date: "2005-12-12T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "430524", }, ], notes: [ { category: "description", text: "Cross-site scripting (XSS) vulnerability in the mod_imap module of Apache httpd before 1.3.35-dev and Apache httpd 2.0.x before 2.0.56-dev allows remote attackers to inject arbitrary web script or HTML via the Referer when using image maps.", title: "Vulnerability description", }, { category: "summary", text: "httpd cross-site scripting flaw in mod_imap", title: "Vulnerability summary", }, ], product_status: { fixed: [ "3AS-RHNPROXY4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel3.i386", "4AS-RHNPROXY4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel4.i386", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2005-3352", }, { category: "external", summary: "RHBZ#430524", url: "https://bugzilla.redhat.com/show_bug.cgi?id=430524", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2005-3352", url: "https://www.cve.org/CVERecord?id=CVE-2005-3352", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2005-3352", url: "https://nvd.nist.gov/vuln/detail/CVE-2005-3352", }, ], release_date: "2005-12-12T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-06-30T15:29:00+00:00", details: "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.\n\nThis update is available via Red Hat Network. Details on how to use \nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/FAQ_58_10188", product_ids: [ "3AS-RHNPROXY4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel3.i386", "4AS-RHNPROXY4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel4.i386", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0523", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "httpd cross-site scripting flaw in mod_imap", }, { cve: "CVE-2006-1329", ids: [ { system_name: "Red Hat Bugzilla ID", text: "429254", }, ], notes: [ { category: "description", text: "The SASL negotiation in Jabber Studio jabberd before 2.0s11 allows remote attackers to cause a denial of service (\"c2s segfault\") by sending a \"response stanza before an auth stanza\".", title: "Vulnerability description", }, { category: "summary", text: "jabberd SASL DoS", title: "Vulnerability summary", }, ], product_status: { fixed: [ "3AS-RHNPROXY4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel3.i386", "4AS-RHNPROXY4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel4.i386", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2006-1329", }, { category: "external", summary: "RHBZ#429254", url: "https://bugzilla.redhat.com/show_bug.cgi?id=429254", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2006-1329", url: "https://www.cve.org/CVERecord?id=CVE-2006-1329", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2006-1329", url: "https://nvd.nist.gov/vuln/detail/CVE-2006-1329", }, ], release_date: "2006-03-09T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-06-30T15:29:00+00:00", details: "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.\n\nThis update is available via Red Hat Network. Details on how to use \nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/FAQ_58_10188", product_ids: [ "3AS-RHNPROXY4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel3.i386", "4AS-RHNPROXY4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel4.i386", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0523", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "jabberd SASL DoS", }, { cve: "CVE-2006-3918", cwe: { id: "CWE-79", name: "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", }, discovery_date: "2006-07-31T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "200732", }, ], notes: [ { category: "description", text: "http_protocol.c in (1) IBM HTTP Server 6.0 before 6.0.2.13 and 6.1 before 6.1.0.1, and (2) Apache HTTP Server 1.3 before 1.3.35, 2.0 before 2.0.58, and 2.2 before 2.2.2, does not sanitize the Expect header from an HTTP request when it is reflected back in an error message, which might allow cross-site scripting (XSS) style attacks using web client components that can send arbitrary headers in requests, as demonstrated using a Flash SWF file.", title: "Vulnerability description", }, { category: "summary", text: "httpd: Expect header XSS", title: "Vulnerability summary", }, ], product_status: { fixed: [ "3AS-RHNPROXY4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel3.i386", "4AS-RHNPROXY4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel4.i386", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2006-3918", }, { category: "external", summary: "RHBZ#200732", url: "https://bugzilla.redhat.com/show_bug.cgi?id=200732", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2006-3918", url: "https://www.cve.org/CVERecord?id=CVE-2006-3918", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2006-3918", url: "https://nvd.nist.gov/vuln/detail/CVE-2006-3918", }, ], release_date: "2006-05-08T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-06-30T15:29:00+00:00", details: "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.\n\nThis update is available via Red Hat Network. Details on how to use \nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/FAQ_58_10188", product_ids: [ "3AS-RHNPROXY4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel3.i386", "4AS-RHNPROXY4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel4.i386", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0523", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "httpd: Expect header XSS", }, { cve: "CVE-2006-5752", cwe: { id: "CWE-79", name: "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", }, discovery_date: "2007-06-20T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "245112", }, ], notes: [ { category: "description", text: "Cross-site scripting (XSS) vulnerability in mod_status.c in the mod_status module in Apache HTTP Server (httpd), when ExtendedStatus is enabled and a public server-status page is used, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors involving charsets with browsers that perform \"charset detection\" when the content-type is not specified.", title: "Vulnerability description", }, { category: "summary", text: "httpd mod_status XSS", title: "Vulnerability summary", }, ], product_status: { fixed: [ "3AS-RHNPROXY4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel3.i386", "4AS-RHNPROXY4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel4.i386", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2006-5752", }, { category: "external", summary: "RHBZ#245112", url: "https://bugzilla.redhat.com/show_bug.cgi?id=245112", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2006-5752", url: "https://www.cve.org/CVERecord?id=CVE-2006-5752", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2006-5752", url: "https://nvd.nist.gov/vuln/detail/CVE-2006-5752", }, ], release_date: "2007-06-20T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-06-30T15:29:00+00:00", details: "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.\n\nThis update is available via Red Hat Network. Details on how to use \nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/FAQ_58_10188", product_ids: [ "3AS-RHNPROXY4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel3.i386", "4AS-RHNPROXY4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel4.i386", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0523", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "httpd mod_status XSS", }, { cve: "CVE-2007-1349", discovery_date: "2007-05-17T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "240423", }, ], notes: [ { category: "description", text: "PerlRun.pm in Apache mod_perl before 1.30, and RegistryCooker.pm in mod_perl 2.x, does not properly escape PATH_INFO before use in a regular expression, which allows remote attackers to cause a denial of service (resource consumption) via a crafted URI.", title: "Vulnerability description", }, { category: "summary", text: "mod_perl PerlRun denial of service", title: "Vulnerability summary", }, ], product_status: { fixed: [ "3AS-RHNPROXY4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel3.i386", "4AS-RHNPROXY4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel4.i386", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-1349", }, { category: "external", summary: "RHBZ#240423", url: "https://bugzilla.redhat.com/show_bug.cgi?id=240423", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-1349", url: "https://www.cve.org/CVERecord?id=CVE-2007-1349", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-1349", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-1349", }, ], release_date: "2007-03-22T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-06-30T15:29:00+00:00", details: "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.\n\nThis update is available via Red Hat Network. Details on how to use \nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/FAQ_58_10188", product_ids: [ "3AS-RHNPROXY4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel3.i386", "4AS-RHNPROXY4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel4.i386", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0523", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "mod_perl PerlRun denial of service", }, { cve: "CVE-2007-3304", discovery_date: "2007-06-19T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "245111", }, ], notes: [ { category: "description", text: "Apache httpd 1.3.37, 2.0.59, and 2.2.4 with the Prefork MPM module, allows local users to cause a denial of service by modifying the worker_score and process_score arrays to reference an arbitrary process ID, which is sent a SIGUSR1 signal from the master process, aka \"SIGUSR1 killer.\"", title: "Vulnerability description", }, { category: "summary", text: "httpd scoreboard lack of PID protection", title: "Vulnerability summary", }, ], product_status: { fixed: [ "3AS-RHNPROXY4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel3.i386", "4AS-RHNPROXY4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel4.i386", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-3304", }, { category: "external", summary: "RHBZ#245111", url: "https://bugzilla.redhat.com/show_bug.cgi?id=245111", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-3304", url: "https://www.cve.org/CVERecord?id=CVE-2007-3304", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-3304", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-3304", }, ], release_date: "2007-06-19T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-06-30T15:29:00+00:00", details: "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.\n\nThis update is available via Red Hat Network. Details on how to use \nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/FAQ_58_10188", product_ids: [ "3AS-RHNPROXY4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel3.i386", "4AS-RHNPROXY4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel4.i386", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0523", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "httpd scoreboard lack of PID protection", }, { cve: "CVE-2007-4465", cwe: { id: "CWE-79", name: "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", }, discovery_date: "2007-09-13T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "289511", }, ], notes: [ { category: "description", text: "Cross-site scripting (XSS) vulnerability in mod_autoindex.c in the Apache HTTP Server before 2.2.6, when the charset on a server-generated page is not defined, allows remote attackers to inject arbitrary web script or HTML via the P parameter using the UTF-7 charset. NOTE: it could be argued that this issue is due to a design limitation of browsers that attempt to perform automatic content type detection.", title: "Vulnerability description", }, { category: "summary", text: "mod_autoindex XSS", title: "Vulnerability summary", }, { category: "other", text: "This is actually a flaw in browsers that do not derive the response character set as required by RFC 2616. This does not affect the default configuration of Apache httpd in Red Hat products and will only affect customers who have removed the \"AddDefaultCharset\" directive and are using directory indexes. The Red Hat Product Security has rated this issue as having low security impact, a future update may address this flaw.", title: "Statement", }, ], product_status: { fixed: [ "3AS-RHNPROXY4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel3.i386", "4AS-RHNPROXY4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel4.i386", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-4465", }, { category: "external", summary: "RHBZ#289511", url: "https://bugzilla.redhat.com/show_bug.cgi?id=289511", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-4465", url: "https://www.cve.org/CVERecord?id=CVE-2007-4465", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-4465", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-4465", }, ], release_date: "2007-09-13T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-06-30T15:29:00+00:00", details: "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.\n\nThis update is available via Red Hat Network. Details on how to use \nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/FAQ_58_10188", product_ids: [ "3AS-RHNPROXY4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel3.i386", "4AS-RHNPROXY4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel4.i386", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0523", }, ], threats: [ { category: "impact", details: "Low", }, ], title: "mod_autoindex XSS", }, { cve: "CVE-2007-5000", cwe: { id: "CWE-79", name: "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", }, discovery_date: "2007-12-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "419931", }, ], notes: [ { category: "description", text: "Cross-site scripting (XSS) vulnerability in the (1) mod_imap module in the Apache HTTP Server 1.3.0 through 1.3.39 and 2.0.35 through 2.0.61 and the (2) mod_imagemap module in the Apache HTTP Server 2.2.0 through 2.2.6 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.", title: "Vulnerability description", }, { category: "summary", text: "httpd: mod_imagemap XSS", title: "Vulnerability summary", }, ], product_status: { fixed: [ "3AS-RHNPROXY4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel3.i386", "4AS-RHNPROXY4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel4.i386", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-5000", }, { category: "external", summary: "RHBZ#419931", url: "https://bugzilla.redhat.com/show_bug.cgi?id=419931", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-5000", url: "https://www.cve.org/CVERecord?id=CVE-2007-5000", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-5000", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-5000", }, ], release_date: "2007-12-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-06-30T15:29:00+00:00", details: "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.\n\nThis update is available via Red Hat Network. Details on how to use \nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/FAQ_58_10188", product_ids: [ "3AS-RHNPROXY4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel3.i386", "4AS-RHNPROXY4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel4.i386", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0523", }, ], threats: [ { category: "impact", details: "Low", }, ], title: "httpd: mod_imagemap XSS", }, { cve: "CVE-2007-6388", cwe: { id: "CWE-79", name: "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", }, discovery_date: "2008-01-02T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "427228", }, ], notes: [ { category: "description", text: "Cross-site scripting (XSS) vulnerability in mod_status in the Apache HTTP Server 2.2.0 through 2.2.6, 2.0.35 through 2.0.61, and 1.3.2 through 1.3.39, when the server-status page is enabled, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.", title: "Vulnerability description", }, { category: "summary", text: "apache mod_status cross-site scripting", title: "Vulnerability summary", }, ], product_status: { fixed: [ "3AS-RHNPROXY4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel3.i386", "4AS-RHNPROXY4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel4.i386", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-6388", }, { category: "external", summary: "RHBZ#427228", url: "https://bugzilla.redhat.com/show_bug.cgi?id=427228", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-6388", url: "https://www.cve.org/CVERecord?id=CVE-2007-6388", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-6388", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-6388", }, ], release_date: "2007-12-29T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-06-30T15:29:00+00:00", details: "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.\n\nThis update is available via Red Hat Network. Details on how to use \nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/FAQ_58_10188", product_ids: [ "3AS-RHNPROXY4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel3.i386", "4AS-RHNPROXY4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel4.i386", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0523", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "apache mod_status cross-site scripting", }, ], }
RHSA-2007:0557
Vulnerability from csaf_redhat
Published
2007-07-13 07:38
Modified
2024-12-01 11:53
Summary
Red Hat Security Advisory: httpd security update
Notes
Topic
Updated Apache httpd packages that correct two security issues are now
available for Red Hat Application Stack.
This update has been rated as having moderate security impact by the Red
Hat Security Response Team.
Details
The Apache HTTP Server is a popular Web server.
A flaw was found in the Apache HTTP Server mod_status module. On sites
where the server-status page is publicly accessible and ExtendedStatus is
enabled, this flaw could lead to a cross-site scripting attack. On Red Hat
Enterprise Linux, the server-status page is not enabled by default and it
is best practice to not make this publicly available. (CVE-2006-5752)
A bug was found in the Apache HTTP Server mod_cache module. On sites where
caching is enabled, a remote attacker could send a carefully crafted
request that would cause the Apache child process handling that request to
crash. This could lead to a denial of service if using a threaded
Multi-Processing Module. (CVE-2007-1863)
The Apache HTTP Server did not verify that a process was an Apache child
process before sending it signals. A local attacker with the ability to run
scripts on the Apache HTTP Server could manipulate the scoreboard and cause
arbitrary processes to be terminated which could lead to a denial of
service. (CVE-2007-3304).
Users of httpd should upgrade to these updated packages, which contain
backported patches to correct these issues. Users should restart Apache
after installing this update.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ document: { aggregate_severity: { namespace: "https://access.redhat.com/security/updates/classification/", text: "Moderate", }, category: "csaf_security_advisory", csaf_version: "2.0", distribution: { text: "Copyright © Red Hat, Inc. All rights reserved.", tlp: { label: "WHITE", url: "https://www.first.org/tlp/", }, }, lang: "en", notes: [ { category: "summary", text: "Updated Apache httpd packages that correct two security issues are now\navailable for Red Hat Application Stack.\n\nThis update has been rated as having moderate security impact by the Red\nHat Security Response Team.", title: "Topic", }, { category: "general", text: "The Apache HTTP Server is a popular Web server.\n\nA flaw was found in the Apache HTTP Server mod_status module. On sites\nwhere the server-status page is publicly accessible and ExtendedStatus is\nenabled, this flaw could lead to a cross-site scripting attack. On Red Hat\nEnterprise Linux, the server-status page is not enabled by default and it\nis best practice to not make this publicly available. (CVE-2006-5752)\n\nA bug was found in the Apache HTTP Server mod_cache module. On sites where\ncaching is enabled, a remote attacker could send a carefully crafted\nrequest that would cause the Apache child process handling that request to\ncrash. This could lead to a denial of service if using a threaded\nMulti-Processing Module. (CVE-2007-1863)\n\nThe Apache HTTP Server did not verify that a process was an Apache child\nprocess before sending it signals. A local attacker with the ability to run\nscripts on the Apache HTTP Server could manipulate the scoreboard and cause\narbitrary processes to be terminated which could lead to a denial of\nservice. (CVE-2007-3304).\n\nUsers of httpd should upgrade to these updated packages, which contain\nbackported patches to correct these issues. Users should restart Apache\nafter installing this update.", title: "Details", }, { category: "legal_disclaimer", text: "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", title: "Terms of Use", }, ], publisher: { category: "vendor", contact_details: "https://access.redhat.com/security/team/contact/", issuing_authority: "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", name: "Red Hat Product Security", namespace: "https://www.redhat.com", }, references: [ { category: "self", summary: "https://access.redhat.com/errata/RHSA-2007:0557", url: "https://access.redhat.com/errata/RHSA-2007:0557", }, { category: "external", summary: "http://www.redhat.com/security/updates/classification/#moderate", url: "http://www.redhat.com/security/updates/classification/#moderate", }, { category: "external", summary: "244658", url: "https://bugzilla.redhat.com/show_bug.cgi?id=244658", }, { category: "external", summary: "245112", url: "https://bugzilla.redhat.com/show_bug.cgi?id=245112", }, { category: "self", summary: "Canonical URL", url: "https://security.access.redhat.com/data/csaf/v2/advisories/2007/rhsa-2007_0557.json", }, ], title: "Red Hat Security Advisory: httpd security update", tracking: { current_release_date: "2024-12-01T11:53:21+00:00", generator: { date: "2024-12-01T11:53:21+00:00", engine: { name: "Red Hat SDEngine", version: "4.2.1", }, }, id: "RHSA-2007:0557", initial_release_date: "2007-07-13T07:38:00+00:00", revision_history: [ { date: "2007-07-13T07:38:00+00:00", number: "1", summary: "Initial version", }, { date: "2007-07-13T03:38:23+00:00", number: "2", summary: "Last updated version", }, { date: "2024-12-01T11:53:21+00:00", number: "3", summary: "Last generated version", }, ], status: "final", version: "3", }, }, product_tree: { branches: [ { branches: [ { branches: [ { category: "product_name", name: "Red Hat Application Stack v1 for Enterprise Linux AS (v.4)", product: { name: "Red Hat Application Stack v1 for Enterprise Linux AS (v.4)", product_id: "4AS-RHWAS", product_identification_helper: { cpe: "cpe:/a:redhat:rhel_application_stack:1", }, }, }, { category: "product_name", name: "Red Hat Application Stack v1 for Enterprise Linux ES (v.4)", product: { name: "Red Hat Application Stack v1 for Enterprise Linux ES (v.4)", product_id: "4ES-RHWAS", product_identification_helper: { cpe: "cpe:/a:redhat:rhel_application_stack:1", }, }, }, ], category: "product_family", name: "Red Hat Application Stack", }, { branches: [ { category: "product_version", name: "httpd-manual-0:2.0.59-1.el4s1.7.x86_64", product: { name: "httpd-manual-0:2.0.59-1.el4s1.7.x86_64", product_id: "httpd-manual-0:2.0.59-1.el4s1.7.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-manual@2.0.59-1.el4s1.7?arch=x86_64", }, }, }, { category: "product_version", name: "httpd-0:2.0.59-1.el4s1.7.x86_64", product: { name: "httpd-0:2.0.59-1.el4s1.7.x86_64", product_id: "httpd-0:2.0.59-1.el4s1.7.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/httpd@2.0.59-1.el4s1.7?arch=x86_64", }, }, }, { category: "product_version", name: "httpd-debuginfo-0:2.0.59-1.el4s1.7.x86_64", product: { name: "httpd-debuginfo-0:2.0.59-1.el4s1.7.x86_64", product_id: "httpd-debuginfo-0:2.0.59-1.el4s1.7.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-debuginfo@2.0.59-1.el4s1.7?arch=x86_64", }, }, }, { category: "product_version", name: "mod_ssl-1:2.0.59-1.el4s1.7.x86_64", product: { name: "mod_ssl-1:2.0.59-1.el4s1.7.x86_64", product_id: "mod_ssl-1:2.0.59-1.el4s1.7.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/mod_ssl@2.0.59-1.el4s1.7?arch=x86_64&epoch=1", }, }, }, { category: "product_version", name: "httpd-devel-0:2.0.59-1.el4s1.7.x86_64", product: { name: "httpd-devel-0:2.0.59-1.el4s1.7.x86_64", product_id: "httpd-devel-0:2.0.59-1.el4s1.7.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-devel@2.0.59-1.el4s1.7?arch=x86_64", }, }, }, ], category: "architecture", name: "x86_64", }, { branches: [ { category: "product_version", name: "httpd-manual-0:2.0.59-1.el4s1.7.i386", product: { name: "httpd-manual-0:2.0.59-1.el4s1.7.i386", product_id: "httpd-manual-0:2.0.59-1.el4s1.7.i386", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-manual@2.0.59-1.el4s1.7?arch=i386", }, }, }, { category: "product_version", name: "httpd-0:2.0.59-1.el4s1.7.i386", product: { name: "httpd-0:2.0.59-1.el4s1.7.i386", product_id: "httpd-0:2.0.59-1.el4s1.7.i386", product_identification_helper: { purl: "pkg:rpm/redhat/httpd@2.0.59-1.el4s1.7?arch=i386", }, }, }, { category: "product_version", name: "httpd-debuginfo-0:2.0.59-1.el4s1.7.i386", product: { name: "httpd-debuginfo-0:2.0.59-1.el4s1.7.i386", product_id: "httpd-debuginfo-0:2.0.59-1.el4s1.7.i386", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-debuginfo@2.0.59-1.el4s1.7?arch=i386", }, }, }, { category: "product_version", name: "mod_ssl-1:2.0.59-1.el4s1.7.i386", product: { name: "mod_ssl-1:2.0.59-1.el4s1.7.i386", product_id: "mod_ssl-1:2.0.59-1.el4s1.7.i386", product_identification_helper: { purl: "pkg:rpm/redhat/mod_ssl@2.0.59-1.el4s1.7?arch=i386&epoch=1", }, }, }, { category: "product_version", name: "httpd-devel-0:2.0.59-1.el4s1.7.i386", product: { name: "httpd-devel-0:2.0.59-1.el4s1.7.i386", product_id: "httpd-devel-0:2.0.59-1.el4s1.7.i386", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-devel@2.0.59-1.el4s1.7?arch=i386", }, }, }, ], category: "architecture", name: "i386", }, { branches: [ { category: "product_version", name: "httpd-0:2.0.59-1.el4s1.7.src", product: { name: "httpd-0:2.0.59-1.el4s1.7.src", product_id: "httpd-0:2.0.59-1.el4s1.7.src", product_identification_helper: { purl: "pkg:rpm/redhat/httpd@2.0.59-1.el4s1.7?arch=src", }, }, }, ], category: "architecture", name: "src", }, ], category: "vendor", name: "Red Hat", }, ], relationships: [ { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.59-1.el4s1.7.i386 as a component of Red Hat Application Stack v1 for Enterprise Linux AS (v.4)", product_id: "4AS-RHWAS:httpd-0:2.0.59-1.el4s1.7.i386", }, product_reference: "httpd-0:2.0.59-1.el4s1.7.i386", relates_to_product_reference: "4AS-RHWAS", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.59-1.el4s1.7.src as a component of Red Hat Application Stack v1 for Enterprise Linux AS (v.4)", product_id: "4AS-RHWAS:httpd-0:2.0.59-1.el4s1.7.src", }, product_reference: "httpd-0:2.0.59-1.el4s1.7.src", relates_to_product_reference: "4AS-RHWAS", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.59-1.el4s1.7.x86_64 as a component of Red Hat Application Stack v1 for Enterprise Linux AS (v.4)", product_id: "4AS-RHWAS:httpd-0:2.0.59-1.el4s1.7.x86_64", }, product_reference: "httpd-0:2.0.59-1.el4s1.7.x86_64", relates_to_product_reference: "4AS-RHWAS", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.59-1.el4s1.7.i386 as a component of Red Hat Application Stack v1 for Enterprise Linux AS (v.4)", product_id: "4AS-RHWAS:httpd-debuginfo-0:2.0.59-1.el4s1.7.i386", }, product_reference: "httpd-debuginfo-0:2.0.59-1.el4s1.7.i386", relates_to_product_reference: "4AS-RHWAS", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.59-1.el4s1.7.x86_64 as a component of Red Hat Application Stack v1 for Enterprise Linux AS (v.4)", product_id: "4AS-RHWAS:httpd-debuginfo-0:2.0.59-1.el4s1.7.x86_64", }, product_reference: "httpd-debuginfo-0:2.0.59-1.el4s1.7.x86_64", relates_to_product_reference: "4AS-RHWAS", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.59-1.el4s1.7.i386 as a component of Red Hat Application Stack v1 for Enterprise Linux AS (v.4)", product_id: "4AS-RHWAS:httpd-devel-0:2.0.59-1.el4s1.7.i386", }, product_reference: "httpd-devel-0:2.0.59-1.el4s1.7.i386", relates_to_product_reference: "4AS-RHWAS", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.59-1.el4s1.7.x86_64 as a component of Red Hat Application Stack v1 for Enterprise Linux AS (v.4)", product_id: "4AS-RHWAS:httpd-devel-0:2.0.59-1.el4s1.7.x86_64", }, product_reference: "httpd-devel-0:2.0.59-1.el4s1.7.x86_64", relates_to_product_reference: "4AS-RHWAS", }, { category: "default_component_of", full_product_name: { name: "httpd-manual-0:2.0.59-1.el4s1.7.i386 as a component of Red Hat Application Stack v1 for Enterprise Linux AS (v.4)", product_id: "4AS-RHWAS:httpd-manual-0:2.0.59-1.el4s1.7.i386", }, product_reference: "httpd-manual-0:2.0.59-1.el4s1.7.i386", relates_to_product_reference: "4AS-RHWAS", }, { category: "default_component_of", full_product_name: { name: "httpd-manual-0:2.0.59-1.el4s1.7.x86_64 as a component of Red Hat Application Stack v1 for Enterprise Linux AS (v.4)", product_id: "4AS-RHWAS:httpd-manual-0:2.0.59-1.el4s1.7.x86_64", }, product_reference: "httpd-manual-0:2.0.59-1.el4s1.7.x86_64", relates_to_product_reference: "4AS-RHWAS", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.59-1.el4s1.7.i386 as a component of Red Hat Application Stack v1 for Enterprise Linux AS (v.4)", product_id: "4AS-RHWAS:mod_ssl-1:2.0.59-1.el4s1.7.i386", }, product_reference: "mod_ssl-1:2.0.59-1.el4s1.7.i386", relates_to_product_reference: "4AS-RHWAS", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.59-1.el4s1.7.x86_64 as a component of Red Hat Application Stack v1 for Enterprise Linux AS (v.4)", product_id: "4AS-RHWAS:mod_ssl-1:2.0.59-1.el4s1.7.x86_64", }, product_reference: "mod_ssl-1:2.0.59-1.el4s1.7.x86_64", relates_to_product_reference: "4AS-RHWAS", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.59-1.el4s1.7.i386 as a component of Red Hat Application Stack v1 for Enterprise Linux ES (v.4)", product_id: "4ES-RHWAS:httpd-0:2.0.59-1.el4s1.7.i386", }, product_reference: "httpd-0:2.0.59-1.el4s1.7.i386", relates_to_product_reference: "4ES-RHWAS", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.59-1.el4s1.7.src as a component of Red Hat Application Stack v1 for Enterprise Linux ES (v.4)", product_id: "4ES-RHWAS:httpd-0:2.0.59-1.el4s1.7.src", }, product_reference: "httpd-0:2.0.59-1.el4s1.7.src", relates_to_product_reference: "4ES-RHWAS", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.59-1.el4s1.7.x86_64 as a component of Red Hat Application Stack v1 for Enterprise Linux ES (v.4)", product_id: "4ES-RHWAS:httpd-0:2.0.59-1.el4s1.7.x86_64", }, product_reference: "httpd-0:2.0.59-1.el4s1.7.x86_64", relates_to_product_reference: "4ES-RHWAS", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.59-1.el4s1.7.i386 as a component of Red Hat Application Stack v1 for Enterprise Linux ES (v.4)", product_id: "4ES-RHWAS:httpd-debuginfo-0:2.0.59-1.el4s1.7.i386", }, product_reference: "httpd-debuginfo-0:2.0.59-1.el4s1.7.i386", relates_to_product_reference: "4ES-RHWAS", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.59-1.el4s1.7.x86_64 as a component of Red Hat Application Stack v1 for Enterprise Linux ES (v.4)", product_id: "4ES-RHWAS:httpd-debuginfo-0:2.0.59-1.el4s1.7.x86_64", }, product_reference: "httpd-debuginfo-0:2.0.59-1.el4s1.7.x86_64", relates_to_product_reference: "4ES-RHWAS", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.59-1.el4s1.7.i386 as a component of Red Hat Application Stack v1 for Enterprise Linux ES (v.4)", product_id: "4ES-RHWAS:httpd-devel-0:2.0.59-1.el4s1.7.i386", }, product_reference: "httpd-devel-0:2.0.59-1.el4s1.7.i386", relates_to_product_reference: "4ES-RHWAS", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.59-1.el4s1.7.x86_64 as a component of Red Hat Application Stack v1 for Enterprise Linux ES (v.4)", product_id: "4ES-RHWAS:httpd-devel-0:2.0.59-1.el4s1.7.x86_64", }, product_reference: "httpd-devel-0:2.0.59-1.el4s1.7.x86_64", relates_to_product_reference: "4ES-RHWAS", }, { category: "default_component_of", full_product_name: { name: "httpd-manual-0:2.0.59-1.el4s1.7.i386 as a component of Red Hat Application Stack v1 for Enterprise Linux ES (v.4)", product_id: "4ES-RHWAS:httpd-manual-0:2.0.59-1.el4s1.7.i386", }, product_reference: "httpd-manual-0:2.0.59-1.el4s1.7.i386", relates_to_product_reference: "4ES-RHWAS", }, { category: "default_component_of", full_product_name: { name: "httpd-manual-0:2.0.59-1.el4s1.7.x86_64 as a component of Red Hat Application Stack v1 for Enterprise Linux ES (v.4)", product_id: "4ES-RHWAS:httpd-manual-0:2.0.59-1.el4s1.7.x86_64", }, product_reference: "httpd-manual-0:2.0.59-1.el4s1.7.x86_64", relates_to_product_reference: "4ES-RHWAS", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.59-1.el4s1.7.i386 as a component of Red Hat Application Stack v1 for Enterprise Linux ES (v.4)", product_id: "4ES-RHWAS:mod_ssl-1:2.0.59-1.el4s1.7.i386", }, product_reference: "mod_ssl-1:2.0.59-1.el4s1.7.i386", relates_to_product_reference: "4ES-RHWAS", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.59-1.el4s1.7.x86_64 as a component of Red Hat Application Stack v1 for Enterprise Linux ES (v.4)", product_id: "4ES-RHWAS:mod_ssl-1:2.0.59-1.el4s1.7.x86_64", }, product_reference: "mod_ssl-1:2.0.59-1.el4s1.7.x86_64", relates_to_product_reference: "4ES-RHWAS", }, ], }, vulnerabilities: [ { cve: "CVE-2006-5752", cwe: { id: "CWE-79", name: "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", }, discovery_date: "2007-06-20T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "245112", }, ], notes: [ { category: "description", text: "Cross-site scripting (XSS) vulnerability in mod_status.c in the mod_status module in Apache HTTP Server (httpd), when ExtendedStatus is enabled and a public server-status page is used, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors involving charsets with browsers that perform \"charset detection\" when the content-type is not specified.", title: "Vulnerability description", }, { category: "summary", text: "httpd mod_status XSS", title: "Vulnerability summary", }, ], product_status: { fixed: [ "4AS-RHWAS:httpd-0:2.0.59-1.el4s1.7.i386", "4AS-RHWAS:httpd-0:2.0.59-1.el4s1.7.src", "4AS-RHWAS:httpd-0:2.0.59-1.el4s1.7.x86_64", "4AS-RHWAS:httpd-debuginfo-0:2.0.59-1.el4s1.7.i386", "4AS-RHWAS:httpd-debuginfo-0:2.0.59-1.el4s1.7.x86_64", "4AS-RHWAS:httpd-devel-0:2.0.59-1.el4s1.7.i386", "4AS-RHWAS:httpd-devel-0:2.0.59-1.el4s1.7.x86_64", "4AS-RHWAS:httpd-manual-0:2.0.59-1.el4s1.7.i386", "4AS-RHWAS:httpd-manual-0:2.0.59-1.el4s1.7.x86_64", "4AS-RHWAS:mod_ssl-1:2.0.59-1.el4s1.7.i386", "4AS-RHWAS:mod_ssl-1:2.0.59-1.el4s1.7.x86_64", "4ES-RHWAS:httpd-0:2.0.59-1.el4s1.7.i386", "4ES-RHWAS:httpd-0:2.0.59-1.el4s1.7.src", "4ES-RHWAS:httpd-0:2.0.59-1.el4s1.7.x86_64", "4ES-RHWAS:httpd-debuginfo-0:2.0.59-1.el4s1.7.i386", "4ES-RHWAS:httpd-debuginfo-0:2.0.59-1.el4s1.7.x86_64", "4ES-RHWAS:httpd-devel-0:2.0.59-1.el4s1.7.i386", "4ES-RHWAS:httpd-devel-0:2.0.59-1.el4s1.7.x86_64", "4ES-RHWAS:httpd-manual-0:2.0.59-1.el4s1.7.i386", "4ES-RHWAS:httpd-manual-0:2.0.59-1.el4s1.7.x86_64", "4ES-RHWAS:mod_ssl-1:2.0.59-1.el4s1.7.i386", "4ES-RHWAS:mod_ssl-1:2.0.59-1.el4s1.7.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2006-5752", }, { category: "external", summary: "RHBZ#245112", url: "https://bugzilla.redhat.com/show_bug.cgi?id=245112", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2006-5752", url: "https://www.cve.org/CVERecord?id=CVE-2006-5752", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2006-5752", url: "https://nvd.nist.gov/vuln/detail/CVE-2006-5752", }, ], release_date: "2007-06-20T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2007-07-13T07:38:00+00:00", details: "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied. \n\nThis update is available via Red Hat Network. Details on how to use \nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/FAQ_58_10188", product_ids: [ "4AS-RHWAS:httpd-0:2.0.59-1.el4s1.7.i386", "4AS-RHWAS:httpd-0:2.0.59-1.el4s1.7.src", "4AS-RHWAS:httpd-0:2.0.59-1.el4s1.7.x86_64", "4AS-RHWAS:httpd-debuginfo-0:2.0.59-1.el4s1.7.i386", "4AS-RHWAS:httpd-debuginfo-0:2.0.59-1.el4s1.7.x86_64", "4AS-RHWAS:httpd-devel-0:2.0.59-1.el4s1.7.i386", "4AS-RHWAS:httpd-devel-0:2.0.59-1.el4s1.7.x86_64", "4AS-RHWAS:httpd-manual-0:2.0.59-1.el4s1.7.i386", "4AS-RHWAS:httpd-manual-0:2.0.59-1.el4s1.7.x86_64", "4AS-RHWAS:mod_ssl-1:2.0.59-1.el4s1.7.i386", "4AS-RHWAS:mod_ssl-1:2.0.59-1.el4s1.7.x86_64", "4ES-RHWAS:httpd-0:2.0.59-1.el4s1.7.i386", "4ES-RHWAS:httpd-0:2.0.59-1.el4s1.7.src", "4ES-RHWAS:httpd-0:2.0.59-1.el4s1.7.x86_64", "4ES-RHWAS:httpd-debuginfo-0:2.0.59-1.el4s1.7.i386", "4ES-RHWAS:httpd-debuginfo-0:2.0.59-1.el4s1.7.x86_64", "4ES-RHWAS:httpd-devel-0:2.0.59-1.el4s1.7.i386", "4ES-RHWAS:httpd-devel-0:2.0.59-1.el4s1.7.x86_64", "4ES-RHWAS:httpd-manual-0:2.0.59-1.el4s1.7.i386", "4ES-RHWAS:httpd-manual-0:2.0.59-1.el4s1.7.x86_64", "4ES-RHWAS:mod_ssl-1:2.0.59-1.el4s1.7.i386", "4ES-RHWAS:mod_ssl-1:2.0.59-1.el4s1.7.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2007:0557", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "httpd mod_status XSS", }, { cve: "CVE-2007-1863", discovery_date: "2007-05-02T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "244658", }, ], notes: [ { category: "description", text: "cache_util.c in the mod_cache module in Apache HTTP Server (httpd), when caching is enabled and a threaded Multi-Processing Module (MPM) is used, allows remote attackers to cause a denial of service (child processing handler crash) via a request with the (1) s-maxage, (2) max-age, (3) min-fresh, or (4) max-stale Cache-Control headers without a value.", title: "Vulnerability description", }, { category: "summary", text: "httpd mod_cache segfault", title: "Vulnerability summary", }, ], product_status: { fixed: [ "4AS-RHWAS:httpd-0:2.0.59-1.el4s1.7.i386", "4AS-RHWAS:httpd-0:2.0.59-1.el4s1.7.src", "4AS-RHWAS:httpd-0:2.0.59-1.el4s1.7.x86_64", "4AS-RHWAS:httpd-debuginfo-0:2.0.59-1.el4s1.7.i386", "4AS-RHWAS:httpd-debuginfo-0:2.0.59-1.el4s1.7.x86_64", "4AS-RHWAS:httpd-devel-0:2.0.59-1.el4s1.7.i386", "4AS-RHWAS:httpd-devel-0:2.0.59-1.el4s1.7.x86_64", "4AS-RHWAS:httpd-manual-0:2.0.59-1.el4s1.7.i386", "4AS-RHWAS:httpd-manual-0:2.0.59-1.el4s1.7.x86_64", "4AS-RHWAS:mod_ssl-1:2.0.59-1.el4s1.7.i386", "4AS-RHWAS:mod_ssl-1:2.0.59-1.el4s1.7.x86_64", "4ES-RHWAS:httpd-0:2.0.59-1.el4s1.7.i386", "4ES-RHWAS:httpd-0:2.0.59-1.el4s1.7.src", "4ES-RHWAS:httpd-0:2.0.59-1.el4s1.7.x86_64", "4ES-RHWAS:httpd-debuginfo-0:2.0.59-1.el4s1.7.i386", "4ES-RHWAS:httpd-debuginfo-0:2.0.59-1.el4s1.7.x86_64", "4ES-RHWAS:httpd-devel-0:2.0.59-1.el4s1.7.i386", "4ES-RHWAS:httpd-devel-0:2.0.59-1.el4s1.7.x86_64", "4ES-RHWAS:httpd-manual-0:2.0.59-1.el4s1.7.i386", "4ES-RHWAS:httpd-manual-0:2.0.59-1.el4s1.7.x86_64", "4ES-RHWAS:mod_ssl-1:2.0.59-1.el4s1.7.i386", "4ES-RHWAS:mod_ssl-1:2.0.59-1.el4s1.7.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-1863", }, { category: "external", summary: "RHBZ#244658", url: "https://bugzilla.redhat.com/show_bug.cgi?id=244658", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-1863", url: "https://www.cve.org/CVERecord?id=CVE-2007-1863", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-1863", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-1863", }, ], release_date: "2007-05-02T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2007-07-13T07:38:00+00:00", details: "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied. \n\nThis update is available via Red Hat Network. Details on how to use \nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/FAQ_58_10188", product_ids: [ "4AS-RHWAS:httpd-0:2.0.59-1.el4s1.7.i386", "4AS-RHWAS:httpd-0:2.0.59-1.el4s1.7.src", "4AS-RHWAS:httpd-0:2.0.59-1.el4s1.7.x86_64", "4AS-RHWAS:httpd-debuginfo-0:2.0.59-1.el4s1.7.i386", "4AS-RHWAS:httpd-debuginfo-0:2.0.59-1.el4s1.7.x86_64", "4AS-RHWAS:httpd-devel-0:2.0.59-1.el4s1.7.i386", "4AS-RHWAS:httpd-devel-0:2.0.59-1.el4s1.7.x86_64", "4AS-RHWAS:httpd-manual-0:2.0.59-1.el4s1.7.i386", "4AS-RHWAS:httpd-manual-0:2.0.59-1.el4s1.7.x86_64", "4AS-RHWAS:mod_ssl-1:2.0.59-1.el4s1.7.i386", "4AS-RHWAS:mod_ssl-1:2.0.59-1.el4s1.7.x86_64", "4ES-RHWAS:httpd-0:2.0.59-1.el4s1.7.i386", "4ES-RHWAS:httpd-0:2.0.59-1.el4s1.7.src", "4ES-RHWAS:httpd-0:2.0.59-1.el4s1.7.x86_64", "4ES-RHWAS:httpd-debuginfo-0:2.0.59-1.el4s1.7.i386", "4ES-RHWAS:httpd-debuginfo-0:2.0.59-1.el4s1.7.x86_64", "4ES-RHWAS:httpd-devel-0:2.0.59-1.el4s1.7.i386", "4ES-RHWAS:httpd-devel-0:2.0.59-1.el4s1.7.x86_64", "4ES-RHWAS:httpd-manual-0:2.0.59-1.el4s1.7.i386", "4ES-RHWAS:httpd-manual-0:2.0.59-1.el4s1.7.x86_64", "4ES-RHWAS:mod_ssl-1:2.0.59-1.el4s1.7.i386", "4ES-RHWAS:mod_ssl-1:2.0.59-1.el4s1.7.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2007:0557", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "httpd mod_cache segfault", }, { cve: "CVE-2007-3304", discovery_date: "2007-06-19T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "245111", }, ], notes: [ { category: "description", text: "Apache httpd 1.3.37, 2.0.59, and 2.2.4 with the Prefork MPM module, allows local users to cause a denial of service by modifying the worker_score and process_score arrays to reference an arbitrary process ID, which is sent a SIGUSR1 signal from the master process, aka \"SIGUSR1 killer.\"", title: "Vulnerability description", }, { category: "summary", text: "httpd scoreboard lack of PID protection", title: "Vulnerability summary", }, ], product_status: { fixed: [ "4AS-RHWAS:httpd-0:2.0.59-1.el4s1.7.i386", "4AS-RHWAS:httpd-0:2.0.59-1.el4s1.7.src", "4AS-RHWAS:httpd-0:2.0.59-1.el4s1.7.x86_64", "4AS-RHWAS:httpd-debuginfo-0:2.0.59-1.el4s1.7.i386", "4AS-RHWAS:httpd-debuginfo-0:2.0.59-1.el4s1.7.x86_64", "4AS-RHWAS:httpd-devel-0:2.0.59-1.el4s1.7.i386", "4AS-RHWAS:httpd-devel-0:2.0.59-1.el4s1.7.x86_64", "4AS-RHWAS:httpd-manual-0:2.0.59-1.el4s1.7.i386", "4AS-RHWAS:httpd-manual-0:2.0.59-1.el4s1.7.x86_64", "4AS-RHWAS:mod_ssl-1:2.0.59-1.el4s1.7.i386", "4AS-RHWAS:mod_ssl-1:2.0.59-1.el4s1.7.x86_64", "4ES-RHWAS:httpd-0:2.0.59-1.el4s1.7.i386", "4ES-RHWAS:httpd-0:2.0.59-1.el4s1.7.src", "4ES-RHWAS:httpd-0:2.0.59-1.el4s1.7.x86_64", "4ES-RHWAS:httpd-debuginfo-0:2.0.59-1.el4s1.7.i386", "4ES-RHWAS:httpd-debuginfo-0:2.0.59-1.el4s1.7.x86_64", "4ES-RHWAS:httpd-devel-0:2.0.59-1.el4s1.7.i386", "4ES-RHWAS:httpd-devel-0:2.0.59-1.el4s1.7.x86_64", "4ES-RHWAS:httpd-manual-0:2.0.59-1.el4s1.7.i386", "4ES-RHWAS:httpd-manual-0:2.0.59-1.el4s1.7.x86_64", "4ES-RHWAS:mod_ssl-1:2.0.59-1.el4s1.7.i386", "4ES-RHWAS:mod_ssl-1:2.0.59-1.el4s1.7.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-3304", }, { category: "external", summary: "RHBZ#245111", url: "https://bugzilla.redhat.com/show_bug.cgi?id=245111", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-3304", url: "https://www.cve.org/CVERecord?id=CVE-2007-3304", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-3304", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-3304", }, ], release_date: "2007-06-19T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2007-07-13T07:38:00+00:00", details: "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied. \n\nThis update is available via Red Hat Network. Details on how to use \nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/FAQ_58_10188", product_ids: [ "4AS-RHWAS:httpd-0:2.0.59-1.el4s1.7.i386", "4AS-RHWAS:httpd-0:2.0.59-1.el4s1.7.src", "4AS-RHWAS:httpd-0:2.0.59-1.el4s1.7.x86_64", "4AS-RHWAS:httpd-debuginfo-0:2.0.59-1.el4s1.7.i386", "4AS-RHWAS:httpd-debuginfo-0:2.0.59-1.el4s1.7.x86_64", "4AS-RHWAS:httpd-devel-0:2.0.59-1.el4s1.7.i386", "4AS-RHWAS:httpd-devel-0:2.0.59-1.el4s1.7.x86_64", "4AS-RHWAS:httpd-manual-0:2.0.59-1.el4s1.7.i386", "4AS-RHWAS:httpd-manual-0:2.0.59-1.el4s1.7.x86_64", "4AS-RHWAS:mod_ssl-1:2.0.59-1.el4s1.7.i386", "4AS-RHWAS:mod_ssl-1:2.0.59-1.el4s1.7.x86_64", "4ES-RHWAS:httpd-0:2.0.59-1.el4s1.7.i386", "4ES-RHWAS:httpd-0:2.0.59-1.el4s1.7.src", "4ES-RHWAS:httpd-0:2.0.59-1.el4s1.7.x86_64", "4ES-RHWAS:httpd-debuginfo-0:2.0.59-1.el4s1.7.i386", "4ES-RHWAS:httpd-debuginfo-0:2.0.59-1.el4s1.7.x86_64", "4ES-RHWAS:httpd-devel-0:2.0.59-1.el4s1.7.i386", "4ES-RHWAS:httpd-devel-0:2.0.59-1.el4s1.7.x86_64", "4ES-RHWAS:httpd-manual-0:2.0.59-1.el4s1.7.i386", "4ES-RHWAS:httpd-manual-0:2.0.59-1.el4s1.7.x86_64", "4ES-RHWAS:mod_ssl-1:2.0.59-1.el4s1.7.i386", "4ES-RHWAS:mod_ssl-1:2.0.59-1.el4s1.7.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2007:0557", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "httpd scoreboard lack of PID protection", }, ], }
RHSA-2008:0261
Vulnerability from csaf_redhat
Published
2008-05-20 14:12
Modified
2025-01-26 19:35
Summary
Red Hat Security Advisory: Red Hat Network Satellite Server security update
Notes
Topic
Red Hat Network Satellite Server version 5.0.2 is now available. This
update includes fixes for a number of security issues in Red Hat Network
Satellite Server components.
This update has been rated as having moderate security impact by the Red
Hat Security Response Team.
Details
During an internal security review, a cross-site scripting flaw was found
that affected the Red Hat Network channel search feature. (CVE-2007-5961)
This release also corrects several security vulnerabilities in various
components shipped as part of the Red Hat Network Satellite Server. In a
typical operating environment, these components are not exposed to users of
Satellite Server in a vulnerable manner. These security updates will reduce
risk in unique Satellite Server environments.
Multiple flaws were fixed in the Apache HTTPD server. These flaws could
result in a cross-site scripting, denial-of-service, or information
disclosure attacks. (CVE-2004-0885, CVE-2006-5752, CVE-2006-7197,
CVE-2007-1860, CVE-2007-3304, CVE-2007-4465, CVE-2007-5000, CVE-2007-6388)
A denial-of-service flaw was fixed in mod_perl. (CVE-2007-1349)
A denial-of-service flaw was fixed in the jabberd server. (CVE-2006-1329)
Multiple cross-site scripting flaws were fixed in the image map feature in
the JFreeChart package. (CVE-2007-6306)
Multiple flaws were fixed in the IBM Java 1.4.2 Runtime. (CVE-2007-0243,
CVE-2007-2435, CVE-2007-2788, CVE-2007-2789)
Two arbitrary code execution flaws were fixed in the OpenMotif package.
(CVE-2005-3964, CVE-2005-0605)
A flaw which could result in weak encryption was fixed in the
perl-Crypt-CBC package. (CVE-2006-0898)
Multiple flaws were fixed in the Tomcat package. (CVE-2008-0128,
CVE-2007-5461, CVE-2007-3385, CVE-2007-3382, CVE-2007-1358, CVE-2007-1355,
CVE-2007-2450, CVE-2007-2449, CVE-2007-0450, CVE-2006-7196, CVE-2006-7195,
CVE-2006-3835, CVE-2006-0254, CVE-2005-2090, CVE-2005-4838, CVE-2005-3510)
Users of Red Hat Network Satellite Server 5.0 are advised to upgrade to
5.0.2, which resolves these issues.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ document: { aggregate_severity: { namespace: "https://access.redhat.com/security/updates/classification/", text: "Moderate", }, category: "csaf_security_advisory", csaf_version: "2.0", distribution: { text: "Copyright © Red Hat, Inc. All rights reserved.", tlp: { label: "WHITE", url: "https://www.first.org/tlp/", }, }, lang: "en", notes: [ { category: "summary", text: "Red Hat Network Satellite Server version 5.0.2 is now available. This\nupdate includes fixes for a number of security issues in Red Hat Network\nSatellite Server components.\n\nThis update has been rated as having moderate security impact by the Red\nHat Security Response Team.", title: "Topic", }, { category: "general", text: "During an internal security review, a cross-site scripting flaw was found\nthat affected the Red Hat Network channel search feature. (CVE-2007-5961)\n\nThis release also corrects several security vulnerabilities in various\ncomponents shipped as part of the Red Hat Network Satellite Server. In a\ntypical operating environment, these components are not exposed to users of\nSatellite Server in a vulnerable manner. These security updates will reduce\nrisk in unique Satellite Server environments.\n\nMultiple flaws were fixed in the Apache HTTPD server. These flaws could\nresult in a cross-site scripting, denial-of-service, or information\ndisclosure attacks. (CVE-2004-0885, CVE-2006-5752, CVE-2006-7197,\nCVE-2007-1860, CVE-2007-3304, CVE-2007-4465, CVE-2007-5000, CVE-2007-6388)\n\nA denial-of-service flaw was fixed in mod_perl. (CVE-2007-1349)\n\nA denial-of-service flaw was fixed in the jabberd server. (CVE-2006-1329)\n\nMultiple cross-site scripting flaws were fixed in the image map feature in\nthe JFreeChart package. (CVE-2007-6306)\n\nMultiple flaws were fixed in the IBM Java 1.4.2 Runtime. (CVE-2007-0243,\nCVE-2007-2435, CVE-2007-2788, CVE-2007-2789)\n\nTwo arbitrary code execution flaws were fixed in the OpenMotif package.\n(CVE-2005-3964, CVE-2005-0605)\n\nA flaw which could result in weak encryption was fixed in the\nperl-Crypt-CBC package. (CVE-2006-0898)\n\nMultiple flaws were fixed in the Tomcat package. (CVE-2008-0128,\nCVE-2007-5461, CVE-2007-3385, CVE-2007-3382, CVE-2007-1358, CVE-2007-1355,\nCVE-2007-2450, CVE-2007-2449, CVE-2007-0450, CVE-2006-7196, CVE-2006-7195,\nCVE-2006-3835, CVE-2006-0254, CVE-2005-2090, CVE-2005-4838, CVE-2005-3510)\n\nUsers of Red Hat Network Satellite Server 5.0 are advised to upgrade to\n5.0.2, which resolves these issues.", title: "Details", }, { category: "legal_disclaimer", text: "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", title: "Terms of Use", }, ], publisher: { category: "vendor", contact_details: "https://access.redhat.com/security/team/contact/", issuing_authority: "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", name: "Red Hat Product Security", namespace: "https://www.redhat.com", }, references: [ { category: "self", summary: "https://access.redhat.com/errata/RHSA-2008:0261", url: "https://access.redhat.com/errata/RHSA-2008:0261", }, { category: "external", summary: "https://access.redhat.com/security/updates/classification/#moderate", url: "https://access.redhat.com/security/updates/classification/#moderate", }, { category: "external", summary: "396641", url: "https://bugzilla.redhat.com/show_bug.cgi?id=396641", }, { category: "external", summary: "444136", url: "https://bugzilla.redhat.com/show_bug.cgi?id=444136", }, { category: "self", summary: "Canonical URL", url: "https://security.access.redhat.com/data/csaf/v2/advisories/2008/rhsa-2008_0261.json", }, ], title: "Red Hat Security Advisory: Red Hat Network Satellite Server security update", tracking: { current_release_date: "2025-01-26T19:35:50+00:00", generator: { date: "2025-01-26T19:35:50+00:00", engine: { name: "Red Hat SDEngine", version: "4.2.6", }, }, id: "RHSA-2008:0261", initial_release_date: "2008-05-20T14:12:00+00:00", revision_history: [ { date: "2008-05-20T14:12:00+00:00", number: "1", summary: "Initial version", }, { date: "2008-05-20T10:12:30+00:00", number: "2", summary: "Last updated version", }, { date: "2025-01-26T19:35:50+00:00", number: "3", summary: "Last generated version", }, ], status: "final", version: "3", }, }, product_tree: { branches: [ { branches: [ { branches: [ { category: "product_name", name: "Red Hat Satellite 5.0 (RHEL v.4 AS)", product: { name: "Red Hat Satellite 5.0 (RHEL v.4 AS)", product_id: "4AS-RHNSAT5", product_identification_helper: { cpe: "cpe:/a:redhat:network_satellite:5.0:el4", }, }, }, ], category: "product_family", name: "Red Hat Satellite", }, { branches: [ { category: "product_version", name: "rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", product: { name: "rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", product_id: "rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", product_identification_helper: { purl: "pkg:rpm/redhat/rhn-modssl@2.8.12-8.rhn.10.rhel4?arch=i386", }, }, }, { category: "product_version", name: "jabberd-0:2.0s10-3.38.rhn.i386", product: { name: "jabberd-0:2.0s10-3.38.rhn.i386", product_id: "jabberd-0:2.0s10-3.38.rhn.i386", product_identification_helper: { purl: "pkg:rpm/redhat/jabberd@2.0s10-3.38.rhn?arch=i386", }, }, }, { category: "product_version", name: "openmotif21-0:2.1.30-11.RHEL4.6.i386", product: { name: "openmotif21-0:2.1.30-11.RHEL4.6.i386", product_id: "openmotif21-0:2.1.30-11.RHEL4.6.i386", product_identification_helper: { purl: "pkg:rpm/redhat/openmotif21@2.1.30-11.RHEL4.6?arch=i386", }, }, }, { category: "product_version", name: "openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", product: { name: "openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", product_id: "openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", product_identification_helper: { purl: "pkg:rpm/redhat/openmotif21-debuginfo@2.1.30-11.RHEL4.6?arch=i386", }, }, }, { category: "product_version", name: "rhn-apache-0:1.3.27-36.rhn.rhel4.i386", product: { name: "rhn-apache-0:1.3.27-36.rhn.rhel4.i386", product_id: "rhn-apache-0:1.3.27-36.rhn.rhel4.i386", product_identification_helper: { purl: "pkg:rpm/redhat/rhn-apache@1.3.27-36.rhn.rhel4?arch=i386", }, }, }, { category: "product_version", name: "java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", product: { name: "java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", product_id: "java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", product_identification_helper: { purl: "pkg:rpm/redhat/java-1.4.2-ibm@1.4.2.10-1jpp.2.el4?arch=i386", }, }, }, { category: "product_version", name: "java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", product: { name: "java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", product_id: "java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", product_identification_helper: { purl: "pkg:rpm/redhat/java-1.4.2-ibm-devel@1.4.2.10-1jpp.2.el4?arch=i386", }, }, }, { category: "product_version", name: "rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", product: { name: "rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", product_id: "rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", product_identification_helper: { purl: "pkg:rpm/redhat/rhn-modjk-ap13@1.2.23-2rhn.rhel4?arch=i386", }, }, }, { category: "product_version", name: "rhn-modperl-0:1.29-16.rhel4.i386", product: { name: "rhn-modperl-0:1.29-16.rhel4.i386", product_id: "rhn-modperl-0:1.29-16.rhel4.i386", product_identification_helper: { purl: "pkg:rpm/redhat/rhn-modperl@1.29-16.rhel4?arch=i386", }, }, }, ], category: "architecture", name: "i386", }, { branches: [ { category: "product_version", name: "jfreechart-0:0.9.20-3.rhn.noarch", product: { name: "jfreechart-0:0.9.20-3.rhn.noarch", product_id: "jfreechart-0:0.9.20-3.rhn.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/jfreechart@0.9.20-3.rhn?arch=noarch", }, }, }, { category: "product_version", name: "tomcat5-0:5.0.30-0jpp_10rh.noarch", product: { name: "tomcat5-0:5.0.30-0jpp_10rh.noarch", product_id: "tomcat5-0:5.0.30-0jpp_10rh.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/tomcat5@5.0.30-0jpp_10rh?arch=noarch", }, }, }, { category: "product_version", name: "perl-Crypt-CBC-0:2.24-1.el4.noarch", product: { name: "perl-Crypt-CBC-0:2.24-1.el4.noarch", product_id: "perl-Crypt-CBC-0:2.24-1.el4.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/perl-Crypt-CBC@2.24-1.el4?arch=noarch", }, }, }, ], category: "architecture", name: "noarch", }, ], category: "vendor", name: "Red Hat", }, ], relationships: [ { category: "default_component_of", full_product_name: { name: "jabberd-0:2.0s10-3.38.rhn.i386 as a component of Red Hat Satellite 5.0 (RHEL v.4 AS)", product_id: "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", }, product_reference: "jabberd-0:2.0s10-3.38.rhn.i386", relates_to_product_reference: "4AS-RHNSAT5", }, { category: "default_component_of", full_product_name: { name: "java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386 as a component of Red Hat Satellite 5.0 (RHEL v.4 AS)", product_id: "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", }, product_reference: "java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", relates_to_product_reference: "4AS-RHNSAT5", }, { category: "default_component_of", full_product_name: { name: "java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386 as a component of Red Hat Satellite 5.0 (RHEL v.4 AS)", product_id: "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", }, product_reference: "java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", relates_to_product_reference: "4AS-RHNSAT5", }, { category: "default_component_of", full_product_name: { name: "jfreechart-0:0.9.20-3.rhn.noarch as a component of Red Hat Satellite 5.0 (RHEL v.4 AS)", product_id: "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", }, product_reference: "jfreechart-0:0.9.20-3.rhn.noarch", relates_to_product_reference: "4AS-RHNSAT5", }, { category: "default_component_of", full_product_name: { name: "openmotif21-0:2.1.30-11.RHEL4.6.i386 as a component of Red Hat Satellite 5.0 (RHEL v.4 AS)", product_id: "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", }, product_reference: "openmotif21-0:2.1.30-11.RHEL4.6.i386", relates_to_product_reference: "4AS-RHNSAT5", }, { category: "default_component_of", full_product_name: { name: "openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386 as a component of Red Hat Satellite 5.0 (RHEL v.4 AS)", product_id: "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", }, product_reference: "openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", relates_to_product_reference: "4AS-RHNSAT5", }, { category: "default_component_of", full_product_name: { name: "perl-Crypt-CBC-0:2.24-1.el4.noarch as a component of Red Hat Satellite 5.0 (RHEL v.4 AS)", product_id: "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", }, product_reference: "perl-Crypt-CBC-0:2.24-1.el4.noarch", relates_to_product_reference: "4AS-RHNSAT5", }, { category: "default_component_of", full_product_name: { name: "rhn-apache-0:1.3.27-36.rhn.rhel4.i386 as a component of Red Hat Satellite 5.0 (RHEL v.4 AS)", product_id: "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", }, product_reference: "rhn-apache-0:1.3.27-36.rhn.rhel4.i386", relates_to_product_reference: "4AS-RHNSAT5", }, { category: "default_component_of", full_product_name: { name: "rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386 as a component of Red Hat Satellite 5.0 (RHEL v.4 AS)", product_id: "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", }, product_reference: "rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", relates_to_product_reference: "4AS-RHNSAT5", }, { category: "default_component_of", full_product_name: { name: "rhn-modperl-0:1.29-16.rhel4.i386 as a component of Red Hat Satellite 5.0 (RHEL v.4 AS)", product_id: "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", }, product_reference: "rhn-modperl-0:1.29-16.rhel4.i386", relates_to_product_reference: "4AS-RHNSAT5", }, { category: "default_component_of", full_product_name: { name: "rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386 as a component of Red Hat Satellite 5.0 (RHEL v.4 AS)", product_id: "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", }, product_reference: "rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", relates_to_product_reference: "4AS-RHNSAT5", }, { category: "default_component_of", full_product_name: { name: "tomcat5-0:5.0.30-0jpp_10rh.noarch as a component of Red Hat Satellite 5.0 (RHEL v.4 AS)", product_id: "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", }, product_reference: "tomcat5-0:5.0.30-0jpp_10rh.noarch", relates_to_product_reference: "4AS-RHNSAT5", }, ], }, vulnerabilities: [ { cve: "CVE-2004-0885", ids: [ { system_name: "Red Hat Bugzilla ID", text: "430637", }, ], notes: [ { category: "description", text: "The mod_ssl module in Apache 2.0.35 through 2.0.52, when using the \"SSLCipherSuite\" directive in directory or location context, allows remote clients to bypass intended restrictions by using any cipher suite that is allowed by the virtual host configuration.", title: "Vulnerability description", }, { category: "summary", text: "mod_ssl SSLCipherSuite bypass", title: "Vulnerability summary", }, ], product_status: { fixed: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2004-0885", }, { category: "external", summary: "RHBZ#430637", url: "https://bugzilla.redhat.com/show_bug.cgi?id=430637", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2004-0885", url: "https://www.cve.org/CVERecord?id=CVE-2004-0885", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2004-0885", url: "https://nvd.nist.gov/vuln/detail/CVE-2004-0885", }, ], release_date: "2004-10-05T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-05-20T14:12:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0261", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "mod_ssl SSLCipherSuite bypass", }, { cve: "CVE-2005-0605", discovery_date: "2005-02-28T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "430520", }, ], notes: [ { category: "description", text: "scan.c for LibXPM may allow attackers to execute arbitrary code via a negative bitmap_unit value that leads to a buffer overflow.", title: "Vulnerability description", }, { category: "summary", text: "libxpm buffer overflow", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Enterprise Linux 5 is not vulnerable to this issue as it contains a backported patch.", title: "Statement", }, ], product_status: { fixed: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2005-0605", }, { category: "external", summary: "RHBZ#430520", url: "https://bugzilla.redhat.com/show_bug.cgi?id=430520", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2005-0605", url: "https://www.cve.org/CVERecord?id=CVE-2005-0605", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2005-0605", url: "https://nvd.nist.gov/vuln/detail/CVE-2005-0605", }, ], release_date: "2005-03-01T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-05-20T14:12:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0261", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "libxpm buffer overflow", }, { cve: "CVE-2005-2090", discovery_date: "2005-06-06T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "237079", }, ], notes: [ { category: "description", text: "Jakarta Tomcat 5.0.19 (Coyote/1.1) and Tomcat 4.1.24 (Coyote/1.0) allows remote attackers to poison the web cache, bypass web application firewall protection, and conduct XSS attacks via an HTTP request with both a \"Transfer-Encoding: chunked\" header and a Content-Length header, which causes Tomcat to incorrectly handle and forward the body of the request in a way that causes the receiving server to process it as a separate HTTP request, aka \"HTTP Request Smuggling.\"", title: "Vulnerability description", }, { category: "summary", text: "tomcat multiple content-length header poisioning", title: "Vulnerability summary", }, ], product_status: { fixed: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2005-2090", }, { category: "external", summary: "RHBZ#237079", url: "https://bugzilla.redhat.com/show_bug.cgi?id=237079", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2005-2090", url: "https://www.cve.org/CVERecord?id=CVE-2005-2090", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2005-2090", url: "https://nvd.nist.gov/vuln/detail/CVE-2005-2090", }, ], release_date: "2005-06-06T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-05-20T14:12:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0261", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "tomcat multiple content-length header poisioning", }, { cve: "CVE-2005-3510", discovery_date: "2005-11-07T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "237085", }, ], notes: [ { category: "description", text: "Apache Tomcat 5.5.0 to 5.5.11 allows remote attackers to cause a denial of service (CPU consumption) via a large number of simultaneous requests to list a web directory that has a large number of files.", title: "Vulnerability description", }, { category: "summary", text: "tomcat DoS", title: "Vulnerability summary", }, ], product_status: { fixed: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2005-3510", }, { category: "external", summary: "RHBZ#237085", url: "https://bugzilla.redhat.com/show_bug.cgi?id=237085", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2005-3510", url: "https://www.cve.org/CVERecord?id=CVE-2005-3510", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2005-3510", url: "https://nvd.nist.gov/vuln/detail/CVE-2005-3510", }, ], release_date: "2005-11-03T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-05-20T14:12:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0261", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "tomcat DoS", }, { cve: "CVE-2005-3964", discovery_date: "2005-12-02T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "430519", }, ], notes: [ { category: "description", text: "Multiple buffer overflows in libUil (libUil.so) in OpenMotif 2.2.3, and possibly other versions, allows attackers to execute arbitrary code via the (1) diag_issue_diagnostic function in UilDiags.c and (2) open_source_file function in UilSrcSrc.c.", title: "Vulnerability description", }, { category: "summary", text: "openmotif libUil buffer overflows", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Enterprise Linux 5 is not vulnerable to this issue as it contains a backported patch.", title: "Statement", }, ], product_status: { fixed: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2005-3964", }, { category: "external", summary: "RHBZ#430519", url: "https://bugzilla.redhat.com/show_bug.cgi?id=430519", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2005-3964", url: "https://www.cve.org/CVERecord?id=CVE-2005-3964", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2005-3964", url: "https://nvd.nist.gov/vuln/detail/CVE-2005-3964", }, ], release_date: "2005-12-02T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-05-20T14:12:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0261", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "openmotif libUil buffer overflows", }, { cve: "CVE-2005-4838", discovery_date: "2005-01-03T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "238401", }, ], notes: [ { category: "description", text: "Multiple cross-site scripting (XSS) vulnerabilities in the example web applications for Jakarta Tomcat 5.5.6 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) el/functions.jsp, (2) el/implicit-objects.jsp, and (3) jspx/textRotate.jspx in examples/jsp2/, as demonstrated via script in a request to snp/snoop.jsp. NOTE: other XSS issues in the manager were simultaneously reported, but these require admin access and do not cross privilege boundaries.", title: "Vulnerability description", }, { category: "summary", text: "tomcat manager example DoS", title: "Vulnerability summary", }, ], product_status: { fixed: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2005-4838", }, { category: "external", summary: "RHBZ#238401", url: "https://bugzilla.redhat.com/show_bug.cgi?id=238401", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2005-4838", url: "https://www.cve.org/CVERecord?id=CVE-2005-4838", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2005-4838", url: "https://nvd.nist.gov/vuln/detail/CVE-2005-4838", }, ], release_date: "2005-01-03T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-05-20T14:12:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0261", }, ], threats: [ { category: "impact", details: "Low", }, ], title: "tomcat manager example DoS", }, { cve: "CVE-2006-0254", cwe: { id: "CWE-79", name: "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", }, discovery_date: "2006-01-17T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "430646", }, ], notes: [ { category: "description", text: "Multiple cross-site scripting (XSS) vulnerabilities in Apache Geronimo 1.0 allow remote attackers to inject arbitrary web script or HTML via the (1) time parameter to cal2.jsp and (2) any invalid parameter, which causes an XSS when the log file is viewed by the Web-Access-Log viewer.", title: "Vulnerability description", }, { category: "summary", text: "tomcat examples XSS", title: "Vulnerability summary", }, ], product_status: { fixed: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2006-0254", }, { category: "external", summary: "RHBZ#430646", url: "https://bugzilla.redhat.com/show_bug.cgi?id=430646", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2006-0254", url: "https://www.cve.org/CVERecord?id=CVE-2006-0254", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2006-0254", url: "https://nvd.nist.gov/vuln/detail/CVE-2006-0254", }, ], release_date: "2006-01-15T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-05-20T14:12:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0261", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "tomcat examples XSS", }, { cve: "CVE-2006-0898", ids: [ { system_name: "Red Hat Bugzilla ID", text: "430522", }, ], notes: [ { category: "description", text: "Crypt::CBC Perl module 2.16 and earlier, when running in RandomIV mode, uses an initialization vector (IV) of 8 bytes, which results in weaker encryption when used with a cipher that requires a larger block size than 8 bytes, such as Rijndael.", title: "Vulnerability description", }, { category: "summary", text: "perl-Crypt-CBC weaker encryption with some ciphers", title: "Vulnerability summary", }, ], product_status: { fixed: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2006-0898", }, { category: "external", summary: "RHBZ#430522", url: "https://bugzilla.redhat.com/show_bug.cgi?id=430522", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2006-0898", url: "https://www.cve.org/CVERecord?id=CVE-2006-0898", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2006-0898", url: "https://nvd.nist.gov/vuln/detail/CVE-2006-0898", }, ], release_date: "2006-02-23T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-05-20T14:12:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0261", }, ], threats: [ { category: "impact", details: "Low", }, ], title: "perl-Crypt-CBC weaker encryption with some ciphers", }, { cve: "CVE-2006-1329", ids: [ { system_name: "Red Hat Bugzilla ID", text: "429254", }, ], notes: [ { category: "description", text: "The SASL negotiation in Jabber Studio jabberd before 2.0s11 allows remote attackers to cause a denial of service (\"c2s segfault\") by sending a \"response stanza before an auth stanza\".", title: "Vulnerability description", }, { category: "summary", text: "jabberd SASL DoS", title: "Vulnerability summary", }, ], product_status: { fixed: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2006-1329", }, { category: "external", summary: "RHBZ#429254", url: "https://bugzilla.redhat.com/show_bug.cgi?id=429254", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2006-1329", url: "https://www.cve.org/CVERecord?id=CVE-2006-1329", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2006-1329", url: "https://nvd.nist.gov/vuln/detail/CVE-2006-1329", }, ], release_date: "2006-03-09T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-05-20T14:12:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0261", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "jabberd SASL DoS", }, { cve: "CVE-2006-3835", discovery_date: "2006-07-21T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "237084", }, ], notes: [ { category: "description", text: "Apache Tomcat 5 before 5.5.17 allows remote attackers to list directories via a semicolon (;) preceding a filename with a mapped extension, as demonstrated by URLs ending with /;index.jsp and /;help.do.", title: "Vulnerability description", }, { category: "summary", text: "tomcat directory listing issue", title: "Vulnerability summary", }, { category: "other", text: "This issue is not a security issue in Tomcat itself, but is caused when directory listings are enabled.\n\nDetails on how to disable directory listings are available at: http://tomcat.apache.org/faq/misc.html#listing", title: "Statement", }, ], product_status: { fixed: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2006-3835", }, { category: "external", summary: "RHBZ#237084", url: "https://bugzilla.redhat.com/show_bug.cgi?id=237084", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2006-3835", url: "https://www.cve.org/CVERecord?id=CVE-2006-3835", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2006-3835", url: "https://nvd.nist.gov/vuln/detail/CVE-2006-3835", }, ], release_date: "2006-07-21T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-05-20T14:12:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0261", }, ], threats: [ { category: "impact", details: "Low", }, ], title: "tomcat directory listing issue", }, { cve: "CVE-2006-5752", cwe: { id: "CWE-79", name: "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", }, discovery_date: "2007-06-20T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "245112", }, ], notes: [ { category: "description", text: "Cross-site scripting (XSS) vulnerability in mod_status.c in the mod_status module in Apache HTTP Server (httpd), when ExtendedStatus is enabled and a public server-status page is used, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors involving charsets with browsers that perform \"charset detection\" when the content-type is not specified.", title: "Vulnerability description", }, { category: "summary", text: "httpd mod_status XSS", title: "Vulnerability summary", }, ], product_status: { fixed: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2006-5752", }, { category: "external", summary: "RHBZ#245112", url: "https://bugzilla.redhat.com/show_bug.cgi?id=245112", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2006-5752", url: "https://www.cve.org/CVERecord?id=CVE-2006-5752", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2006-5752", url: "https://nvd.nist.gov/vuln/detail/CVE-2006-5752", }, ], release_date: "2007-06-20T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-05-20T14:12:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0261", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "httpd mod_status XSS", }, { cve: "CVE-2006-7195", cwe: { id: "CWE-79", name: "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", }, discovery_date: "2007-04-19T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "237081", }, ], notes: [ { category: "description", text: "Cross-site scripting (XSS) vulnerability in implicit-objects.jsp in Apache Tomcat 5.0.0 through 5.0.30 and 5.5.0 through 5.5.17 allows remote attackers to inject arbitrary web script or HTML via certain header values.", title: "Vulnerability description", }, { category: "summary", text: "tomcat XSS in example webapps", title: "Vulnerability summary", }, ], product_status: { fixed: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2006-7195", }, { category: "external", summary: "RHBZ#237081", url: "https://bugzilla.redhat.com/show_bug.cgi?id=237081", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2006-7195", url: "https://www.cve.org/CVERecord?id=CVE-2006-7195", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2006-7195", url: "https://nvd.nist.gov/vuln/detail/CVE-2006-7195", }, ], release_date: "2007-04-19T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-05-20T14:12:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0261", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "tomcat XSS in example webapps", }, { cve: "CVE-2006-7196", cwe: { id: "CWE-79", name: "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", }, discovery_date: "2007-04-26T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "238131", }, ], notes: [ { category: "description", text: "Cross-site scripting (XSS) vulnerability in the calendar application example in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0 through 4.1.31, 5.0.0 through 5.0.30, and 5.5.0 through 5.5.15 allows remote attackers to inject arbitrary web script or HTML via the time parameter to cal2.jsp and possibly unspecified other vectors. NOTE: this may be related to CVE-2006-0254.1.", title: "Vulnerability description", }, { category: "summary", text: "tomcat XSS in example webapps", title: "Vulnerability summary", }, ], product_status: { fixed: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2006-7196", }, { category: "external", summary: "RHBZ#238131", url: "https://bugzilla.redhat.com/show_bug.cgi?id=238131", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2006-7196", url: "https://www.cve.org/CVERecord?id=CVE-2006-7196", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2006-7196", url: "https://nvd.nist.gov/vuln/detail/CVE-2006-7196", }, ], release_date: "2007-04-26T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-05-20T14:12:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0261", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "tomcat XSS in example webapps", }, { cve: "CVE-2006-7197", ids: [ { system_name: "Red Hat Bugzilla ID", text: "430642", }, ], notes: [ { category: "description", text: "The AJP connector in Apache Tomcat 5.5.15 uses an incorrect length for chunks, which can cause a buffer over-read in the ajp_process_callback in mod_jk, which allows remote attackers to read portions of sensitive memory.", title: "Vulnerability description", }, { category: "summary", text: "mod_jk chunk too long", title: "Vulnerability summary", }, ], product_status: { fixed: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2006-7197", }, { category: "external", summary: "RHBZ#430642", url: "https://bugzilla.redhat.com/show_bug.cgi?id=430642", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2006-7197", url: "https://www.cve.org/CVERecord?id=CVE-2006-7197", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2006-7197", url: "https://nvd.nist.gov/vuln/detail/CVE-2006-7197", }, ], release_date: "2006-03-05T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-05-20T14:12:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0261", }, ], threats: [ { category: "impact", details: "Important", }, ], title: "mod_jk chunk too long", }, { cve: "CVE-2007-0243", discovery_date: "2007-04-17T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "325941", }, ], notes: [ { category: "description", text: "Buffer overflow in Sun JDK and Java Runtime Environment (JRE) 5.0 Update 9 and earlier, SDK and JRE 1.4.2_12 and earlier, and SDK and JRE 1.3.1_18 and earlier allows applets to gain privileges via a GIF image with a block with a 0 width field, which triggers memory corruption.", title: "Vulnerability description", }, { category: "summary", text: "java-jre: GIF buffer overflow", title: "Vulnerability summary", }, ], product_status: { fixed: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-0243", }, { category: "external", summary: "RHBZ#325941", url: "https://bugzilla.redhat.com/show_bug.cgi?id=325941", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-0243", url: "https://www.cve.org/CVERecord?id=CVE-2007-0243", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-0243", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-0243", }, ], release_date: "2007-01-17T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-05-20T14:12:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0261", }, ], threats: [ { category: "impact", details: "Important", }, ], title: "java-jre: GIF buffer overflow", }, { cve: "CVE-2007-0450", discovery_date: "2007-03-14T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "237080", }, ], notes: [ { category: "description", text: "Directory traversal vulnerability in Apache HTTP Server and Tomcat 5.x before 5.5.22 and 6.x before 6.0.10, when using certain proxy modules (mod_proxy, mod_rewrite, mod_jk), allows remote attackers to read arbitrary files via a .. (dot dot) sequence with combinations of (1) \"/\" (slash), (2) \"\\\" (backslash), and (3) URL-encoded backslash (%5C) characters in the URL, which are valid separators in Tomcat but not in Apache.", title: "Vulnerability description", }, { category: "summary", text: "tomcat directory traversal", title: "Vulnerability summary", }, ], product_status: { fixed: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-0450", }, { category: "external", summary: "RHBZ#237080", url: "https://bugzilla.redhat.com/show_bug.cgi?id=237080", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-0450", url: "https://www.cve.org/CVERecord?id=CVE-2007-0450", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-0450", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-0450", }, ], release_date: "2007-03-14T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-05-20T14:12:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0261", }, ], threats: [ { category: "impact", details: "Important", }, ], title: "tomcat directory traversal", }, { cve: "CVE-2007-1349", discovery_date: "2007-05-17T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "240423", }, ], notes: [ { category: "description", text: "PerlRun.pm in Apache mod_perl before 1.30, and RegistryCooker.pm in mod_perl 2.x, does not properly escape PATH_INFO before use in a regular expression, which allows remote attackers to cause a denial of service (resource consumption) via a crafted URI.", title: "Vulnerability description", }, { category: "summary", text: "mod_perl PerlRun denial of service", title: "Vulnerability summary", }, ], product_status: { fixed: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-1349", }, { category: "external", summary: "RHBZ#240423", url: "https://bugzilla.redhat.com/show_bug.cgi?id=240423", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-1349", url: "https://www.cve.org/CVERecord?id=CVE-2007-1349", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-1349", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-1349", }, ], release_date: "2007-03-22T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-05-20T14:12:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0261", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "mod_perl PerlRun denial of service", }, { cve: "CVE-2007-1355", cwe: { id: "CWE-79", name: "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", }, discovery_date: "2007-05-19T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "253166", }, ], notes: [ { category: "description", text: "Multiple cross-site scripting (XSS) vulnerabilities in the appdev/sample/web/hello.jsp example application in Tomcat 4.0.0 through 4.0.6, 4.1.0 through 4.1.36, 5.0.0 through 5.0.30, 5.5.0 through 5.5.23, and 6.0.0 through 6.0.10 allow remote attackers to inject arbitrary web script or HTML via the test parameter and unspecified vectors.", title: "Vulnerability description", }, { category: "summary", text: "tomcat XSS in samples", title: "Vulnerability summary", }, ], product_status: { fixed: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-1355", }, { category: "external", summary: "RHBZ#253166", url: "https://bugzilla.redhat.com/show_bug.cgi?id=253166", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-1355", url: "https://www.cve.org/CVERecord?id=CVE-2007-1355", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-1355", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-1355", }, ], release_date: "2007-05-19T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-05-20T14:12:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0261", }, ], threats: [ { category: "impact", details: "Low", }, ], title: "tomcat XSS in samples", }, { cve: "CVE-2007-1358", cwe: { id: "CWE-79", name: "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", }, discovery_date: "2007-04-10T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "244803", }, ], notes: [ { category: "description", text: "Cross-site scripting (XSS) vulnerability in certain applications using Apache Tomcat 4.0.0 through 4.0.6 and 4.1.0 through 4.1.34 allows remote attackers to inject arbitrary web script or HTML via crafted \"Accept-Language headers that do not conform to RFC 2616\".", title: "Vulnerability description", }, { category: "summary", text: "tomcat accept-language xss flaw", title: "Vulnerability summary", }, ], product_status: { fixed: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-1358", }, { category: "external", summary: "RHBZ#244803", url: "https://bugzilla.redhat.com/show_bug.cgi?id=244803", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-1358", url: "https://www.cve.org/CVERecord?id=CVE-2007-1358", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-1358", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-1358", }, ], release_date: "2007-06-06T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-05-20T14:12:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0261", }, ], threats: [ { category: "impact", details: "Low", }, ], title: "tomcat accept-language xss flaw", }, { cve: "CVE-2007-1860", discovery_date: "2007-04-20T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "237656", }, ], notes: [ { category: "description", text: "mod_jk in Apache Tomcat JK Web Server Connector 1.2.x before 1.2.23 decodes request URLs within the Apache HTTP Server before passing the URL to Tomcat, which allows remote attackers to access protected pages via a crafted prefix JkMount, possibly involving double-encoded .. (dot dot) sequences and directory traversal, a related issue to CVE-2007-0450.", title: "Vulnerability description", }, { category: "summary", text: "mod_jk sends decoded URL to tomcat", title: "Vulnerability summary", }, ], product_status: { fixed: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-1860", }, { category: "external", summary: "RHBZ#237656", url: "https://bugzilla.redhat.com/show_bug.cgi?id=237656", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-1860", url: "https://www.cve.org/CVERecord?id=CVE-2007-1860", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-1860", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-1860", }, ], release_date: "2007-05-21T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-05-20T14:12:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0261", }, ], threats: [ { category: "impact", details: "Important", }, ], title: "mod_jk sends decoded URL to tomcat", }, { cve: "CVE-2007-2435", discovery_date: "2007-05-01T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "239660", }, ], notes: [ { category: "description", text: "Sun Java Web Start in JDK and JRE 5.0 Update 10 and earlier, and Java Web Start in SDK and JRE 1.4.2_13 and earlier, allows remote attackers to perform unauthorized actions via an application that grants privileges to itself, related to \"Incorrect Use of System Classes\" and probably related to support for JNLP files.", title: "Vulnerability description", }, { category: "summary", text: "javaws vulnerabilities", title: "Vulnerability summary", }, ], product_status: { fixed: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-2435", }, { category: "external", summary: "RHBZ#239660", url: "https://bugzilla.redhat.com/show_bug.cgi?id=239660", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-2435", url: "https://www.cve.org/CVERecord?id=CVE-2007-2435", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-2435", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-2435", }, ], release_date: "2007-04-30T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-05-20T14:12:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0261", }, ], threats: [ { category: "impact", details: "Critical", }, ], title: "javaws vulnerabilities", }, { cve: "CVE-2007-2449", cwe: { id: "CWE-79", name: "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", }, discovery_date: "2007-05-24T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "244804", }, ], notes: [ { category: "description", text: "Multiple cross-site scripting (XSS) vulnerabilities in certain JSP files in the examples web application in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0 through 4.1.36, 5.0.0 through 5.0.30, 5.5.0 through 5.5.24, and 6.0.0 through 6.0.13 allow remote attackers to inject arbitrary web script or HTML via the portion of the URI after the ';' character, as demonstrated by a URI containing a \"snp/snoop.jsp;\" sequence.", title: "Vulnerability description", }, { category: "summary", text: "tomcat examples jsp XSS", title: "Vulnerability summary", }, ], product_status: { fixed: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-2449", }, { category: "external", summary: "RHBZ#244804", url: "https://bugzilla.redhat.com/show_bug.cgi?id=244804", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-2449", url: "https://www.cve.org/CVERecord?id=CVE-2007-2449", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-2449", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-2449", }, ], release_date: "2007-06-13T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-05-20T14:12:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0261", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "tomcat examples jsp XSS", }, { cve: "CVE-2007-2450", cwe: { id: "CWE-79", name: "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", }, discovery_date: "2007-05-24T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "244808", }, ], notes: [ { category: "description", text: "Multiple cross-site scripting (XSS) vulnerabilities in the (1) Manager and (2) Host Manager web applications in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0 through 4.1.36, 5.0.0 through 5.0.30, 5.5.0 through 5.5.24, and 6.0.0 through 6.0.13 allow remote authenticated users to inject arbitrary web script or HTML via a parameter name to manager/html/upload, and other unspecified vectors.", title: "Vulnerability description", }, { category: "summary", text: "tomcat host manager XSS", title: "Vulnerability summary", }, ], product_status: { fixed: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-2450", }, { category: "external", summary: "RHBZ#244808", url: "https://bugzilla.redhat.com/show_bug.cgi?id=244808", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-2450", url: "https://www.cve.org/CVERecord?id=CVE-2007-2450", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-2450", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-2450", }, ], release_date: "2007-06-13T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-05-20T14:12:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0261", }, ], threats: [ { category: "impact", details: "Low", }, ], title: "tomcat host manager XSS", }, { cve: "CVE-2007-2788", cwe: { id: "CWE-190", name: "Integer Overflow or Wraparound", }, discovery_date: "2007-05-21T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "250725", }, ], notes: [ { category: "description", text: "Integer overflow in the embedded ICC profile image parser in Sun Java Development Kit (JDK) before 1.5.0_11-b03 and 1.6.x before 1.6.0_01-b06, and Sun Java Runtime Environment in JDK and JRE 6, JDK and JRE 5.0 Update 10 and earlier, SDK and JRE 1.4.2_14 and earlier, and SDK and JRE 1.3.1_20 and earlier, allows remote attackers to execute arbitrary code or cause a denial of service (JVM crash) via a crafted JPEG or BMP file that triggers a buffer overflow.", title: "Vulnerability description", }, { category: "summary", text: "Integer overflow in the embedded ICC profile image parser in Sun Java Development Kit", title: "Vulnerability summary", }, ], product_status: { fixed: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-2788", }, { category: "external", summary: "RHBZ#250725", url: "https://bugzilla.redhat.com/show_bug.cgi?id=250725", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-2788", url: "https://www.cve.org/CVERecord?id=CVE-2007-2788", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-2788", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-2788", }, ], release_date: "2007-05-21T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-05-20T14:12:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0261", }, ], threats: [ { category: "impact", details: "Critical", }, ], title: "Integer overflow in the embedded ICC profile image parser in Sun Java Development Kit", }, { cve: "CVE-2007-2789", discovery_date: "2007-05-21T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "250729", }, ], notes: [ { category: "description", text: "The BMP image parser in Sun Java Development Kit (JDK) before 1.5.0_11-b03 and 1.6.x before 1.6.0_01-b06, and Sun Java Runtime Environment in JDK and JRE 6, JDK and JRE 5.0 Update 10 and earlier, SDK and JRE 1.4.2_14 and earlier, and SDK and JRE 1.3.1_19 and earlier, when running on Unix/Linux systems, allows remote attackers to cause a denial of service (JVM hang) via untrusted applets or applications that open arbitrary local files via a crafted BMP file, such as /dev/tty.", title: "Vulnerability description", }, { category: "summary", text: "BMP image parser vulnerability", title: "Vulnerability summary", }, ], product_status: { fixed: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-2789", }, { category: "external", summary: "RHBZ#250729", url: "https://bugzilla.redhat.com/show_bug.cgi?id=250729", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-2789", url: "https://www.cve.org/CVERecord?id=CVE-2007-2789", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-2789", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-2789", }, ], release_date: "2007-05-21T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-05-20T14:12:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0261", }, ], threats: [ { category: "impact", details: "Critical", }, ], title: "BMP image parser vulnerability", }, { cve: "CVE-2007-3304", discovery_date: "2007-06-19T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "245111", }, ], notes: [ { category: "description", text: "Apache httpd 1.3.37, 2.0.59, and 2.2.4 with the Prefork MPM module, allows local users to cause a denial of service by modifying the worker_score and process_score arrays to reference an arbitrary process ID, which is sent a SIGUSR1 signal from the master process, aka \"SIGUSR1 killer.\"", title: "Vulnerability description", }, { category: "summary", text: "httpd scoreboard lack of PID protection", title: "Vulnerability summary", }, ], product_status: { fixed: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-3304", }, { category: "external", summary: "RHBZ#245111", url: "https://bugzilla.redhat.com/show_bug.cgi?id=245111", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-3304", url: "https://www.cve.org/CVERecord?id=CVE-2007-3304", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-3304", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-3304", }, ], release_date: "2007-06-19T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-05-20T14:12:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0261", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "httpd scoreboard lack of PID protection", }, { cve: "CVE-2007-3382", discovery_date: "2007-07-12T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "247972", }, ], notes: [ { category: "description", text: "Apache Tomcat 6.0.0 to 6.0.13, 5.5.0 to 5.5.24, 5.0.0 to 5.0.30, 4.1.0 to 4.1.36, and 3.3 to 3.3.2 treats single quotes (\"'\") as delimiters in cookies, which might cause sensitive information such as session IDs to be leaked and allow remote attackers to conduct session hijacking attacks.", title: "Vulnerability description", }, { category: "summary", text: "tomcat handling of cookies", title: "Vulnerability summary", }, ], product_status: { fixed: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-3382", }, { category: "external", summary: "RHBZ#247972", url: "https://bugzilla.redhat.com/show_bug.cgi?id=247972", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-3382", url: "https://www.cve.org/CVERecord?id=CVE-2007-3382", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-3382", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-3382", }, ], release_date: "2007-08-14T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-05-20T14:12:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0261", }, ], threats: [ { category: "impact", details: "Low", }, ], title: "tomcat handling of cookies", }, { cve: "CVE-2007-3385", discovery_date: "2007-07-12T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "247976", }, ], notes: [ { category: "description", text: "Apache Tomcat 6.0.0 to 6.0.13, 5.5.0 to 5.5.24, 5.0.0 to 5.0.30, 4.1.0 to 4.1.36, and 3.3 to 3.3.2 does not properly handle the \\\" character sequence in a cookie value, which might cause sensitive information such as session IDs to be leaked to remote attackers and enable session hijacking attacks.", title: "Vulnerability description", }, { category: "summary", text: "tomcat handling of cookie values", title: "Vulnerability summary", }, ], product_status: { fixed: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-3385", }, { category: "external", summary: "RHBZ#247976", url: "https://bugzilla.redhat.com/show_bug.cgi?id=247976", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-3385", url: "https://www.cve.org/CVERecord?id=CVE-2007-3385", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-3385", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-3385", }, ], release_date: "2007-08-14T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-05-20T14:12:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0261", }, ], threats: [ { category: "impact", details: "Low", }, ], title: "tomcat handling of cookie values", }, { cve: "CVE-2007-4465", cwe: { id: "CWE-79", name: "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", }, discovery_date: "2007-09-13T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "289511", }, ], notes: [ { category: "description", text: "Cross-site scripting (XSS) vulnerability in mod_autoindex.c in the Apache HTTP Server before 2.2.6, when the charset on a server-generated page is not defined, allows remote attackers to inject arbitrary web script or HTML via the P parameter using the UTF-7 charset. NOTE: it could be argued that this issue is due to a design limitation of browsers that attempt to perform automatic content type detection.", title: "Vulnerability description", }, { category: "summary", text: "mod_autoindex XSS", title: "Vulnerability summary", }, { category: "other", text: "This is actually a flaw in browsers that do not derive the response character set as required by RFC 2616. This does not affect the default configuration of Apache httpd in Red Hat products and will only affect customers who have removed the \"AddDefaultCharset\" directive and are using directory indexes. The Red Hat Product Security has rated this issue as having low security impact, a future update may address this flaw.", title: "Statement", }, ], product_status: { fixed: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-4465", }, { category: "external", summary: "RHBZ#289511", url: "https://bugzilla.redhat.com/show_bug.cgi?id=289511", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-4465", url: "https://www.cve.org/CVERecord?id=CVE-2007-4465", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-4465", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-4465", }, ], release_date: "2007-09-13T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-05-20T14:12:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0261", }, ], threats: [ { category: "impact", details: "Low", }, ], title: "mod_autoindex XSS", }, { cve: "CVE-2007-5000", cwe: { id: "CWE-79", name: "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", }, discovery_date: "2007-12-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "419931", }, ], notes: [ { category: "description", text: "Cross-site scripting (XSS) vulnerability in the (1) mod_imap module in the Apache HTTP Server 1.3.0 through 1.3.39 and 2.0.35 through 2.0.61 and the (2) mod_imagemap module in the Apache HTTP Server 2.2.0 through 2.2.6 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.", title: "Vulnerability description", }, { category: "summary", text: "httpd: mod_imagemap XSS", title: "Vulnerability summary", }, ], product_status: { fixed: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-5000", }, { category: "external", summary: "RHBZ#419931", url: "https://bugzilla.redhat.com/show_bug.cgi?id=419931", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-5000", url: "https://www.cve.org/CVERecord?id=CVE-2007-5000", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-5000", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-5000", }, ], release_date: "2007-12-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-05-20T14:12:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0261", }, ], threats: [ { category: "impact", details: "Low", }, ], title: "httpd: mod_imagemap XSS", }, { cve: "CVE-2007-5461", discovery_date: "2007-10-14T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "333791", }, ], notes: [ { category: "description", text: "Absolute path traversal vulnerability in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0, 5.0.0, 5.5.0 through 5.5.25, and 6.0.0 through 6.0.14, under certain configurations, allows remote authenticated users to read arbitrary files via a WebDAV write request that specifies an entity with a SYSTEM tag.", title: "Vulnerability description", }, { category: "summary", text: "Absolute path traversal Apache Tomcat WEBDAV", title: "Vulnerability summary", }, ], product_status: { fixed: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-5461", }, { category: "external", summary: "RHBZ#333791", url: "https://bugzilla.redhat.com/show_bug.cgi?id=333791", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-5461", url: "https://www.cve.org/CVERecord?id=CVE-2007-5461", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-5461", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-5461", }, ], release_date: "2007-10-14T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-05-20T14:12:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0261", }, ], threats: [ { category: "impact", details: "Important", }, ], title: "Absolute path traversal Apache Tomcat WEBDAV", }, { cve: "CVE-2007-5961", cwe: { id: "CWE-79", name: "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", }, discovery_date: "2007-09-26T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "396641", }, ], notes: [ { category: "description", text: "Cross-site scripting (XSS) vulnerability in the Red Hat Network channel search feature, as used in RHN and Red Hat Network Satellite before 5.0.2, allows remote attackers to inject arbitrary web script or HTML via unknown vectors.", title: "Vulnerability description", }, { category: "summary", text: "RHN XSS flaw", title: "Vulnerability summary", }, ], product_status: { fixed: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-5961", }, { category: "external", summary: "RHBZ#396641", url: "https://bugzilla.redhat.com/show_bug.cgi?id=396641", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-5961", url: "https://www.cve.org/CVERecord?id=CVE-2007-5961", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-5961", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-5961", }, ], release_date: "2008-05-20T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-05-20T14:12:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0261", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "RHN XSS flaw", }, { cve: "CVE-2007-6306", cwe: { id: "CWE-79", name: "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", }, discovery_date: "2007-12-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "421081", }, ], notes: [ { category: "description", text: "Multiple cross-site scripting (XSS) vulnerabilities in the image map feature in JFreeChart 1.0.8 allow remote attackers to inject arbitrary web script or HTML via the (1) chart name or (2) chart tool tip text; or the (3) href, (4) shape, or (5) coords attribute of a chart area.", title: "Vulnerability description", }, { category: "summary", text: "JFreeChart: XSS vulnerabilities in the image map feature", title: "Vulnerability summary", }, ], product_status: { fixed: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-6306", }, { category: "external", summary: "RHBZ#421081", url: "https://bugzilla.redhat.com/show_bug.cgi?id=421081", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-6306", url: "https://www.cve.org/CVERecord?id=CVE-2007-6306", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-6306", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-6306", }, ], release_date: "2007-12-06T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-05-20T14:12:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0261", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "JFreeChart: XSS vulnerabilities in the image map feature", }, { cve: "CVE-2007-6388", cwe: { id: "CWE-79", name: "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", }, discovery_date: "2008-01-02T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "427228", }, ], notes: [ { category: "description", text: "Cross-site scripting (XSS) vulnerability in mod_status in the Apache HTTP Server 2.2.0 through 2.2.6, 2.0.35 through 2.0.61, and 1.3.2 through 1.3.39, when the server-status page is enabled, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.", title: "Vulnerability description", }, { category: "summary", text: "apache mod_status cross-site scripting", title: "Vulnerability summary", }, ], product_status: { fixed: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-6388", }, { category: "external", summary: "RHBZ#427228", url: "https://bugzilla.redhat.com/show_bug.cgi?id=427228", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-6388", url: "https://www.cve.org/CVERecord?id=CVE-2007-6388", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-6388", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-6388", }, ], release_date: "2007-12-29T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-05-20T14:12:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0261", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "apache mod_status cross-site scripting", }, { cve: "CVE-2008-0128", discovery_date: "2008-01-23T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "429821", }, ], notes: [ { category: "description", text: "The SingleSignOn Valve (org.apache.catalina.authenticator.SingleSignOn) in Apache Tomcat before 5.5.21 does not set the secure flag for the JSESSIONIDSSO cookie in an https session, which can cause the cookie to be sent in http requests and make it easier for remote attackers to capture this cookie.", title: "Vulnerability description", }, { category: "summary", text: "tomcat5 SSO cookie login information disclosure", title: "Vulnerability summary", }, ], product_status: { fixed: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2008-0128", }, { category: "external", summary: "RHBZ#429821", url: "https://bugzilla.redhat.com/show_bug.cgi?id=429821", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2008-0128", url: "https://www.cve.org/CVERecord?id=CVE-2008-0128", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2008-0128", url: "https://nvd.nist.gov/vuln/detail/CVE-2008-0128", }, ], release_date: "2006-12-20T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-05-20T14:12:00+00:00", details: "This update is available via Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html", product_ids: [ "4AS-RHNSAT5:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNSAT5:java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:java-1.4.2-ibm-devel-0:1.4.2.10-1jpp.2.el4.i386", "4AS-RHNSAT5:jfreechart-0:0.9.20-3.rhn.noarch", "4AS-RHNSAT5:openmotif21-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:openmotif21-debuginfo-0:2.1.30-11.RHEL4.6.i386", "4AS-RHNSAT5:perl-Crypt-CBC-0:2.24-1.el4.noarch", "4AS-RHNSAT5:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modjk-ap13-0:1.2.23-2rhn.rhel4.i386", "4AS-RHNSAT5:rhn-modperl-0:1.29-16.rhel4.i386", "4AS-RHNSAT5:rhn-modssl-0:2.8.12-8.rhn.10.rhel4.i386", "4AS-RHNSAT5:tomcat5-0:5.0.30-0jpp_10rh.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0261", }, ], threats: [ { category: "impact", details: "Low", }, ], title: "tomcat5 SSO cookie login information disclosure", }, ], }
opensuse-su-2024:10623-1
Vulnerability from csaf_opensuse
Published
2024-06-15 00:00
Modified
2024-06-15 00:00
Summary
apache2-2.4.49-1.1 on GA media
Notes
Title of the patch
apache2-2.4.49-1.1 on GA media
Description of the patch
These are all security issues fixed in the apache2-2.4.49-1.1 package on the GA media of openSUSE Tumbleweed.
Patchnames
openSUSE-Tumbleweed-2024-10623
Terms of use
CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
{ document: { aggregate_severity: { namespace: "https://www.suse.com/support/security/rating/", text: "moderate", }, category: "csaf_security_advisory", csaf_version: "2.0", distribution: { text: "Copyright 2024 SUSE LLC. All rights reserved.", tlp: { label: "WHITE", url: "https://www.first.org/tlp/", }, }, lang: "en", notes: [ { category: "summary", text: "apache2-2.4.49-1.1 on GA media", title: "Title of the patch", }, { category: "description", text: "These are all security issues fixed in the apache2-2.4.49-1.1 package on the GA media of openSUSE Tumbleweed.", title: "Description of the patch", }, { category: "details", text: "openSUSE-Tumbleweed-2024-10623", title: "Patchnames", }, { category: "legal_disclaimer", text: "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).", title: "Terms of use", }, ], publisher: { category: "vendor", contact_details: "https://www.suse.com/support/security/contact/", name: "SUSE Product Security Team", namespace: "https://www.suse.com/", }, references: [ { category: "external", summary: "SUSE ratings", url: "https://www.suse.com/support/security/rating/", }, { category: "self", summary: "URL of this CSAF notice", url: "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2024_10623-1.json", }, { category: "self", summary: "SUSE CVE CVE-2005-3352 page", url: "https://www.suse.com/security/cve/CVE-2005-3352/", }, { category: "self", summary: "SUSE CVE CVE-2005-3357 page", url: "https://www.suse.com/security/cve/CVE-2005-3357/", }, { category: "self", summary: "SUSE CVE CVE-2006-3747 page", url: "https://www.suse.com/security/cve/CVE-2006-3747/", }, { category: "self", summary: "SUSE CVE CVE-2006-5752 page", url: "https://www.suse.com/security/cve/CVE-2006-5752/", }, { category: "self", summary: "SUSE CVE CVE-2007-1862 page", url: "https://www.suse.com/security/cve/CVE-2007-1862/", }, { category: "self", summary: "SUSE CVE CVE-2007-1863 page", url: "https://www.suse.com/security/cve/CVE-2007-1863/", }, { category: "self", summary: "SUSE CVE CVE-2007-3304 page", url: "https://www.suse.com/security/cve/CVE-2007-3304/", }, { category: "self", summary: "SUSE CVE CVE-2007-3847 page", url: "https://www.suse.com/security/cve/CVE-2007-3847/", }, { category: "self", summary: "SUSE CVE CVE-2007-4465 page", url: "https://www.suse.com/security/cve/CVE-2007-4465/", }, { category: "self", summary: "SUSE CVE CVE-2007-5000 page", url: "https://www.suse.com/security/cve/CVE-2007-5000/", }, { category: "self", summary: "SUSE CVE CVE-2007-6388 page", url: "https://www.suse.com/security/cve/CVE-2007-6388/", }, { category: "self", summary: "SUSE CVE CVE-2007-6420 page", url: "https://www.suse.com/security/cve/CVE-2007-6420/", }, { category: "self", summary: "SUSE CVE CVE-2007-6421 page", url: "https://www.suse.com/security/cve/CVE-2007-6421/", }, { category: "self", summary: "SUSE CVE CVE-2007-6422 page", url: "https://www.suse.com/security/cve/CVE-2007-6422/", }, { category: "self", summary: "SUSE CVE CVE-2008-0005 page", url: "https://www.suse.com/security/cve/CVE-2008-0005/", }, { category: "self", summary: "SUSE CVE CVE-2008-1678 page", url: "https://www.suse.com/security/cve/CVE-2008-1678/", }, { category: "self", summary: "SUSE CVE CVE-2008-2364 page", url: "https://www.suse.com/security/cve/CVE-2008-2364/", }, { category: "self", summary: "SUSE CVE CVE-2008-2939 page", url: "https://www.suse.com/security/cve/CVE-2008-2939/", }, { category: "self", summary: "SUSE CVE CVE-2016-5387 page", url: "https://www.suse.com/security/cve/CVE-2016-5387/", }, { category: "self", summary: "SUSE CVE CVE-2016-8740 page", url: "https://www.suse.com/security/cve/CVE-2016-8740/", }, { category: "self", summary: "SUSE CVE CVE-2017-9798 page", url: "https://www.suse.com/security/cve/CVE-2017-9798/", }, { category: "self", summary: "SUSE CVE CVE-2019-10081 page", url: "https://www.suse.com/security/cve/CVE-2019-10081/", }, { category: "self", summary: "SUSE CVE CVE-2019-10082 page", url: "https://www.suse.com/security/cve/CVE-2019-10082/", }, { category: "self", summary: "SUSE CVE CVE-2019-10092 page", url: "https://www.suse.com/security/cve/CVE-2019-10092/", }, { category: "self", summary: "SUSE CVE CVE-2019-10097 page", url: "https://www.suse.com/security/cve/CVE-2019-10097/", }, { category: "self", summary: "SUSE CVE CVE-2019-10098 page", url: "https://www.suse.com/security/cve/CVE-2019-10098/", }, { category: "self", summary: "SUSE CVE CVE-2019-9517 page", url: "https://www.suse.com/security/cve/CVE-2019-9517/", }, ], title: "apache2-2.4.49-1.1 on GA media", tracking: { current_release_date: "2024-06-15T00:00:00Z", generator: { date: "2024-06-15T00:00:00Z", engine: { name: "cve-database.git:bin/generate-csaf.pl", version: "1", }, }, id: "openSUSE-SU-2024:10623-1", initial_release_date: "2024-06-15T00:00:00Z", revision_history: [ { date: "2024-06-15T00:00:00Z", number: "1", summary: "Current version", }, ], status: "final", version: "1", }, }, product_tree: { branches: [ { branches: [ { branches: [ { category: "product_version", name: "apache2-2.4.49-1.1.aarch64", product: { name: "apache2-2.4.49-1.1.aarch64", product_id: "apache2-2.4.49-1.1.aarch64", }, }, ], category: "architecture", name: "aarch64", }, { branches: [ { category: "product_version", name: "apache2-2.4.49-1.1.ppc64le", product: { name: "apache2-2.4.49-1.1.ppc64le", product_id: "apache2-2.4.49-1.1.ppc64le", }, }, ], category: "architecture", name: "ppc64le", }, { branches: [ { category: "product_version", name: "apache2-2.4.49-1.1.s390x", product: { name: "apache2-2.4.49-1.1.s390x", product_id: "apache2-2.4.49-1.1.s390x", }, }, ], category: "architecture", name: "s390x", }, { branches: [ { category: "product_version", name: "apache2-2.4.49-1.1.x86_64", product: { name: "apache2-2.4.49-1.1.x86_64", product_id: "apache2-2.4.49-1.1.x86_64", }, }, ], category: "architecture", name: "x86_64", }, { branches: [ { category: "product_name", name: "openSUSE Tumbleweed", product: { name: "openSUSE Tumbleweed", product_id: "openSUSE Tumbleweed", product_identification_helper: { cpe: "cpe:/o:opensuse:tumbleweed", }, }, }, ], category: "product_family", name: "SUSE Linux Enterprise", }, ], category: "vendor", name: "SUSE", }, ], relationships: [ { category: "default_component_of", full_product_name: { name: "apache2-2.4.49-1.1.aarch64 as component of openSUSE Tumbleweed", product_id: "openSUSE Tumbleweed:apache2-2.4.49-1.1.aarch64", }, product_reference: "apache2-2.4.49-1.1.aarch64", relates_to_product_reference: "openSUSE Tumbleweed", }, { category: "default_component_of", full_product_name: { name: "apache2-2.4.49-1.1.ppc64le as component of openSUSE Tumbleweed", product_id: "openSUSE Tumbleweed:apache2-2.4.49-1.1.ppc64le", }, product_reference: "apache2-2.4.49-1.1.ppc64le", relates_to_product_reference: "openSUSE Tumbleweed", }, { category: "default_component_of", full_product_name: { name: "apache2-2.4.49-1.1.s390x as component of openSUSE Tumbleweed", product_id: "openSUSE Tumbleweed:apache2-2.4.49-1.1.s390x", }, product_reference: "apache2-2.4.49-1.1.s390x", relates_to_product_reference: "openSUSE Tumbleweed", }, { category: "default_component_of", full_product_name: { name: "apache2-2.4.49-1.1.x86_64 as component of openSUSE Tumbleweed", product_id: "openSUSE Tumbleweed:apache2-2.4.49-1.1.x86_64", }, product_reference: "apache2-2.4.49-1.1.x86_64", relates_to_product_reference: "openSUSE Tumbleweed", }, ], }, vulnerabilities: [ { cve: "CVE-2005-3352", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2005-3352", }, ], notes: [ { category: "general", text: "Cross-site scripting (XSS) vulnerability in the mod_imap module of Apache httpd before 1.3.35-dev and Apache httpd 2.0.x before 2.0.56-dev allows remote attackers to inject arbitrary web script or HTML via the Referer when using image maps.", title: "CVE description", }, ], product_status: { recommended: [ "openSUSE Tumbleweed:apache2-2.4.49-1.1.aarch64", "openSUSE Tumbleweed:apache2-2.4.49-1.1.ppc64le", "openSUSE Tumbleweed:apache2-2.4.49-1.1.s390x", "openSUSE Tumbleweed:apache2-2.4.49-1.1.x86_64", ], }, references: [ { category: "external", summary: "CVE-2005-3352", url: "https://www.suse.com/security/cve/CVE-2005-3352", }, { category: "external", summary: "SUSE Bug 138083 for CVE-2005-3352", url: "https://bugzilla.suse.com/138083", }, { category: "external", summary: "SUSE Bug 142507 for CVE-2005-3352", url: "https://bugzilla.suse.com/142507", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "openSUSE Tumbleweed:apache2-2.4.49-1.1.aarch64", "openSUSE Tumbleweed:apache2-2.4.49-1.1.ppc64le", "openSUSE Tumbleweed:apache2-2.4.49-1.1.s390x", "openSUSE Tumbleweed:apache2-2.4.49-1.1.x86_64", ], }, ], threats: [ { category: "impact", date: "2024-06-15T00:00:00Z", details: "moderate", }, ], title: "CVE-2005-3352", }, { cve: "CVE-2005-3357", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2005-3357", }, ], notes: [ { category: "general", text: "mod_ssl in Apache 2.0 up to 2.0.55, when configured with an SSL vhost with access control and a custom error 400 error page, allows remote attackers to cause a denial of service (application crash) via a non-SSL request to an SSL port, which triggers a NULL pointer dereference.", title: "CVE description", }, ], product_status: { recommended: [ "openSUSE Tumbleweed:apache2-2.4.49-1.1.aarch64", "openSUSE Tumbleweed:apache2-2.4.49-1.1.ppc64le", "openSUSE Tumbleweed:apache2-2.4.49-1.1.s390x", "openSUSE Tumbleweed:apache2-2.4.49-1.1.x86_64", ], }, references: [ { category: "external", summary: "CVE-2005-3357", url: "https://www.suse.com/security/cve/CVE-2005-3357", }, { category: "external", summary: "SUSE Bug 138083 for CVE-2005-3357", url: "https://bugzilla.suse.com/138083", }, { category: "external", summary: "SUSE Bug 142338 for CVE-2005-3357", url: "https://bugzilla.suse.com/142338", }, { category: "external", summary: "SUSE Bug 186167 for CVE-2005-3357", url: "https://bugzilla.suse.com/186167", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "openSUSE Tumbleweed:apache2-2.4.49-1.1.aarch64", "openSUSE Tumbleweed:apache2-2.4.49-1.1.ppc64le", "openSUSE Tumbleweed:apache2-2.4.49-1.1.s390x", "openSUSE Tumbleweed:apache2-2.4.49-1.1.x86_64", ], }, ], threats: [ { category: "impact", date: "2024-06-15T00:00:00Z", details: "moderate", }, ], title: "CVE-2005-3357", }, { cve: "CVE-2006-3747", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2006-3747", }, ], notes: [ { category: "general", text: "Off-by-one error in the ldap scheme handling in the Rewrite module (mod_rewrite) in Apache 1.3 from 1.3.28, 2.0.46 and other versions before 2.0.59, and 2.2, when RewriteEngine is enabled, allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via crafted URLs that are not properly handled using certain rewrite rules.", title: "CVE description", }, ], product_status: { recommended: [ "openSUSE Tumbleweed:apache2-2.4.49-1.1.aarch64", "openSUSE Tumbleweed:apache2-2.4.49-1.1.ppc64le", "openSUSE Tumbleweed:apache2-2.4.49-1.1.s390x", "openSUSE Tumbleweed:apache2-2.4.49-1.1.x86_64", ], }, references: [ { category: "external", summary: "CVE-2006-3747", url: "https://www.suse.com/security/cve/CVE-2006-3747", }, { category: "external", summary: "SUSE Bug 194675 for CVE-2006-3747", url: "https://bugzilla.suse.com/194675", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "openSUSE Tumbleweed:apache2-2.4.49-1.1.aarch64", "openSUSE Tumbleweed:apache2-2.4.49-1.1.ppc64le", "openSUSE Tumbleweed:apache2-2.4.49-1.1.s390x", "openSUSE Tumbleweed:apache2-2.4.49-1.1.x86_64", ], }, ], threats: [ { category: "impact", date: "2024-06-15T00:00:00Z", details: "important", }, ], title: "CVE-2006-3747", }, { cve: "CVE-2006-5752", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2006-5752", }, ], notes: [ { category: "general", text: "Cross-site scripting (XSS) vulnerability in mod_status.c in the mod_status module in Apache HTTP Server (httpd), when ExtendedStatus is enabled and a public server-status page is used, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors involving charsets with browsers that perform \"charset detection\" when the content-type is not specified.", title: "CVE description", }, ], product_status: { recommended: [ "openSUSE Tumbleweed:apache2-2.4.49-1.1.aarch64", "openSUSE Tumbleweed:apache2-2.4.49-1.1.ppc64le", "openSUSE Tumbleweed:apache2-2.4.49-1.1.s390x", "openSUSE Tumbleweed:apache2-2.4.49-1.1.x86_64", ], }, references: [ { category: "external", summary: "CVE-2006-5752", url: "https://www.suse.com/security/cve/CVE-2006-5752", }, { category: "external", summary: "SUSE Bug 289996 for CVE-2006-5752", url: "https://bugzilla.suse.com/289996", }, { category: "external", summary: "SUSE Bug 308637 for CVE-2006-5752", url: "https://bugzilla.suse.com/308637", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "openSUSE Tumbleweed:apache2-2.4.49-1.1.aarch64", "openSUSE Tumbleweed:apache2-2.4.49-1.1.ppc64le", "openSUSE Tumbleweed:apache2-2.4.49-1.1.s390x", "openSUSE Tumbleweed:apache2-2.4.49-1.1.x86_64", ], }, ], threats: [ { category: "impact", date: "2024-06-15T00:00:00Z", details: "moderate", }, ], title: "CVE-2006-5752", }, { cve: "CVE-2007-1862", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2007-1862", }, ], notes: [ { category: "general", text: "The recall_headers function in mod_mem_cache in Apache 2.2.4 does not properly copy all levels of header data, which can cause Apache to return HTTP headers containing previously used data, which could be used by remote attackers to obtain potentially sensitive information.", title: "CVE description", }, ], product_status: { recommended: [ "openSUSE Tumbleweed:apache2-2.4.49-1.1.aarch64", "openSUSE Tumbleweed:apache2-2.4.49-1.1.ppc64le", "openSUSE Tumbleweed:apache2-2.4.49-1.1.s390x", "openSUSE Tumbleweed:apache2-2.4.49-1.1.x86_64", ], }, references: [ { category: "external", summary: "CVE-2007-1862", url: "https://www.suse.com/security/cve/CVE-2007-1862", }, { category: "external", summary: "SUSE Bug 280414 for CVE-2007-1862", url: "https://bugzilla.suse.com/280414", }, { category: "external", summary: "SUSE Bug 308637 for CVE-2007-1862", url: "https://bugzilla.suse.com/308637", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "openSUSE Tumbleweed:apache2-2.4.49-1.1.aarch64", "openSUSE Tumbleweed:apache2-2.4.49-1.1.ppc64le", "openSUSE Tumbleweed:apache2-2.4.49-1.1.s390x", "openSUSE Tumbleweed:apache2-2.4.49-1.1.x86_64", ], }, ], threats: [ { category: "impact", date: "2024-06-15T00:00:00Z", details: "moderate", }, ], title: "CVE-2007-1862", }, { cve: "CVE-2007-1863", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2007-1863", }, ], notes: [ { category: "general", text: "cache_util.c in the mod_cache module in Apache HTTP Server (httpd), when caching is enabled and a threaded Multi-Processing Module (MPM) is used, allows remote attackers to cause a denial of service (child processing handler crash) via a request with the (1) s-maxage, (2) max-age, (3) min-fresh, or (4) max-stale Cache-Control headers without a value.", title: "CVE description", }, ], product_status: { recommended: [ "openSUSE Tumbleweed:apache2-2.4.49-1.1.aarch64", "openSUSE Tumbleweed:apache2-2.4.49-1.1.ppc64le", "openSUSE Tumbleweed:apache2-2.4.49-1.1.s390x", "openSUSE Tumbleweed:apache2-2.4.49-1.1.x86_64", ], }, references: [ { category: "external", summary: "CVE-2007-1863", url: "https://www.suse.com/security/cve/CVE-2007-1863", }, { category: "external", summary: "SUSE Bug 289997 for CVE-2007-1863", url: "https://bugzilla.suse.com/289997", }, { category: "external", summary: "SUSE Bug 308637 for CVE-2007-1863", url: "https://bugzilla.suse.com/308637", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "openSUSE Tumbleweed:apache2-2.4.49-1.1.aarch64", "openSUSE Tumbleweed:apache2-2.4.49-1.1.ppc64le", "openSUSE Tumbleweed:apache2-2.4.49-1.1.s390x", "openSUSE Tumbleweed:apache2-2.4.49-1.1.x86_64", ], }, ], threats: [ { category: "impact", date: "2024-06-15T00:00:00Z", details: "moderate", }, ], title: "CVE-2007-1863", }, { cve: "CVE-2007-3304", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2007-3304", }, ], notes: [ { category: "general", text: "Apache httpd 1.3.37, 2.0.59, and 2.2.4 with the Prefork MPM module, allows local users to cause a denial of service by modifying the worker_score and process_score arrays to reference an arbitrary process ID, which is sent a SIGUSR1 signal from the master process, aka \"SIGUSR1 killer.\"", title: "CVE description", }, ], product_status: { recommended: [ "openSUSE Tumbleweed:apache2-2.4.49-1.1.aarch64", "openSUSE Tumbleweed:apache2-2.4.49-1.1.ppc64le", "openSUSE Tumbleweed:apache2-2.4.49-1.1.s390x", "openSUSE Tumbleweed:apache2-2.4.49-1.1.x86_64", ], }, references: [ { category: "external", summary: "CVE-2007-3304", url: "https://www.suse.com/security/cve/CVE-2007-3304", }, { category: "external", summary: "SUSE Bug 286685 for CVE-2007-3304", url: "https://bugzilla.suse.com/286685", }, { category: "external", summary: "SUSE Bug 308637 for CVE-2007-3304", url: "https://bugzilla.suse.com/308637", }, { category: "external", summary: "SUSE Bug 422464 for CVE-2007-3304", url: "https://bugzilla.suse.com/422464", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "openSUSE Tumbleweed:apache2-2.4.49-1.1.aarch64", "openSUSE Tumbleweed:apache2-2.4.49-1.1.ppc64le", "openSUSE Tumbleweed:apache2-2.4.49-1.1.s390x", "openSUSE Tumbleweed:apache2-2.4.49-1.1.x86_64", ], }, ], threats: [ { category: "impact", date: "2024-06-15T00:00:00Z", details: "moderate", }, ], title: "CVE-2007-3304", }, { cve: "CVE-2007-3847", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2007-3847", }, ], notes: [ { category: "general", text: "The date handling code in modules/proxy/proxy_util.c (mod_proxy) in Apache 2.3.0, when using a threaded MPM, allows remote origin servers to cause a denial of service (caching forward proxy process crash) via crafted date headers that trigger a buffer over-read.", title: "CVE description", }, ], product_status: { recommended: [ "openSUSE Tumbleweed:apache2-2.4.49-1.1.aarch64", "openSUSE Tumbleweed:apache2-2.4.49-1.1.ppc64le", "openSUSE Tumbleweed:apache2-2.4.49-1.1.s390x", "openSUSE Tumbleweed:apache2-2.4.49-1.1.x86_64", ], }, references: [ { category: "external", summary: "CVE-2007-3847", url: "https://www.suse.com/security/cve/CVE-2007-3847", }, { category: "external", summary: "SUSE Bug 308637 for CVE-2007-3847", url: "https://bugzilla.suse.com/308637", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "openSUSE Tumbleweed:apache2-2.4.49-1.1.aarch64", "openSUSE Tumbleweed:apache2-2.4.49-1.1.ppc64le", "openSUSE Tumbleweed:apache2-2.4.49-1.1.s390x", "openSUSE Tumbleweed:apache2-2.4.49-1.1.x86_64", ], }, ], threats: [ { category: "impact", date: "2024-06-15T00:00:00Z", details: "moderate", }, ], title: "CVE-2007-3847", }, { cve: "CVE-2007-4465", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2007-4465", }, ], notes: [ { category: "general", text: "Cross-site scripting (XSS) vulnerability in mod_autoindex.c in the Apache HTTP Server before 2.2.6, when the charset on a server-generated page is not defined, allows remote attackers to inject arbitrary web script or HTML via the P parameter using the UTF-7 charset. NOTE: it could be argued that this issue is due to a design limitation of browsers that attempt to perform automatic content type detection.", title: "CVE description", }, ], product_status: { recommended: [ "openSUSE Tumbleweed:apache2-2.4.49-1.1.aarch64", "openSUSE Tumbleweed:apache2-2.4.49-1.1.ppc64le", "openSUSE Tumbleweed:apache2-2.4.49-1.1.s390x", "openSUSE Tumbleweed:apache2-2.4.49-1.1.x86_64", ], }, references: [ { category: "external", summary: "CVE-2007-4465", url: "https://www.suse.com/security/cve/CVE-2007-4465", }, { category: "external", summary: "SUSE Bug 308637 for CVE-2007-4465", url: "https://bugzilla.suse.com/308637", }, { category: "external", summary: "SUSE Bug 310161 for CVE-2007-4465", url: "https://bugzilla.suse.com/310161", }, { category: "external", summary: "SUSE Bug 325655 for CVE-2007-4465", url: "https://bugzilla.suse.com/325655", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "openSUSE Tumbleweed:apache2-2.4.49-1.1.aarch64", "openSUSE Tumbleweed:apache2-2.4.49-1.1.ppc64le", "openSUSE Tumbleweed:apache2-2.4.49-1.1.s390x", "openSUSE Tumbleweed:apache2-2.4.49-1.1.x86_64", ], }, ], threats: [ { category: "impact", date: "2024-06-15T00:00:00Z", details: "moderate", }, ], title: "CVE-2007-4465", }, { cve: "CVE-2007-5000", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2007-5000", }, ], notes: [ { category: "general", text: "Cross-site scripting (XSS) vulnerability in the (1) mod_imap module in the Apache HTTP Server 1.3.0 through 1.3.39 and 2.0.35 through 2.0.61 and the (2) mod_imagemap module in the Apache HTTP Server 2.2.0 through 2.2.6 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.", title: "CVE description", }, ], product_status: { recommended: [ "openSUSE Tumbleweed:apache2-2.4.49-1.1.aarch64", "openSUSE Tumbleweed:apache2-2.4.49-1.1.ppc64le", "openSUSE Tumbleweed:apache2-2.4.49-1.1.s390x", "openSUSE Tumbleweed:apache2-2.4.49-1.1.x86_64", ], }, references: [ { category: "external", summary: "CVE-2007-5000", url: "https://www.suse.com/security/cve/CVE-2007-5000", }, { category: "external", summary: "SUSE Bug 353859 for CVE-2007-5000", url: "https://bugzilla.suse.com/353859", }, { category: "external", summary: "SUSE Bug 355888 for CVE-2007-5000", url: "https://bugzilla.suse.com/355888", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "openSUSE Tumbleweed:apache2-2.4.49-1.1.aarch64", "openSUSE Tumbleweed:apache2-2.4.49-1.1.ppc64le", "openSUSE Tumbleweed:apache2-2.4.49-1.1.s390x", "openSUSE Tumbleweed:apache2-2.4.49-1.1.x86_64", ], }, ], threats: [ { category: "impact", date: "2024-06-15T00:00:00Z", details: "moderate", }, ], title: "CVE-2007-5000", }, { cve: "CVE-2007-6388", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2007-6388", }, ], notes: [ { category: "general", text: "Cross-site scripting (XSS) vulnerability in mod_status in the Apache HTTP Server 2.2.0 through 2.2.6, 2.0.35 through 2.0.61, and 1.3.2 through 1.3.39, when the server-status page is enabled, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.", title: "CVE description", }, ], product_status: { recommended: [ "openSUSE Tumbleweed:apache2-2.4.49-1.1.aarch64", "openSUSE Tumbleweed:apache2-2.4.49-1.1.ppc64le", "openSUSE Tumbleweed:apache2-2.4.49-1.1.s390x", "openSUSE Tumbleweed:apache2-2.4.49-1.1.x86_64", ], }, references: [ { category: "external", summary: "CVE-2007-6388", url: "https://www.suse.com/security/cve/CVE-2007-6388", }, { category: "external", summary: "SUSE Bug 352235 for CVE-2007-6388", url: "https://bugzilla.suse.com/352235", }, { category: "external", summary: "SUSE Bug 355888 for CVE-2007-6388", url: "https://bugzilla.suse.com/355888", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "openSUSE Tumbleweed:apache2-2.4.49-1.1.aarch64", "openSUSE Tumbleweed:apache2-2.4.49-1.1.ppc64le", "openSUSE Tumbleweed:apache2-2.4.49-1.1.s390x", "openSUSE Tumbleweed:apache2-2.4.49-1.1.x86_64", ], }, ], threats: [ { category: "impact", date: "2024-06-15T00:00:00Z", details: "moderate", }, ], title: "CVE-2007-6388", }, { cve: "CVE-2007-6420", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2007-6420", }, ], notes: [ { category: "general", text: "Cross-site request forgery (CSRF) vulnerability in the balancer-manager in mod_proxy_balancer for Apache HTTP Server 2.2.x allows remote attackers to gain privileges via unspecified vectors.", title: "CVE description", }, ], product_status: { recommended: [ "openSUSE Tumbleweed:apache2-2.4.49-1.1.aarch64", "openSUSE Tumbleweed:apache2-2.4.49-1.1.ppc64le", "openSUSE Tumbleweed:apache2-2.4.49-1.1.s390x", "openSUSE Tumbleweed:apache2-2.4.49-1.1.x86_64", ], }, references: [ { category: "external", summary: "CVE-2007-6420", url: "https://www.suse.com/security/cve/CVE-2007-6420", }, { category: "external", summary: "SUSE Bug 353261 for CVE-2007-6420", url: "https://bugzilla.suse.com/353261", }, { category: "external", summary: "SUSE Bug 373903 for CVE-2007-6420", url: "https://bugzilla.suse.com/373903", }, { category: "external", summary: "SUSE Bug 422464 for CVE-2007-6420", url: "https://bugzilla.suse.com/422464", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "openSUSE Tumbleweed:apache2-2.4.49-1.1.aarch64", "openSUSE Tumbleweed:apache2-2.4.49-1.1.ppc64le", "openSUSE Tumbleweed:apache2-2.4.49-1.1.s390x", "openSUSE Tumbleweed:apache2-2.4.49-1.1.x86_64", ], }, ], threats: [ { category: "impact", date: "2024-06-15T00:00:00Z", details: "moderate", }, ], title: "CVE-2007-6420", }, { cve: "CVE-2007-6421", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2007-6421", }, ], notes: [ { category: "general", text: "Cross-site scripting (XSS) vulnerability in balancer-manager in mod_proxy_balancer in the Apache HTTP Server 2.2.0 through 2.2.6 allows remote attackers to inject arbitrary web script or HTML via the (1) ss, (2) wr, or (3) rr parameters, or (4) the URL.", title: "CVE description", }, ], product_status: { recommended: [ "openSUSE Tumbleweed:apache2-2.4.49-1.1.aarch64", "openSUSE Tumbleweed:apache2-2.4.49-1.1.ppc64le", "openSUSE Tumbleweed:apache2-2.4.49-1.1.s390x", "openSUSE Tumbleweed:apache2-2.4.49-1.1.x86_64", ], }, references: [ { category: "external", summary: "CVE-2007-6421", url: "https://www.suse.com/security/cve/CVE-2007-6421", }, { category: "external", summary: "SUSE Bug 353261 for CVE-2007-6421", url: "https://bugzilla.suse.com/353261", }, { category: "external", summary: "SUSE Bug 355888 for CVE-2007-6421", url: "https://bugzilla.suse.com/355888", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "openSUSE Tumbleweed:apache2-2.4.49-1.1.aarch64", "openSUSE Tumbleweed:apache2-2.4.49-1.1.ppc64le", "openSUSE Tumbleweed:apache2-2.4.49-1.1.s390x", "openSUSE Tumbleweed:apache2-2.4.49-1.1.x86_64", ], }, ], threats: [ { category: "impact", date: "2024-06-15T00:00:00Z", details: "low", }, ], title: "CVE-2007-6421", }, { cve: "CVE-2007-6422", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2007-6422", }, ], notes: [ { category: "general", text: "The balancer_handler function in mod_proxy_balancer in the Apache HTTP Server 2.2.0 through 2.2.6, when a threaded Multi-Processing Module is used, allows remote authenticated users to cause a denial of service (child process crash) via an invalid bb variable.", title: "CVE description", }, ], product_status: { recommended: [ "openSUSE Tumbleweed:apache2-2.4.49-1.1.aarch64", "openSUSE Tumbleweed:apache2-2.4.49-1.1.ppc64le", "openSUSE Tumbleweed:apache2-2.4.49-1.1.s390x", "openSUSE Tumbleweed:apache2-2.4.49-1.1.x86_64", ], }, references: [ { category: "external", summary: "CVE-2007-6422", url: "https://www.suse.com/security/cve/CVE-2007-6422", }, { category: "external", summary: "SUSE Bug 353261 for CVE-2007-6422", url: "https://bugzilla.suse.com/353261", }, { category: "external", summary: "SUSE Bug 355888 for CVE-2007-6422", url: "https://bugzilla.suse.com/355888", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "openSUSE Tumbleweed:apache2-2.4.49-1.1.aarch64", "openSUSE Tumbleweed:apache2-2.4.49-1.1.ppc64le", "openSUSE Tumbleweed:apache2-2.4.49-1.1.s390x", "openSUSE Tumbleweed:apache2-2.4.49-1.1.x86_64", ], }, ], threats: [ { category: "impact", date: "2024-06-15T00:00:00Z", details: "low", }, ], title: "CVE-2007-6422", }, { cve: "CVE-2008-0005", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2008-0005", }, ], notes: [ { category: "general", text: "mod_proxy_ftp in Apache 2.2.x before 2.2.7-dev, 2.0.x before 2.0.62-dev, and 1.3.x before 1.3.40-dev does not define a charset, which allows remote attackers to conduct cross-site scripting (XSS) attacks using UTF-7 encoding.", title: "CVE description", }, ], product_status: { recommended: [ "openSUSE Tumbleweed:apache2-2.4.49-1.1.aarch64", "openSUSE Tumbleweed:apache2-2.4.49-1.1.ppc64le", "openSUSE Tumbleweed:apache2-2.4.49-1.1.s390x", "openSUSE Tumbleweed:apache2-2.4.49-1.1.x86_64", ], }, references: [ { category: "external", summary: "CVE-2008-0005", url: "https://www.suse.com/security/cve/CVE-2008-0005", }, { category: "external", summary: "SUSE Bug 353262 for CVE-2008-0005", url: "https://bugzilla.suse.com/353262", }, { category: "external", summary: "SUSE Bug 355888 for CVE-2008-0005", url: "https://bugzilla.suse.com/355888", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "openSUSE Tumbleweed:apache2-2.4.49-1.1.aarch64", "openSUSE Tumbleweed:apache2-2.4.49-1.1.ppc64le", "openSUSE Tumbleweed:apache2-2.4.49-1.1.s390x", "openSUSE Tumbleweed:apache2-2.4.49-1.1.x86_64", ], }, ], threats: [ { category: "impact", date: "2024-06-15T00:00:00Z", details: "moderate", }, ], title: "CVE-2008-0005", }, { cve: "CVE-2008-1678", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2008-1678", }, ], notes: [ { category: "general", text: "Memory leak in the zlib_stateful_init function in crypto/comp/c_zlib.c in libssl in OpenSSL 0.9.8f through 0.9.8h allows remote attackers to cause a denial of service (memory consumption) via multiple calls, as demonstrated by initial SSL client handshakes to the Apache HTTP Server mod_ssl that specify a compression algorithm.", title: "CVE description", }, ], product_status: { recommended: [ "openSUSE Tumbleweed:apache2-2.4.49-1.1.aarch64", "openSUSE Tumbleweed:apache2-2.4.49-1.1.ppc64le", "openSUSE Tumbleweed:apache2-2.4.49-1.1.s390x", "openSUSE Tumbleweed:apache2-2.4.49-1.1.x86_64", ], }, references: [ { category: "external", summary: "CVE-2008-1678", url: "https://www.suse.com/security/cve/CVE-2008-1678", }, { category: "external", summary: "SUSE Bug 392096 for CVE-2008-1678", url: "https://bugzilla.suse.com/392096", }, { category: "external", summary: "SUSE Bug 422464 for CVE-2008-1678", url: "https://bugzilla.suse.com/422464", }, { category: "external", summary: "SUSE Bug 566238 for CVE-2008-1678", url: "https://bugzilla.suse.com/566238", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "openSUSE Tumbleweed:apache2-2.4.49-1.1.aarch64", "openSUSE Tumbleweed:apache2-2.4.49-1.1.ppc64le", "openSUSE Tumbleweed:apache2-2.4.49-1.1.s390x", "openSUSE Tumbleweed:apache2-2.4.49-1.1.x86_64", ], }, ], threats: [ { category: "impact", date: "2024-06-15T00:00:00Z", details: "moderate", }, ], title: "CVE-2008-1678", }, { cve: "CVE-2008-2364", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2008-2364", }, ], notes: [ { category: "general", text: "The ap_proxy_http_process_response function in mod_proxy_http.c in the mod_proxy module in the Apache HTTP Server 2.0.63 and 2.2.8 does not limit the number of forwarded interim responses, which allows remote HTTP servers to cause a denial of service (memory consumption) via a large number of interim responses.", title: "CVE description", }, ], product_status: { recommended: [ "openSUSE Tumbleweed:apache2-2.4.49-1.1.aarch64", "openSUSE Tumbleweed:apache2-2.4.49-1.1.ppc64le", "openSUSE Tumbleweed:apache2-2.4.49-1.1.s390x", "openSUSE Tumbleweed:apache2-2.4.49-1.1.x86_64", ], }, references: [ { category: "external", summary: "CVE-2008-2364", url: "https://www.suse.com/security/cve/CVE-2008-2364", }, { category: "external", summary: "SUSE Bug 408832 for CVE-2008-2364", url: "https://bugzilla.suse.com/408832", }, { category: "external", summary: "SUSE Bug 422464 for CVE-2008-2364", url: "https://bugzilla.suse.com/422464", }, { category: "external", summary: "SUSE Bug 443824 for CVE-2008-2364", url: "https://bugzilla.suse.com/443824", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "openSUSE Tumbleweed:apache2-2.4.49-1.1.aarch64", "openSUSE Tumbleweed:apache2-2.4.49-1.1.ppc64le", "openSUSE Tumbleweed:apache2-2.4.49-1.1.s390x", "openSUSE Tumbleweed:apache2-2.4.49-1.1.x86_64", ], }, ], threats: [ { category: "impact", date: "2024-06-15T00:00:00Z", details: "moderate", }, ], title: "CVE-2008-2364", }, { cve: "CVE-2008-2939", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2008-2939", }, ], notes: [ { category: "general", text: "Cross-site scripting (XSS) vulnerability in proxy_ftp.c in the mod_proxy_ftp module in Apache 2.0.63 and earlier, and mod_proxy_ftp.c in the mod_proxy_ftp module in Apache 2.2.9 and earlier 2.2 versions, allows remote attackers to inject arbitrary web script or HTML via a wildcard in the last directory component in the pathname in an FTP URI.", title: "CVE description", }, ], product_status: { recommended: [ "openSUSE Tumbleweed:apache2-2.4.49-1.1.aarch64", "openSUSE Tumbleweed:apache2-2.4.49-1.1.ppc64le", "openSUSE Tumbleweed:apache2-2.4.49-1.1.s390x", "openSUSE Tumbleweed:apache2-2.4.49-1.1.x86_64", ], }, references: [ { category: "external", summary: "CVE-2008-2939", url: "https://www.suse.com/security/cve/CVE-2008-2939", }, { category: "external", summary: "SUSE Bug 210904 for CVE-2008-2939", url: "https://bugzilla.suse.com/210904", }, { category: "external", summary: "SUSE Bug 415061 for CVE-2008-2939", url: "https://bugzilla.suse.com/415061", }, { category: "external", summary: "SUSE Bug 422464 for CVE-2008-2939", url: "https://bugzilla.suse.com/422464", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "openSUSE Tumbleweed:apache2-2.4.49-1.1.aarch64", "openSUSE Tumbleweed:apache2-2.4.49-1.1.ppc64le", "openSUSE Tumbleweed:apache2-2.4.49-1.1.s390x", "openSUSE Tumbleweed:apache2-2.4.49-1.1.x86_64", ], }, ], threats: [ { category: "impact", date: "2024-06-15T00:00:00Z", details: "moderate", }, ], title: "CVE-2008-2939", }, { cve: "CVE-2016-5387", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2016-5387", }, ], notes: [ { category: "general", text: "The Apache HTTP Server through 2.4.23 follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an \"httpoxy\" issue. NOTE: the vendor states \"This mitigation has been assigned the identifier CVE-2016-5387\"; in other words, this is not a CVE ID for a vulnerability.", title: "CVE description", }, ], product_status: { recommended: [ "openSUSE Tumbleweed:apache2-2.4.49-1.1.aarch64", "openSUSE Tumbleweed:apache2-2.4.49-1.1.ppc64le", "openSUSE Tumbleweed:apache2-2.4.49-1.1.s390x", "openSUSE Tumbleweed:apache2-2.4.49-1.1.x86_64", ], }, references: [ { category: "external", summary: "CVE-2016-5387", url: "https://www.suse.com/security/cve/CVE-2016-5387", }, { category: "external", summary: "SUSE Bug 988484 for CVE-2016-5387", url: "https://bugzilla.suse.com/988484", }, { category: "external", summary: "SUSE Bug 988486 for CVE-2016-5387", url: "https://bugzilla.suse.com/988486", }, { category: "external", summary: "SUSE Bug 988487 for CVE-2016-5387", url: "https://bugzilla.suse.com/988487", }, { category: "external", summary: "SUSE Bug 988488 for CVE-2016-5387", url: "https://bugzilla.suse.com/988488", }, { category: "external", summary: "SUSE Bug 988489 for CVE-2016-5387", url: "https://bugzilla.suse.com/988489", }, { category: "external", summary: "SUSE Bug 988491 for CVE-2016-5387", url: "https://bugzilla.suse.com/988491", }, { category: "external", summary: "SUSE Bug 988492 for CVE-2016-5387", url: "https://bugzilla.suse.com/988492", }, { category: "external", summary: "SUSE Bug 989125 for CVE-2016-5387", url: "https://bugzilla.suse.com/989125", }, { category: "external", summary: "SUSE Bug 989174 for CVE-2016-5387", url: "https://bugzilla.suse.com/989174", }, { category: "external", summary: "SUSE Bug 989684 for CVE-2016-5387", url: "https://bugzilla.suse.com/989684", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "openSUSE Tumbleweed:apache2-2.4.49-1.1.aarch64", "openSUSE Tumbleweed:apache2-2.4.49-1.1.ppc64le", "openSUSE Tumbleweed:apache2-2.4.49-1.1.s390x", "openSUSE Tumbleweed:apache2-2.4.49-1.1.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 8.1, baseSeverity: "HIGH", vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "openSUSE Tumbleweed:apache2-2.4.49-1.1.aarch64", "openSUSE Tumbleweed:apache2-2.4.49-1.1.ppc64le", "openSUSE Tumbleweed:apache2-2.4.49-1.1.s390x", "openSUSE Tumbleweed:apache2-2.4.49-1.1.x86_64", ], }, ], threats: [ { category: "impact", date: "2024-06-15T00:00:00Z", details: "moderate", }, ], title: "CVE-2016-5387", }, { cve: "CVE-2016-8740", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2016-8740", }, ], notes: [ { category: "general", text: "The mod_http2 module in the Apache HTTP Server 2.4.17 through 2.4.23, when the Protocols configuration includes h2 or h2c, does not restrict request-header length, which allows remote attackers to cause a denial of service (memory consumption) via crafted CONTINUATION frames in an HTTP/2 request.", title: "CVE description", }, ], product_status: { recommended: [ "openSUSE Tumbleweed:apache2-2.4.49-1.1.aarch64", "openSUSE Tumbleweed:apache2-2.4.49-1.1.ppc64le", "openSUSE Tumbleweed:apache2-2.4.49-1.1.s390x", "openSUSE Tumbleweed:apache2-2.4.49-1.1.x86_64", ], }, references: [ { category: "external", summary: "CVE-2016-8740", url: "https://www.suse.com/security/cve/CVE-2016-8740", }, { category: "external", summary: "SUSE Bug 1013648 for CVE-2016-8740", url: "https://bugzilla.suse.com/1013648", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "openSUSE Tumbleweed:apache2-2.4.49-1.1.aarch64", "openSUSE Tumbleweed:apache2-2.4.49-1.1.ppc64le", "openSUSE Tumbleweed:apache2-2.4.49-1.1.s390x", "openSUSE Tumbleweed:apache2-2.4.49-1.1.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 7.5, baseSeverity: "HIGH", vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", version: "3.0", }, products: [ "openSUSE Tumbleweed:apache2-2.4.49-1.1.aarch64", "openSUSE Tumbleweed:apache2-2.4.49-1.1.ppc64le", "openSUSE Tumbleweed:apache2-2.4.49-1.1.s390x", "openSUSE Tumbleweed:apache2-2.4.49-1.1.x86_64", ], }, ], threats: [ { category: "impact", date: "2024-06-15T00:00:00Z", details: "moderate", }, ], title: "CVE-2016-8740", }, { cve: "CVE-2017-9798", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2017-9798", }, ], notes: [ { category: "general", text: "Apache httpd allows remote attackers to read secret data from process memory if the Limit directive can be set in a user's .htaccess file, or if httpd.conf has certain misconfigurations, aka Optionsbleed. This affects the Apache HTTP Server through 2.2.34 and 2.4.x through 2.4.27. The attacker sends an unauthenticated OPTIONS HTTP request when attempting to read secret data. This is a use-after-free issue and thus secret data is not always sent, and the specific data depends on many factors including configuration. Exploitation with .htaccess can be blocked with a patch to the ap_limit_section function in server/core.c.", title: "CVE description", }, ], product_status: { recommended: [ "openSUSE Tumbleweed:apache2-2.4.49-1.1.aarch64", "openSUSE Tumbleweed:apache2-2.4.49-1.1.ppc64le", "openSUSE Tumbleweed:apache2-2.4.49-1.1.s390x", "openSUSE Tumbleweed:apache2-2.4.49-1.1.x86_64", ], }, references: [ { category: "external", summary: "CVE-2017-9798", url: "https://www.suse.com/security/cve/CVE-2017-9798", }, { category: "external", summary: "SUSE Bug 1058058 for CVE-2017-9798", url: "https://bugzilla.suse.com/1058058", }, { category: "external", summary: "SUSE Bug 1060757 for CVE-2017-9798", url: "https://bugzilla.suse.com/1060757", }, { category: "external", summary: "SUSE Bug 1077582 for CVE-2017-9798", url: "https://bugzilla.suse.com/1077582", }, { category: "external", summary: "SUSE Bug 1078450 for CVE-2017-9798", url: "https://bugzilla.suse.com/1078450", }, { category: "external", summary: "SUSE Bug 1089997 for CVE-2017-9798", url: "https://bugzilla.suse.com/1089997", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "openSUSE Tumbleweed:apache2-2.4.49-1.1.aarch64", "openSUSE Tumbleweed:apache2-2.4.49-1.1.ppc64le", "openSUSE Tumbleweed:apache2-2.4.49-1.1.s390x", "openSUSE Tumbleweed:apache2-2.4.49-1.1.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 5.9, baseSeverity: "MEDIUM", vectorString: "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", version: "3.0", }, products: [ "openSUSE Tumbleweed:apache2-2.4.49-1.1.aarch64", "openSUSE Tumbleweed:apache2-2.4.49-1.1.ppc64le", "openSUSE Tumbleweed:apache2-2.4.49-1.1.s390x", "openSUSE Tumbleweed:apache2-2.4.49-1.1.x86_64", ], }, ], threats: [ { category: "impact", date: "2024-06-15T00:00:00Z", details: "moderate", }, ], title: "CVE-2017-9798", }, { cve: "CVE-2019-10081", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2019-10081", }, ], notes: [ { category: "general", text: "HTTP/2 (2.4.20 through 2.4.39) very early pushes, for example configured with \"H2PushResource\", could lead to an overwrite of memory in the pushing request's pool, leading to crashes. The memory copied is that of the configured push link header values, not data supplied by the client.", title: "CVE description", }, ], product_status: { recommended: [ "openSUSE Tumbleweed:apache2-2.4.49-1.1.aarch64", "openSUSE Tumbleweed:apache2-2.4.49-1.1.ppc64le", "openSUSE Tumbleweed:apache2-2.4.49-1.1.s390x", "openSUSE Tumbleweed:apache2-2.4.49-1.1.x86_64", ], }, references: [ { category: "external", summary: "CVE-2019-10081", url: "https://www.suse.com/security/cve/CVE-2019-10081", }, { category: "external", summary: "SUSE Bug 1145742 for CVE-2019-10081", url: "https://bugzilla.suse.com/1145742", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "openSUSE Tumbleweed:apache2-2.4.49-1.1.aarch64", "openSUSE Tumbleweed:apache2-2.4.49-1.1.ppc64le", "openSUSE Tumbleweed:apache2-2.4.49-1.1.s390x", "openSUSE Tumbleweed:apache2-2.4.49-1.1.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 5.3, baseSeverity: "MEDIUM", vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", version: "3.0", }, products: [ "openSUSE Tumbleweed:apache2-2.4.49-1.1.aarch64", "openSUSE Tumbleweed:apache2-2.4.49-1.1.ppc64le", "openSUSE Tumbleweed:apache2-2.4.49-1.1.s390x", "openSUSE Tumbleweed:apache2-2.4.49-1.1.x86_64", ], }, ], threats: [ { category: "impact", date: "2024-06-15T00:00:00Z", details: "moderate", }, ], title: "CVE-2019-10081", }, { cve: "CVE-2019-10082", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2019-10082", }, ], notes: [ { category: "general", text: "In Apache HTTP Server 2.4.18-2.4.39, using fuzzed network input, the http/2 session handling could be made to read memory after being freed, during connection shutdown.", title: "CVE description", }, ], product_status: { recommended: [ "openSUSE Tumbleweed:apache2-2.4.49-1.1.aarch64", "openSUSE Tumbleweed:apache2-2.4.49-1.1.ppc64le", "openSUSE Tumbleweed:apache2-2.4.49-1.1.s390x", "openSUSE Tumbleweed:apache2-2.4.49-1.1.x86_64", ], }, references: [ { category: "external", summary: "CVE-2019-10082", url: "https://www.suse.com/security/cve/CVE-2019-10082", }, { category: "external", summary: "SUSE Bug 1145741 for CVE-2019-10082", url: "https://bugzilla.suse.com/1145741", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "openSUSE Tumbleweed:apache2-2.4.49-1.1.aarch64", "openSUSE Tumbleweed:apache2-2.4.49-1.1.ppc64le", "openSUSE Tumbleweed:apache2-2.4.49-1.1.s390x", "openSUSE Tumbleweed:apache2-2.4.49-1.1.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 5.3, baseSeverity: "MEDIUM", vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", version: "3.0", }, products: [ "openSUSE Tumbleweed:apache2-2.4.49-1.1.aarch64", "openSUSE Tumbleweed:apache2-2.4.49-1.1.ppc64le", "openSUSE Tumbleweed:apache2-2.4.49-1.1.s390x", "openSUSE Tumbleweed:apache2-2.4.49-1.1.x86_64", ], }, ], threats: [ { category: "impact", date: "2024-06-15T00:00:00Z", details: "moderate", }, ], title: "CVE-2019-10082", }, { cve: "CVE-2019-10092", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2019-10092", }, ], notes: [ { category: "general", text: "In Apache HTTP Server 2.4.0-2.4.39, a limited cross-site scripting issue was reported affecting the mod_proxy error page. An attacker could cause the link on the error page to be malformed and instead point to a page of their choice. This would only be exploitable where a server was set up with proxying enabled but was misconfigured in such a way that the Proxy Error page was displayed.", title: "CVE description", }, ], product_status: { recommended: [ "openSUSE Tumbleweed:apache2-2.4.49-1.1.aarch64", "openSUSE Tumbleweed:apache2-2.4.49-1.1.ppc64le", "openSUSE Tumbleweed:apache2-2.4.49-1.1.s390x", "openSUSE Tumbleweed:apache2-2.4.49-1.1.x86_64", ], }, references: [ { category: "external", summary: "CVE-2019-10092", url: "https://www.suse.com/security/cve/CVE-2019-10092", }, { category: "external", summary: "SUSE Bug 1145740 for CVE-2019-10092", url: "https://bugzilla.suse.com/1145740", }, { category: "external", summary: "SUSE Bug 1182703 for CVE-2019-10092", url: "https://bugzilla.suse.com/1182703", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "openSUSE Tumbleweed:apache2-2.4.49-1.1.aarch64", "openSUSE Tumbleweed:apache2-2.4.49-1.1.ppc64le", "openSUSE Tumbleweed:apache2-2.4.49-1.1.s390x", "openSUSE Tumbleweed:apache2-2.4.49-1.1.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 7.1, baseSeverity: "HIGH", vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N", version: "3.0", }, products: [ "openSUSE Tumbleweed:apache2-2.4.49-1.1.aarch64", "openSUSE Tumbleweed:apache2-2.4.49-1.1.ppc64le", "openSUSE Tumbleweed:apache2-2.4.49-1.1.s390x", "openSUSE Tumbleweed:apache2-2.4.49-1.1.x86_64", ], }, ], threats: [ { category: "impact", date: "2024-06-15T00:00:00Z", details: "important", }, ], title: "CVE-2019-10092", }, { cve: "CVE-2019-10097", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2019-10097", }, ], notes: [ { category: "general", text: "In Apache HTTP Server 2.4.32-2.4.39, when mod_remoteip was configured to use a trusted intermediary proxy server using the \"PROXY\" protocol, a specially crafted PROXY header could trigger a stack buffer overflow or NULL pointer deference. This vulnerability could only be triggered by a trusted proxy and not by untrusted HTTP clients.", title: "CVE description", }, ], product_status: { recommended: [ "openSUSE Tumbleweed:apache2-2.4.49-1.1.aarch64", "openSUSE Tumbleweed:apache2-2.4.49-1.1.ppc64le", "openSUSE Tumbleweed:apache2-2.4.49-1.1.s390x", "openSUSE Tumbleweed:apache2-2.4.49-1.1.x86_64", ], }, references: [ { category: "external", summary: "CVE-2019-10097", url: "https://www.suse.com/security/cve/CVE-2019-10097", }, { category: "external", summary: "SUSE Bug 1145739 for CVE-2019-10097", url: "https://bugzilla.suse.com/1145739", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "openSUSE Tumbleweed:apache2-2.4.49-1.1.aarch64", "openSUSE Tumbleweed:apache2-2.4.49-1.1.ppc64le", "openSUSE Tumbleweed:apache2-2.4.49-1.1.s390x", "openSUSE Tumbleweed:apache2-2.4.49-1.1.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 4.9, baseSeverity: "MEDIUM", vectorString: "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H", version: "3.0", }, products: [ "openSUSE Tumbleweed:apache2-2.4.49-1.1.aarch64", "openSUSE Tumbleweed:apache2-2.4.49-1.1.ppc64le", "openSUSE Tumbleweed:apache2-2.4.49-1.1.s390x", "openSUSE Tumbleweed:apache2-2.4.49-1.1.x86_64", ], }, ], threats: [ { category: "impact", date: "2024-06-15T00:00:00Z", details: "moderate", }, ], title: "CVE-2019-10097", }, { cve: "CVE-2019-10098", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2019-10098", }, ], notes: [ { category: "general", text: "In Apache HTTP server 2.4.0 to 2.4.39, Redirects configured with mod_rewrite that were intended to be self-referential might be fooled by encoded newlines and redirect instead to an unexpected URL within the request URL.", title: "CVE description", }, ], product_status: { recommended: [ "openSUSE Tumbleweed:apache2-2.4.49-1.1.aarch64", "openSUSE Tumbleweed:apache2-2.4.49-1.1.ppc64le", "openSUSE Tumbleweed:apache2-2.4.49-1.1.s390x", "openSUSE Tumbleweed:apache2-2.4.49-1.1.x86_64", ], }, references: [ { category: "external", summary: "CVE-2019-10098", url: "https://www.suse.com/security/cve/CVE-2019-10098", }, { category: "external", summary: "SUSE Bug 1145738 for CVE-2019-10098", url: "https://bugzilla.suse.com/1145738", }, { category: "external", summary: "SUSE Bug 1168407 for CVE-2019-10098", url: "https://bugzilla.suse.com/1168407", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "openSUSE Tumbleweed:apache2-2.4.49-1.1.aarch64", "openSUSE Tumbleweed:apache2-2.4.49-1.1.ppc64le", "openSUSE Tumbleweed:apache2-2.4.49-1.1.s390x", "openSUSE Tumbleweed:apache2-2.4.49-1.1.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 8.2, baseSeverity: "HIGH", vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N", version: "3.0", }, products: [ "openSUSE Tumbleweed:apache2-2.4.49-1.1.aarch64", "openSUSE Tumbleweed:apache2-2.4.49-1.1.ppc64le", "openSUSE Tumbleweed:apache2-2.4.49-1.1.s390x", "openSUSE Tumbleweed:apache2-2.4.49-1.1.x86_64", ], }, ], threats: [ { category: "impact", date: "2024-06-15T00:00:00Z", details: "important", }, ], title: "CVE-2019-10098", }, { cve: "CVE-2019-9517", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2019-9517", }, ], notes: [ { category: "general", text: "Some HTTP/2 implementations are vulnerable to unconstrained interal data buffering, potentially leading to a denial of service. The attacker opens the HTTP/2 window so the peer can send without constraint; however, they leave the TCP window closed so the peer cannot actually write (many of) the bytes on the wire. The attacker then sends a stream of requests for a large response object. Depending on how the servers queue the responses, this can consume excess memory, CPU, or both.", title: "CVE description", }, ], product_status: { recommended: [ "openSUSE Tumbleweed:apache2-2.4.49-1.1.aarch64", "openSUSE Tumbleweed:apache2-2.4.49-1.1.ppc64le", "openSUSE Tumbleweed:apache2-2.4.49-1.1.s390x", "openSUSE Tumbleweed:apache2-2.4.49-1.1.x86_64", ], }, references: [ { category: "external", summary: "CVE-2019-9517", url: "https://www.suse.com/security/cve/CVE-2019-9517", }, { category: "external", summary: "SUSE Bug 1145575 for CVE-2019-9517", url: "https://bugzilla.suse.com/1145575", }, { category: "external", summary: "SUSE Bug 1146097 for CVE-2019-9517", url: "https://bugzilla.suse.com/1146097", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "openSUSE Tumbleweed:apache2-2.4.49-1.1.aarch64", "openSUSE Tumbleweed:apache2-2.4.49-1.1.ppc64le", "openSUSE Tumbleweed:apache2-2.4.49-1.1.s390x", "openSUSE Tumbleweed:apache2-2.4.49-1.1.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 7.5, baseSeverity: "HIGH", vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", version: "3.0", }, products: [ "openSUSE Tumbleweed:apache2-2.4.49-1.1.aarch64", "openSUSE Tumbleweed:apache2-2.4.49-1.1.ppc64le", "openSUSE Tumbleweed:apache2-2.4.49-1.1.s390x", "openSUSE Tumbleweed:apache2-2.4.49-1.1.x86_64", ], }, ], threats: [ { category: "impact", date: "2024-06-15T00:00:00Z", details: "important", }, ], title: "CVE-2019-9517", }, ], }
var-200705-0681
Vulnerability from variot
Apache httpd 1.3.37, 2.0.59, and 2.2.4 with the Prefork MPM module, allows local users to cause a denial of service by modifying the worker_score and process_score arrays to reference an arbitrary process ID, which is sent a SIGUSR1 signal from the master process, aka "SIGUSR1 killer.". Apache is prone to multiple denial-of-service vulnerabilities. An attacker with the ability to execute arbitrary server-side script-code can exploit these issues to stop arbitrary services on the affected computer in the context of the master webserver process; other attacks may also be possible.
A vulnerability was found in the Apache mod_cache module that could cause the httpd server child process to crash if it was sent a carefully crafted request. This could lead to a denial of service if using a threaded MPM (CVE-2007-1863). A local attacker with the ability to run scripts on the server could manipulate the scoreboard and cause arbitrary processes to be terminated (CVE-2007-3304).
Updated packages have been patched to prevent the above issues.
References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-5752 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1863 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3304
Updated Packages:
Mandriva Linux 2007.0: 5f906bba3e1195f5ffbc3fcb2a6bde38 2007.0/i586/apache-base-2.2.3-1.1mdv2007.0.i586.rpm 83a4844cd98ef203958796ce280a71b2 2007.0/i586/apache-devel-2.2.3-1.1mdv2007.0.i586.rpm 2a6853cad61ca0548715486c5d4c8a23 2007.0/i586/apache-htcacheclean-2.2.3-1.1mdv2007.0.i586.rpm bebbc850c030be2ef87ce12d420fb825 2007.0/i586/apache-mod_authn_dbd-2.2.3-1.1mdv2007.0.i586.rpm 9e08e4738b304aab4f90f4f18aa5da45 2007.0/i586/apache-mod_cache-2.2.3-1.1mdv2007.0.i586.rpm 989d0538f7882277053f6d4c89ca581c 2007.0/i586/apache-mod_dav-2.2.3-1.1mdv2007.0.i586.rpm c1c0fc53dd811dd6176800226574efbf 2007.0/i586/apache-mod_dbd-2.2.3-1.1mdv2007.0.i586.rpm e68509c01d66b9d42e676e7974360154 2007.0/i586/apache-mod_deflate-2.2.3-1.1mdv2007.0.i586.rpm 5596cb5359b7919125fc10be83598445 2007.0/i586/apache-mod_disk_cache-2.2.3-1.1mdv2007.0.i586.rpm d71b54240667224fd7da7fec4693c30b 2007.0/i586/apache-mod_file_cache-2.2.3-1.1mdv2007.0.i586.rpm 3571cab041e622f9399c57f377ac3fe3 2007.0/i586/apache-mod_ldap-2.2.3-1.1mdv2007.0.i586.rpm 598fdd7aad80fdc557142c5e9fc00677 2007.0/i586/apache-mod_mem_cache-2.2.3-1.1mdv2007.0.i586.rpm f4ec774478f5d198ad2e3d3384a5ad83 2007.0/i586/apache-mod_proxy-2.2.3-1.1mdv2007.0.i586.rpm ab7726290be59f03a5ade2029a2b02f8 2007.0/i586/apache-mod_proxy_ajp-2.2.3-1.1mdv2007.0.i586.rpm d72ab4173d51da4a0c1df63dbb52ccf5 2007.0/i586/apache-mod_ssl-2.2.3-1.1mdv2007.0.i586.rpm fcde0ec8b64d83402b53f926ec7fa835 2007.0/i586/apache-mod_userdir-2.2.3-1.1mdv2007.0.i586.rpm 58a0628d42d23c9aa5df6567789fad40 2007.0/i586/apache-modules-2.2.3-1.1mdv2007.0.i586.rpm 011487e1afdfb400419303182e5320c7 2007.0/i586/apache-mpm-prefork-2.2.3-1.1mdv2007.0.i586.rpm 7a755b22020153b44f8d00ba153d3d97 2007.0/i586/apache-mpm-worker-2.2.3-1.1mdv2007.0.i586.rpm ef6e11f0d26db492bc9fe83a2dbf53d7 2007.0/i586/apache-source-2.2.3-1.1mdv2007.0.i586.rpm 411b90e42ed304f329e9989d64a9dfc5 2007.0/SRPMS/apache-2.2.3-1.1mdv2007.0.src.rpm
Mandriva Linux 2007.0/X86_64: 7c5408879073413fb27f2d40854813d0 2007.0/x86_64/apache-base-2.2.3-1.1mdv2007.0.x86_64.rpm c720f2a661616b0bf35bc353d14b9b3b 2007.0/x86_64/apache-devel-2.2.3-1.1mdv2007.0.x86_64.rpm 12164d6d70972cb9ed2fb6581e212bf1 2007.0/x86_64/apache-htcacheclean-2.2.3-1.1mdv2007.0.x86_64.rpm 5278f8d03ce9d59ec4929d4362b04bbe 2007.0/x86_64/apache-mod_authn_dbd-2.2.3-1.1mdv2007.0.x86_64.rpm 40c83185db12d04f4953a374b329ebb3 2007.0/x86_64/apache-mod_cache-2.2.3-1.1mdv2007.0.x86_64.rpm fe37fb1d4378c4bbcfd8d63bd57c3d4d 2007.0/x86_64/apache-mod_dav-2.2.3-1.1mdv2007.0.x86_64.rpm 0830bc5d1718a533e3358a45975596ce 2007.0/x86_64/apache-mod_dbd-2.2.3-1.1mdv2007.0.x86_64.rpm e18c3a6a322258e73b87170766aa7882 2007.0/x86_64/apache-mod_deflate-2.2.3-1.1mdv2007.0.x86_64.rpm fc8c27067e6b04bd549fe0b95579ebaa 2007.0/x86_64/apache-mod_disk_cache-2.2.3-1.1mdv2007.0.x86_64.rpm b31385db2199fd33eeb624c80e9d882a 2007.0/x86_64/apache-mod_file_cache-2.2.3-1.1mdv2007.0.x86_64.rpm 08123786649152eab65e123c75db8e66 2007.0/x86_64/apache-mod_ldap-2.2.3-1.1mdv2007.0.x86_64.rpm 7de4b739d93683648209dcdc69dd5473 2007.0/x86_64/apache-mod_mem_cache-2.2.3-1.1mdv2007.0.x86_64.rpm 85fde2923d945f3849d77f806b8bc55d 2007.0/x86_64/apache-mod_proxy-2.2.3-1.1mdv2007.0.x86_64.rpm b68991944f2989b6d3f89f7272239d76 2007.0/x86_64/apache-mod_proxy_ajp-2.2.3-1.1mdv2007.0.x86_64.rpm 19871683773211daa721957dc5dd565d 2007.0/x86_64/apache-mod_ssl-2.2.3-1.1mdv2007.0.x86_64.rpm 5cf2a97219d6789e4572da1ecddedf16 2007.0/x86_64/apache-mod_userdir-2.2.3-1.1mdv2007.0.x86_64.rpm feede872aaf0ca4bbd86ffe24455e9cd 2007.0/x86_64/apache-modules-2.2.3-1.1mdv2007.0.x86_64.rpm a00a35d4eba8f538cea741b2fc4079f4 2007.0/x86_64/apache-mpm-prefork-2.2.3-1.1mdv2007.0.x86_64.rpm da86251e4417f068d2cafed30e380779 2007.0/x86_64/apache-mpm-worker-2.2.3-1.1mdv2007.0.x86_64.rpm ceb7fd32d3ad933ab6a914085f858911 2007.0/x86_64/apache-source-2.2.3-1.1mdv2007.0.x86_64.rpm 411b90e42ed304f329e9989d64a9dfc5 2007.0/SRPMS/apache-2.2.3-1.1mdv2007.0.src.rpm
Mandriva Linux 2007.1: 9daef91724ded29a3c76e74c261f7766 2007.1/i586/apache-base-2.2.4-6.2mdv2007.1.i586.rpm 9288ee938a0853d6e0072f839c68c1c2 2007.1/i586/apache-devel-2.2.4-6.2mdv2007.1.i586.rpm 613a986f9f654f1ce3432ee6f6db2391 2007.1/i586/apache-htcacheclean-2.2.4-6.2mdv2007.1.i586.rpm 8e0eb376d851d1ddba8850d4233fc3d3 2007.1/i586/apache-mod_authn_dbd-2.2.4-6.2mdv2007.1.i586.rpm 24de68668efa15e4abaaffd690837256 2007.1/i586/apache-mod_cache-2.2.4-6.2mdv2007.1.i586.rpm 288866908d43959c4b31c368346ba65d 2007.1/i586/apache-mod_dav-2.2.4-6.2mdv2007.1.i586.rpm d25838ec739d7a0037148f573262f81c 2007.1/i586/apache-mod_dbd-2.2.4-6.2mdv2007.1.i586.rpm ebad14bcccb73c8f8a27e98a6982a6f1 2007.1/i586/apache-mod_deflate-2.2.4-6.2mdv2007.1.i586.rpm 810d445f2146848b582e798e368b32ab 2007.1/i586/apache-mod_disk_cache-2.2.4-6.2mdv2007.1.i586.rpm 307de93279683b5b3e76ee6d971781cc 2007.1/i586/apache-mod_file_cache-2.2.4-6.2mdv2007.1.i586.rpm f59890e1bc38cfa598a4100705cf4cc6 2007.1/i586/apache-mod_ldap-2.2.4-6.2mdv2007.1.i586.rpm 098a05d1cbaa6bfa2d2707896dd6366c 2007.1/i586/apache-mod_mem_cache-2.2.4-6.2mdv2007.1.i586.rpm 6504f5e57440ff07da16de3d928898f6 2007.1/i586/apache-mod_proxy-2.2.4-6.2mdv2007.1.i586.rpm adc3a611a780e23178e93a6cedf135d4 2007.1/i586/apache-mod_proxy_ajp-2.2.4-6.2mdv2007.1.i586.rpm 659508a67fbe28b5dd9f861384ca1cf1 2007.1/i586/apache-mod_ssl-2.2.4-6.2mdv2007.1.i586.rpm 604eb70716d7e7b6bc6e8399cc4d9f5c 2007.1/i586/apache-mod_userdir-2.2.4-6.2mdv2007.1.i586.rpm 750d7cb431356abc88fe7a031f872b04 2007.1/i586/apache-modules-2.2.4-6.2mdv2007.1.i586.rpm 210be718db221db891452f05a001ee4e 2007.1/i586/apache-mpm-event-2.2.4-6.2mdv2007.1.i586.rpm 482e3d3af6756108c3e9a26ec2a8ac56 2007.1/i586/apache-mpm-itk-2.2.4-6.2mdv2007.1.i586.rpm b76ff4578c127ebd248b21a85a31140a 2007.1/i586/apache-mpm-prefork-2.2.4-6.2mdv2007.1.i586.rpm 2484dee8a4d4e7604a69abcd1b443954 2007.1/i586/apache-mpm-worker-2.2.4-6.2mdv2007.1.i586.rpm 9823f9b97e1829df97999494c3a3d453 2007.1/i586/apache-source-2.2.4-6.2mdv2007.1.i586.rpm ccbd9fad2b29ff86d8601f7201f48d72 2007.1/SRPMS/apache-2.2.4-6.2mdv2007.1.src.rpm
Mandriva Linux 2007.1/X86_64: 4d043339268bff11fa07897ee3dc2988 2007.1/x86_64/apache-base-2.2.4-6.2mdv2007.1.x86_64.rpm afbae73f408fa95c9e4d25e3aa39583d 2007.1/x86_64/apache-devel-2.2.4-6.2mdv2007.1.x86_64.rpm d92c22ff28fcd919b3a8525f753066c3 2007.1/x86_64/apache-htcacheclean-2.2.4-6.2mdv2007.1.x86_64.rpm abe81d2effd6f4975accbdc8d25d089e 2007.1/x86_64/apache-mod_authn_dbd-2.2.4-6.2mdv2007.1.x86_64.rpm 480d5c31af3289f26953a691f92e2a51 2007.1/x86_64/apache-mod_cache-2.2.4-6.2mdv2007.1.x86_64.rpm 3feae93ade4038e67fcbaa691f2a74aa 2007.1/x86_64/apache-mod_dav-2.2.4-6.2mdv2007.1.x86_64.rpm b60eead7fe808fbc5eff6cb34f1de80b 2007.1/x86_64/apache-mod_dbd-2.2.4-6.2mdv2007.1.x86_64.rpm 023afee3221da629fd8e1d34006b7463 2007.1/x86_64/apache-mod_deflate-2.2.4-6.2mdv2007.1.x86_64.rpm 1180446c8cf65c196352006d6da00e17 2007.1/x86_64/apache-mod_disk_cache-2.2.4-6.2mdv2007.1.x86_64.rpm 0e8c2dfc0e42c23b0afbada9f8868bb6 2007.1/x86_64/apache-mod_file_cache-2.2.4-6.2mdv2007.1.x86_64.rpm 32aa45f45b8893d6c23c6892b7ad7e62 2007.1/x86_64/apache-mod_ldap-2.2.4-6.2mdv2007.1.x86_64.rpm 15c20ffb5fdc8ab2a6fa92157c9f0536 2007.1/x86_64/apache-mod_mem_cache-2.2.4-6.2mdv2007.1.x86_64.rpm f91fd6552f480eb36d030bb2e91d30b4 2007.1/x86_64/apache-mod_proxy-2.2.4-6.2mdv2007.1.x86_64.rpm 2c9d1e35af7adebaeb6284bf5da4dd5f 2007.1/x86_64/apache-mod_proxy_ajp-2.2.4-6.2mdv2007.1.x86_64.rpm caa59aaba47c89d20e799a3f02271afd 2007.1/x86_64/apache-mod_ssl-2.2.4-6.2mdv2007.1.x86_64.rpm 8ac44f8c409ea29492a3acdc1eb44c7f 2007.1/x86_64/apache-mod_userdir-2.2.4-6.2mdv2007.1.x86_64.rpm 0f2198ec988390ff3b7843a1e7090517 2007.1/x86_64/apache-modules-2.2.4-6.2mdv2007.1.x86_64.rpm 2548664fde736f25acf59f46c847d1ff 2007.1/x86_64/apache-mpm-event-2.2.4-6.2mdv2007.1.x86_64.rpm 2434c402bae11969ddf5281f2f042d24 2007.1/x86_64/apache-mpm-itk-2.2.4-6.2mdv2007.1.x86_64.rpm 8a06ecd19726db033496a042c6a6be2f 2007.1/x86_64/apache-mpm-prefork-2.2.4-6.2mdv2007.1.x86_64.rpm e8d339c397409391f3fb36f704c38c6c 2007.1/x86_64/apache-mpm-worker-2.2.4-6.2mdv2007.1.x86_64.rpm 8a6f923428242f7aa1b4d489739e241b 2007.1/x86_64/apache-source-2.2.4-6.2mdv2007.1.x86_64.rpm ccbd9fad2b29ff86d8601f7201f48d72 2007.1/SRPMS/apache-2.2.4-6.2mdv2007.1.src.rpm
Corporate 4.0: 74beb8d1579ce5d5f12c8b15981b6e63 corporate/4.0/i586/apache-base-2.2.3-1.1.20060mlcs4.i586.rpm 326a8259b0d99bc2938bfa6cd85743e7 corporate/4.0/i586/apache-devel-2.2.3-1.1.20060mlcs4.i586.rpm ca305d0928255a65814af781b345a056 corporate/4.0/i586/apache-htcacheclean-2.2.3-1.1.20060mlcs4.i586.rpm 48c2b6a5ee11c3f011b1f6dc60a86479 corporate/4.0/i586/apache-mod_authn_dbd-2.2.3-1.1.20060mlcs4.i586.rpm b81a3077cb88a34af43a61ad6f2559ea corporate/4.0/i586/apache-mod_cache-2.2.3-1.1.20060mlcs4.i586.rpm ba5aee0b2a86182560e54f0cf4d360bd corporate/4.0/i586/apache-mod_dav-2.2.3-1.1.20060mlcs4.i586.rpm b696352106c5a0d1697385523455c767 corporate/4.0/i586/apache-mod_dbd-2.2.3-1.1.20060mlcs4.i586.rpm e79f271f000dd7f3a009cca70fd7e4a2 corporate/4.0/i586/apache-mod_deflate-2.2.3-1.1.20060mlcs4.i586.rpm c7bdb987f61099b64e751639ca02dd8a corporate/4.0/i586/apache-mod_disk_cache-2.2.3-1.1.20060mlcs4.i586.rpm b0303fcc2f43bdcf25419dde56df2297 corporate/4.0/i586/apache-mod_file_cache-2.2.3-1.1.20060mlcs4.i586.rpm f818ff0f890abe230c92069f9d256e5c corporate/4.0/i586/apache-mod_ldap-2.2.3-1.1.20060mlcs4.i586.rpm 4247be23e42c368b3880c7ab5ac13c89 corporate/4.0/i586/apache-mod_mem_cache-2.2.3-1.1.20060mlcs4.i586.rpm e50f1749935c96d3364bdce9af5d22bf corporate/4.0/i586/apache-mod_proxy-2.2.3-1.1.20060mlcs4.i586.rpm a619b4e0130d1db7f77a790fee0917a6 corporate/4.0/i586/apache-mod_proxy_ajp-2.2.3-1.1.20060mlcs4.i586.rpm 8170e0e77256f08d07b02119400a19f9 corporate/4.0/i586/apache-mod_ssl-2.2.3-1.1.20060mlcs4.i586.rpm 4a5d94d4f94295efe48266a1d529486e corporate/4.0/i586/apache-mod_userdir-2.2.3-1.1.20060mlcs4.i586.rpm 7c0c27197d6b44115366eac339c424f2 corporate/4.0/i586/apache-modules-2.2.3-1.1.20060mlcs4.i586.rpm 56351aafc723fdea2f2fac22d5046944 corporate/4.0/i586/apache-mpm-prefork-2.2.3-1.1.20060mlcs4.i586.rpm ccbb2f27b762b5dd564dc7a00aac6db0 corporate/4.0/i586/apache-mpm-worker-2.2.3-1.1.20060mlcs4.i586.rpm a65137ff29ed6a1da1f894d19997faec corporate/4.0/i586/apache-source-2.2.3-1.1.20060mlcs4.i586.rpm 8cdf592a822485abba00dfb6591615ea corporate/4.0/SRPMS/apache-2.2.3-1.1.20060mlcs4.src.rpm
Corporate 4.0/X86_64: 7a9b4f5b3fcf2cac67e4c38022ee2441 corporate/4.0/x86_64/apache-base-2.2.3-1.1.20060mlcs4.x86_64.rpm 5604ba341d957fbe6182bd2eb29a8e9d corporate/4.0/x86_64/apache-devel-2.2.3-1.1.20060mlcs4.x86_64.rpm 8983bda4bbe3b58f9c6c317531eb52b7 corporate/4.0/x86_64/apache-htcacheclean-2.2.3-1.1.20060mlcs4.x86_64.rpm 9baf252cbc8ef8a093ed25e7a0daf25d corporate/4.0/x86_64/apache-mod_authn_dbd-2.2.3-1.1.20060mlcs4.x86_64.rpm 26cc58bcbfd25a83c15051c8f590a36d corporate/4.0/x86_64/apache-mod_cache-2.2.3-1.1.20060mlcs4.x86_64.rpm 941a32aea1b1b3bca1ae343d5d925892 corporate/4.0/x86_64/apache-mod_dav-2.2.3-1.1.20060mlcs4.x86_64.rpm 1d79a7b921ce150de88e22ffbaba4b31 corporate/4.0/x86_64/apache-mod_dbd-2.2.3-1.1.20060mlcs4.x86_64.rpm d80b9ffca3dd024e73d069e55ba7fa3e corporate/4.0/x86_64/apache-mod_deflate-2.2.3-1.1.20060mlcs4.x86_64.rpm 7a7a11645680a7bee9cf88b166b0d32f corporate/4.0/x86_64/apache-mod_disk_cache-2.2.3-1.1.20060mlcs4.x86_64.rpm fcc85c0f9faf1fa08a01f3d4ecb68033 corporate/4.0/x86_64/apache-mod_file_cache-2.2.3-1.1.20060mlcs4.x86_64.rpm 55789d16ff565bcd31dfa522435d4d4b corporate/4.0/x86_64/apache-mod_ldap-2.2.3-1.1.20060mlcs4.x86_64.rpm 7ee708824d65878b71ede35e139ac94d corporate/4.0/x86_64/apache-mod_mem_cache-2.2.3-1.1.20060mlcs4.x86_64.rpm e8579835f848cade641da14354196497 corporate/4.0/x86_64/apache-mod_proxy-2.2.3-1.1.20060mlcs4.x86_64.rpm 6a1e70a638aecf603f3bc2485d14bd78 corporate/4.0/x86_64/apache-mod_proxy_ajp-2.2.3-1.1.20060mlcs4.x86_64.rpm 212f40574d0821b909972ebc36fb697a corporate/4.0/x86_64/apache-mod_ssl-2.2.3-1.1.20060mlcs4.x86_64.rpm 32a8dd886e42c8093be05c9ee4d31855 corporate/4.0/x86_64/apache-mod_userdir-2.2.3-1.1.20060mlcs4.x86_64.rpm 265bccd86baa7fca942f1c6d4d694523 corporate/4.0/x86_64/apache-modules-2.2.3-1.1.20060mlcs4.x86_64.rpm babdb585a6c754f23d91c41fc844a5e2 corporate/4.0/x86_64/apache-mpm-prefork-2.2.3-1.1.20060mlcs4.x86_64.rpm 63274f5c5dc3897d0062f621b1c63e0e corporate/4.0/x86_64/apache-mpm-worker-2.2.3-1.1.20060mlcs4.x86_64.rpm 18782a1fcbcb760d36162ce830ac4cdd corporate/4.0/x86_64/apache-source-2.2.3-1.1.20060mlcs4.x86_64.rpm 8cdf592a822485abba00dfb6591615ea corporate/4.0/SRPMS/apache-2.2.3-1.1.20060mlcs4.src.rpm
To upgrade automatically use MandrivaUpdate or urpmi. The verification of md5 checksums and GPG signatures is performed automatically for you.
All packages are signed by Mandriva for security. You can obtain the GPG public key of the Mandriva Security Team by executing:
gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98
You can view other update advisories for Mandriva Linux at:
http://www.mandriva.com/security/advisories
If you want to report vulnerabilities, please contact
security_(at)_mandriva.com
Type Bits/KeyID Date User ID pub 1024D/22458A98 2000-07-10 Mandriva Security Team -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.7 (GNU/Linux)
iD8DBQFGjD3WmqjQ0CJFipgRAtGoAKCXMGCKCMbkso0ugvF0TpsWNwkPjgCfVakS Re00IyLecNs4MIGgsrv2qJE= =5EEm -----END PGP SIGNATURE-----
.
Affected packages
-------------------------------------------------------------------
Package / Vulnerable / Unaffected
-------------------------------------------------------------------
1 www-servers/apache < 2.2.6 *>= 2.0.59-r5 >= 2.2.6
Description
Multiple cross-site scripting vulnerabilities have been discovered in mod_status and mod_autoindex (CVE-2006-5752, CVE-2007-4465). An error has been discovered in the recall_headers() function in mod_mem_cache (CVE-2007-1862). The mod_cache module does not properly sanitize requests before processing them (CVE-2007-1863). The Prefork module does not properly check PID values before sending signals (CVE-2007-3304). The mod_proxy module does not correctly check headers before processing them (CVE-2007-3847).
Impact
A remote attacker could exploit one of these vulnerabilities to inject arbitrary script or HTML content, obtain sensitive information or cause a Denial of Service.
Workaround
There is no known workaround at this time.
Resolution
All Apache users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=www-servers/apache-2.0.59-r5"
References
[ 1 ] CVE-2006-5752 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-5752 [ 2 ] CVE-2007-1862 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1862 [ 3 ] CVE-2007-1863 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1863 [ 4 ] CVE-2007-3304 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3304 [ 5 ] CVE-2007-3847 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3847 [ 6 ] CVE-2007-4465 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4465
Availability
This GLSA and any updates to it are available for viewing at the Gentoo Security Website:
http://security.gentoo.org/glsa/glsa-200711-06.xml
Concerns?
Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at http://bugs.gentoo.org.
License
Copyright 2007 Gentoo Foundation, Inc; referenced text belongs to its owner(s).
The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
SUPPORT COMMUNICATION - SUPPORT COMMUNICATION - SECURITY BULLETIN
Document ID: c01182588 Version: 1
HPSBUX02273 SSRT071476 rev. 1 - HP-UX running Apache, Remote Unauthorized Denial of Service (DoS)
NOTICE: The information in this Security Bulletin should be acted upon as soon as possible.
Release Date: 2007-10-10 Last Updated: 2007-10-10
Potential Security Impact: Remote Unauthorized Denial of Service (DoS)
Source: Hewlett-Packard Company, HP Software Security Response Team
VULNERABILITY SUMMARY A potential security vulnerability has been identified with HP-UX Apache version 2.0.59. The vulnerability could be exploited remotely to create a Denial of Service (DoS).
References: CVE-2007-3847, CVE-2007-3304
SUPPORTED SOFTWARE VERSIONS*: ONLY impacted versions are listed. HP-UX B.11.11, B.11.23, B.11.31 running Apache 2.0.59.00
BACKGROUND
To determine if a system has an affected version, search the output of "swlist -a revision -l fileset" for an affected fileset. Then determine if the recommended action has been taken.
AFFECTED VERSIONS
For IPv4: HP-UX B.11.11 ============= hpuxwsAPACHE action: install revision B.2.0.59.00.0 or subsequent restart Apache URL: ftp://ssrt1476:ssrt1476@hprc.external.hp.com
For IPv6: HP-UX B.11.11 HP-UX B.11.23 HP-UX B.11.31 ============= hpuxwsAPACHE,revision=B.1.0.00.01 hpuxwsAPACHE,revision=B.1.0.07.01 hpuxwsAPACHE,revision=B.1.0.08.01 hpuxwsAPACHE,revision=B.1.0.09.01 hpuxwsAPACHE,revision=B.1.0.10.01 hpuxwsAPACHE,revision=B.2.0.48.00 hpuxwsAPACHE,revision=B.2.0.49.00 hpuxwsAPACHE,revision=B.2.0.50.00 hpuxwsAPACHE,revision=B.2.0.51.00 hpuxwsAPACHE,revision=B.2.0.52.00 hpuxwsAPACHE,revision=B.2.0.53.00 hpuxwsAPACHE,revision=B.2.0.54.00 hpuxwsAPACHE,revision=B.2.0.55.00 hpuxwsAPACHE,revision=B.2.0.56.00 hpuxwsAPACHE,revision=B.2.0.58.00 hpuxwsAPACHE,revision=B.2.0.58.01 hpuxwsAPACHE,revision=B.2.0.59.00
action: install revision B.2.0.59.00.0 or subsequent restart Apache URL: ftp://ssrt1476:ssrt1476@hprc.external.hp.com
END AFFECTED VERSIONS
RESOLUTION HP has made the following available to resolve the vulnerability.
OS Release Depot name MD5 Sum
B.11.11 (IPv4) HPUXWSA-B218-01-1111ipv4.depot eb3bb933baac0f05e1e0809ef1e84eb2
B.11.11 (IPv6) HPUXWSA-B218-01-1111ipv6.depot 540a56b155699336bcbfac0eaf87e3ce
B.11.23 PA-32 HPUXWSA-B218-01-1123-32.depot 2900a0cbea01b6905dc768680fbd5381
B.11.23 IA-64 HPUXWSA-B218-01-1123-64.depot 3be084d96e8a509692e37c71c0184014
B.11.31 PA-32 HPUXWSA-B218-01-1131-32.depot 861122eef70f1b53d68c5adafc64cdb5
B.11.31 IA-64 HPUXWSA-B218-01-1131-64.depot 8dc57222257fe27fb5994da16e91f9a4
The updates are available from: ftp://ssrt1476:ssrt1476@hprc.external.hp.com/ ftp://ssrt1476:ssrt1476@192.170.19.100/
MANUAL ACTIONS: Yes - Update Install Apache 2.0.59.00.0 or subsequent.
PRODUCT SPECIFIC INFORMATION HP-UX Software Assistant: HP-UX Software Assistant is an enhanced application that replaces HP-UX Security Patch Check. It analyzes all HP-issued Security Bulletins and lists recommended actions that may apply to a specific HP-UX system. It can also download patches and create a depot automatically. For more information see: https://www.hp.com/go/swa
HISTORY Revision: 1 (rev.1) - 10 October 2007 Initial release
Third Party Security Patches: Third party security patches which are to be installed on systems running HP software products should be applied in accordance with the customer's patch management policy.
Support: For further information, contact normal HP Services support channel.
Report: To report a potential security vulnerability with any HP supported product, send Email to: security-alert@hp.com It is strongly recommended that security related information being communicated to HP be encrypted using PGP, especially exploit information. To get the security-alert PGP key, please send an e-mail message as follows: To: security-alert@hp.com Subject: get key
Subscribe: To initiate a subscription to receive future HP Security Bulletins via Email: http://h30046.www3.hp.com/driverAlertProfile.php?regioncode=NA&langcode=USENG&jumpid=in_SC-GEN__driverITRC&topiccode=ITRC On the web page: ITRC security bulletins and patch sign-up Under Step1: your ITRC security bulletins and patches -check ALL categories for which alerts are required and continue. Under Step2: your ITRC operating systems -verify your operating system selections are checked and save.
To update an existing subscription: http://h30046.www3.hp.com/subSignIn.php Log in on the web page: Subscriber's choice for Business: sign-in. On the web page: Subscriber's Choice: your profile summary - use Edit Profile to update appropriate sections.
To review previously published Security Bulletins visit: http://www.itrc.hp.com/service/cki/secBullArchive.do
- The Software Product Category that this Security Bulletin relates to is represented by the 5th and 6th characters of the Bulletin number in the title:
GN = HP General SW MA = HP Management Agents MI = Misc. 3rd Party SW MP = HP MPE/iX NS = HP NonStop Servers OV = HP OpenVMS PI = HP Printing & Imaging ST = HP Storage SW TL = HP Trusted Linux
TU = HP Tru64 UNIX UX = HP-UX VV = HP VirtualVault
System management and security procedures must be reviewed frequently to maintain system integrity. HP is continually reviewing and enhancing the security features of software products to provide customers with current secure solutions.
"HP is broadly distributing this Security Bulletin in order to bring to the attention of users of the affected HP products the important security information contained in this Bulletin. HP recommends that all users determine the applicability of this information to their individual situations and take appropriate action. HP does not warrant that this information is necessarily accurate or complete for all user situations and, consequently, HP will not be responsible for any damages resulting from user's use or disregard of the information provided in this Bulletin. To the extent permitted by law, HP disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose, title and non-infringement."
\xa9Copyright 2007 Hewlett-Packard Development Company, L.P.
Hewlett-Packard Company shall not be liable for technical or editorial errors or omissions contained herein. The information provided is provided "as is" without warranty of any kind. To the extent permitted by law, neither HP or its affiliates, subcontractors or suppliers will be liable for incidental,special or consequential damages including downtime cost; lost profits;damages relating to the procurement of substitute products or services; or damages for loss of data, or software restoration. The information in this document is subject to change without notice. Hewlett-Packard Company and the names of Hewlett-Packard products referenced herein are trademarks of Hewlett-Packard Company in the United States and other countries. Other product and company names mentioned herein may be trademarks of their respective owners. -----BEGIN PGP SIGNATURE----- Version: PGP 8.1
iQA/AwUBRw4UMuAfOvwtKn1ZEQLDowCgnVZZuBkuV66atvv6mh6sxARqYYkAmQEy 7CP41v96ckMOtfU4yeG76pv2 =VMzd -----END PGP SIGNATURE----- . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
VMware Security Advisory
Advisory ID: VMSA-2009-0010 Synopsis: VMware Hosted products update libpng and Apache HTTP Server Issue date: 2009-08-20 Updated on: 2009-08-20 (initial release of advisory) CVE numbers: CVE-2009-0040 CVE-2007-3847 CVE-2007-1863 CVE-2006-5752 CVE-2007-3304 CVE-2007-6388 CVE-2007-5000 CVE-2008-0005
- Summary
Updated VMware Hosted products address security issues in libpng and the Apace HTTP Server.
- Relevant releases
VMware Workstation 6.5.2 and earlier, VMware Player 2.5.2 and earlier, VMware ACE 2.5.2 and earlier
- Problem Description
a. Third Party Library libpng Updated to 1.2.35
Several flaws were discovered in the way third party library libpng
handled uninitialized pointers. An attacker could create a PNG image
file in such a way, that when loaded by an application linked to
libpng, it could cause the application to crash or execute arbitrary
code at the privilege level of the user that runs the application.
The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the name CVE-2009-0040 to this issue.
The following table lists what action remediates the vulnerability
(column 4) if a solution is available.
VMware Product Running Replace with/
Product Version on Apply Patch
============= ======== ======= =================
VirtualCenter any Windows not affected
Workstation 6.5.x any 6.5.3 build 185404 or later
Player 2.5.x any 2.5.3 build 185404 or later
ACE 2.5.x any 2.5.3 build 185404 or later
Server 2.x any patch pending
Server 1.x any patch pending
Fusion 2.x Mac OS/X not affected
Fusion 1.x Mac OS/X not affected
ESXi 4.0 ESXi not affected
ESXi 3.5 ESXi not affected
ESX 4.0 ESX not affected
ESX 3.5 ESX not affected
ESX 3.0.3 ESX not affected
ESX 3.0.2 ESX not affected
ESX 2.5.5 ESX not affected *
* The libpng update for the Service Console of ESX 2.5.5 is
documented in VMSA-2009-0007.
b. Apache HTTP Server updated to 2.0.63
The new version of ACE updates the Apache HTTP Server on Windows
hosts to version 2.0.63 which addresses multiple security issues
that existed in the previous versions of this server.
The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the names CVE-2007-3847, CVE-2007-1863, CVE-2006-5752,
CVE-2007-3304, CVE-2007-6388, CVE-2007-5000, CVE-2008-0005 to the
issues that have been addressed by this update.
The following table lists what action remediates the vulnerability
(column 4) if a solution is available.
VMware Product Running Replace with/
Product Version on Apply Patch
============= ======== ======= =================
VirtualCenter any Windows not affected
Workstation 6.5.x any not affected
Player 2.5.x any not affected
ACE 2.5.x Windows 2.5.3 build 185404 or later
ACE 2.5.x Linux update Apache on host system *
Server 2.x any not affected
Server 1.x any not affected
Fusion 2.x Mac OS/X not affected
Fusion 1.x Mac OS/X not affected
ESXi 4.0 ESXi not affected
ESXi 3.5 ESXi not affected
ESX 4.0 ESX not affected
ESX 3.5 ESX not affected
ESX 3.0.3 ESX not affected
ESX 3.0.2 ESX not affected
ESX 2.5.5 ESX not affected
* The Apache HTTP Server is not part of an ACE install on a Linux
host. Update the Apache HTTP Server on the host system to version
2.0.63 in order to remediate the vulnerabilities listed above.
- Solution
Please review the patch/release notes for your product and version and verify the md5sum and/or the sha1sum of your downloaded file.
VMware Workstation 6.5.3
http://www.vmware.com/download/ws/ Release notes: http://www.vmware.com/support/ws65/doc/releasenotes_ws653.html
For Windows
Workstation for Windows 32-bit and 64-bit Windows 32-bit and 64-bit .exe md5sum: 7565d16b7d7e0173b90c3b76ca4656bc sha1sum: 9f687afd8b0f39cde40aeceb3213a91be487aad1
For Linux
Workstation for Linux 32-bit Linux 32-bit .rpm md5sum: 4d55c491bd008ded0ea19f373d1d1fd4 sha1sum: 1f43131c960e76a530390d3b6984c78dfc2da23e
Workstation for Linux 32-bit Linux 32-bit .bundle md5sum: d4a721c1918c0e8a87c6fa4bad49ad35 sha1sum: c0c6f9b56e70bd3ffdb5467ee176110e283a69e5
Workstation for Linux 64-bit Linux 64-bit .rpm md5sum: 72adfdb03de4959f044fcb983412ae7c sha1sum: ba16163c8d9b5aa572526b34a7b63dc6e68f9bbb
Workstation for Linux 64-bit Linux 64-bit .bundle md5sum: 83e1f0c94d6974286256c4d3b559e854 sha1sum: 8763f250a3ac5fc4698bd26319b93fecb498d542
VMware Player 2.5.3
http://www.vmware.com/download/player/ Release notes: http://www.vmware.com/support/player25/doc/releasenotes_player253.html
Player for Windows binary
http://download3.vmware.com/software/vmplayer/VMware-player-2.5.3-185404.exe md5sum: fe28f193374c9457752ee16cd6cad4e7 sha1sum: 13bd3ff93c04fa272544d3ef6de5ae746708af04
Player for Linux (.rpm)
http://download3.vmware.com/software/vmplayer/VMware-Player-2.5.3-185404.i386.rpm md5sum: c99cd65f19fdfc7651bcb7f328b73bc2 sha1sum: a33231b26e2358a72d16e1b4e2656a5873fe637e
Player for Linux (.bundle)
http://download3.vmware.com/software/vmplayer/VMware-Player-2.5.3-185404.i386.bundle md5sum: 210f4cb5615bd3b2171bc054b9b2bac5 sha1sum: 2f6497890b17b37480165bab9f430e8645edae9b
Player for Linux - 64-bit (.rpm)
http://download3.vmware.com/software/vmplayer/VMware-Player-2.5.3-185404.x86_64.rpm md5sum: f91576ef90b322d83225117ae9335968 sha1sum: f492fa9cf26ee2818f164aac04cde1680c25d974
Player for Linux - 64-bit (.bundle)
http://download3.vmware.com/software/vmplayer/VMware-Player-2.5.3-185404.x86_64.bundle md5sum: 595d44d7945c129b1aeb679d2f001b05 sha1sum: acd69fcb0c6bc49fd4af748c65c7fb730ab1e8c4
VMware ACE 2.5.3
http://www.vmware.com/download/ace/ Release notes: http://www.vmware.com/support/ace25/doc/releasenotes_ace253.html
ACE Management Server Virtual Appliance AMS Virtual Appliance .zip md5sum: 44cc7b86353047f02cf6ea0653e38418 sha1sum: 9f44b15e6681a6e58dd20784f829c68091a62cd1
VMware ACE for Windows 32-bit and 64-bit Windows 32-bit and 64-bit .exe md5sum: 0779da73408c5e649e0fd1c62d23820f sha1sum: 2b2e4963adc89f3b642874685f490222523b63ef
ACE Management Server for Windows Windows .exe md5sum: 0779da73408c5e649e0fd1c62d23820f sha1sum: 2b2e4963adc89f3b642874685f490222523b63ef
ACE Management Server for SUSE Enterprise Linux 9 SLES 9 .rpm md5sum: a4fc92d7197f0d569361cdf4b8cca642 sha1sum: af8a135cca398cacaa82c8c3c325011c6cd3ed75
ACE Management Server for Red Hat Enterprise Linux 4 RHEL 4 .rpm md5sum: 841005151338c8b954f08d035815fd58 sha1sum: 67e48624dba20e6be9e41ec9a5aba407dd8cc01e
- References
CVE numbers http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0040 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3847 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1863 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-5752 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3304 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6388 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5000 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0005
- Change log
2009-08-20 VMSA-2009-0010 Initial security advisory after release of Workstation 6.5.3, Player 2.5.3, and ACE 2.5.3 on 2009-08-20.
- Contact
E-mail list for product security notifications and announcements: http://lists.vmware.com/cgi-bin/mailman/listinfo/security-announce
This Security Advisory is posted to the following lists:
- security-announce at lists.vmware.com
- bugtraq at securityfocus.com
- full-disclosure at lists.grok.org.uk
E-mail: security at vmware.com PGP key at: http://kb.vmware.com/kb/1055
VMware Security Center http://www.vmware.com/security
VMware security response policy http://www.vmware.com/support/policies/security_response.html
General support life cycle policy http://www.vmware.com/support/policies/eos.html
VMware Infrastructure support life cycle policy http://www.vmware.com/support/policies/eos_vi.html
Copyright 2009 VMware Inc. All rights reserved. =========================================================== Ubuntu Security Notice USN-499-1 August 16, 2007 apache2 vulnerabilities CVE-2006-5752, CVE-2007-1863, CVE-2007-3304 ===========================================================
A security issue affects the following Ubuntu releases:
Ubuntu 6.06 LTS Ubuntu 6.10 Ubuntu 7.04
This advisory also applies to the corresponding versions of Kubuntu, Edubuntu, and Xubuntu.
The problem can be corrected by upgrading your system to the following package versions:
Ubuntu 6.06 LTS: apache2-common 2.0.55-4ubuntu2.2 apache2-mpm-prefork 2.0.55-4ubuntu2.2 apache2-mpm-worker 2.0.55-4ubuntu2.2
Ubuntu 6.10: apache2-common 2.0.55-4ubuntu4.1 apache2-mpm-prefork 2.0.55-4ubuntu4.1 apache2-mpm-worker 2.0.55-4ubuntu4.1
Ubuntu 7.04: apache2-mpm-prefork 2.2.3-3.2ubuntu0.1 apache2-mpm-worker 2.2.3-3.2ubuntu0.1 apache2.2-common 2.2.3-3.2ubuntu0.1
In general, a standard system upgrade is sufficient to effect the necessary changes.
Details follow:
Stefan Esser discovered that mod_status did not force a character set, which could result in browsers becoming vulnerable to XSS attacks when processing the output. If a user were tricked into viewing server status output during a crafted server request, a remote attacker could exploit this to modify the contents, or steal confidential data (such as passwords), within the same domain. By default, mod_status is disabled in Ubuntu. (CVE-2006-5752)
Niklas Edmundsson discovered that the mod_cache module could be made to crash using a specially crafted request. A remote user could use this to cause a denial of service if Apache was configured to use a threaded worker. By default, mod_cache is disabled in Ubuntu. (CVE-2007-1863)
A flaw was discovered in the signal handling of Apache. A local attacker could trick Apache into sending SIGUSR1 to other processes. The vulnerable code was only present in Ubuntu Feisty. (CVE-2007-3304)
Updated packages for Ubuntu 6.06 LTS:
Source archives:
http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2_2.0.55-4ubuntu2.2.diff.gz
Size/MD5: 115882 e94e45574e3b131d3a9a0e07e193f1e5
http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2_2.0.55-4ubuntu2.2.dsc
Size/MD5: 1148 c2bc143625fbf8ca59fea300845c5a42
http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2_2.0.55.orig.tar.gz
Size/MD5: 6092031 45e32c9432a8e3cf4227f5af91b03622
Architecture independent packages:
http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-doc_2.0.55-4ubuntu2.2_all.deb
Size/MD5: 2124364 9b8ca5d5757c63f5ee6bbd507f0a8357
amd64 architecture (Athlon64, Opteron, EM64T Xeon)
http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-common_2.0.55-4ubuntu2.2_amd64.deb
Size/MD5: 833000 be4c7770c725f5f4401ca06d1347211f
http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-perchild_2.0.55-4ubuntu2.2_amd64.deb
Size/MD5: 227832 41c12dfe84f109e6544a33e4e1d791a8
http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-prefork_2.0.55-4ubuntu2.2_amd64.deb
Size/MD5: 222934 7e4d072bad27239e366a6eda94c09190
http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-worker_2.0.55-4ubuntu2.2_amd64.deb
Size/MD5: 227576 8fc59f78a3fa0e5d6dac81e875039bda
http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-prefork-dev_2.0.55-4ubuntu2.2_amd64.deb
Size/MD5: 171082 4318f93373b705563251f377ed398614
http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-threaded-dev_2.0.55-4ubuntu2.2_amd64.deb
Size/MD5: 171860 257f4183d70be5a00546c39c5a18f108
http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-utils_2.0.55-4ubuntu2.2_amd64.deb
Size/MD5: 93916 695cee55f91ceb9424abe31d8b6ee1dd
http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2_2.0.55-4ubuntu2.2_amd64.deb
Size/MD5: 35902 00c1082a77ff1d863f72874c4472a26d
http://security.ubuntu.com/ubuntu/pool/main/a/apache2/libapr0-dev_2.0.55-4ubuntu2.2_amd64.deb
Size/MD5: 285336 0a8510634b21f56f0d9619aa6fc9cec9
http://security.ubuntu.com/ubuntu/pool/main/a/apache2/libapr0_2.0.55-4ubuntu2.2_amd64.deb
Size/MD5: 143952 d75f83ac219bce95a15a8f44b82b8ea7
i386 architecture (x86 compatible Intel/AMD)
http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-common_2.0.55-4ubuntu2.2_i386.deb
Size/MD5: 786186 4e78fa0d438867194f66b11b4eb6fc2e
http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-perchild_2.0.55-4ubuntu2.2_i386.deb
Size/MD5: 202448 74cf60884e18c1fc93f157010a15b12c
http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-prefork_2.0.55-4ubuntu2.2_i386.deb
Size/MD5: 198456 209a0b92995fec453ed4c2c181e3e555
http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-worker_2.0.55-4ubuntu2.2_i386.deb
Size/MD5: 202038 6cbd437caf993fa2b2b38369cd3d5863
http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-prefork-dev_2.0.55-4ubuntu2.2_i386.deb
Size/MD5: 171074 0a5a26aa58af7aa2d51d1cf5d7c543d6
http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-threaded-dev_2.0.55-4ubuntu2.2_i386.deb
Size/MD5: 171848 af9ca78febc5bc0c7936296dab958349
http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-utils_2.0.55-4ubuntu2.2_i386.deb
Size/MD5: 91884 2857d60b507b28c736f83815c9f3d1b8
http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2_2.0.55-4ubuntu2.2_i386.deb
Size/MD5: 35906 202b5b233af0d26e29ca7302cf7fd04c
http://security.ubuntu.com/ubuntu/pool/main/a/apache2/libapr0-dev_2.0.55-4ubuntu2.2_i386.deb
Size/MD5: 261418 c90342706ac26682d15032a5ba5cb51a
http://security.ubuntu.com/ubuntu/pool/main/a/apache2/libapr0_2.0.55-4ubuntu2.2_i386.deb
Size/MD5: 131850 951a4573901bc2f10d5febf940d57516
powerpc architecture (Apple Macintosh G3/G4/G5)
http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-common_2.0.55-4ubuntu2.2_powerpc.deb
Size/MD5: 859126 afdd8642ca447fc9dc70dfed92be0fa6
http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-perchild_2.0.55-4ubuntu2.2_powerpc.deb
Size/MD5: 219898 6d9c9f924d2356bf9d3438a280870a7d
http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-prefork_2.0.55-4ubuntu2.2_powerpc.deb
Size/MD5: 215602 dd554132cdea0f860e01cf5d4e0dbc7c
http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-worker_2.0.55-4ubuntu2.2_powerpc.deb
Size/MD5: 219378 7a1f4b325dacef287c901fa66680c04e
http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-prefork-dev_2.0.55-4ubuntu2.2_powerpc.deb
Size/MD5: 171096 a0e2547d38ef1b84dc419d69e42ffa0b
http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-threaded-dev_2.0.55-4ubuntu2.2_powerpc.deb
Size/MD5: 171864 200ab662b2c13786658486df37fda881
http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-utils_2.0.55-4ubuntu2.2_powerpc.deb
Size/MD5: 103628 ae36642fbd4698bb362fa4bf9417b0e3
http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2_2.0.55-4ubuntu2.2_powerpc.deb
Size/MD5: 35910 358027282f2f19451d3aa784dc0474dc
http://security.ubuntu.com/ubuntu/pool/main/a/apache2/libapr0-dev_2.0.55-4ubuntu2.2_powerpc.deb
Size/MD5: 280950 0d9b56ec076da25e2a03f6d3c6445057
http://security.ubuntu.com/ubuntu/pool/main/a/apache2/libapr0_2.0.55-4ubuntu2.2_powerpc.deb
Size/MD5: 141074 f5d3d5e0e5911e0c0156ae55af50f87b
sparc architecture (Sun SPARC/UltraSPARC)
http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-common_2.0.55-4ubuntu2.2_sparc.deb
Size/MD5: 803440 d66da6a91c08956c3c5062668349ef41
http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-perchild_2.0.55-4ubuntu2.2_sparc.deb
Size/MD5: 209970 57f0a8f823a4502ee9a2608e3181cc81
http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-prefork_2.0.55-4ubuntu2.2_sparc.deb
Size/MD5: 205582 1dcfb0df796e85c409f614544ea589fe
http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-worker_2.0.55-4ubuntu2.2_sparc.deb
Size/MD5: 209330 6bf7ae824eea35d3487febef384fce91
http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-prefork-dev_2.0.55-4ubuntu2.2_sparc.deb
Size/MD5: 171080 1088337f4abcb6c8f65751b6120c2307
http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-threaded-dev_2.0.55-4ubuntu2.2_sparc.deb
Size/MD5: 171868 5cda04cd73a9c6d8dfc18abd55c09ebd
http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-utils_2.0.55-4ubuntu2.2_sparc.deb
Size/MD5: 92972 850ab3bb0904e8fe9b6255c42ba7f84c
http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2_2.0.55-4ubuntu2.2_sparc.deb
Size/MD5: 35904 7af260b95c4faa17ef34810fed888caf
http://security.ubuntu.com/ubuntu/pool/main/a/apache2/libapr0-dev_2.0.55-4ubuntu2.2_sparc.deb
Size/MD5: 267550 08182a8a2cab00fc0e6bca2cccf5165f
http://security.ubuntu.com/ubuntu/pool/main/a/apache2/libapr0_2.0.55-4ubuntu2.2_sparc.deb
Size/MD5: 129760 a60606c6d2f12209b0bdae997be4a13f
Updated packages for Ubuntu 6.10:
Source archives:
http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2_2.0.55-4ubuntu4.1.diff.gz
Size/MD5: 116265 2732761b18dfb3c2cd1aa0b54c2cf623
http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2_2.0.55-4ubuntu4.1.dsc
Size/MD5: 1148 4b9c4612469c521db0c5fdbe2f6b9b25
http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2_2.0.55.orig.tar.gz
Size/MD5: 6092031 45e32c9432a8e3cf4227f5af91b03622
Architecture independent packages:
http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-doc_2.0.55-4ubuntu4.1_all.deb
Size/MD5: 2124550 8d5c30342b35f9fd595fb09d7659b6fc
amd64 architecture (Athlon64, Opteron, EM64T Xeon)
http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-common_2.0.55-4ubuntu4.1_amd64.deb
Size/MD5: 836342 2c4ba483b0b20fdc2d43819109177941
http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-perchild_2.0.55-4ubuntu4.1_amd64.deb
Size/MD5: 227390 e61cc1998f5b8f2c44dce587e59d288a
http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-prefork_2.0.55-4ubuntu4.1_amd64.deb
Size/MD5: 222376 6bdbff7f7f80fd464d1e3ec52d6e7171
http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-worker_2.0.55-4ubuntu4.1_amd64.deb
Size/MD5: 226848 4356b4caf2b40f364c8893c41b9f9355
http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-prefork-dev_2.0.55-4ubuntu4.1_amd64.deb
Size/MD5: 171304 c4395af051e876228541ef5b8037d979
http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-threaded-dev_2.0.55-4ubuntu4.1_amd64.deb
Size/MD5: 172074 99dadc4ad0f0947f9368d89f4589d95a
http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-utils_2.0.55-4ubuntu4.1_amd64.deb
Size/MD5: 94204 30f3bb8c72575fe93940ecc730b8e4b6
http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2_2.0.55-4ubuntu4.1_amd64.deb
Size/MD5: 36152 ea3cbefcbee7e2f6e5555edb44733ad9
http://security.ubuntu.com/ubuntu/pool/main/a/apache2/libapr0-dev_2.0.55-4ubuntu4.1_amd64.deb
Size/MD5: 286544 d555931490d44d93bec31c4bfc19ed12
http://security.ubuntu.com/ubuntu/pool/main/a/apache2/libapr0_2.0.55-4ubuntu4.1_amd64.deb
Size/MD5: 145014 3e06ceb0a55598d82f9f781c44e210b3
i386 architecture (x86 compatible Intel/AMD)
http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-common_2.0.55-4ubuntu4.1_i386.deb
Size/MD5: 806938 050bb7665332d3761e1a8e47939fa507
http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-perchild_2.0.55-4ubuntu4.1_i386.deb
Size/MD5: 209556 ee530b24aba8838001ebb6c901bc90cd
http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-prefork_2.0.55-4ubuntu4.1_i386.deb
Size/MD5: 205718 b52a17c63909eae3c49bad0ab1958f4b
http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-worker_2.0.55-4ubuntu4.1_i386.deb
Size/MD5: 209158 1844fa5e09224a90944f8b886ddb5a2a
http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-prefork-dev_2.0.55-4ubuntu4.1_i386.deb
Size/MD5: 171296 9de8aba41f7e3d60f41536ca712adebb
http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-threaded-dev_2.0.55-4ubuntu4.1_i386.deb
Size/MD5: 172078 01ccd554177364747b08e2933f121d2c
http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-utils_2.0.55-4ubuntu4.1_i386.deb
Size/MD5: 93240 4573597317416869646eb2ea42cd0945
http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2_2.0.55-4ubuntu4.1_i386.deb
Size/MD5: 36150 77666d65bade6a91bd58826c79f11dc9
http://security.ubuntu.com/ubuntu/pool/main/a/apache2/libapr0-dev_2.0.55-4ubuntu4.1_i386.deb
Size/MD5: 266390 a3963d8e76f6865404f7fadb47880c87
http://security.ubuntu.com/ubuntu/pool/main/a/apache2/libapr0_2.0.55-4ubuntu4.1_i386.deb
Size/MD5: 137604 387f6bcdaa58dbbe53082241b3231844
powerpc architecture (Apple Macintosh G3/G4/G5)
http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-common_2.0.55-4ubuntu4.1_powerpc.deb
Size/MD5: 865372 27d7f1de1fcb2114d3f3b0a774302488
http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-perchild_2.0.55-4ubuntu4.1_powerpc.deb
Size/MD5: 221542 1ae8fa5cf4b77f3b2aa054e2886e587e
http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-prefork_2.0.55-4ubuntu4.1_powerpc.deb
Size/MD5: 217044 9134983c40107f79fcac8d1eacbc7117
http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-worker_2.0.55-4ubuntu4.1_powerpc.deb
Size/MD5: 221324 b435dc09c63ecbcd564a0923a8f07350
http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-prefork-dev_2.0.55-4ubuntu4.1_powerpc.deb
Size/MD5: 171296 6d2a0abfb7a1daaeae56559eeb322dcb
http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-threaded-dev_2.0.55-4ubuntu4.1_powerpc.deb
Size/MD5: 172064 ecc2037409554ea43c5a6848aa510c76
http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-utils_2.0.55-4ubuntu4.1_powerpc.deb
Size/MD5: 104654 d0957d8df044c4a34437241792ed97d1
http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2_2.0.55-4ubuntu4.1_powerpc.deb
Size/MD5: 36148 34e102e1d2e1c6a6f31801dfb98cb82a
http://security.ubuntu.com/ubuntu/pool/main/a/apache2/libapr0-dev_2.0.55-4ubuntu4.1_powerpc.deb
Size/MD5: 284548 c8f325ccc42cbe77191d4ddd9abc2a4e
http://security.ubuntu.com/ubuntu/pool/main/a/apache2/libapr0_2.0.55-4ubuntu4.1_powerpc.deb
Size/MD5: 144238 82cfbfcec5fc4931078145af8947c035
sparc architecture (Sun SPARC/UltraSPARC)
http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-common_2.0.55-4ubuntu4.1_sparc.deb
Size/MD5: 811594 d8548e537fd81994bbb638e105dfbf8b
http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-perchild_2.0.55-4ubuntu4.1_sparc.deb
Size/MD5: 212160 81cd0197ff89b79c967c1074ede9f8d7
http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-prefork_2.0.55-4ubuntu4.1_sparc.deb
Size/MD5: 207870 5d80ed8dc39b0d4d59fccb747624a684
http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-worker_2.0.55-4ubuntu4.1_sparc.deb
Size/MD5: 211578 9407383d85db831dab728b39cce9acc8
http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-prefork-dev_2.0.55-4ubuntu4.1_sparc.deb
Size/MD5: 171294 5e4d695a99bdc1fdfb0bfcef8b91d03d
http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-threaded-dev_2.0.55-4ubuntu4.1_sparc.deb
Size/MD5: 172064 06e3e765d799e281dba7329ff9d9e138
http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-utils_2.0.55-4ubuntu4.1_sparc.deb
Size/MD5: 93796 1048b47b289fb2047fa9ac7ebbe94a57
http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2_2.0.55-4ubuntu4.1_sparc.deb
Size/MD5: 36150 0d106a177aa4271b1cfc0e96eec1a748
http://security.ubuntu.com/ubuntu/pool/main/a/apache2/libapr0-dev_2.0.55-4ubuntu4.1_sparc.deb
Size/MD5: 268444 3912123e7c71cc638132305ca89fe23b
http://security.ubuntu.com/ubuntu/pool/main/a/apache2/libapr0_2.0.55-4ubuntu4.1_sparc.deb
Size/MD5: 130626 f4444e0239c2da7d3c31e3486606f95a
Updated packages for Ubuntu 7.04:
Source archives:
http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2_2.2.3-3.2ubuntu0.1.diff.gz
Size/MD5: 112120 f7b1a17718aed7ca73da3a6d7aad06b0
http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2_2.2.3-3.2ubuntu0.1.dsc
Size/MD5: 1128 e82b1bee591fff50d6673ed1a443e543
http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2_2.2.3.orig.tar.gz
Size/MD5: 6342475 f72ffb176e2dc7b322be16508c09f63c
Architecture independent packages:
http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-doc_2.2.3-3.2ubuntu0.1_all.deb
Size/MD5: 2199184 c03756f87cb164213428532f70e0c198
http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-perchild_2.2.3-3.2ubuntu0.1_all.deb
Size/MD5: 272064 5be351f491f8d1aae9a270d1214e93e3
http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-src_2.2.3-3.2ubuntu0.1_all.deb
Size/MD5: 6674104 bdbabf8f478562f0e003737e977ffc7b
http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2_2.2.3-3.2ubuntu0.1_all.deb
Size/MD5: 38668 9f0c7c01e8441285c084002eb4619065
amd64 architecture (Athlon64, Opteron, EM64T Xeon)
http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-event_2.2.3-3.2ubuntu0.1_amd64.deb
Size/MD5: 449624 1b54a8000c40eaaa0f9e31527b9bb180
http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-prefork_2.2.3-3.2ubuntu0.1_amd64.deb
Size/MD5: 445346 d15625641a3247fbf5d9d9b9aed34968
http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-worker_2.2.3-3.2ubuntu0.1_amd64.deb
Size/MD5: 449208 55f39c28a4de98d53f80231aeb7d6c59
http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-prefork-dev_2.2.3-3.2ubuntu0.1_amd64.deb
Size/MD5: 403570 0042c75be8a2d128d62b79398deaefa8
http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-threaded-dev_2.2.3-3.2ubuntu0.1_amd64.deb
Size/MD5: 404138 929772b95ea67f338ad423a65b2b7011
http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-utils_2.2.3-3.2ubuntu0.1_amd64.deb
Size/MD5: 341312 906819b0de863209575aa65d39a594a5
http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2.2-common_2.2.3-3.2ubuntu0.1_amd64.deb
Size/MD5: 971462 f85e32c5f6437ce149553aee97ffd934
i386 architecture (x86 compatible Intel/AMD)
http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-event_2.2.3-3.2ubuntu0.1_i386.deb
Size/MD5: 432922 c1b81ac7dc7b7a0b2261fd10d9bcf5c6
http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-prefork_2.2.3-3.2ubuntu0.1_i386.deb
Size/MD5: 428856 f506f2a9dd2dbd5c2d3f72a476cc3537
http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-worker_2.2.3-3.2ubuntu0.1_i386.deb
Size/MD5: 432314 a5a11947ad8cf14604efa7ddcfd20bfe
http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-prefork-dev_2.2.3-3.2ubuntu0.1_i386.deb
Size/MD5: 403574 da84a3a99276f14a11ac892ce7eee170
http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-threaded-dev_2.2.3-3.2ubuntu0.1_i386.deb
Size/MD5: 404138 0fdd43a53e6957aa3a348a7bd9c876f5
http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-utils_2.2.3-3.2ubuntu0.1_i386.deb
Size/MD5: 340396 88a0ddbc58335416d91c9f10adc9d5f5
http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2.2-common_2.2.3-3.2ubuntu0.1_i386.deb
Size/MD5: 929716 138d58487b882e6002e3c5e4a9489add
powerpc architecture (Apple Macintosh G3/G4/G5)
http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-event_2.2.3-3.2ubuntu0.1_powerpc.deb
Size/MD5: 451530 ddc437092ef642fcd396713cd1972f4c
http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-prefork_2.2.3-3.2ubuntu0.1_powerpc.deb
Size/MD5: 446960 af1b667708e062f81bca4e995355394d
http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-worker_2.2.3-3.2ubuntu0.1_powerpc.deb
Size/MD5: 450940 ed9f31ec5045a88446115987c6e97655
http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-prefork-dev_2.2.3-3.2ubuntu0.1_powerpc.deb
Size/MD5: 403574 65801ab51335a15dc370b9341a0e50dd
http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-threaded-dev_2.2.3-3.2ubuntu0.1_powerpc.deb
Size/MD5: 404146 fd35e65fadd836feb0190b209947b466
http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-utils_2.2.3-3.2ubuntu0.1_powerpc.deb
Size/MD5: 360518 b74bc9eead429cd8f0ebecd6a94e5edb
http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2.2-common_2.2.3-3.2ubuntu0.1_powerpc.deb
Size/MD5: 1073812 376fe5b1ee383a6d870eea5dd3c6a704
sparc architecture (Sun SPARC/UltraSPARC)
http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-event_2.2.3-3.2ubuntu0.1_sparc.deb
Size/MD5: 434408 c70ef2e9aed191fe53886ceb3725596e
http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-prefork_2.2.3-3.2ubuntu0.1_sparc.deb
Size/MD5: 430574 7b690896da23a151ee5e106d596c1143
http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-worker_2.2.3-3.2ubuntu0.1_sparc.deb
Size/MD5: 433918 cc01edfcfc673ba9a86c83fcc66e6870
http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-prefork-dev_2.2.3-3.2ubuntu0.1_sparc.deb
Size/MD5: 403568 a7660cff70394403c764cf8f30c7298a
http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-threaded-dev_2.2.3-3.2ubuntu0.1_sparc.deb
Size/MD5: 404136 b8587d5eba0be59a6576d6cf645b2122
http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-utils_2.2.3-3.2ubuntu0.1_sparc.deb
Size/MD5: 343370 1572a001a612add57d23350210ac1736
http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2.2-common_2.2.3-3.2ubuntu0.1_sparc.deb
Size/MD5: 938586 b74a91fcfbb0503355e94981310bd1ce
{ "@context": { "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#", affected_products: { "@id": "https://www.variotdbs.pl/ref/affected_products", }, configurations: { "@id": "https://www.variotdbs.pl/ref/configurations", }, credits: { "@id": "https://www.variotdbs.pl/ref/credits", }, cvss: { "@id": "https://www.variotdbs.pl/ref/cvss/", }, description: { "@id": "https://www.variotdbs.pl/ref/description/", }, exploit_availability: { "@id": "https://www.variotdbs.pl/ref/exploit_availability/", }, external_ids: { "@id": "https://www.variotdbs.pl/ref/external_ids/", }, iot: { "@id": "https://www.variotdbs.pl/ref/iot/", }, iot_taxonomy: { "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/", }, patch: { "@id": "https://www.variotdbs.pl/ref/patch/", }, problemtype_data: { "@id": "https://www.variotdbs.pl/ref/problemtype_data/", }, references: { "@id": "https://www.variotdbs.pl/ref/references/", }, sources: { "@id": "https://www.variotdbs.pl/ref/sources/", }, sources_release_date: { "@id": "https://www.variotdbs.pl/ref/sources_release_date/", }, sources_update_date: { "@id": "https://www.variotdbs.pl/ref/sources_update_date/", }, threat_type: { "@id": "https://www.variotdbs.pl/ref/threat_type/", }, title: { "@id": "https://www.variotdbs.pl/ref/title/", }, type: { "@id": "https://www.variotdbs.pl/ref/type/", }, }, "@id": "https://www.variotdbs.pl/vuln/VAR-200705-0681", affected_products: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/affected_products#", data: { "@container": "@list", }, sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, "@id": "https://www.variotdbs.pl/ref/sources", }, }, data: [ { model: "http server", scope: "eq", trust: 1.1, vendor: "ibm", version: "6.1.0.13", }, { model: "http server", scope: "eq", trust: 1.1, vendor: "ibm", version: "6.0.2.23", }, { model: "enterprise linux desktop", scope: "eq", trust: 1, vendor: "redhat", version: "5.0", }, { model: "ubuntu linux", scope: "eq", trust: 1, vendor: "canonical", version: "6.06", }, { model: "http server", scope: "gte", trust: 1, vendor: "apache", version: "2.0.0", }, { model: "http server", scope: "lt", trust: 1, vendor: "apache", version: "1.3.39", }, { model: "enterprise linux workstation", scope: "eq", trust: 1, vendor: "redhat", version: "5.0", }, { model: "http server", scope: "lt", trust: 1, vendor: "apache", version: "2.2.6", }, { model: "fedora", scope: "eq", trust: 1, vendor: "fedoraproject", version: "7", }, { model: "ubuntu linux", scope: "eq", trust: 1, vendor: "canonical", version: "6.10", }, { model: "http server", scope: "gte", trust: 1, vendor: "apache", version: "2.2.0", }, { model: "enterprise linux server", scope: "eq", trust: 1, vendor: "redhat", version: "5.0", }, { model: "ubuntu linux", scope: "eq", trust: 1, vendor: "canonical", version: "7.04", }, { model: "http server", scope: "lt", trust: 1, vendor: "apache", version: "2.0.61", }, { model: "http server", scope: "gte", trust: 1, vendor: "apache", version: "1.3.0", }, { model: "asianux server", scope: "eq", trust: 0.8, vendor: "cybertrust", version: "3.0", }, { model: "http server", scope: "lte", trust: 0.8, vendor: "apache", version: "2.0.59 and earlier", }, { model: "rhel desktop workstation", scope: "eq", trust: 0.8, vendor: "red hat", version: "5 (client)", }, { model: "enterprise linux", scope: "eq", trust: 0.8, vendor: "red hat", version: "2.1 (as)", }, { model: "enterprise linux", scope: "eq", trust: 0.8, vendor: "red hat", version: "4 (ws)", }, { model: "http server", scope: "lte", trust: 0.8, vendor: "apache", version: "1.3.37 and earlier", }, { model: "enterprise linux", scope: "eq", trust: 0.8, vendor: "red hat", version: "4 (es)", }, { model: "interstage application server", scope: null, trust: 0.8, vendor: "fujitsu", version: null, }, { model: "interstage apworks", scope: null, trust: 0.8, vendor: "fujitsu", version: null, }, { model: "enterprise linux", scope: "eq", trust: 0.8, vendor: "red hat", version: "2.1 (es)", }, { model: "hp-ux", scope: "eq", trust: 0.8, vendor: "hewlett packard", version: "11.23", }, { model: "interstage application framework suite", scope: null, trust: 0.8, vendor: "fujitsu", version: null, }, { model: "enterprise linux", scope: "eq", trust: 0.8, vendor: "red hat", version: "3 (as)", }, { model: "solaris", scope: "eq", trust: 0.8, vendor: "sun microsystems", version: "9 (sparc)", }, { model: "http server", scope: "eq", trust: 0.8, vendor: "ibm", version: "2.0.47", }, { model: "systemwalker resource coordinator", scope: null, trust: 0.8, vendor: "fujitsu", version: null, }, { model: "http server", scope: "lte", trust: 0.8, vendor: "apache", version: "2.2.4 and earlier", }, { model: "solaris", scope: "eq", trust: 0.8, vendor: "sun microsystems", version: "8 (sparc)", }, { model: "trendmicro interscan web security suite", scope: "eq", trust: 0.8, vendor: "trend micro", version: "1.1 solaris edition", }, { model: "linux advanced workstation", scope: "eq", trust: 0.8, vendor: "red hat", version: "2.1", }, { model: "http server", scope: "lt", trust: 0.8, vendor: "ibm", version: "version", }, { model: "solaris", scope: "eq", trust: 0.8, vendor: "sun microsystems", version: "8 (x86)", }, { model: "enterprise linux", scope: "eq", trust: 0.8, vendor: "red hat", version: "2.1 (ws)", }, { model: "solaris", scope: "eq", trust: 0.8, vendor: "sun microsystems", version: "10 (x86)", }, { model: "interstage web server", scope: null, trust: 0.8, vendor: "fujitsu", version: null, }, { model: "enterprise linux", scope: "eq", trust: 0.8, vendor: "red hat", version: "4 (as)", }, { model: "enterprise linux desktop", scope: "eq", trust: 0.8, vendor: "red hat", version: "4.0", }, { model: "solaris", scope: "eq", trust: 0.8, vendor: "sun microsystems", version: "9 (x86)", }, { model: "interstage studio", scope: null, trust: 0.8, vendor: "fujitsu", version: null, }, { model: "enterprise linux desktop", scope: "eq", trust: 0.8, vendor: "red hat", version: "3.0", }, { model: "asianux server", scope: "eq", trust: 0.8, vendor: "cybertrust", version: "3.0 (x86-64)", }, { model: "interstage business application server", scope: null, trust: 0.8, vendor: "fujitsu", version: null, }, { model: "http server", scope: "eq", trust: 0.8, vendor: "ibm", version: "1.3.28.1", }, { model: "enterprise linux", scope: "eq", trust: 0.8, vendor: "red hat", version: "3 (es)", }, { model: "hp-ux", scope: "eq", trust: 0.8, vendor: "hewlett packard", version: "11.11", }, { model: "hp-ux", scope: "eq", trust: 0.8, vendor: "hewlett packard", version: "11.31", }, { model: "asianux server", scope: "eq", trust: 0.8, vendor: "cybertrust", version: "4.0 (x86-64)", }, { model: "enterprise linux", scope: "eq", trust: 0.8, vendor: "red hat", version: "5 (server)", }, { model: "enterprise linux desktop", scope: "eq", trust: 0.8, vendor: "red hat", version: "5.0 (client)", }, { model: "enterprise linux", scope: "eq", trust: 0.8, vendor: "red hat", version: "3 (ws)", }, { model: "solaris", scope: "eq", trust: 0.8, vendor: "sun microsystems", version: "10 (sparc)", }, { model: "asianux server", scope: "eq", trust: 0.8, vendor: "cybertrust", version: "4.0", }, { model: "interstage job workload server", scope: null, trust: 0.8, vendor: "fujitsu", version: null, }, { model: "http server", scope: "eq", trust: 0.6, vendor: "apache", version: "2.0.59", }, { model: "http server", scope: "eq", trust: 0.6, vendor: "apache", version: "2.2.4", }, { model: "http server", scope: "eq", trust: 0.6, vendor: "apache", version: "1.3.37", }, { model: "workstation", scope: "eq", trust: 0.3, vendor: "vmware", version: "6.5.2", }, { model: "workstation", scope: "eq", trust: 0.3, vendor: "vmware", version: "6.5.1", }, { model: "player", scope: "eq", trust: 0.3, vendor: "vmware", version: "2.5.2", }, { model: "player", scope: "eq", trust: 0.3, vendor: "vmware", version: "2.5.1", }, { model: "ace", scope: "eq", trust: 0.3, vendor: "vmware", version: "2.5.2", }, { model: "ace", scope: "eq", trust: 0.3, vendor: "vmware", version: "2.5.1", }, { model: "linux sparc", scope: "eq", trust: 0.3, vendor: "ubuntu", version: "7.04", }, { model: "linux powerpc", scope: "eq", trust: 0.3, vendor: "ubuntu", version: "7.04", }, { model: "linux i386", scope: "eq", trust: 0.3, vendor: "ubuntu", version: "7.04", }, { model: "linux amd64", scope: "eq", trust: 0.3, vendor: "ubuntu", version: "7.04", }, { model: "linux sparc", scope: "eq", trust: 0.3, vendor: "ubuntu", version: "6.10", }, { model: "linux powerpc", scope: "eq", trust: 0.3, vendor: "ubuntu", version: "6.10", }, { model: "linux i386", scope: "eq", trust: 0.3, vendor: "ubuntu", version: "6.10", }, { model: "linux amd64", scope: "eq", trust: 0.3, vendor: "ubuntu", version: "6.10", }, { model: "linux lts sparc", scope: "eq", trust: 0.3, vendor: "ubuntu", version: "6.06", }, { model: "linux lts powerpc", scope: "eq", trust: 0.3, vendor: "ubuntu", version: "6.06", }, { model: "linux lts i386", scope: "eq", trust: 0.3, vendor: "ubuntu", version: "6.06", }, { model: "linux lts amd64", scope: "eq", trust: 0.3, vendor: "ubuntu", version: "6.06", }, { model: "server", scope: "eq", trust: 0.3, vendor: "turbolinux", version: "10.0x86", }, { model: "server", scope: "eq", trust: 0.3, vendor: "turbolinux", version: "10.0.0x64", }, { model: "fuji", scope: "eq", trust: 0.3, vendor: "turbolinux", version: "0", }, { model: "appliance server", scope: "eq", trust: 0.3, vendor: "turbolinux", version: "2.0", }, { model: "secure linux", scope: "eq", trust: 0.3, vendor: "trustix", version: "3.0.5", }, { model: "secure linux", scope: "eq", trust: 0.3, vendor: "trustix", version: "3.0", }, { model: "secure linux", scope: "eq", trust: 0.3, vendor: "trustix", version: "2.2", }, { model: "operating system enterprise server", scope: "eq", trust: 0.3, vendor: "trustix", version: "2.0", }, { model: "linux enterprise server", scope: "eq", trust: 0.3, vendor: "suse", version: "9", }, { model: "linux enterprise server sp1", scope: "eq", trust: 0.3, vendor: "suse", version: "10", }, { model: "linux enterprise sdk 10.sp1", scope: null, trust: 0.3, vendor: "suse", version: null, }, { model: "linux enterprise sdk", scope: "eq", trust: 0.3, vendor: "suse", version: "10", }, { model: "opensuse", scope: "eq", trust: 0.3, vendor: "suse", version: "10.3", }, { model: "solaris 9 x86", scope: null, trust: 0.3, vendor: "sun", version: null, }, { model: "solaris 9 sparc", scope: null, trust: 0.3, vendor: "sun", version: null, }, { model: "solaris 8 x86", scope: null, trust: 0.3, vendor: "sun", version: null, }, { model: "solaris 8 sparc", scope: null, trust: 0.3, vendor: "sun", version: null, }, { model: "solaris 10 x86", scope: null, trust: 0.3, vendor: "sun", version: null, }, { model: "propack sp6", scope: "eq", trust: 0.3, vendor: "sgi", version: "3.0", }, { model: "opensuse", scope: "eq", trust: 0.3, vendor: "s u s e", version: "10.2", }, { model: "open-enterprise-server", scope: "eq", trust: 0.3, vendor: "s u s e", version: "0", }, { model: "novell linux pos", scope: "eq", trust: 0.3, vendor: "s u s e", version: "9", }, { model: "novell linux desktop sdk", scope: "eq", trust: 0.3, vendor: "s u s e", version: "9.0", }, { model: "novell linux desktop", scope: "eq", trust: 0.3, vendor: "s u s e", version: "9.0", }, { model: "linux professional oss", scope: "eq", trust: 0.3, vendor: "s u s e", version: "10.0", }, { model: "linux professional", scope: "eq", trust: 0.3, vendor: "s u s e", version: "10.1", }, { model: "linux personal oss", scope: "eq", trust: 0.3, vendor: "s u s e", version: "10.0", }, { model: "linux personal", scope: "eq", trust: 0.3, vendor: "s u s e", version: "10.1", }, { model: "linux", scope: "eq", trust: 0.3, vendor: "rpath", version: "1", }, { model: "network satellite (for rhel", scope: "eq", trust: 0.3, vendor: "redhat", version: "4)4.2", }, { model: "network proxy (for rhel", scope: "eq", trust: 0.3, vendor: "redhat", version: "3)4.2", }, { model: "enterprise linux ws", scope: "eq", trust: 0.3, vendor: "redhat", version: "4", }, { model: "enterprise linux ws", scope: "eq", trust: 0.3, vendor: "redhat", version: "3", }, { model: "enterprise linux ws ia64", scope: "eq", trust: 0.3, vendor: "redhat", version: "2.1", }, { model: "enterprise linux ws", scope: "eq", trust: 0.3, vendor: "redhat", version: "2.1", }, { model: "enterprise linux es", scope: "eq", trust: 0.3, vendor: "redhat", version: "4", }, { model: "enterprise linux es", scope: "eq", trust: 0.3, vendor: "redhat", version: "3", }, { model: "enterprise linux es ia64", scope: "eq", trust: 0.3, vendor: "redhat", version: "2.1", }, { model: "enterprise linux es", scope: "eq", trust: 0.3, vendor: "redhat", version: "2.1", }, { model: "enterprise linux desktop workstation client", scope: "eq", trust: 0.3, vendor: "redhat", version: "5", }, { model: "desktop", scope: "eq", trust: 0.3, vendor: "redhat", version: "4.0", }, { model: "desktop", scope: "eq", trust: 0.3, vendor: "redhat", version: "3.0", }, { model: "certificate server", scope: "eq", trust: 0.3, vendor: "redhat", version: "7.3", }, { model: "advanced workstation for the itanium processor ia64", scope: "eq", trust: 0.3, vendor: "redhat", version: "2.1", }, { model: "advanced workstation for the itanium processor", scope: "eq", trust: 0.3, vendor: "redhat", version: "2.1", }, { model: "hat red hat network satellite server", scope: "eq", trust: 0.3, vendor: "red", version: "5.0", }, { model: "hat network satellite (for rhel", scope: "eq", trust: 0.3, vendor: "red", version: "3)4.2", }, { model: "hat network proxy (for rhel", scope: "eq", trust: 0.3, vendor: "red", version: "4)5.0", }, { model: "hat network proxy (for rhel", scope: "eq", trust: 0.3, vendor: "red", version: "4)4.2", }, { model: "hat enterprise linux desktop client", scope: "eq", trust: 0.3, vendor: "red", version: "5", }, { model: "hat enterprise linux as", scope: "eq", trust: 0.3, vendor: "red", version: "4", }, { model: "hat enterprise linux as", scope: "eq", trust: 0.3, vendor: "red", version: "3", }, { model: "hat enterprise linux as ia64", scope: "eq", trust: 0.3, vendor: "red", version: "2.1", }, { model: "hat enterprise linux as", scope: "eq", trust: 0.3, vendor: "red", version: "2.1", }, { model: "hat enterprise linux server", scope: "eq", trust: 0.3, vendor: "red", version: "5", }, { model: "linux mandrake x86 64", scope: "eq", trust: 0.3, vendor: "mandriva", version: "2007.1", }, { model: "linux mandrake", scope: "eq", trust: 0.3, vendor: "mandriva", version: "2007.1", }, { model: "linux mandrake x86 64", scope: "eq", trust: 0.3, vendor: "mandriva", version: "2007.0", }, { model: "linux mandrake", scope: "eq", trust: 0.3, vendor: "mandriva", version: "2007.0", }, { model: "multi network firewall", scope: "eq", trust: 0.3, vendor: "mandrakesoft", version: "2.0", }, { model: "corporate server x86 64", scope: "eq", trust: 0.3, vendor: "mandrakesoft", version: "4.0", }, { model: "corporate server x86 64", scope: "eq", trust: 0.3, vendor: "mandrakesoft", version: "3.0", }, { model: "corporate server", scope: "eq", trust: 0.3, vendor: "mandrakesoft", version: "3.0", }, { model: "corporate server", scope: "eq", trust: 0.3, vendor: "mandrakesoft", version: "4.0", }, { model: "websphere application server", scope: "eq", trust: 0.3, vendor: "ibm", version: "6.0.1", }, { model: "hp-ux b.11.31", scope: null, trust: 0.3, vendor: "hp", version: null, }, { model: "hp-ux b.11.23", scope: null, trust: 0.3, vendor: "hp", version: null, }, { model: "hp-ux b.11.11", scope: null, trust: 0.3, vendor: "hp", version: null, }, { model: "linux", scope: null, trust: 0.3, vendor: "gentoo", version: null, }, { model: "interstage studio standard-j edition", scope: "eq", trust: 0.3, vendor: "fujitsu", version: "9.0", }, { model: "interstage studio standard-j edition", scope: "eq", trust: 0.3, vendor: "fujitsu", version: "8.0.1", }, { model: "interstage studio enterprise edition", scope: "eq", trust: 0.3, vendor: "fujitsu", version: "9.0", }, { model: "interstage studio enterprise edition", scope: "eq", trust: 0.3, vendor: "fujitsu", version: "8.0.1", }, { model: "interstage job workload server", scope: "eq", trust: 0.3, vendor: "fujitsu", version: "8.1", }, { model: "interstage business application server enterprise", scope: "eq", trust: 0.3, vendor: "fujitsu", version: "8.0.0", }, { model: "interstage apworks standard-j edition", scope: "eq", trust: 0.3, vendor: "fujitsu", version: "8.0", }, { model: "interstage apworks modelers-j edition", scope: "eq", trust: 0.3, vendor: "fujitsu", version: "7.0", }, { model: "interstage apworks modelers-j edition 6.0a", scope: null, trust: 0.3, vendor: "fujitsu", version: null, }, { model: "interstage apworks modelers-j edition", scope: "eq", trust: 0.3, vendor: "fujitsu", version: "6.0", }, { model: "interstage apworks enterprise edition", scope: "eq", trust: 0.3, vendor: "fujitsu", version: "8.0", }, { model: "interstage application server web-j edition", scope: "eq", trust: 0.3, vendor: "fujitsu", version: "5.0", }, { model: "interstage application server standard-j edition a", scope: "eq", trust: 0.3, vendor: "fujitsu", version: "9.0", }, { model: "interstage application server standard-j edition", scope: "eq", trust: 0.3, vendor: "fujitsu", version: "9.0", }, { model: "interstage application server standard-j edition", scope: "eq", trust: 0.3, vendor: "fujitsu", version: "8.0.2", }, { model: "interstage application server standard-j edition", scope: "eq", trust: 0.3, vendor: "fujitsu", version: "8.0.1", }, { model: "interstage application server standard-j edition", scope: "eq", trust: 0.3, vendor: "fujitsu", version: "8.0", }, { model: "interstage application server standard edition", scope: "eq", trust: 0.3, vendor: "fujitsu", version: "5.0", }, { model: "interstage application server plus developer", scope: "eq", trust: 0.3, vendor: "fujitsu", version: "5.0.1", }, { model: "interstage application server plus developer", scope: "eq", trust: 0.3, vendor: "fujitsu", version: "7.0", }, { model: "interstage application server plus developer", scope: "eq", trust: 0.3, vendor: "fujitsu", version: "6.0", }, { model: "interstage application server plus", scope: "eq", trust: 0.3, vendor: "fujitsu", version: "7.0.1", }, { model: "interstage application server plus", scope: "eq", trust: 0.3, vendor: "fujitsu", version: "5.0.1", }, { model: "interstage application server plus", scope: "eq", trust: 0.3, vendor: "fujitsu", version: "7.0", }, { model: "interstage application server plus", scope: "eq", trust: 0.3, vendor: "fujitsu", version: "6.0", }, { model: "interstage application server enterprise edition a", scope: "eq", trust: 0.3, vendor: "fujitsu", version: "9.0", }, { model: "interstage application server enterprise edition", scope: "eq", trust: 0.3, vendor: "fujitsu", version: "9.0", }, { model: "interstage application server enterprise edition", scope: "eq", trust: 0.3, vendor: "fujitsu", version: "8.0.2", }, { model: "interstage application server enterprise edition", scope: "eq", trust: 0.3, vendor: "fujitsu", version: "8.0.1", }, { model: "interstage application server enterprise edition", scope: "eq", trust: 0.3, vendor: "fujitsu", version: "8.0", }, { model: "interstage application server enterprise edition", scope: "eq", trust: 0.3, vendor: "fujitsu", version: "7.0.1", }, { model: "interstage application server enterprise edition", scope: "eq", trust: 0.3, vendor: "fujitsu", version: "5.0.1", }, { model: "interstage application server enterprise edition", scope: "eq", trust: 0.3, vendor: "fujitsu", version: "7.0", }, { model: "interstage application server enterprise edition 6.0a", scope: null, trust: 0.3, vendor: "fujitsu", version: null, }, { model: "interstage application server enterprise edition", scope: "eq", trust: 0.3, vendor: "fujitsu", version: "6.0", }, { model: "interstage application server enterprise edition", scope: "eq", trust: 0.3, vendor: "fujitsu", version: "5.0", }, { model: "ses", scope: "eq", trust: 0.3, vendor: "avaya", version: "2.0", }, { model: "messaging storage server mm3.0", scope: null, trust: 0.3, vendor: "avaya", version: null, }, { model: "messaging storage server", scope: "eq", trust: 0.3, vendor: "avaya", version: "2.0", }, { model: "messaging storage server", scope: "eq", trust: 0.3, vendor: "avaya", version: "1.0", }, { model: "messaging storage server", scope: null, trust: 0.3, vendor: "avaya", version: null, }, { model: "message networking mn", scope: "eq", trust: 0.3, vendor: "avaya", version: "3.1", }, { model: "message networking", scope: null, trust: 0.3, vendor: "avaya", version: null, }, { model: "intuity lx", scope: "eq", trust: 0.3, vendor: "avaya", version: "2.0", }, { model: "intuity lx", scope: null, trust: 0.3, vendor: "avaya", version: null, }, { model: "interactive response", scope: "eq", trust: 0.3, vendor: "avaya", version: "1.3", }, { model: "interactive response", scope: "eq", trust: 0.3, vendor: "avaya", version: "3.0", }, { model: "interactive response", scope: "eq", trust: 0.3, vendor: "avaya", version: "2.0", }, { model: "emmc", scope: "eq", trust: 0.3, vendor: "avaya", version: "1.021", }, { model: "emmc", scope: "eq", trust: 0.3, vendor: "avaya", version: "1.017", }, { model: "emmc", scope: "eq", trust: 0.3, vendor: "avaya", version: "0", }, { model: "communication manager", scope: "eq", trust: 0.3, vendor: "avaya", version: "2.0.1", }, { model: "communication manager", scope: "eq", trust: 0.3, vendor: "avaya", version: "2.0", }, { model: "communication manager", scope: "eq", trust: 0.3, vendor: "avaya", version: "4.0", }, { model: "communication manager", scope: "eq", trust: 0.3, vendor: "avaya", version: "3.1", }, { model: "communication manager", scope: "eq", trust: 0.3, vendor: "avaya", version: "3.0", }, { model: "aura sip enablement services", scope: "eq", trust: 0.3, vendor: "avaya", version: "3.1.1", }, { model: "aura sip enablement services", scope: "eq", trust: 0.3, vendor: "avaya", version: "3.0", }, { model: "aura application enablement services", scope: "eq", trust: 0.3, vendor: "avaya", version: "4.0.1", }, { model: "aura application enablement services", scope: "eq", trust: 0.3, vendor: "avaya", version: "3.1.3", }, { model: "aura application enablement services", scope: "eq", trust: 0.3, vendor: "avaya", version: "4.0", }, { model: "aura application enablement services", scope: "eq", trust: 0.3, vendor: "avaya", version: "3.1", }, { model: "aura application enablement services", scope: "eq", trust: 0.3, vendor: "avaya", version: "3.0", }, { model: "software foundation mpm prefork", scope: "eq", trust: 0.3, vendor: "apache", version: "0", }, { model: "software foundation apache", scope: "eq", trust: 0.3, vendor: "apache", version: "2.2.4", }, { model: "software foundation apache", scope: "eq", trust: 0.3, vendor: "apache", version: "2.0.59", }, { model: "software foundation apache", scope: "eq", trust: 0.3, vendor: "apache", version: "1.3.37", }, { model: "software foundation apache", scope: "ne", trust: 0.3, vendor: "apache", version: "2.2.6", }, { model: "software foundation apache 2.3.38-dev", scope: "ne", trust: 0.3, vendor: "apache", version: null, }, { model: "software foundation apache 2.0.60-dev", scope: "ne", trust: 0.3, vendor: "apache", version: null, }, ], sources: [ { db: "BID", id: "24215", }, { db: "JVNDB", id: "JVNDB-2007-000477", }, { db: "CNNVD", id: "CNNVD-200706-316", }, { db: "NVD", id: "CVE-2007-3304", }, ], }, configurations: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/configurations#", children: { "@container": "@list", }, cpe_match: { "@container": "@list", }, data: { "@container": "@list", }, nodes: { "@container": "@list", }, }, data: [ { CVE_data_version: "4.0", nodes: [ { cpe_match: [ { cpe22Uri: "cpe:/a:apache:http_server", vulnerable: true, }, { cpe22Uri: "cpe:/a:ibm:http_server", vulnerable: true, }, { cpe22Uri: "cpe:/o:misc:miraclelinux_asianux_server", vulnerable: true, }, { cpe22Uri: "cpe:/o:sun:solaris", vulnerable: true, }, { cpe22Uri: "cpe:/a:trendmicro:interscan_web_security_suite", vulnerable: true, }, { cpe22Uri: "cpe:/o:hp:hp-ux", vulnerable: true, }, { cpe22Uri: "cpe:/o:redhat:enterprise_linux", vulnerable: true, }, { cpe22Uri: "cpe:/o:redhat:enterprise_linux_desktop", vulnerable: true, }, { cpe22Uri: "cpe:/o:redhat:linux_advanced_workstation", vulnerable: true, }, { cpe22Uri: "cpe:/o:redhat:rhel_desktop_workstation", vulnerable: true, }, { cpe22Uri: "cpe:/a:fujitsu:interstage_application_framework_suite", vulnerable: true, }, { cpe22Uri: "cpe:/a:fujitsu:interstage_application_server", vulnerable: true, }, { cpe22Uri: "cpe:/a:fujitsu:interstage_apworks", vulnerable: true, }, { cpe22Uri: "cpe:/a:fujitsu:interstage_business_application_server", vulnerable: true, }, { cpe22Uri: "cpe:/a:fujitsu:interstage_job_workload_server", vulnerable: true, }, { cpe22Uri: "cpe:/a:fujitsu:interstage_studio", vulnerable: true, }, { cpe22Uri: "cpe:/a:fujitsu:interstage_web_server", vulnerable: true, }, { cpe22Uri: "cpe:/a:fujitsu:systemwalker_resource_coordinator", vulnerable: true, }, ], operator: "OR", }, ], }, ], sources: [ { db: "JVNDB", id: "JVNDB-2007-000477", }, ], }, credits: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/credits#", sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, }, }, data: "Blazej Miga", sources: [ { db: "CNNVD", id: "CNNVD-200706-316", }, ], trust: 0.6, }, cve: "CVE-2007-3304", cvss: { "@context": { cvssV2: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#", }, "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2", }, cvssV3: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#", }, "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/", }, severity: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/cvss/severity#", }, "@id": "https://www.variotdbs.pl/ref/cvss/severity", }, sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, "@id": "https://www.variotdbs.pl/ref/sources", }, }, data: [ { cvssV2: [ { accessComplexity: "MEDIUM", accessVector: "LOCAL", authentication: "NONE", author: "nvd@nist.gov", availabilityImpact: "COMPLETE", baseScore: 4.7, confidentialityImpact: "NONE", exploitabilityScore: 3.4, id: "CVE-2007-3304", impactScore: 6.9, integrityImpact: "NONE", severity: "MEDIUM", trust: 1.9, vectorString: "AV:L/AC:M/Au:N/C:N/I:N/A:C", version: "2.0", }, ], cvssV3: [], severity: [ { author: "nvd@nist.gov", id: "CVE-2007-3304", trust: 1, value: "MEDIUM", }, { author: "NVD", id: "CVE-2007-3304", trust: 0.8, value: "Medium", }, { author: "CNNVD", id: "CNNVD-200706-316", trust: 0.6, value: "LOW", }, { author: "VULMON", id: "CVE-2007-3304", trust: 0.1, value: "MEDIUM", }, ], }, ], sources: [ { db: "VULMON", id: "CVE-2007-3304", }, { db: "JVNDB", id: "JVNDB-2007-000477", }, { db: "CNNVD", id: "CNNVD-200706-316", }, { db: "NVD", id: "CVE-2007-3304", }, ], }, description: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/description#", sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, }, }, data: "Apache httpd 1.3.37, 2.0.59, and 2.2.4 with the Prefork MPM module, allows local users to cause a denial of service by modifying the worker_score and process_score arrays to reference an arbitrary process ID, which is sent a SIGUSR1 signal from the master process, aka \"SIGUSR1 killer.\". Apache is prone to multiple denial-of-service vulnerabilities. \nAn attacker with the ability to execute arbitrary server-side script-code can exploit these issues to stop arbitrary services on the affected computer in the context of the master webserver process; other attacks may also be possible. \n \n A vulnerability was found in the Apache mod_cache module that could\n cause the httpd server child process to crash if it was sent a\n carefully crafted request. This could lead to a denial of service\n if using a threaded MPM (CVE-2007-1863). A local attacker with the\n ability to run scripts on the server could manipulate the scoreboard\n and cause arbitrary processes to be terminated (CVE-2007-3304). \n \n Updated packages have been patched to prevent the above issues. \n _______________________________________________________________________\n\n References:\n \n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-5752\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1863\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3304\n _______________________________________________________________________\n \n Updated Packages:\n \n Mandriva Linux 2007.0:\n 5f906bba3e1195f5ffbc3fcb2a6bde38 2007.0/i586/apache-base-2.2.3-1.1mdv2007.0.i586.rpm\n 83a4844cd98ef203958796ce280a71b2 2007.0/i586/apache-devel-2.2.3-1.1mdv2007.0.i586.rpm\n 2a6853cad61ca0548715486c5d4c8a23 2007.0/i586/apache-htcacheclean-2.2.3-1.1mdv2007.0.i586.rpm\n bebbc850c030be2ef87ce12d420fb825 2007.0/i586/apache-mod_authn_dbd-2.2.3-1.1mdv2007.0.i586.rpm\n 9e08e4738b304aab4f90f4f18aa5da45 2007.0/i586/apache-mod_cache-2.2.3-1.1mdv2007.0.i586.rpm\n 989d0538f7882277053f6d4c89ca581c 2007.0/i586/apache-mod_dav-2.2.3-1.1mdv2007.0.i586.rpm\n c1c0fc53dd811dd6176800226574efbf 2007.0/i586/apache-mod_dbd-2.2.3-1.1mdv2007.0.i586.rpm\n e68509c01d66b9d42e676e7974360154 2007.0/i586/apache-mod_deflate-2.2.3-1.1mdv2007.0.i586.rpm\n 5596cb5359b7919125fc10be83598445 2007.0/i586/apache-mod_disk_cache-2.2.3-1.1mdv2007.0.i586.rpm\n d71b54240667224fd7da7fec4693c30b 2007.0/i586/apache-mod_file_cache-2.2.3-1.1mdv2007.0.i586.rpm\n 3571cab041e622f9399c57f377ac3fe3 2007.0/i586/apache-mod_ldap-2.2.3-1.1mdv2007.0.i586.rpm\n 598fdd7aad80fdc557142c5e9fc00677 2007.0/i586/apache-mod_mem_cache-2.2.3-1.1mdv2007.0.i586.rpm\n f4ec774478f5d198ad2e3d3384a5ad83 2007.0/i586/apache-mod_proxy-2.2.3-1.1mdv2007.0.i586.rpm\n ab7726290be59f03a5ade2029a2b02f8 2007.0/i586/apache-mod_proxy_ajp-2.2.3-1.1mdv2007.0.i586.rpm\n d72ab4173d51da4a0c1df63dbb52ccf5 2007.0/i586/apache-mod_ssl-2.2.3-1.1mdv2007.0.i586.rpm\n fcde0ec8b64d83402b53f926ec7fa835 2007.0/i586/apache-mod_userdir-2.2.3-1.1mdv2007.0.i586.rpm\n 58a0628d42d23c9aa5df6567789fad40 2007.0/i586/apache-modules-2.2.3-1.1mdv2007.0.i586.rpm\n 011487e1afdfb400419303182e5320c7 2007.0/i586/apache-mpm-prefork-2.2.3-1.1mdv2007.0.i586.rpm\n 7a755b22020153b44f8d00ba153d3d97 2007.0/i586/apache-mpm-worker-2.2.3-1.1mdv2007.0.i586.rpm\n ef6e11f0d26db492bc9fe83a2dbf53d7 2007.0/i586/apache-source-2.2.3-1.1mdv2007.0.i586.rpm \n 411b90e42ed304f329e9989d64a9dfc5 2007.0/SRPMS/apache-2.2.3-1.1mdv2007.0.src.rpm\n\n Mandriva Linux 2007.0/X86_64:\n 7c5408879073413fb27f2d40854813d0 2007.0/x86_64/apache-base-2.2.3-1.1mdv2007.0.x86_64.rpm\n c720f2a661616b0bf35bc353d14b9b3b 2007.0/x86_64/apache-devel-2.2.3-1.1mdv2007.0.x86_64.rpm\n 12164d6d70972cb9ed2fb6581e212bf1 2007.0/x86_64/apache-htcacheclean-2.2.3-1.1mdv2007.0.x86_64.rpm\n 5278f8d03ce9d59ec4929d4362b04bbe 2007.0/x86_64/apache-mod_authn_dbd-2.2.3-1.1mdv2007.0.x86_64.rpm\n 40c83185db12d04f4953a374b329ebb3 2007.0/x86_64/apache-mod_cache-2.2.3-1.1mdv2007.0.x86_64.rpm\n fe37fb1d4378c4bbcfd8d63bd57c3d4d 2007.0/x86_64/apache-mod_dav-2.2.3-1.1mdv2007.0.x86_64.rpm\n 0830bc5d1718a533e3358a45975596ce 2007.0/x86_64/apache-mod_dbd-2.2.3-1.1mdv2007.0.x86_64.rpm\n e18c3a6a322258e73b87170766aa7882 2007.0/x86_64/apache-mod_deflate-2.2.3-1.1mdv2007.0.x86_64.rpm\n fc8c27067e6b04bd549fe0b95579ebaa 2007.0/x86_64/apache-mod_disk_cache-2.2.3-1.1mdv2007.0.x86_64.rpm\n b31385db2199fd33eeb624c80e9d882a 2007.0/x86_64/apache-mod_file_cache-2.2.3-1.1mdv2007.0.x86_64.rpm\n 08123786649152eab65e123c75db8e66 2007.0/x86_64/apache-mod_ldap-2.2.3-1.1mdv2007.0.x86_64.rpm\n 7de4b739d93683648209dcdc69dd5473 2007.0/x86_64/apache-mod_mem_cache-2.2.3-1.1mdv2007.0.x86_64.rpm\n 85fde2923d945f3849d77f806b8bc55d 2007.0/x86_64/apache-mod_proxy-2.2.3-1.1mdv2007.0.x86_64.rpm\n b68991944f2989b6d3f89f7272239d76 2007.0/x86_64/apache-mod_proxy_ajp-2.2.3-1.1mdv2007.0.x86_64.rpm\n 19871683773211daa721957dc5dd565d 2007.0/x86_64/apache-mod_ssl-2.2.3-1.1mdv2007.0.x86_64.rpm\n 5cf2a97219d6789e4572da1ecddedf16 2007.0/x86_64/apache-mod_userdir-2.2.3-1.1mdv2007.0.x86_64.rpm\n feede872aaf0ca4bbd86ffe24455e9cd 2007.0/x86_64/apache-modules-2.2.3-1.1mdv2007.0.x86_64.rpm\n a00a35d4eba8f538cea741b2fc4079f4 2007.0/x86_64/apache-mpm-prefork-2.2.3-1.1mdv2007.0.x86_64.rpm\n da86251e4417f068d2cafed30e380779 2007.0/x86_64/apache-mpm-worker-2.2.3-1.1mdv2007.0.x86_64.rpm\n ceb7fd32d3ad933ab6a914085f858911 2007.0/x86_64/apache-source-2.2.3-1.1mdv2007.0.x86_64.rpm \n 411b90e42ed304f329e9989d64a9dfc5 2007.0/SRPMS/apache-2.2.3-1.1mdv2007.0.src.rpm\n\n Mandriva Linux 2007.1:\n 9daef91724ded29a3c76e74c261f7766 2007.1/i586/apache-base-2.2.4-6.2mdv2007.1.i586.rpm\n 9288ee938a0853d6e0072f839c68c1c2 2007.1/i586/apache-devel-2.2.4-6.2mdv2007.1.i586.rpm\n 613a986f9f654f1ce3432ee6f6db2391 2007.1/i586/apache-htcacheclean-2.2.4-6.2mdv2007.1.i586.rpm\n 8e0eb376d851d1ddba8850d4233fc3d3 2007.1/i586/apache-mod_authn_dbd-2.2.4-6.2mdv2007.1.i586.rpm\n 24de68668efa15e4abaaffd690837256 2007.1/i586/apache-mod_cache-2.2.4-6.2mdv2007.1.i586.rpm\n 288866908d43959c4b31c368346ba65d 2007.1/i586/apache-mod_dav-2.2.4-6.2mdv2007.1.i586.rpm\n d25838ec739d7a0037148f573262f81c 2007.1/i586/apache-mod_dbd-2.2.4-6.2mdv2007.1.i586.rpm\n ebad14bcccb73c8f8a27e98a6982a6f1 2007.1/i586/apache-mod_deflate-2.2.4-6.2mdv2007.1.i586.rpm\n 810d445f2146848b582e798e368b32ab 2007.1/i586/apache-mod_disk_cache-2.2.4-6.2mdv2007.1.i586.rpm\n 307de93279683b5b3e76ee6d971781cc 2007.1/i586/apache-mod_file_cache-2.2.4-6.2mdv2007.1.i586.rpm\n f59890e1bc38cfa598a4100705cf4cc6 2007.1/i586/apache-mod_ldap-2.2.4-6.2mdv2007.1.i586.rpm\n 098a05d1cbaa6bfa2d2707896dd6366c 2007.1/i586/apache-mod_mem_cache-2.2.4-6.2mdv2007.1.i586.rpm\n 6504f5e57440ff07da16de3d928898f6 2007.1/i586/apache-mod_proxy-2.2.4-6.2mdv2007.1.i586.rpm\n adc3a611a780e23178e93a6cedf135d4 2007.1/i586/apache-mod_proxy_ajp-2.2.4-6.2mdv2007.1.i586.rpm\n 659508a67fbe28b5dd9f861384ca1cf1 2007.1/i586/apache-mod_ssl-2.2.4-6.2mdv2007.1.i586.rpm\n 604eb70716d7e7b6bc6e8399cc4d9f5c 2007.1/i586/apache-mod_userdir-2.2.4-6.2mdv2007.1.i586.rpm\n 750d7cb431356abc88fe7a031f872b04 2007.1/i586/apache-modules-2.2.4-6.2mdv2007.1.i586.rpm\n 210be718db221db891452f05a001ee4e 2007.1/i586/apache-mpm-event-2.2.4-6.2mdv2007.1.i586.rpm\n 482e3d3af6756108c3e9a26ec2a8ac56 2007.1/i586/apache-mpm-itk-2.2.4-6.2mdv2007.1.i586.rpm\n b76ff4578c127ebd248b21a85a31140a 2007.1/i586/apache-mpm-prefork-2.2.4-6.2mdv2007.1.i586.rpm\n 2484dee8a4d4e7604a69abcd1b443954 2007.1/i586/apache-mpm-worker-2.2.4-6.2mdv2007.1.i586.rpm\n 9823f9b97e1829df97999494c3a3d453 2007.1/i586/apache-source-2.2.4-6.2mdv2007.1.i586.rpm \n ccbd9fad2b29ff86d8601f7201f48d72 2007.1/SRPMS/apache-2.2.4-6.2mdv2007.1.src.rpm\n\n Mandriva Linux 2007.1/X86_64:\n 4d043339268bff11fa07897ee3dc2988 2007.1/x86_64/apache-base-2.2.4-6.2mdv2007.1.x86_64.rpm\n afbae73f408fa95c9e4d25e3aa39583d 2007.1/x86_64/apache-devel-2.2.4-6.2mdv2007.1.x86_64.rpm\n d92c22ff28fcd919b3a8525f753066c3 2007.1/x86_64/apache-htcacheclean-2.2.4-6.2mdv2007.1.x86_64.rpm\n abe81d2effd6f4975accbdc8d25d089e 2007.1/x86_64/apache-mod_authn_dbd-2.2.4-6.2mdv2007.1.x86_64.rpm\n 480d5c31af3289f26953a691f92e2a51 2007.1/x86_64/apache-mod_cache-2.2.4-6.2mdv2007.1.x86_64.rpm\n 3feae93ade4038e67fcbaa691f2a74aa 2007.1/x86_64/apache-mod_dav-2.2.4-6.2mdv2007.1.x86_64.rpm\n b60eead7fe808fbc5eff6cb34f1de80b 2007.1/x86_64/apache-mod_dbd-2.2.4-6.2mdv2007.1.x86_64.rpm\n 023afee3221da629fd8e1d34006b7463 2007.1/x86_64/apache-mod_deflate-2.2.4-6.2mdv2007.1.x86_64.rpm\n 1180446c8cf65c196352006d6da00e17 2007.1/x86_64/apache-mod_disk_cache-2.2.4-6.2mdv2007.1.x86_64.rpm\n 0e8c2dfc0e42c23b0afbada9f8868bb6 2007.1/x86_64/apache-mod_file_cache-2.2.4-6.2mdv2007.1.x86_64.rpm\n 32aa45f45b8893d6c23c6892b7ad7e62 2007.1/x86_64/apache-mod_ldap-2.2.4-6.2mdv2007.1.x86_64.rpm\n 15c20ffb5fdc8ab2a6fa92157c9f0536 2007.1/x86_64/apache-mod_mem_cache-2.2.4-6.2mdv2007.1.x86_64.rpm\n f91fd6552f480eb36d030bb2e91d30b4 2007.1/x86_64/apache-mod_proxy-2.2.4-6.2mdv2007.1.x86_64.rpm\n 2c9d1e35af7adebaeb6284bf5da4dd5f 2007.1/x86_64/apache-mod_proxy_ajp-2.2.4-6.2mdv2007.1.x86_64.rpm\n caa59aaba47c89d20e799a3f02271afd 2007.1/x86_64/apache-mod_ssl-2.2.4-6.2mdv2007.1.x86_64.rpm\n 8ac44f8c409ea29492a3acdc1eb44c7f 2007.1/x86_64/apache-mod_userdir-2.2.4-6.2mdv2007.1.x86_64.rpm\n 0f2198ec988390ff3b7843a1e7090517 2007.1/x86_64/apache-modules-2.2.4-6.2mdv2007.1.x86_64.rpm\n 2548664fde736f25acf59f46c847d1ff 2007.1/x86_64/apache-mpm-event-2.2.4-6.2mdv2007.1.x86_64.rpm\n 2434c402bae11969ddf5281f2f042d24 2007.1/x86_64/apache-mpm-itk-2.2.4-6.2mdv2007.1.x86_64.rpm\n 8a06ecd19726db033496a042c6a6be2f 2007.1/x86_64/apache-mpm-prefork-2.2.4-6.2mdv2007.1.x86_64.rpm\n e8d339c397409391f3fb36f704c38c6c 2007.1/x86_64/apache-mpm-worker-2.2.4-6.2mdv2007.1.x86_64.rpm\n 8a6f923428242f7aa1b4d489739e241b 2007.1/x86_64/apache-source-2.2.4-6.2mdv2007.1.x86_64.rpm \n ccbd9fad2b29ff86d8601f7201f48d72 2007.1/SRPMS/apache-2.2.4-6.2mdv2007.1.src.rpm\n\n Corporate 4.0:\n 74beb8d1579ce5d5f12c8b15981b6e63 corporate/4.0/i586/apache-base-2.2.3-1.1.20060mlcs4.i586.rpm\n 326a8259b0d99bc2938bfa6cd85743e7 corporate/4.0/i586/apache-devel-2.2.3-1.1.20060mlcs4.i586.rpm\n ca305d0928255a65814af781b345a056 corporate/4.0/i586/apache-htcacheclean-2.2.3-1.1.20060mlcs4.i586.rpm\n 48c2b6a5ee11c3f011b1f6dc60a86479 corporate/4.0/i586/apache-mod_authn_dbd-2.2.3-1.1.20060mlcs4.i586.rpm\n b81a3077cb88a34af43a61ad6f2559ea corporate/4.0/i586/apache-mod_cache-2.2.3-1.1.20060mlcs4.i586.rpm\n ba5aee0b2a86182560e54f0cf4d360bd corporate/4.0/i586/apache-mod_dav-2.2.3-1.1.20060mlcs4.i586.rpm\n b696352106c5a0d1697385523455c767 corporate/4.0/i586/apache-mod_dbd-2.2.3-1.1.20060mlcs4.i586.rpm\n e79f271f000dd7f3a009cca70fd7e4a2 corporate/4.0/i586/apache-mod_deflate-2.2.3-1.1.20060mlcs4.i586.rpm\n c7bdb987f61099b64e751639ca02dd8a corporate/4.0/i586/apache-mod_disk_cache-2.2.3-1.1.20060mlcs4.i586.rpm\n b0303fcc2f43bdcf25419dde56df2297 corporate/4.0/i586/apache-mod_file_cache-2.2.3-1.1.20060mlcs4.i586.rpm\n f818ff0f890abe230c92069f9d256e5c corporate/4.0/i586/apache-mod_ldap-2.2.3-1.1.20060mlcs4.i586.rpm\n 4247be23e42c368b3880c7ab5ac13c89 corporate/4.0/i586/apache-mod_mem_cache-2.2.3-1.1.20060mlcs4.i586.rpm\n e50f1749935c96d3364bdce9af5d22bf corporate/4.0/i586/apache-mod_proxy-2.2.3-1.1.20060mlcs4.i586.rpm\n a619b4e0130d1db7f77a790fee0917a6 corporate/4.0/i586/apache-mod_proxy_ajp-2.2.3-1.1.20060mlcs4.i586.rpm\n 8170e0e77256f08d07b02119400a19f9 corporate/4.0/i586/apache-mod_ssl-2.2.3-1.1.20060mlcs4.i586.rpm\n 4a5d94d4f94295efe48266a1d529486e corporate/4.0/i586/apache-mod_userdir-2.2.3-1.1.20060mlcs4.i586.rpm\n 7c0c27197d6b44115366eac339c424f2 corporate/4.0/i586/apache-modules-2.2.3-1.1.20060mlcs4.i586.rpm\n 56351aafc723fdea2f2fac22d5046944 corporate/4.0/i586/apache-mpm-prefork-2.2.3-1.1.20060mlcs4.i586.rpm\n ccbb2f27b762b5dd564dc7a00aac6db0 corporate/4.0/i586/apache-mpm-worker-2.2.3-1.1.20060mlcs4.i586.rpm\n a65137ff29ed6a1da1f894d19997faec corporate/4.0/i586/apache-source-2.2.3-1.1.20060mlcs4.i586.rpm \n 8cdf592a822485abba00dfb6591615ea corporate/4.0/SRPMS/apache-2.2.3-1.1.20060mlcs4.src.rpm\n\n Corporate 4.0/X86_64:\n 7a9b4f5b3fcf2cac67e4c38022ee2441 corporate/4.0/x86_64/apache-base-2.2.3-1.1.20060mlcs4.x86_64.rpm\n 5604ba341d957fbe6182bd2eb29a8e9d corporate/4.0/x86_64/apache-devel-2.2.3-1.1.20060mlcs4.x86_64.rpm\n 8983bda4bbe3b58f9c6c317531eb52b7 corporate/4.0/x86_64/apache-htcacheclean-2.2.3-1.1.20060mlcs4.x86_64.rpm\n 9baf252cbc8ef8a093ed25e7a0daf25d corporate/4.0/x86_64/apache-mod_authn_dbd-2.2.3-1.1.20060mlcs4.x86_64.rpm\n 26cc58bcbfd25a83c15051c8f590a36d corporate/4.0/x86_64/apache-mod_cache-2.2.3-1.1.20060mlcs4.x86_64.rpm\n 941a32aea1b1b3bca1ae343d5d925892 corporate/4.0/x86_64/apache-mod_dav-2.2.3-1.1.20060mlcs4.x86_64.rpm\n 1d79a7b921ce150de88e22ffbaba4b31 corporate/4.0/x86_64/apache-mod_dbd-2.2.3-1.1.20060mlcs4.x86_64.rpm\n d80b9ffca3dd024e73d069e55ba7fa3e corporate/4.0/x86_64/apache-mod_deflate-2.2.3-1.1.20060mlcs4.x86_64.rpm\n 7a7a11645680a7bee9cf88b166b0d32f corporate/4.0/x86_64/apache-mod_disk_cache-2.2.3-1.1.20060mlcs4.x86_64.rpm\n fcc85c0f9faf1fa08a01f3d4ecb68033 corporate/4.0/x86_64/apache-mod_file_cache-2.2.3-1.1.20060mlcs4.x86_64.rpm\n 55789d16ff565bcd31dfa522435d4d4b corporate/4.0/x86_64/apache-mod_ldap-2.2.3-1.1.20060mlcs4.x86_64.rpm\n 7ee708824d65878b71ede35e139ac94d corporate/4.0/x86_64/apache-mod_mem_cache-2.2.3-1.1.20060mlcs4.x86_64.rpm\n e8579835f848cade641da14354196497 corporate/4.0/x86_64/apache-mod_proxy-2.2.3-1.1.20060mlcs4.x86_64.rpm\n 6a1e70a638aecf603f3bc2485d14bd78 corporate/4.0/x86_64/apache-mod_proxy_ajp-2.2.3-1.1.20060mlcs4.x86_64.rpm\n 212f40574d0821b909972ebc36fb697a corporate/4.0/x86_64/apache-mod_ssl-2.2.3-1.1.20060mlcs4.x86_64.rpm\n 32a8dd886e42c8093be05c9ee4d31855 corporate/4.0/x86_64/apache-mod_userdir-2.2.3-1.1.20060mlcs4.x86_64.rpm\n 265bccd86baa7fca942f1c6d4d694523 corporate/4.0/x86_64/apache-modules-2.2.3-1.1.20060mlcs4.x86_64.rpm\n babdb585a6c754f23d91c41fc844a5e2 corporate/4.0/x86_64/apache-mpm-prefork-2.2.3-1.1.20060mlcs4.x86_64.rpm\n 63274f5c5dc3897d0062f621b1c63e0e corporate/4.0/x86_64/apache-mpm-worker-2.2.3-1.1.20060mlcs4.x86_64.rpm\n 18782a1fcbcb760d36162ce830ac4cdd corporate/4.0/x86_64/apache-source-2.2.3-1.1.20060mlcs4.x86_64.rpm \n 8cdf592a822485abba00dfb6591615ea corporate/4.0/SRPMS/apache-2.2.3-1.1.20060mlcs4.src.rpm\n _______________________________________________________________________\n\n To upgrade automatically use MandrivaUpdate or urpmi. The verification\n of md5 checksums and GPG signatures is performed automatically for you. \n\n All packages are signed by Mandriva for security. You can obtain the\n GPG public key of the Mandriva Security Team by executing:\n\n gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98\n\n You can view other update advisories for Mandriva Linux at:\n\n http://www.mandriva.com/security/advisories\n\n If you want to report vulnerabilities, please contact\n\n security_(at)_mandriva.com\n _______________________________________________________________________\n\n Type Bits/KeyID Date User ID\n pub 1024D/22458A98 2000-07-10 Mandriva Security Team\n <security*mandriva.com>\n-----BEGIN PGP SIGNATURE-----\nVersion: GnuPG v1.4.7 (GNU/Linux)\n\niD8DBQFGjD3WmqjQ0CJFipgRAtGoAKCXMGCKCMbkso0ugvF0TpsWNwkPjgCfVakS\nRe00IyLecNs4MIGgsrv2qJE=\n=5EEm\n-----END PGP SIGNATURE-----\n\n. \n\nAffected packages\n=================\n\n -------------------------------------------------------------------\n Package / Vulnerable / Unaffected\n -------------------------------------------------------------------\n 1 www-servers/apache < 2.2.6 *>= 2.0.59-r5\n >= 2.2.6\n\nDescription\n===========\n\nMultiple cross-site scripting vulnerabilities have been discovered in\nmod_status and mod_autoindex (CVE-2006-5752, CVE-2007-4465). An error\nhas been discovered in the recall_headers() function in mod_mem_cache\n(CVE-2007-1862). The mod_cache module does not properly sanitize\nrequests before processing them (CVE-2007-1863). The Prefork module\ndoes not properly check PID values before sending signals\n(CVE-2007-3304). The mod_proxy module does not correctly check headers\nbefore processing them (CVE-2007-3847). \n\nImpact\n======\n\nA remote attacker could exploit one of these vulnerabilities to inject\narbitrary script or HTML content, obtain sensitive information or cause\na Denial of Service. \n\nWorkaround\n==========\n\nThere is no known workaround at this time. \n\nResolution\n==========\n\nAll Apache users should upgrade to the latest version:\n\n # emerge --sync\n # emerge --ask --oneshot --verbose \">=www-servers/apache-2.0.59-r5\"\n\nReferences\n==========\n\n [ 1 ] CVE-2006-5752\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-5752\n [ 2 ] CVE-2007-1862\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1862\n [ 3 ] CVE-2007-1863\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1863\n [ 4 ] CVE-2007-3304\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3304\n [ 5 ] CVE-2007-3847\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3847\n [ 6 ] CVE-2007-4465\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4465\n\nAvailability\n============\n\nThis GLSA and any updates to it are available for viewing at\nthe Gentoo Security Website:\n\n http://security.gentoo.org/glsa/glsa-200711-06.xml\n\nConcerns?\n=========\n\nSecurity is a primary focus of Gentoo Linux and ensuring the\nconfidentiality and security of our users machines is of utmost\nimportance to us. Any security concerns should be addressed to\nsecurity@gentoo.org or alternatively, you may file a bug at\nhttp://bugs.gentoo.org. \n\nLicense\n=======\n\nCopyright 2007 Gentoo Foundation, Inc; referenced text\nbelongs to its owner(s). \n\nThe contents of this document are licensed under the\nCreative Commons - Attribution / Share Alike license. \nCharter: http://lists.grok.org.uk/full-disclosure-charter.html\nHosted and sponsored by Secunia - http://secunia.com/\n. -----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA1\n\nSUPPORT COMMUNICATION - SUPPORT COMMUNICATION - SECURITY BULLETIN\n\nDocument ID: c01182588\nVersion: 1\n\nHPSBUX02273 SSRT071476 rev. 1 - HP-UX running Apache, Remote Unauthorized Denial of Service (DoS)\n\nNOTICE: The information in this Security Bulletin should be acted upon as soon as possible. \n\nRelease Date: 2007-10-10\nLast Updated: 2007-10-10\n\nPotential Security Impact: Remote Unauthorized Denial of Service (DoS) \n\nSource: Hewlett-Packard Company, HP Software Security Response Team\n\nVULNERABILITY SUMMARY\nA potential security vulnerability has been identified with HP-UX Apache version 2.0.59. The vulnerability could be exploited remotely to create a Denial of Service (DoS). \n\nReferences: CVE-2007-3847, CVE-2007-3304\n\nSUPPORTED SOFTWARE VERSIONS*: ONLY impacted versions are listed. \nHP-UX B.11.11, B.11.23, B.11.31 running Apache 2.0.59.00\n\nBACKGROUND\n\nTo determine if a system has an affected version, search the output of \"swlist -a revision -l fileset\" for an affected fileset. Then determine if the recommended action has been taken. \n\nAFFECTED VERSIONS \n\nFor IPv4: \nHP-UX B.11.11 \n============= \nhpuxwsAPACHE \naction: install revision B.2.0.59.00.0 or subsequent \nrestart Apache \nURL: ftp://ssrt1476:ssrt1476@hprc.external.hp.com \n\nFor IPv6: \nHP-UX B.11.11 \nHP-UX B.11.23 \nHP-UX B.11.31 \n============= \nhpuxwsAPACHE,revision=B.1.0.00.01 \nhpuxwsAPACHE,revision=B.1.0.07.01 \nhpuxwsAPACHE,revision=B.1.0.08.01 \nhpuxwsAPACHE,revision=B.1.0.09.01 \nhpuxwsAPACHE,revision=B.1.0.10.01 \nhpuxwsAPACHE,revision=B.2.0.48.00 \nhpuxwsAPACHE,revision=B.2.0.49.00 \nhpuxwsAPACHE,revision=B.2.0.50.00 \nhpuxwsAPACHE,revision=B.2.0.51.00 \nhpuxwsAPACHE,revision=B.2.0.52.00 \nhpuxwsAPACHE,revision=B.2.0.53.00 \nhpuxwsAPACHE,revision=B.2.0.54.00 \nhpuxwsAPACHE,revision=B.2.0.55.00 \nhpuxwsAPACHE,revision=B.2.0.56.00 \nhpuxwsAPACHE,revision=B.2.0.58.00 \nhpuxwsAPACHE,revision=B.2.0.58.01 \nhpuxwsAPACHE,revision=B.2.0.59.00 \n\naction: install revision B.2.0.59.00.0 or subsequent \nrestart Apache \nURL: ftp://ssrt1476:ssrt1476@hprc.external.hp.com \n\nEND AFFECTED VERSIONS \n\n\nRESOLUTION\nHP has made the following available to resolve the vulnerability. \n\nOS Release \n Depot name \n MD5 Sum \n \nB.11.11 (IPv4)\n HPUXWSA-B218-01-1111ipv4.depot\n eb3bb933baac0f05e1e0809ef1e84eb2\n \nB.11.11 (IPv6) \n HPUXWSA-B218-01-1111ipv6.depot\n 540a56b155699336bcbfac0eaf87e3ce\n \nB.11.23 PA-32\n HPUXWSA-B218-01-1123-32.depot\n 2900a0cbea01b6905dc768680fbd5381\n \nB.11.23 IA-64\n HPUXWSA-B218-01-1123-64.depot\n 3be084d96e8a509692e37c71c0184014\n \nB.11.31 PA-32\n HPUXWSA-B218-01-1131-32.depot\n 861122eef70f1b53d68c5adafc64cdb5\n \nB.11.31 IA-64\n HPUXWSA-B218-01-1131-64.depot\n 8dc57222257fe27fb5994da16e91f9a4\n \n\nThe updates are available from: \nftp://ssrt1476:ssrt1476@hprc.external.hp.com/ \nftp://ssrt1476:ssrt1476@192.170.19.100/ \n\nMANUAL ACTIONS: Yes - Update \nInstall Apache 2.0.59.00.0 or subsequent. \n\nPRODUCT SPECIFIC INFORMATION \nHP-UX Software Assistant: \nHP-UX Software Assistant is an enhanced application that replaces HP-UX Security Patch Check. It analyzes all HP-issued Security Bulletins and lists recommended actions that may apply to a specific HP-UX system. It can also download patches and create a depot automatically. \nFor more information see: https://www.hp.com/go/swa \n\nHISTORY \nRevision: 1 (rev.1) - 10 October 2007 Initial release \n\nThird Party Security Patches: \nThird party security patches which are to be installed on systems running HP software products should be applied in accordance with the customer's patch management policy. \n\n\nSupport: For further information, contact normal HP Services support channel. \n\nReport: To report a potential security vulnerability with any HP supported product, send Email to: security-alert@hp.com \nIt is strongly recommended that security related information being communicated to HP be encrypted using PGP, especially exploit information. \nTo get the security-alert PGP key, please send an e-mail message as follows:\n To: security-alert@hp.com \n Subject: get key\n\nSubscribe: To initiate a subscription to receive future HP Security Bulletins via Email: \nhttp://h30046.www3.hp.com/driverAlertProfile.php?regioncode=NA&langcode=USENG&jumpid=in_SC-GEN__driverITRC&topiccode=ITRC \nOn the web page: ITRC security bulletins and patch sign-up \nUnder Step1: your ITRC security bulletins and patches \n -check ALL categories for which alerts are required and continue. \nUnder Step2: your ITRC operating systems \n -verify your operating system selections are checked and save. \n\n\nTo update an existing subscription: http://h30046.www3.hp.com/subSignIn.php \nLog in on the web page: Subscriber's choice for Business: sign-in. \nOn the web page: Subscriber's Choice: your profile summary - use Edit Profile to update appropriate sections. \n\n\nTo review previously published Security Bulletins visit: http://www.itrc.hp.com/service/cki/secBullArchive.do \n\n\n* The Software Product Category that this Security Bulletin relates to is represented by the 5th and 6th characters of the Bulletin number in the title: \n\nGN = HP General SW\nMA = HP Management Agents\nMI = Misc. 3rd Party SW\nMP = HP MPE/iX\nNS = HP NonStop Servers\nOV = HP OpenVMS \nPI = HP Printing & Imaging\nST = HP Storage SW\nTL = HP Trusted Linux\n\nTU = HP Tru64 UNIX\nUX = HP-UX\nVV = HP VirtualVault\n \n\nSystem management and security procedures must be reviewed frequently to maintain system integrity. HP is continually reviewing and enhancing the security features of software products to provide customers with current secure solutions. \n\n\n\"HP is broadly distributing this Security Bulletin in order to bring to the attention of users of the affected HP products the important security information contained in this Bulletin. HP recommends that all users determine the applicability of this information to their individual situations and take appropriate action. HP does not warrant that this information is necessarily accurate or complete for all user situations and, consequently, HP will not be responsible for any damages resulting from user's use or disregard of the information provided in this Bulletin. To the extent permitted by law, HP disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose, title and non-infringement.\"\n\n\\xa9Copyright 2007 Hewlett-Packard Development Company, L.P. \n\nHewlett-Packard Company shall not be liable for technical or editorial errors or omissions contained herein. The information provided is provided \"as is\" without warranty of any kind. To the extent permitted by law, neither HP or its affiliates, subcontractors or suppliers will be liable for incidental,special or consequential damages including downtime cost; lost profits;damages relating to the procurement of substitute products or services; or damages for loss of data, or software restoration. The information in this document is subject to change without notice. Hewlett-Packard Company and the names of Hewlett-Packard products referenced herein are trademarks of Hewlett-Packard Company in the United States and other countries. Other product and company names mentioned herein may be trademarks of their respective owners. \n-----BEGIN PGP SIGNATURE-----\nVersion: PGP 8.1\n\niQA/AwUBRw4UMuAfOvwtKn1ZEQLDowCgnVZZuBkuV66atvv6mh6sxARqYYkAmQEy\n7CP41v96ckMOtfU4yeG76pv2\n=VMzd\n-----END PGP SIGNATURE-----\n. -----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA1\n\n- ------------------------------------------------------------------------\n VMware Security Advisory\n\nAdvisory ID: VMSA-2009-0010\nSynopsis: VMware Hosted products update libpng and Apache HTTP\n Server\nIssue date: 2009-08-20\nUpdated on: 2009-08-20 (initial release of advisory)\nCVE numbers: CVE-2009-0040 CVE-2007-3847 CVE-2007-1863\n CVE-2006-5752 CVE-2007-3304 CVE-2007-6388\n CVE-2007-5000 CVE-2008-0005\n- ------------------------------------------------------------------------\n\n1. Summary\n\n Updated VMware Hosted products address security issues in libpng and\n the Apace HTTP Server. \n\n2. Relevant releases\n\n VMware Workstation 6.5.2 and earlier,\n VMware Player 2.5.2 and earlier,\n VMware ACE 2.5.2 and earlier\n\n3. Problem Description\n\n a. Third Party Library libpng Updated to 1.2.35\n\n Several flaws were discovered in the way third party library libpng\n handled uninitialized pointers. An attacker could create a PNG image\n file in such a way, that when loaded by an application linked to\n libpng, it could cause the application to crash or execute arbitrary\n code at the privilege level of the user that runs the application. \n\n The Common Vulnerabilities and Exposures project (cve.mitre.org)\n has assigned the name CVE-2009-0040 to this issue. \n\n The following table lists what action remediates the vulnerability\n (column 4) if a solution is available. \n\n VMware Product Running Replace with/\n Product Version on Apply Patch\n ============= ======== ======= =================\n VirtualCenter any Windows not affected\n\n Workstation 6.5.x any 6.5.3 build 185404 or later\n\n Player 2.5.x any 2.5.3 build 185404 or later\n\n ACE 2.5.x any 2.5.3 build 185404 or later\n\n Server 2.x any patch pending\n Server 1.x any patch pending\n\n Fusion 2.x Mac OS/X not affected\n Fusion 1.x Mac OS/X not affected\n\n ESXi 4.0 ESXi not affected\n ESXi 3.5 ESXi not affected\n\n ESX 4.0 ESX not affected\n ESX 3.5 ESX not affected\n ESX 3.0.3 ESX not affected\n ESX 3.0.2 ESX not affected\n ESX 2.5.5 ESX not affected *\n\n * The libpng update for the Service Console of ESX 2.5.5 is\n documented in VMSA-2009-0007. \n\n b. Apache HTTP Server updated to 2.0.63\n\n The new version of ACE updates the Apache HTTP Server on Windows\n hosts to version 2.0.63 which addresses multiple security issues\n that existed in the previous versions of this server. \n\n The Common Vulnerabilities and Exposures project (cve.mitre.org)\n has assigned the names CVE-2007-3847, CVE-2007-1863, CVE-2006-5752,\n CVE-2007-3304, CVE-2007-6388, CVE-2007-5000, CVE-2008-0005 to the\n issues that have been addressed by this update. \n\n The following table lists what action remediates the vulnerability\n (column 4) if a solution is available. \n\n VMware Product Running Replace with/\n Product Version on Apply Patch\n ============= ======== ======= =================\n VirtualCenter any Windows not affected\n\n Workstation 6.5.x any not affected\n\n Player 2.5.x any not affected\n\n ACE 2.5.x Windows 2.5.3 build 185404 or later\n ACE 2.5.x Linux update Apache on host system *\n\n Server 2.x any not affected\n Server 1.x any not affected\n\n Fusion 2.x Mac OS/X not affected\n Fusion 1.x Mac OS/X not affected\n\n ESXi 4.0 ESXi not affected\n ESXi 3.5 ESXi not affected\n\n ESX 4.0 ESX not affected\n ESX 3.5 ESX not affected\n ESX 3.0.3 ESX not affected\n ESX 3.0.2 ESX not affected\n ESX 2.5.5 ESX not affected\n\n * The Apache HTTP Server is not part of an ACE install on a Linux\n host. Update the Apache HTTP Server on the host system to version\n 2.0.63 in order to remediate the vulnerabilities listed above. \n\n4. Solution\n\n Please review the patch/release notes for your product and version\n and verify the md5sum and/or the sha1sum of your downloaded file. \n\n VMware Workstation 6.5.3\n ------------------------\n http://www.vmware.com/download/ws/\n Release notes:\n http://www.vmware.com/support/ws65/doc/releasenotes_ws653.html\n\n For Windows\n\n Workstation for Windows 32-bit and 64-bit\n Windows 32-bit and 64-bit .exe\n md5sum: 7565d16b7d7e0173b90c3b76ca4656bc\n sha1sum: 9f687afd8b0f39cde40aeceb3213a91be487aad1\n\n For Linux\n\n Workstation for Linux 32-bit\n Linux 32-bit .rpm\n md5sum: 4d55c491bd008ded0ea19f373d1d1fd4\n sha1sum: 1f43131c960e76a530390d3b6984c78dfc2da23e\n\n Workstation for Linux 32-bit\n Linux 32-bit .bundle\n md5sum: d4a721c1918c0e8a87c6fa4bad49ad35\n sha1sum: c0c6f9b56e70bd3ffdb5467ee176110e283a69e5\n\n Workstation for Linux 64-bit\n Linux 64-bit .rpm\n md5sum: 72adfdb03de4959f044fcb983412ae7c\n sha1sum: ba16163c8d9b5aa572526b34a7b63dc6e68f9bbb\n\n Workstation for Linux 64-bit\n Linux 64-bit .bundle\n md5sum: 83e1f0c94d6974286256c4d3b559e854\n sha1sum: 8763f250a3ac5fc4698bd26319b93fecb498d542\n\n\n VMware Player 2.5.3\n -------------------\n http://www.vmware.com/download/player/\n Release notes:\n http://www.vmware.com/support/player25/doc/releasenotes_player253.html\n\n Player for Windows binary\n\nhttp://download3.vmware.com/software/vmplayer/VMware-player-2.5.3-185404.exe\n md5sum: fe28f193374c9457752ee16cd6cad4e7\n sha1sum: 13bd3ff93c04fa272544d3ef6de5ae746708af04\n\n Player for Linux (.rpm)\n\nhttp://download3.vmware.com/software/vmplayer/VMware-Player-2.5.3-185404.i386.rpm\n md5sum: c99cd65f19fdfc7651bcb7f328b73bc2\n sha1sum: a33231b26e2358a72d16e1b4e2656a5873fe637e\n\n Player for Linux (.bundle)\n\nhttp://download3.vmware.com/software/vmplayer/VMware-Player-2.5.3-185404.i386.bundle\n md5sum: 210f4cb5615bd3b2171bc054b9b2bac5\n sha1sum: 2f6497890b17b37480165bab9f430e8645edae9b\n\n Player for Linux - 64-bit (.rpm)\n\nhttp://download3.vmware.com/software/vmplayer/VMware-Player-2.5.3-185404.x86_64.rpm\n md5sum: f91576ef90b322d83225117ae9335968\n sha1sum: f492fa9cf26ee2818f164aac04cde1680c25d974\n\n Player for Linux - 64-bit (.bundle)\n\nhttp://download3.vmware.com/software/vmplayer/VMware-Player-2.5.3-185404.x86_64.bundle\n md5sum: 595d44d7945c129b1aeb679d2f001b05\n sha1sum: acd69fcb0c6bc49fd4af748c65c7fb730ab1e8c4\n\n\n VMware ACE 2.5.3\n ----------------\n http://www.vmware.com/download/ace/\n Release notes:\n http://www.vmware.com/support/ace25/doc/releasenotes_ace253.html\n\n ACE Management Server Virtual Appliance\n AMS Virtual Appliance .zip\n md5sum: 44cc7b86353047f02cf6ea0653e38418\n sha1sum: 9f44b15e6681a6e58dd20784f829c68091a62cd1\n\n VMware ACE for Windows 32-bit and 64-bit\n Windows 32-bit and 64-bit .exe\n md5sum: 0779da73408c5e649e0fd1c62d23820f\n sha1sum: 2b2e4963adc89f3b642874685f490222523b63ef\n\n ACE Management Server for Windows\n Windows .exe\n md5sum: 0779da73408c5e649e0fd1c62d23820f\n sha1sum: 2b2e4963adc89f3b642874685f490222523b63ef\n\n ACE Management Server for SUSE Enterprise Linux 9\n SLES 9 .rpm\n md5sum: a4fc92d7197f0d569361cdf4b8cca642\n sha1sum: af8a135cca398cacaa82c8c3c325011c6cd3ed75\n\n ACE Management Server for Red Hat Enterprise Linux 4\n RHEL 4 .rpm\n md5sum: 841005151338c8b954f08d035815fd58\n sha1sum: 67e48624dba20e6be9e41ec9a5aba407dd8cc01e\n\n\n5. References\n\n CVE numbers\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0040\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3847\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1863\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-5752\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3304\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6388\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5000\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0005\n\n- ------------------------------------------------------------------------\n6. Change log\n\n2009-08-20 VMSA-2009-0010\nInitial security advisory after release of Workstation 6.5.3,\nPlayer 2.5.3, and ACE 2.5.3 on 2009-08-20. \n\n\n- ------------------------------------------------------------------------\n7. Contact\n\nE-mail list for product security notifications and announcements:\nhttp://lists.vmware.com/cgi-bin/mailman/listinfo/security-announce\n\nThis Security Advisory is posted to the following lists:\n\n * security-announce at lists.vmware.com\n * bugtraq at securityfocus.com\n * full-disclosure at lists.grok.org.uk\n\nE-mail: security at vmware.com\nPGP key at: http://kb.vmware.com/kb/1055\n\nVMware Security Center\nhttp://www.vmware.com/security\n\nVMware security response policy\nhttp://www.vmware.com/support/policies/security_response.html\n\nGeneral support life cycle policy\nhttp://www.vmware.com/support/policies/eos.html\n\nVMware Infrastructure support life cycle policy\nhttp://www.vmware.com/support/policies/eos_vi.html\n\nCopyright 2009 VMware Inc. All rights reserved. =========================================================== \nUbuntu Security Notice USN-499-1 August 16, 2007\napache2 vulnerabilities\nCVE-2006-5752, CVE-2007-1863, CVE-2007-3304\n===========================================================\n\nA security issue affects the following Ubuntu releases:\n\nUbuntu 6.06 LTS\nUbuntu 6.10\nUbuntu 7.04\n\nThis advisory also applies to the corresponding versions of\nKubuntu, Edubuntu, and Xubuntu. \n\nThe problem can be corrected by upgrading your system to the\nfollowing package versions:\n\nUbuntu 6.06 LTS:\n apache2-common 2.0.55-4ubuntu2.2\n apache2-mpm-prefork 2.0.55-4ubuntu2.2\n apache2-mpm-worker 2.0.55-4ubuntu2.2\n\nUbuntu 6.10:\n apache2-common 2.0.55-4ubuntu4.1\n apache2-mpm-prefork 2.0.55-4ubuntu4.1\n apache2-mpm-worker 2.0.55-4ubuntu4.1\n\nUbuntu 7.04:\n apache2-mpm-prefork 2.2.3-3.2ubuntu0.1\n apache2-mpm-worker 2.2.3-3.2ubuntu0.1\n apache2.2-common 2.2.3-3.2ubuntu0.1\n\nIn general, a standard system upgrade is sufficient to effect the\nnecessary changes. \n\nDetails follow:\n\nStefan Esser discovered that mod_status did not force a character set,\nwhich could result in browsers becoming vulnerable to XSS attacks when\nprocessing the output. If a user were tricked into viewing server\nstatus output during a crafted server request, a remote attacker could\nexploit this to modify the contents, or steal confidential data (such as\npasswords), within the same domain. By default, mod_status is disabled\nin Ubuntu. (CVE-2006-5752)\n\nNiklas Edmundsson discovered that the mod_cache module could be made to\ncrash using a specially crafted request. A remote user could use this\nto cause a denial of service if Apache was configured to use a threaded\nworker. By default, mod_cache is disabled in Ubuntu. (CVE-2007-1863)\n\nA flaw was discovered in the signal handling of Apache. A local\nattacker could trick Apache into sending SIGUSR1 to other processes. \nThe vulnerable code was only present in Ubuntu Feisty. (CVE-2007-3304)\n\n\nUpdated packages for Ubuntu 6.06 LTS:\n\n Source archives:\n\n http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2_2.0.55-4ubuntu2.2.diff.gz\n Size/MD5: 115882 e94e45574e3b131d3a9a0e07e193f1e5\n http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2_2.0.55-4ubuntu2.2.dsc\n Size/MD5: 1148 c2bc143625fbf8ca59fea300845c5a42\n http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2_2.0.55.orig.tar.gz\n Size/MD5: 6092031 45e32c9432a8e3cf4227f5af91b03622\n\n Architecture independent packages:\n\n http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-doc_2.0.55-4ubuntu2.2_all.deb\n Size/MD5: 2124364 9b8ca5d5757c63f5ee6bbd507f0a8357\n\n amd64 architecture (Athlon64, Opteron, EM64T Xeon)\n\n http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-common_2.0.55-4ubuntu2.2_amd64.deb\n Size/MD5: 833000 be4c7770c725f5f4401ca06d1347211f\n http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-perchild_2.0.55-4ubuntu2.2_amd64.deb\n Size/MD5: 227832 41c12dfe84f109e6544a33e4e1d791a8\n http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-prefork_2.0.55-4ubuntu2.2_amd64.deb\n Size/MD5: 222934 7e4d072bad27239e366a6eda94c09190\n http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-worker_2.0.55-4ubuntu2.2_amd64.deb\n Size/MD5: 227576 8fc59f78a3fa0e5d6dac81e875039bda\n http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-prefork-dev_2.0.55-4ubuntu2.2_amd64.deb\n Size/MD5: 171082 4318f93373b705563251f377ed398614\n http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-threaded-dev_2.0.55-4ubuntu2.2_amd64.deb\n Size/MD5: 171860 257f4183d70be5a00546c39c5a18f108\n http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-utils_2.0.55-4ubuntu2.2_amd64.deb\n Size/MD5: 93916 695cee55f91ceb9424abe31d8b6ee1dd\n http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2_2.0.55-4ubuntu2.2_amd64.deb\n Size/MD5: 35902 00c1082a77ff1d863f72874c4472a26d\n http://security.ubuntu.com/ubuntu/pool/main/a/apache2/libapr0-dev_2.0.55-4ubuntu2.2_amd64.deb\n Size/MD5: 285336 0a8510634b21f56f0d9619aa6fc9cec9\n http://security.ubuntu.com/ubuntu/pool/main/a/apache2/libapr0_2.0.55-4ubuntu2.2_amd64.deb\n Size/MD5: 143952 d75f83ac219bce95a15a8f44b82b8ea7\n\n i386 architecture (x86 compatible Intel/AMD)\n\n http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-common_2.0.55-4ubuntu2.2_i386.deb\n Size/MD5: 786186 4e78fa0d438867194f66b11b4eb6fc2e\n http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-perchild_2.0.55-4ubuntu2.2_i386.deb\n Size/MD5: 202448 74cf60884e18c1fc93f157010a15b12c\n http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-prefork_2.0.55-4ubuntu2.2_i386.deb\n Size/MD5: 198456 209a0b92995fec453ed4c2c181e3e555\n http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-worker_2.0.55-4ubuntu2.2_i386.deb\n Size/MD5: 202038 6cbd437caf993fa2b2b38369cd3d5863\n http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-prefork-dev_2.0.55-4ubuntu2.2_i386.deb\n Size/MD5: 171074 0a5a26aa58af7aa2d51d1cf5d7c543d6\n http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-threaded-dev_2.0.55-4ubuntu2.2_i386.deb\n Size/MD5: 171848 af9ca78febc5bc0c7936296dab958349\n http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-utils_2.0.55-4ubuntu2.2_i386.deb\n Size/MD5: 91884 2857d60b507b28c736f83815c9f3d1b8\n http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2_2.0.55-4ubuntu2.2_i386.deb\n Size/MD5: 35906 202b5b233af0d26e29ca7302cf7fd04c\n http://security.ubuntu.com/ubuntu/pool/main/a/apache2/libapr0-dev_2.0.55-4ubuntu2.2_i386.deb\n Size/MD5: 261418 c90342706ac26682d15032a5ba5cb51a\n http://security.ubuntu.com/ubuntu/pool/main/a/apache2/libapr0_2.0.55-4ubuntu2.2_i386.deb\n Size/MD5: 131850 951a4573901bc2f10d5febf940d57516\n\n powerpc architecture (Apple Macintosh G3/G4/G5)\n\n http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-common_2.0.55-4ubuntu2.2_powerpc.deb\n Size/MD5: 859126 afdd8642ca447fc9dc70dfed92be0fa6\n http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-perchild_2.0.55-4ubuntu2.2_powerpc.deb\n Size/MD5: 219898 6d9c9f924d2356bf9d3438a280870a7d\n http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-prefork_2.0.55-4ubuntu2.2_powerpc.deb\n Size/MD5: 215602 dd554132cdea0f860e01cf5d4e0dbc7c\n http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-worker_2.0.55-4ubuntu2.2_powerpc.deb\n Size/MD5: 219378 7a1f4b325dacef287c901fa66680c04e\n http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-prefork-dev_2.0.55-4ubuntu2.2_powerpc.deb\n Size/MD5: 171096 a0e2547d38ef1b84dc419d69e42ffa0b\n http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-threaded-dev_2.0.55-4ubuntu2.2_powerpc.deb\n Size/MD5: 171864 200ab662b2c13786658486df37fda881\n http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-utils_2.0.55-4ubuntu2.2_powerpc.deb\n Size/MD5: 103628 ae36642fbd4698bb362fa4bf9417b0e3\n http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2_2.0.55-4ubuntu2.2_powerpc.deb\n Size/MD5: 35910 358027282f2f19451d3aa784dc0474dc\n http://security.ubuntu.com/ubuntu/pool/main/a/apache2/libapr0-dev_2.0.55-4ubuntu2.2_powerpc.deb\n Size/MD5: 280950 0d9b56ec076da25e2a03f6d3c6445057\n http://security.ubuntu.com/ubuntu/pool/main/a/apache2/libapr0_2.0.55-4ubuntu2.2_powerpc.deb\n Size/MD5: 141074 f5d3d5e0e5911e0c0156ae55af50f87b\n\n sparc architecture (Sun SPARC/UltraSPARC)\n\n http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-common_2.0.55-4ubuntu2.2_sparc.deb\n Size/MD5: 803440 d66da6a91c08956c3c5062668349ef41\n http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-perchild_2.0.55-4ubuntu2.2_sparc.deb\n Size/MD5: 209970 57f0a8f823a4502ee9a2608e3181cc81\n http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-prefork_2.0.55-4ubuntu2.2_sparc.deb\n Size/MD5: 205582 1dcfb0df796e85c409f614544ea589fe\n http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-worker_2.0.55-4ubuntu2.2_sparc.deb\n Size/MD5: 209330 6bf7ae824eea35d3487febef384fce91\n http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-prefork-dev_2.0.55-4ubuntu2.2_sparc.deb\n Size/MD5: 171080 1088337f4abcb6c8f65751b6120c2307\n http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-threaded-dev_2.0.55-4ubuntu2.2_sparc.deb\n Size/MD5: 171868 5cda04cd73a9c6d8dfc18abd55c09ebd\n http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-utils_2.0.55-4ubuntu2.2_sparc.deb\n Size/MD5: 92972 850ab3bb0904e8fe9b6255c42ba7f84c\n http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2_2.0.55-4ubuntu2.2_sparc.deb\n Size/MD5: 35904 7af260b95c4faa17ef34810fed888caf\n http://security.ubuntu.com/ubuntu/pool/main/a/apache2/libapr0-dev_2.0.55-4ubuntu2.2_sparc.deb\n Size/MD5: 267550 08182a8a2cab00fc0e6bca2cccf5165f\n http://security.ubuntu.com/ubuntu/pool/main/a/apache2/libapr0_2.0.55-4ubuntu2.2_sparc.deb\n Size/MD5: 129760 a60606c6d2f12209b0bdae997be4a13f\n\nUpdated packages for Ubuntu 6.10:\n\n Source archives:\n\n http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2_2.0.55-4ubuntu4.1.diff.gz\n Size/MD5: 116265 2732761b18dfb3c2cd1aa0b54c2cf623\n http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2_2.0.55-4ubuntu4.1.dsc\n Size/MD5: 1148 4b9c4612469c521db0c5fdbe2f6b9b25\n http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2_2.0.55.orig.tar.gz\n Size/MD5: 6092031 45e32c9432a8e3cf4227f5af91b03622\n\n Architecture independent packages:\n\n http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-doc_2.0.55-4ubuntu4.1_all.deb\n Size/MD5: 2124550 8d5c30342b35f9fd595fb09d7659b6fc\n\n amd64 architecture (Athlon64, Opteron, EM64T Xeon)\n\n http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-common_2.0.55-4ubuntu4.1_amd64.deb\n Size/MD5: 836342 2c4ba483b0b20fdc2d43819109177941\n http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-perchild_2.0.55-4ubuntu4.1_amd64.deb\n Size/MD5: 227390 e61cc1998f5b8f2c44dce587e59d288a\n http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-prefork_2.0.55-4ubuntu4.1_amd64.deb\n Size/MD5: 222376 6bdbff7f7f80fd464d1e3ec52d6e7171\n http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-worker_2.0.55-4ubuntu4.1_amd64.deb\n Size/MD5: 226848 4356b4caf2b40f364c8893c41b9f9355\n http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-prefork-dev_2.0.55-4ubuntu4.1_amd64.deb\n Size/MD5: 171304 c4395af051e876228541ef5b8037d979\n http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-threaded-dev_2.0.55-4ubuntu4.1_amd64.deb\n Size/MD5: 172074 99dadc4ad0f0947f9368d89f4589d95a\n http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-utils_2.0.55-4ubuntu4.1_amd64.deb\n Size/MD5: 94204 30f3bb8c72575fe93940ecc730b8e4b6\n http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2_2.0.55-4ubuntu4.1_amd64.deb\n Size/MD5: 36152 ea3cbefcbee7e2f6e5555edb44733ad9\n http://security.ubuntu.com/ubuntu/pool/main/a/apache2/libapr0-dev_2.0.55-4ubuntu4.1_amd64.deb\n Size/MD5: 286544 d555931490d44d93bec31c4bfc19ed12\n http://security.ubuntu.com/ubuntu/pool/main/a/apache2/libapr0_2.0.55-4ubuntu4.1_amd64.deb\n Size/MD5: 145014 3e06ceb0a55598d82f9f781c44e210b3\n\n i386 architecture (x86 compatible Intel/AMD)\n\n http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-common_2.0.55-4ubuntu4.1_i386.deb\n Size/MD5: 806938 050bb7665332d3761e1a8e47939fa507\n http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-perchild_2.0.55-4ubuntu4.1_i386.deb\n Size/MD5: 209556 ee530b24aba8838001ebb6c901bc90cd\n http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-prefork_2.0.55-4ubuntu4.1_i386.deb\n Size/MD5: 205718 b52a17c63909eae3c49bad0ab1958f4b\n http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-worker_2.0.55-4ubuntu4.1_i386.deb\n Size/MD5: 209158 1844fa5e09224a90944f8b886ddb5a2a\n http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-prefork-dev_2.0.55-4ubuntu4.1_i386.deb\n Size/MD5: 171296 9de8aba41f7e3d60f41536ca712adebb\n http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-threaded-dev_2.0.55-4ubuntu4.1_i386.deb\n Size/MD5: 172078 01ccd554177364747b08e2933f121d2c\n http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-utils_2.0.55-4ubuntu4.1_i386.deb\n Size/MD5: 93240 4573597317416869646eb2ea42cd0945\n http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2_2.0.55-4ubuntu4.1_i386.deb\n Size/MD5: 36150 77666d65bade6a91bd58826c79f11dc9\n http://security.ubuntu.com/ubuntu/pool/main/a/apache2/libapr0-dev_2.0.55-4ubuntu4.1_i386.deb\n Size/MD5: 266390 a3963d8e76f6865404f7fadb47880c87\n http://security.ubuntu.com/ubuntu/pool/main/a/apache2/libapr0_2.0.55-4ubuntu4.1_i386.deb\n Size/MD5: 137604 387f6bcdaa58dbbe53082241b3231844\n\n powerpc architecture (Apple Macintosh G3/G4/G5)\n\n http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-common_2.0.55-4ubuntu4.1_powerpc.deb\n Size/MD5: 865372 27d7f1de1fcb2114d3f3b0a774302488\n http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-perchild_2.0.55-4ubuntu4.1_powerpc.deb\n Size/MD5: 221542 1ae8fa5cf4b77f3b2aa054e2886e587e\n http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-prefork_2.0.55-4ubuntu4.1_powerpc.deb\n Size/MD5: 217044 9134983c40107f79fcac8d1eacbc7117\n http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-worker_2.0.55-4ubuntu4.1_powerpc.deb\n Size/MD5: 221324 b435dc09c63ecbcd564a0923a8f07350\n http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-prefork-dev_2.0.55-4ubuntu4.1_powerpc.deb\n Size/MD5: 171296 6d2a0abfb7a1daaeae56559eeb322dcb\n http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-threaded-dev_2.0.55-4ubuntu4.1_powerpc.deb\n Size/MD5: 172064 ecc2037409554ea43c5a6848aa510c76\n http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-utils_2.0.55-4ubuntu4.1_powerpc.deb\n Size/MD5: 104654 d0957d8df044c4a34437241792ed97d1\n http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2_2.0.55-4ubuntu4.1_powerpc.deb\n Size/MD5: 36148 34e102e1d2e1c6a6f31801dfb98cb82a\n http://security.ubuntu.com/ubuntu/pool/main/a/apache2/libapr0-dev_2.0.55-4ubuntu4.1_powerpc.deb\n Size/MD5: 284548 c8f325ccc42cbe77191d4ddd9abc2a4e\n http://security.ubuntu.com/ubuntu/pool/main/a/apache2/libapr0_2.0.55-4ubuntu4.1_powerpc.deb\n Size/MD5: 144238 82cfbfcec5fc4931078145af8947c035\n\n sparc architecture (Sun SPARC/UltraSPARC)\n\n http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-common_2.0.55-4ubuntu4.1_sparc.deb\n Size/MD5: 811594 d8548e537fd81994bbb638e105dfbf8b\n http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-perchild_2.0.55-4ubuntu4.1_sparc.deb\n Size/MD5: 212160 81cd0197ff89b79c967c1074ede9f8d7\n http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-prefork_2.0.55-4ubuntu4.1_sparc.deb\n Size/MD5: 207870 5d80ed8dc39b0d4d59fccb747624a684\n http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-worker_2.0.55-4ubuntu4.1_sparc.deb\n Size/MD5: 211578 9407383d85db831dab728b39cce9acc8\n http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-prefork-dev_2.0.55-4ubuntu4.1_sparc.deb\n Size/MD5: 171294 5e4d695a99bdc1fdfb0bfcef8b91d03d\n http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-threaded-dev_2.0.55-4ubuntu4.1_sparc.deb\n Size/MD5: 172064 06e3e765d799e281dba7329ff9d9e138\n http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-utils_2.0.55-4ubuntu4.1_sparc.deb\n Size/MD5: 93796 1048b47b289fb2047fa9ac7ebbe94a57\n http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2_2.0.55-4ubuntu4.1_sparc.deb\n Size/MD5: 36150 0d106a177aa4271b1cfc0e96eec1a748\n http://security.ubuntu.com/ubuntu/pool/main/a/apache2/libapr0-dev_2.0.55-4ubuntu4.1_sparc.deb\n Size/MD5: 268444 3912123e7c71cc638132305ca89fe23b\n http://security.ubuntu.com/ubuntu/pool/main/a/apache2/libapr0_2.0.55-4ubuntu4.1_sparc.deb\n Size/MD5: 130626 f4444e0239c2da7d3c31e3486606f95a\n\nUpdated packages for Ubuntu 7.04:\n\n Source archives:\n\n http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2_2.2.3-3.2ubuntu0.1.diff.gz\n Size/MD5: 112120 f7b1a17718aed7ca73da3a6d7aad06b0\n http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2_2.2.3-3.2ubuntu0.1.dsc\n Size/MD5: 1128 e82b1bee591fff50d6673ed1a443e543\n http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2_2.2.3.orig.tar.gz\n Size/MD5: 6342475 f72ffb176e2dc7b322be16508c09f63c\n\n Architecture independent packages:\n\n http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-doc_2.2.3-3.2ubuntu0.1_all.deb\n Size/MD5: 2199184 c03756f87cb164213428532f70e0c198\n http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-perchild_2.2.3-3.2ubuntu0.1_all.deb\n Size/MD5: 272064 5be351f491f8d1aae9a270d1214e93e3\n http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-src_2.2.3-3.2ubuntu0.1_all.deb\n Size/MD5: 6674104 bdbabf8f478562f0e003737e977ffc7b\n http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2_2.2.3-3.2ubuntu0.1_all.deb\n Size/MD5: 38668 9f0c7c01e8441285c084002eb4619065\n\n amd64 architecture (Athlon64, Opteron, EM64T Xeon)\n\n http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-event_2.2.3-3.2ubuntu0.1_amd64.deb\n Size/MD5: 449624 1b54a8000c40eaaa0f9e31527b9bb180\n http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-prefork_2.2.3-3.2ubuntu0.1_amd64.deb\n Size/MD5: 445346 d15625641a3247fbf5d9d9b9aed34968\n http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-worker_2.2.3-3.2ubuntu0.1_amd64.deb\n Size/MD5: 449208 55f39c28a4de98d53f80231aeb7d6c59\n http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-prefork-dev_2.2.3-3.2ubuntu0.1_amd64.deb\n Size/MD5: 403570 0042c75be8a2d128d62b79398deaefa8\n http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-threaded-dev_2.2.3-3.2ubuntu0.1_amd64.deb\n Size/MD5: 404138 929772b95ea67f338ad423a65b2b7011\n http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-utils_2.2.3-3.2ubuntu0.1_amd64.deb\n Size/MD5: 341312 906819b0de863209575aa65d39a594a5\n http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2.2-common_2.2.3-3.2ubuntu0.1_amd64.deb\n Size/MD5: 971462 f85e32c5f6437ce149553aee97ffd934\n\n i386 architecture (x86 compatible Intel/AMD)\n\n http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-event_2.2.3-3.2ubuntu0.1_i386.deb\n Size/MD5: 432922 c1b81ac7dc7b7a0b2261fd10d9bcf5c6\n http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-prefork_2.2.3-3.2ubuntu0.1_i386.deb\n Size/MD5: 428856 f506f2a9dd2dbd5c2d3f72a476cc3537\n http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-worker_2.2.3-3.2ubuntu0.1_i386.deb\n Size/MD5: 432314 a5a11947ad8cf14604efa7ddcfd20bfe\n http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-prefork-dev_2.2.3-3.2ubuntu0.1_i386.deb\n Size/MD5: 403574 da84a3a99276f14a11ac892ce7eee170\n http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-threaded-dev_2.2.3-3.2ubuntu0.1_i386.deb\n Size/MD5: 404138 0fdd43a53e6957aa3a348a7bd9c876f5\n http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-utils_2.2.3-3.2ubuntu0.1_i386.deb\n Size/MD5: 340396 88a0ddbc58335416d91c9f10adc9d5f5\n http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2.2-common_2.2.3-3.2ubuntu0.1_i386.deb\n Size/MD5: 929716 138d58487b882e6002e3c5e4a9489add\n\n powerpc architecture (Apple Macintosh G3/G4/G5)\n\n http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-event_2.2.3-3.2ubuntu0.1_powerpc.deb\n Size/MD5: 451530 ddc437092ef642fcd396713cd1972f4c\n http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-prefork_2.2.3-3.2ubuntu0.1_powerpc.deb\n Size/MD5: 446960 af1b667708e062f81bca4e995355394d\n http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-worker_2.2.3-3.2ubuntu0.1_powerpc.deb\n Size/MD5: 450940 ed9f31ec5045a88446115987c6e97655\n http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-prefork-dev_2.2.3-3.2ubuntu0.1_powerpc.deb\n Size/MD5: 403574 65801ab51335a15dc370b9341a0e50dd\n http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-threaded-dev_2.2.3-3.2ubuntu0.1_powerpc.deb\n Size/MD5: 404146 fd35e65fadd836feb0190b209947b466\n http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-utils_2.2.3-3.2ubuntu0.1_powerpc.deb\n Size/MD5: 360518 b74bc9eead429cd8f0ebecd6a94e5edb\n http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2.2-common_2.2.3-3.2ubuntu0.1_powerpc.deb\n Size/MD5: 1073812 376fe5b1ee383a6d870eea5dd3c6a704\n\n sparc architecture (Sun SPARC/UltraSPARC)\n\n http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-event_2.2.3-3.2ubuntu0.1_sparc.deb\n Size/MD5: 434408 c70ef2e9aed191fe53886ceb3725596e\n http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-prefork_2.2.3-3.2ubuntu0.1_sparc.deb\n Size/MD5: 430574 7b690896da23a151ee5e106d596c1143\n http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-worker_2.2.3-3.2ubuntu0.1_sparc.deb\n Size/MD5: 433918 cc01edfcfc673ba9a86c83fcc66e6870\n http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-prefork-dev_2.2.3-3.2ubuntu0.1_sparc.deb\n Size/MD5: 403568 a7660cff70394403c764cf8f30c7298a\n http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-threaded-dev_2.2.3-3.2ubuntu0.1_sparc.deb\n Size/MD5: 404136 b8587d5eba0be59a6576d6cf645b2122\n http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-utils_2.2.3-3.2ubuntu0.1_sparc.deb\n Size/MD5: 343370 1572a001a612add57d23350210ac1736\n http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2.2-common_2.2.3-3.2ubuntu0.1_sparc.deb\n Size/MD5: 938586 b74a91fcfbb0503355e94981310bd1ce\n\n", sources: [ { db: "NVD", id: "CVE-2007-3304", }, { db: "JVNDB", id: "JVNDB-2007-000477", }, { db: "BID", id: "24215", }, { db: "VULMON", id: "CVE-2007-3304", }, { db: "PACKETSTORM", id: "57505", }, { db: "PACKETSTORM", id: "60759", }, { db: "PACKETSTORM", id: "60039", }, { db: "PACKETSTORM", id: "80533", }, { db: "PACKETSTORM", id: "57507", }, { db: "PACKETSTORM", id: "58667", }, ], trust: 2.52, }, external_ids: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/external_ids#", data: { "@container": "@list", }, sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, }, }, data: [ { db: "NVD", id: "CVE-2007-3304", trust: 3.4, }, { db: "BID", id: "24215", trust: 2.8, }, { db: "VUPEN", id: "ADV-2007-3100", trust: 1.7, }, { db: "VUPEN", id: "ADV-2007-3283", trust: 1.7, }, { db: "VUPEN", id: "ADV-2007-2727", trust: 1.7, }, { db: "VUPEN", id: "ADV-2007-4305", trust: 1.7, }, { db: "VUPEN", id: "ADV-2008-0233", trust: 1.7, }, { db: "VUPEN", id: "ADV-2007-3494", trust: 1.7, }, { db: "VUPEN", id: "ADV-2007-3420", trust: 1.7, }, { db: "SECUNIA", id: "26211", trust: 1.7, }, { db: "SECUNIA", id: "27732", trust: 1.7, }, { db: "SECUNIA", id: "25920", trust: 1.7, }, { db: "SECUNIA", id: "26759", trust: 1.7, }, { db: "SECUNIA", id: "26993", trust: 1.7, }, { db: "SECUNIA", id: "28212", trust: 1.7, }, { db: "SECUNIA", id: "28606", trust: 1.7, }, { db: "SECUNIA", id: "28224", trust: 1.7, }, { db: "SECUNIA", id: "26790", trust: 1.7, }, { db: "SECUNIA", id: "26842", trust: 1.7, }, { db: "SECUNIA", id: "27563", trust: 1.7, }, { db: "SECUNIA", id: "27209", trust: 1.7, }, { db: "SECUNIA", id: "27121", trust: 1.7, }, { db: "SECUNIA", id: "26508", trust: 1.7, }, { db: "SECUNIA", id: "26443", trust: 1.7, }, { db: "SECUNIA", id: "26822", trust: 1.7, }, { db: "SECUNIA", id: "26611", trust: 1.7, }, { db: "SECUNIA", id: "26273", trust: 1.7, }, { db: "SECUNIA", id: "25827", trust: 1.7, }, { db: "SECUNIA", id: "25830", trust: 1.7, }, { db: "SREASON", id: "2814", trust: 1.7, }, { db: "OSVDB", id: "38939", trust: 1.7, }, { db: "SECTRACK", id: "1018304", trust: 1.7, }, { db: "JVNDB", id: "JVNDB-2007-000477", trust: 0.8, }, { db: "CNNVD", id: "CNNVD-200706-316", trust: 0.6, }, { db: "VULMON", id: "CVE-2007-3304", trust: 0.1, }, { db: "PACKETSTORM", id: "57505", trust: 0.1, }, { db: "PACKETSTORM", id: "60759", trust: 0.1, }, { db: "PACKETSTORM", id: "60039", trust: 0.1, }, { db: "PACKETSTORM", id: "80533", trust: 0.1, }, { db: "PACKETSTORM", id: "57507", trust: 0.1, }, { db: "PACKETSTORM", id: "58667", trust: 0.1, }, ], sources: [ { db: "VULMON", id: "CVE-2007-3304", }, { db: "BID", id: "24215", }, { db: "JVNDB", id: "JVNDB-2007-000477", }, { db: "PACKETSTORM", id: "57505", }, { db: "PACKETSTORM", id: "60759", }, { db: "PACKETSTORM", id: "60039", }, { db: "PACKETSTORM", id: "80533", }, { db: "PACKETSTORM", id: "57507", }, { db: "PACKETSTORM", id: "58667", }, { db: "CNNVD", id: "CNNVD-200706-316", }, { db: "NVD", id: "CVE-2007-3304", }, ], }, id: "VAR-200705-0681", iot: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/iot#", sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, }, }, data: true, sources: [ { db: "VARIoT devices database", id: null, }, ], trust: 0.16519225, }, last_update_date: "2024-11-29T21:27:08.901000Z", patch: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/patch#", data: { "@container": "@list", }, sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, }, }, data: [ { title: "Fixed in Apache httpd 1.3.39-dev", trust: 0.8, url: "http://httpd.apache.org/security/vulnerabilities_13.html#1.3.39-dev", }, { title: "Fixed in Apache httpd 2.0.61-dev", trust: 0.8, url: "http://httpd.apache.org/security/vulnerabilities_20.html#2.0.61-dev", }, { title: "Fixed in Apache httpd 2.2.6-dev", trust: 0.8, url: "http://httpd.apache.org/security/vulnerabilities_22.html#2.2.6-dev", }, { title: "Revision 551843", trust: 0.8, url: "http://svn.apache.org/viewvc/httpd/httpd/trunk/CHANGES?view=markup", }, { title: "HPSBUX02273", trust: 0.8, url: "http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c01182588", }, { title: "HPSBUX02273", trust: 0.8, url: "http://h50221.www5.hp.com/upassist/itrc_japan/assist2/secbltn/HP-UX/HPSBUX02273.html", }, { title: "PK50467", trust: 0.8, url: "http://www-1.ibm.com/support/docview.wss?uid=swg1PK50467", }, { title: "PK55141", trust: 0.8, url: "http://www-1.ibm.com/support/docview.wss?uid=swg1PK55141", }, { title: "4017303", trust: 0.8, url: "http://www-1.ibm.com/support/docview.wss?uid=swg24017303", }, { title: "Fix Pack 13 (6.1.0.13)", trust: 0.8, url: "http://www-1.ibm.com/support/docview.wss?uid=swg27007951#61013", }, { title: "4017141", trust: 0.8, url: "http://www-1.ibm.com/support/docview.wss?uid=swg24017141", }, { title: "httpd (V3.0/V4.0)", trust: 0.8, url: "http://www.miraclelinux.com/support/update/list.php?errata_id=1093", }, { title: "RHSA-2007:0532", trust: 0.8, url: "https://rhn.redhat.com/errata/RHSA-2007-0532.html", }, { title: "RHSA-2007:0556", trust: 0.8, url: "https://rhn.redhat.com/errata/RHSA-2007-0556.html", }, { title: "RHSA-2007:0662", trust: 0.8, url: "https://rhn.redhat.com/errata/RHSA-2007-0662.html", }, { title: "103179", trust: 0.8, url: "http://sunsolve.sun.com/search/document.do?assetkey=1-26-103179-1", }, { title: "readme_iwss11_sol_patch7_b1182", trust: 0.8, url: "http://www.trendmicro.com/ftp/jp/ucmodule/iwss/sol/11/readme_iwss11_sol_patch7_b1182.txt", }, { title: "RHSA-2007:0532", trust: 0.8, url: "http://www.jp.redhat.com/support/errata/RHSA/RHSA-2007-0532J.html", }, { title: "RHSA-2007:0556", trust: 0.8, url: "http://www.jp.redhat.com/support/errata/RHSA/RHSA-2007-0556J.html", }, { title: "RHSA-2007:0662", trust: 0.8, url: "http://www.jp.redhat.com/support/errata/RHSA/RHSA-2007-0662J.html", }, { title: "interstage_as_200802", trust: 0.8, url: "http://software.fujitsu.com/jp/security/products-fujitsu/solution/interstage_as_200802.html", }, { title: "Apache HTTP Server Worker Repair measures for multiple local denial of service vulnerabilities in the process", trust: 0.6, url: "http://123.124.177.30/web/xxk/bdxqById.tag?id=145950", }, { title: "Ubuntu Security Notice: apache2 vulnerabilities", trust: 0.1, url: "https://vulmon.com/vendoradvisory?qidtp=ubuntu_security_notice&qid=USN-499-1", }, { title: "", trust: 0.1, url: "https://github.com/Live-Hack-CVE/CVE-2007-3304 ", }, { title: "", trust: 0.1, url: "https://github.com/kasem545/vulnsearch ", }, ], sources: [ { db: "VULMON", id: "CVE-2007-3304", }, { db: "JVNDB", id: "JVNDB-2007-000477", }, { db: "CNNVD", id: "CNNVD-200706-316", }, ], }, problemtype_data: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#", sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, }, }, data: [ { problemtype: "NVD-CWE-noinfo", trust: 1, }, { problemtype: "CWE-DesignError", trust: 0.8, }, ], sources: [ { db: "JVNDB", id: "JVNDB-2007-000477", }, { db: "NVD", id: "CVE-2007-3304", }, ], }, references: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/references#", data: { "@container": "@list", }, sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, }, }, data: [ { trust: 2.6, url: "http://www.securityfocus.com/bid/24215", }, { trust: 2, url: "http://support.avaya.com/elmodocs2/security/asa-2007-353.htm", }, { trust: 2, url: "http://support.avaya.com/elmodocs2/security/asa-2007-363.htm", }, { trust: 2, url: "http://www-1.ibm.com/support/docview.wss?uid=swg1pk52702", }, { trust: 2, url: "http://www-1.ibm.com/support/docview.wss?uid=swg1pk53984", }, { trust: 2, url: "http://rhn.redhat.com/errata/rhsa-2007-0556.html", }, { trust: 2, url: "http://sunsolve.sun.com/search/document.do?assetkey=1-26-103179-1", }, { trust: 2, url: "http://www.fujitsu.com/global/support/software/security/products-f/interstage-200802e.html", }, { trust: 2, url: "http://sunsolve.sun.com/search/document.do?assetkey=1-66-200032-1", }, { trust: 1.8, url: "http://security.gentoo.org/glsa/glsa-200711-06.xml", }, { trust: 1.7, url: "http://security.psnc.pl/files/apache_report.pdf", }, { trust: 1.7, url: "http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=245111", }, { trust: 1.7, url: "http://svn.apache.org/viewvc?view=rev&revision=547987", }, { trust: 1.7, url: "https://issues.rpath.com/browse/rpl-1710", }, { trust: 1.7, url: "http://bugs.gentoo.org/show_bug.cgi?id=186219", }, { trust: 1.7, url: "http://www-1.ibm.com/support/search.wss?rs=0&q=pk50467&apar=only", }, { trust: 1.7, url: "http://www.redhat.com/archives/fedora-package-announce/2007-september/msg00320.html", }, { trust: 1.7, url: "http://www.mandriva.com/security/advisories?name=mdksa-2007:140", }, { trust: 1.7, url: "http://www.mandriva.com/security/advisories?name=mdksa-2007:142", }, { trust: 1.7, url: "http://www.redhat.com/errata/rhsa-2007-0532.html", }, { trust: 1.7, url: "http://www.redhat.com/support/errata/rhsa-2007-0557.html", }, { trust: 1.7, url: "http://www.redhat.com/support/errata/rhsa-2007-0662.html", }, { trust: 1.7, url: "http://www.novell.com/linux/security/advisories/2007_61_apache2.html", }, { trust: 1.7, url: "http://www.trustix.org/errata/2007/0026/", }, { trust: 1.7, url: "http://www.ubuntu.com/usn/usn-499-1", }, { trust: 1.7, url: "http://www.securitytracker.com/id?1018304", }, { trust: 1.7, url: "http://secunia.com/advisories/25827", }, { trust: 1.7, url: "http://secunia.com/advisories/25830", }, { trust: 1.7, url: "http://secunia.com/advisories/25920", }, { trust: 1.7, url: "http://secunia.com/advisories/26211", }, { trust: 1.7, url: "http://secunia.com/advisories/26273", }, { trust: 1.7, url: "http://secunia.com/advisories/26443", }, { trust: 1.7, url: "http://secunia.com/advisories/26508", }, { trust: 1.7, url: "http://secunia.com/advisories/26611", }, { trust: 1.7, url: "http://secunia.com/advisories/26759", }, { trust: 1.7, url: "http://secunia.com/advisories/26790", }, { trust: 1.7, url: "http://secunia.com/advisories/26822", }, { trust: 1.7, url: "http://secunia.com/advisories/26842", }, { trust: 1.7, url: "http://secunia.com/advisories/26993", }, { trust: 1.7, url: "http://secunia.com/advisories/27121", }, { trust: 1.7, url: "http://secunia.com/advisories/27209", }, { trust: 1.7, url: "http://secunia.com/advisories/27563", }, { trust: 1.7, url: "http://secunia.com/advisories/27732", }, { trust: 1.7, url: "http://securityreason.com/securityalert/2814", }, { trust: 1.7, url: "http://secunia.com/advisories/28212", }, { trust: 1.7, url: "http://secunia.com/advisories/28224", }, { trust: 1.7, url: "http://secunia.com/advisories/28606", }, { trust: 1.7, url: "http://www.redhat.com/support/errata/rhsa-2008-0261.html", }, { trust: 1.7, url: "http://lists.vmware.com/pipermail/security-announce/2009/000062.html", }, { trust: 1.7, url: "http://www.vupen.com/english/advisories/2008/0233", }, { trust: 1.7, url: "http://h20000.www2.hp.com/bizsupport/techsupport/document.jsp?objectid=c01182588", }, { trust: 1.7, url: "http://www.vupen.com/english/advisories/2007/3494", }, { trust: 1.7, url: "http://www.vupen.com/english/advisories/2007/3100", }, { trust: 1.7, url: "http://www.vupen.com/english/advisories/2007/3420", }, { trust: 1.7, url: "http://www.vupen.com/english/advisories/2007/4305", }, { trust: 1.7, url: "http://www.vupen.com/english/advisories/2007/3283", }, { trust: 1.7, url: "http://www.vupen.com/english/advisories/2007/2727", }, { trust: 1.7, url: "http://osvdb.org/38939", }, { trust: 1.7, url: "https://exchange.xforce.ibmcloud.com/vulnerabilities/35095", }, { trust: 1.7, url: "https://oval.cisecurity.org/repository/search/definition/oval%3aorg.mitre.oval%3adef%3a11589", }, { trust: 1.7, url: "http://www.securityfocus.com/archive/1/505990/100/0/threaded", }, { trust: 1.7, url: "http://www.securityfocus.com/archive/1/471832/100/0/threaded", }, { trust: 1.7, url: "http://www.securityfocus.com/archive/1/469899/100/0/threaded", }, { trust: 1.4, url: "http://httpd.apache.org/security/vulnerabilities_13.html", }, { trust: 1.4, url: "http://httpd.apache.org/security/vulnerabilities_20.html", }, { trust: 1.4, url: "http://httpd.apache.org/security/vulnerabilities_22.html", }, { trust: 1.2, url: "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2007-3304", }, { trust: 1.1, url: "http://marc.info/?l=apache-httpd-dev&m=118252946632447&w=2", }, { trust: 1.1, url: "ftp://patches.sgi.com/support/free/security/advisories/20070701-01-p.asc", }, { trust: 1, url: "http://mail-archives.apache.org/mod_mbox/httpd-dev/200706.mbox/%3c20070629141032.ga15192%40redhat.com%3e", }, { trust: 1, url: "https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3ccvs.httpd.apache.org%3e", }, { trust: 1, url: "https://lists.apache.org/thread.html/r9e8622254184645bc963a1d47c5d47f6d5a36d6f080d8d2c43b2b142%40%3ccvs.httpd.apache.org%3e", }, { trust: 1, url: "https://lists.apache.org/thread.html/54a42d4b01968df1117cea77fc53d6beb931c0e05936ad02af93e9ac%40%3ccvs.httpd.apache.org%3e", }, { trust: 1, url: "https://lists.apache.org/thread.html/r5f9c22f9c28adbd9f00556059edc7b03a5d5bb71d4bb80257c0d34e4%40%3ccvs.httpd.apache.org%3e", }, { trust: 1, url: "https://lists.apache.org/thread.html/rb9c9f42dafa25d2f669dac2a536a03f2575bc5ec1be6f480618aee10%40%3ccvs.httpd.apache.org%3e", }, { trust: 1, url: "https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3ccvs.httpd.apache.org%3e", }, { trust: 1, url: "https://lists.apache.org/thread.html/r2cb985de917e7da0848c440535f65a247754db8b2154a10089e4247b%40%3ccvs.httpd.apache.org%3e", }, { trust: 1, url: "https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3ccvs.httpd.apache.org%3e", }, { trust: 1, url: "https://lists.apache.org/thread.html/reb542d2038e9c331506e0cbff881b47e40fbe2bd93ff00979e60cdf7%40%3ccvs.httpd.apache.org%3e", }, { trust: 1, url: "https://lists.apache.org/thread.html/r0276683d8e1e07153fc8642618830ac0ade85b9ae0dc7b07f63bb8fc%40%3ccvs.httpd.apache.org%3e", }, { trust: 1, url: "https://lists.apache.org/thread.html/r5419c9ba0951ef73a655362403d12bb8d10fab38274deb3f005816f5%40%3ccvs.httpd.apache.org%3e", }, { trust: 1, url: "https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3ccvs.httpd.apache.org%3e", }, { trust: 1, url: "https://lists.apache.org/thread.html/r652fc951306cdeca5a276e2021a34878a76695a9f3cfb6490b4a6840%40%3ccvs.httpd.apache.org%3e", }, { trust: 1, url: "https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3ccvs.httpd.apache.org%3e", }, { trust: 1, url: "https://lists.apache.org/thread.html/rafd145ba6cd0a4ced113a5823cdaff45aeb36eb09855b216401c66d6%40%3ccvs.httpd.apache.org%3e", }, { trust: 1, url: "https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3ccvs.httpd.apache.org%3e", }, { trust: 1, url: "https://lists.apache.org/thread.html/r476d175be0aaf4a17680ef98c5153b4d336eaef76fb2224cc94c463a%40%3ccvs.httpd.apache.org%3e", }, { trust: 1, url: "https://lists.apache.org/thread.html/r8828e649175df56f1f9e3919938ac7826128525426e2748f0ab62feb%40%3ccvs.httpd.apache.org%3e", }, { trust: 1, url: "https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3ccvs.httpd.apache.org%3e", }, { trust: 1, url: "https://lists.apache.org/thread.html/5df9bfb86a3b054bb985a45ff9250b0332c9ecc181eec232489e7f79%40%3ccvs.httpd.apache.org%3e", }, { trust: 1, url: "https://lists.apache.org/thread.html/rad01d817195e6cc871cb1d73b207ca326379a20a6e7f30febaf56d24%40%3ccvs.httpd.apache.org%3e", }, { trust: 1, url: "https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3ccvs.httpd.apache.org%3e", }, { trust: 1, url: "https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3ccvs.httpd.apache.org%3e", }, { trust: 0.8, url: "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2007-3304", }, { trust: 0.6, url: "https://nvd.nist.gov/vuln/detail/cve-2007-3304", }, { trust: 0.6, url: "httpd.apache.org%3e", }, { trust: 0.6, url: "https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f@%3ccvs.", }, { trust: 0.6, url: "https://lists.apache.org/thread.html/reb542d2038e9c331506e0cbff881b47e40fbe2bd93ff00979e60cdf7@%3ccvs.", }, { trust: 0.6, url: "https://lists.apache.org/thread.html/r652fc951306cdeca5a276e2021a34878a76695a9f3cfb6490b4a6840@%3ccvs.", }, { trust: 0.6, url: "httpd.apache.org/security/vulnerabilities_13.html", }, { trust: 0.6, url: "https://lists.apache.org/thread.html/5df9bfb86a3b054bb985a45ff9250b0332c9ecc181eec232489e7f79@%3ccvs.", }, { trust: 0.6, url: "https://lists.apache.org/thread.html/54a42d4b01968df1117cea77fc53d6beb931c0e05936ad02af93e9ac@%3ccvs.", }, { trust: 0.6, url: "https://lists.apache.org/thread.html/r2cb985de917e7da0848c440535f65a247754db8b2154a10089e4247b@%3ccvs.", }, { trust: 0.6, url: "https://lists.apache.org/thread.html/r5f9c22f9c28adbd9f00556059edc7b03a5d5bb71d4bb80257c0d34e4@%3ccvs.", }, { trust: 0.6, url: "httpd.apache.org/security/vulnerabilities_22.html", }, { trust: 0.6, url: "https://lists.apache.org/thread.html/r5419c9ba0951ef73a655362403d12bb8d10fab38274deb3f005816f5@%3ccvs.", }, { trust: 0.6, url: "https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7@%3ccvs.", }, { trust: 0.6, url: "https://lists.apache.org/thread.html/r0276683d8e1e07153fc8642618830ac0ade85b9ae0dc7b07f63bb8fc@%3ccvs.", }, { trust: 0.6, url: "https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920@%3ccvs.", }, { trust: 0.6, url: "httpd.apache.org/security/vulnerabilities_20.html", }, { trust: 0.6, url: "https://lists.apache.org/thread.html/rafd145ba6cd0a4ced113a5823cdaff45aeb36eb09855b216401c66d6@%3ccvs.", }, { trust: 0.6, url: "httpd-dev/200706.mbox/%3c20070629141032.ga15192@redhat.com%3e", }, { trust: 0.6, url: "http://mail-archives.apache.org/mod_mbox/", }, { trust: 0.6, url: "https://lists.apache.org/thread.html/r8828e649175df56f1f9e3919938ac7826128525426e2748f0ab62feb@%3ccvs.", }, { trust: 0.6, url: "https://lists.apache.org/thread.html/rb9c9f42dafa25d2f669dac2a536a03f2575bc5ec1be6f480618aee10@%3ccvs.", }, { trust: 0.6, url: "httpd-dev&m=118252946632447&w=2", }, { trust: 0.6, url: "http://marc.info/?l=apache-", }, { trust: 0.6, url: "https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b@%3ccvs.", }, { trust: 0.6, url: "https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53@%3ccvs.", }, { trust: 0.6, url: "https://lists.apache.org/thread.html/rad01d817195e6cc871cb1d73b207ca326379a20a6e7f30febaf56d24@%3ccvs.", }, { trust: 0.6, url: "https://lists.apache.org/thread.html/r9e8622254184645bc963a1d47c5d47f6d5a36d6f080d8d2c43b2b142@%3ccvs.", }, { trust: 0.6, url: "https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b@%3ccvs.", }, { trust: 0.6, url: "https://lists.apache.org/thread.html/r476d175be0aaf4a17680ef98c5153b4d336eaef76fb2224cc94c463a@%3ccvs.", }, { trust: 0.6, url: "https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9@%3ccvs.", }, { trust: 0.6, url: "https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f@%3ccvs.", }, { trust: 0.6, url: "https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064@%3ccvs.", }, { trust: 0.5, url: "https://nvd.nist.gov/vuln/detail/cve-2006-5752", }, { trust: 0.4, url: "https://nvd.nist.gov/vuln/detail/cve-2007-1863", }, { trust: 0.4, url: "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2006-5752", }, { trust: 0.3, url: "http://httpd.apache.org/", }, { trust: 0.3, url: "http://support.avaya.com/elmodocs2/security/asa-2008-012.htm", }, { trust: 0.3, url: "http://www.apache.org/dist/httpd/changes_2.2.6", }, { trust: 0.3, url: "/archive/1/482486", }, { trust: 0.3, url: "/archive/1/469899", }, { trust: 0.3, url: "/archive/1/479708", }, { trust: 0.3, url: "http://www-1.ibm.com/support/docview.wss?uid=swg1pk50467", }, { trust: 0.3, url: "http://rhn.redhat.com/errata/rhsa-2007-0532.html", }, { trust: 0.3, url: "https://rhn.redhat.com/errata/rhsa-2007-0662.html", }, { trust: 0.3, url: "http://rhn.redhat.com/errata/rhsa-2008-0261.html", }, { trust: 0.3, url: "http://rhn.redhat.com/errata/rhsa-2008-0263.html", }, { trust: 0.3, url: "http://rhn.redhat.com/errata/rhsa-2008-0523.html", }, { trust: 0.3, url: "http://rhn.redhat.com/errata/rhsa-2008-0524.html", }, { trust: 0.3, url: "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2007-1863", }, { trust: 0.3, url: "https://nvd.nist.gov/vuln/detail/cve-2007-3847", }, { trust: 0.2, url: "http://www.mandriva.com/security/", }, { trust: 0.2, url: "http://www.mandriva.com/security/advisories", }, { trust: 0.2, url: "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2007-3847", }, { trust: 0.1, url: "https://cwe.mitre.org/data/definitions/.html", }, { trust: 0.1, url: "http://mail-archives.apache.org/mod_mbox/httpd-dev/200706.mbox/%3c20070629141032.ga15192@redhat.com%3e", }, { trust: 0.1, url: "https://lists.apache.org/thread.html/5df9bfb86a3b054bb985a45ff9250b0332c9ecc181eec232489e7f79@%3ccvs.httpd.apache.org%3e", }, { trust: 0.1, url: "https://lists.apache.org/thread.html/54a42d4b01968df1117cea77fc53d6beb931c0e05936ad02af93e9ac@%3ccvs.httpd.apache.org%3e", }, { trust: 0.1, url: "https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7@%3ccvs.httpd.apache.org%3e", }, { trust: 0.1, url: "https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f@%3ccvs.httpd.apache.org%3e", }, { trust: 0.1, url: "https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53@%3ccvs.httpd.apache.org%3e", }, { trust: 0.1, url: "https://lists.apache.org/thread.html/r0276683d8e1e07153fc8642618830ac0ade85b9ae0dc7b07f63bb8fc@%3ccvs.httpd.apache.org%3e", }, { trust: 0.1, url: "https://lists.apache.org/thread.html/r8828e649175df56f1f9e3919938ac7826128525426e2748f0ab62feb@%3ccvs.httpd.apache.org%3e", }, { trust: 0.1, url: "https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b@%3ccvs.httpd.apache.org%3e", }, { trust: 0.1, url: "https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9@%3ccvs.httpd.apache.org%3e", }, { trust: 0.1, url: "https://lists.apache.org/thread.html/r2cb985de917e7da0848c440535f65a247754db8b2154a10089e4247b@%3ccvs.httpd.apache.org%3e", }, { trust: 0.1, url: "https://lists.apache.org/thread.html/r5419c9ba0951ef73a655362403d12bb8d10fab38274deb3f005816f5@%3ccvs.httpd.apache.org%3e", }, { trust: 0.1, url: "https://lists.apache.org/thread.html/r652fc951306cdeca5a276e2021a34878a76695a9f3cfb6490b4a6840@%3ccvs.httpd.apache.org%3e", }, { trust: 0.1, url: "https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b@%3ccvs.httpd.apache.org%3e", }, { trust: 0.1, url: "https://lists.apache.org/thread.html/rafd145ba6cd0a4ced113a5823cdaff45aeb36eb09855b216401c66d6@%3ccvs.httpd.apache.org%3e", }, { trust: 0.1, url: "https://lists.apache.org/thread.html/r9e8622254184645bc963a1d47c5d47f6d5a36d6f080d8d2c43b2b142@%3ccvs.httpd.apache.org%3e", }, { trust: 0.1, url: "https://lists.apache.org/thread.html/reb542d2038e9c331506e0cbff881b47e40fbe2bd93ff00979e60cdf7@%3ccvs.httpd.apache.org%3e", }, { trust: 0.1, url: "https://lists.apache.org/thread.html/r5f9c22f9c28adbd9f00556059edc7b03a5d5bb71d4bb80257c0d34e4@%3ccvs.httpd.apache.org%3e", }, { trust: 0.1, url: "https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064@%3ccvs.httpd.apache.org%3e", }, { trust: 0.1, url: "https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920@%3ccvs.httpd.apache.org%3e", }, { trust: 0.1, url: "https://lists.apache.org/thread.html/rad01d817195e6cc871cb1d73b207ca326379a20a6e7f30febaf56d24@%3ccvs.httpd.apache.org%3e", }, { trust: 0.1, url: "https://lists.apache.org/thread.html/r476d175be0aaf4a17680ef98c5153b4d336eaef76fb2224cc94c463a@%3ccvs.httpd.apache.org%3e", }, { trust: 0.1, url: "https://lists.apache.org/thread.html/rb9c9f42dafa25d2f669dac2a536a03f2575bc5ec1be6f480618aee10@%3ccvs.httpd.apache.org%3e", }, { trust: 0.1, url: "https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f@%3ccvs.httpd.apache.org%3e", }, { trust: 0.1, url: "https://github.com/live-hack-cve/cve-2007-3304", }, { trust: 0.1, url: "https://nvd.nist.gov", }, { trust: 0.1, url: "https://usn.ubuntu.com/499-1/", }, { trust: 0.1, url: "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2007-1862", }, { trust: 0.1, url: "http://secunia.com/", }, { trust: 0.1, url: "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2007-4465", }, { trust: 0.1, url: "http://bugs.gentoo.org.", }, { trust: 0.1, url: "http://enigmail.mozdev.org", }, { trust: 0.1, url: "https://nvd.nist.gov/vuln/detail/cve-2007-1862", }, { trust: 0.1, url: "http://lists.grok.org.uk/full-disclosure-charter.html", }, { trust: 0.1, url: "http://creativecommons.org/licenses/by-sa/2.5", }, { trust: 0.1, url: "http://security.gentoo.org/", }, { trust: 0.1, url: "https://nvd.nist.gov/vuln/detail/cve-2007-4465", }, { trust: 0.1, url: "http://www.itrc.hp.com/service/cki/secbullarchive.do", }, { trust: 0.1, url: "http://h30046.www3.hp.com/driveralertprofile.php?regioncode=na&langcode=useng&jumpid=in_sc-gen__driveritrc&topiccode=itrc", }, { trust: 0.1, url: "https://www.hp.com/go/swa", }, { trust: 0.1, url: "http://h30046.www3.hp.com/subsignin.php", }, { trust: 0.1, url: "http://download3.vmware.com/software/vmplayer/vmware-player-2.5.3-185404.i386.rpm", }, { trust: 0.1, url: "http://www.vmware.com/support/ace25/doc/releasenotes_ace253.html", }, { trust: 0.1, url: "http://www.vmware.com/support/player25/doc/releasenotes_player253.html", }, { trust: 0.1, url: "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2007-5000", }, { trust: 0.1, url: "http://www.vmware.com/download/ace/", }, { trust: 0.1, url: "http://www.vmware.com/download/player/", }, { trust: 0.1, url: "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2007-6388", }, { trust: 0.1, url: "http://www.vmware.com/security", }, { trust: 0.1, url: "https://nvd.nist.gov/vuln/detail/cve-2008-0005", }, { trust: 0.1, url: "http://kb.vmware.com/kb/1055", }, { trust: 0.1, url: "http://www.vmware.com/support/ws65/doc/releasenotes_ws653.html", }, { trust: 0.1, url: "http://www.vmware.com/download/ws/", }, { trust: 0.1, url: "https://nvd.nist.gov/vuln/detail/cve-2009-0040", }, { trust: 0.1, url: "http://www.vmware.com/support/policies/security_response.html", }, { trust: 0.1, url: "http://download3.vmware.com/software/vmplayer/vmware-player-2.5.3-185404.x86_64.rpm", }, { trust: 0.1, url: "http://www.vmware.com/support/policies/eos.html", }, { trust: 0.1, url: "http://download3.vmware.com/software/vmplayer/vmware-player-2.5.3-185404.exe", }, { trust: 0.1, url: "https://nvd.nist.gov/vuln/detail/cve-2007-5000", }, { trust: 0.1, url: "http://download3.vmware.com/software/vmplayer/vmware-player-2.5.3-185404.i386.bundle", }, { trust: 0.1, url: "http://download3.vmware.com/software/vmplayer/vmware-player-2.5.3-185404.x86_64.bundle", }, { trust: 0.1, url: "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2009-0040", }, { trust: 0.1, url: "http://lists.vmware.com/cgi-bin/mailman/listinfo/security-announce", }, { trust: 0.1, url: "https://nvd.nist.gov/vuln/detail/cve-2007-6388", }, { trust: 0.1, url: "http://www.vmware.com/support/policies/eos_vi.html", }, { trust: 0.1, url: "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2008-0005", }, { trust: 0.1, url: "http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-threaded-dev_2.0.55-4ubuntu4.1_i386.deb", }, { trust: 0.1, url: "http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-prefork-dev_2.2.3-3.2ubuntu0.1_i386.deb", }, { trust: 0.1, url: "http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-perchild_2.0.55-4ubuntu4.1_sparc.deb", }, { trust: 0.1, url: "http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-worker_2.0.55-4ubuntu2.2_amd64.deb", }, { trust: 0.1, url: "http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2_2.0.55-4ubuntu2.2_sparc.deb", }, { trust: 0.1, url: "http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-event_2.2.3-3.2ubuntu0.1_i386.deb", }, { trust: 0.1, url: "http://security.ubuntu.com/ubuntu/pool/main/a/apache2/libapr0_2.0.55-4ubuntu2.2_amd64.deb", }, { trust: 0.1, url: "http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-prefork-dev_2.2.3-3.2ubuntu0.1_sparc.deb", }, { trust: 0.1, url: "http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2_2.2.3-3.2ubuntu0.1.dsc", }, { trust: 0.1, url: "http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-worker_2.0.55-4ubuntu2.2_powerpc.deb", }, { trust: 0.1, url: "http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-perchild_2.0.55-4ubuntu4.1_amd64.deb", }, { trust: 0.1, url: "http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-common_2.0.55-4ubuntu4.1_i386.deb", }, { trust: 0.1, url: "http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2.2-common_2.2.3-3.2ubuntu0.1_i386.deb", }, { trust: 0.1, url: "http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2.2-common_2.2.3-3.2ubuntu0.1_powerpc.deb", }, { trust: 0.1, url: "http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-utils_2.0.55-4ubuntu2.2_powerpc.deb", }, { trust: 0.1, url: "http://security.ubuntu.com/ubuntu/pool/main/a/apache2/libapr0-dev_2.0.55-4ubuntu4.1_sparc.deb", }, { trust: 0.1, url: "http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-prefork_2.0.55-4ubuntu4.1_sparc.deb", }, { trust: 0.1, url: "http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-perchild_2.0.55-4ubuntu2.2_powerpc.deb", }, { trust: 0.1, url: "http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-worker_2.0.55-4ubuntu4.1_sparc.deb", }, { trust: 0.1, url: "http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2.2-common_2.2.3-3.2ubuntu0.1_sparc.deb", }, { trust: 0.1, url: "http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-prefork-dev_2.0.55-4ubuntu2.2_amd64.deb", }, { trust: 0.1, url: "http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2_2.0.55-4ubuntu4.1_i386.deb", }, { trust: 0.1, url: "http://security.ubuntu.com/ubuntu/pool/main/a/apache2/libapr0_2.0.55-4ubuntu4.1_powerpc.deb", }, { trust: 0.1, url: "http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2_2.0.55-4ubuntu4.1_powerpc.deb", }, { trust: 0.1, url: "http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-prefork_2.0.55-4ubuntu2.2_powerpc.deb", }, { trust: 0.1, url: "http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-perchild_2.0.55-4ubuntu4.1_powerpc.deb", }, { trust: 0.1, url: "http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-common_2.0.55-4ubuntu2.2_powerpc.deb", }, { trust: 0.1, url: "http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-utils_2.2.3-3.2ubuntu0.1_i386.deb", }, { trust: 0.1, url: "http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2_2.0.55-4ubuntu2.2_powerpc.deb", }, { trust: 0.1, url: "http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-common_2.0.55-4ubuntu2.2_sparc.deb", }, { trust: 0.1, url: "http://security.ubuntu.com/ubuntu/pool/main/a/apache2/libapr0_2.0.55-4ubuntu4.1_amd64.deb", }, { trust: 0.1, url: "http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-prefork_2.0.55-4ubuntu2.2_i386.deb", }, { trust: 0.1, url: "http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2_2.0.55.orig.tar.gz", }, { trust: 0.1, url: "http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-prefork-dev_2.2.3-3.2ubuntu0.1_amd64.deb", }, { trust: 0.1, url: "http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-common_2.0.55-4ubuntu4.1_amd64.deb", }, { trust: 0.1, url: "http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-perchild_2.0.55-4ubuntu2.2_sparc.deb", }, { trust: 0.1, url: "http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2_2.0.55-4ubuntu4.1_amd64.deb", }, { trust: 0.1, url: "http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2_2.2.3.orig.tar.gz", }, { trust: 0.1, url: "http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-prefork_2.0.55-4ubuntu4.1_powerpc.deb", }, { trust: 0.1, url: "http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-threaded-dev_2.2.3-3.2ubuntu0.1_sparc.deb", }, { trust: 0.1, url: "http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2_2.2.3-3.2ubuntu0.1_all.deb", }, { trust: 0.1, url: "http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-threaded-dev_2.0.55-4ubuntu4.1_sparc.deb", }, { trust: 0.1, url: "http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-prefork_2.2.3-3.2ubuntu0.1_powerpc.deb", }, { trust: 0.1, url: "http://security.ubuntu.com/ubuntu/pool/main/a/apache2/libapr0-dev_2.0.55-4ubuntu4.1_powerpc.deb", }, { trust: 0.1, url: "http://security.ubuntu.com/ubuntu/pool/main/a/apache2/libapr0_2.0.55-4ubuntu2.2_sparc.deb", }, { trust: 0.1, url: "http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-prefork-dev_2.0.55-4ubuntu4.1_powerpc.deb", }, { trust: 0.1, url: "http://security.ubuntu.com/ubuntu/pool/main/a/apache2/libapr0-dev_2.0.55-4ubuntu2.2_powerpc.deb", }, { trust: 0.1, url: "http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-doc_2.0.55-4ubuntu2.2_all.deb", }, { trust: 0.1, url: "http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-utils_2.0.55-4ubuntu2.2_sparc.deb", }, { trust: 0.1, url: "http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-prefork-dev_2.0.55-4ubuntu2.2_powerpc.deb", }, { trust: 0.1, url: "http://security.ubuntu.com/ubuntu/pool/main/a/apache2/libapr0-dev_2.0.55-4ubuntu4.1_amd64.deb", }, { trust: 0.1, url: "http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-prefork_2.0.55-4ubuntu2.2_sparc.deb", }, { trust: 0.1, url: "http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-prefork-dev_2.2.3-3.2ubuntu0.1_powerpc.deb", }, { trust: 0.1, url: "http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-prefork_2.0.55-4ubuntu2.2_amd64.deb", }, { trust: 0.1, url: "http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-prefork-dev_2.0.55-4ubuntu4.1_amd64.deb", }, { trust: 0.1, url: "http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2_2.0.55-4ubuntu4.1.diff.gz", }, { trust: 0.1, url: "http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-threaded-dev_2.2.3-3.2ubuntu0.1_amd64.deb", }, { trust: 0.1, url: "http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-event_2.2.3-3.2ubuntu0.1_sparc.deb", }, { trust: 0.1, url: "http://security.ubuntu.com/ubuntu/pool/main/a/apache2/libapr0-dev_2.0.55-4ubuntu2.2_sparc.deb", }, { trust: 0.1, url: "http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-perchild_2.0.55-4ubuntu4.1_i386.deb", }, { trust: 0.1, url: "http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-worker_2.0.55-4ubuntu4.1_i386.deb", }, { trust: 0.1, url: "http://security.ubuntu.com/ubuntu/pool/main/a/apache2/libapr0-dev_2.0.55-4ubuntu4.1_i386.deb", }, { trust: 0.1, url: "http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-event_2.2.3-3.2ubuntu0.1_powerpc.deb", }, { trust: 0.1, url: "http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-utils_2.0.55-4ubuntu4.1_amd64.deb", }, { trust: 0.1, url: "http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-prefork-dev_2.0.55-4ubuntu2.2_i386.deb", }, { trust: 0.1, url: "http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-prefork_2.0.55-4ubuntu4.1_i386.deb", }, { trust: 0.1, url: "http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-threaded-dev_2.2.3-3.2ubuntu0.1_powerpc.deb", }, { trust: 0.1, url: "http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-src_2.2.3-3.2ubuntu0.1_all.deb", }, { trust: 0.1, url: "http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-perchild_2.0.55-4ubuntu2.2_amd64.deb", }, { trust: 0.1, url: "http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-prefork_2.0.55-4ubuntu4.1_amd64.deb", }, { trust: 0.1, url: "http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-event_2.2.3-3.2ubuntu0.1_amd64.deb", }, { trust: 0.1, url: "http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2_2.0.55-4ubuntu2.2_amd64.deb", }, { trust: 0.1, url: "http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-perchild_2.2.3-3.2ubuntu0.1_all.deb", }, { trust: 0.1, url: "http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-threaded-dev_2.0.55-4ubuntu2.2_powerpc.deb", }, { trust: 0.1, url: "http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-worker_2.0.55-4ubuntu2.2_i386.deb", }, { trust: 0.1, url: "http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-prefork-dev_2.0.55-4ubuntu4.1_i386.deb", }, { trust: 0.1, url: "http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-utils_2.0.55-4ubuntu4.1_powerpc.deb", }, { trust: 0.1, url: "http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-threaded-dev_2.0.55-4ubuntu2.2_sparc.deb", }, { trust: 0.1, url: "http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-utils_2.0.55-4ubuntu4.1_sparc.deb", }, { trust: 0.1, url: "http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-prefork-dev_2.0.55-4ubuntu2.2_sparc.deb", }, { trust: 0.1, url: "http://security.ubuntu.com/ubuntu/pool/main/a/apache2/libapr0_2.0.55-4ubuntu2.2_i386.deb", }, { trust: 0.1, url: "http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-doc_2.2.3-3.2ubuntu0.1_all.deb", }, { trust: 0.1, url: "http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-worker_2.0.55-4ubuntu4.1_powerpc.deb", }, { trust: 0.1, url: "http://security.ubuntu.com/ubuntu/pool/main/a/apache2/libapr0_2.0.55-4ubuntu2.2_powerpc.deb", }, { trust: 0.1, url: "http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-common_2.0.55-4ubuntu4.1_powerpc.deb", }, { trust: 0.1, url: "http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-prefork_2.2.3-3.2ubuntu0.1_amd64.deb", }, { trust: 0.1, url: "http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2_2.2.3-3.2ubuntu0.1.diff.gz", }, { trust: 0.1, url: "http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-doc_2.0.55-4ubuntu4.1_all.deb", }, { trust: 0.1, url: "http://security.ubuntu.com/ubuntu/pool/main/a/apache2/libapr0-dev_2.0.55-4ubuntu2.2_i386.deb", }, { trust: 0.1, url: "http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2_2.0.55-4ubuntu2.2.dsc", }, { trust: 0.1, url: "http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-worker_2.2.3-3.2ubuntu0.1_powerpc.deb", }, { trust: 0.1, url: "http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2_2.0.55-4ubuntu2.2_i386.deb", }, { trust: 0.1, url: "http://security.ubuntu.com/ubuntu/pool/main/a/apache2/libapr0-dev_2.0.55-4ubuntu2.2_amd64.deb", }, { trust: 0.1, url: "http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-threaded-dev_2.0.55-4ubuntu4.1_amd64.deb", }, { trust: 0.1, url: "http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-threaded-dev_2.0.55-4ubuntu2.2_amd64.deb", }, { trust: 0.1, url: "http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-worker_2.0.55-4ubuntu2.2_sparc.deb", }, { trust: 0.1, url: "http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-utils_2.0.55-4ubuntu2.2_i386.deb", }, { trust: 0.1, url: "http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-prefork-dev_2.0.55-4ubuntu4.1_sparc.deb", }, { trust: 0.1, url: "http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-common_2.0.55-4ubuntu2.2_i386.deb", }, { trust: 0.1, url: "http://security.ubuntu.com/ubuntu/pool/main/a/apache2/libapr0_2.0.55-4ubuntu4.1_i386.deb", }, { trust: 0.1, url: "http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-prefork_2.2.3-3.2ubuntu0.1_sparc.deb", }, { trust: 0.1, url: "http://security.ubuntu.com/ubuntu/pool/main/a/apache2/libapr0_2.0.55-4ubuntu4.1_sparc.deb", }, { trust: 0.1, url: "http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-perchild_2.0.55-4ubuntu2.2_i386.deb", }, { trust: 0.1, url: "http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-worker_2.0.55-4ubuntu4.1_amd64.deb", }, { trust: 0.1, url: "http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-common_2.0.55-4ubuntu2.2_amd64.deb", }, { trust: 0.1, url: "http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2_2.0.55-4ubuntu4.1.dsc", }, { trust: 0.1, url: "http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-threaded-dev_2.0.55-4ubuntu4.1_powerpc.deb", }, { trust: 0.1, url: "http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-worker_2.2.3-3.2ubuntu0.1_amd64.deb", }, { trust: 0.1, url: "http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-utils_2.0.55-4ubuntu2.2_amd64.deb", }, { trust: 0.1, url: "http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-threaded-dev_2.0.55-4ubuntu2.2_i386.deb", }, { trust: 0.1, url: "http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2_2.0.55-4ubuntu4.1_sparc.deb", }, { trust: 0.1, url: "http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2_2.0.55-4ubuntu2.2.diff.gz", }, { trust: 0.1, url: "http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-utils_2.2.3-3.2ubuntu0.1_powerpc.deb", }, { trust: 0.1, url: "http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-utils_2.2.3-3.2ubuntu0.1_sparc.deb", }, { trust: 0.1, url: "http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-utils_2.0.55-4ubuntu4.1_i386.deb", }, { trust: 0.1, url: "http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-utils_2.2.3-3.2ubuntu0.1_amd64.deb", }, { trust: 0.1, url: "http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-threaded-dev_2.2.3-3.2ubuntu0.1_i386.deb", }, { trust: 0.1, url: "http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-worker_2.2.3-3.2ubuntu0.1_i386.deb", }, { trust: 0.1, url: "http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-common_2.0.55-4ubuntu4.1_sparc.deb", }, { trust: 0.1, url: "http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-worker_2.2.3-3.2ubuntu0.1_sparc.deb", }, { trust: 0.1, url: "http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2.2-common_2.2.3-3.2ubuntu0.1_amd64.deb", }, { trust: 0.1, url: "http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-prefork_2.2.3-3.2ubuntu0.1_i386.deb", }, ], sources: [ { db: "VULMON", id: "CVE-2007-3304", }, { db: "BID", id: "24215", }, { db: "JVNDB", id: "JVNDB-2007-000477", }, { db: "PACKETSTORM", id: "57505", }, { db: "PACKETSTORM", id: "60759", }, { db: "PACKETSTORM", id: "60039", }, { db: "PACKETSTORM", id: "80533", }, { db: "PACKETSTORM", id: "57507", }, { db: "PACKETSTORM", id: "58667", }, { db: "CNNVD", id: "CNNVD-200706-316", }, { db: "NVD", id: "CVE-2007-3304", }, ], }, sources: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", data: { "@container": "@list", }, }, data: [ { db: "VULMON", id: "CVE-2007-3304", }, { db: "BID", id: "24215", }, { db: "JVNDB", id: "JVNDB-2007-000477", }, { db: "PACKETSTORM", id: "57505", }, { db: "PACKETSTORM", id: "60759", }, { db: "PACKETSTORM", id: "60039", }, { db: "PACKETSTORM", id: "80533", }, { db: "PACKETSTORM", id: "57507", }, { db: "PACKETSTORM", id: "58667", }, { db: "CNNVD", id: "CNNVD-200706-316", }, { db: "NVD", id: "CVE-2007-3304", }, ], }, sources_release_date: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#", data: { "@container": "@list", }, }, data: [ { date: "2007-06-20T00:00:00", db: "VULMON", id: "CVE-2007-3304", }, { date: "2007-05-29T00:00:00", db: "BID", id: "24215", }, { date: "2007-07-02T00:00:00", db: "JVNDB", id: "JVNDB-2007-000477", }, { date: "2007-07-07T04:29:41", db: "PACKETSTORM", id: "57505", }, { date: "2007-11-07T20:27:55", db: "PACKETSTORM", id: "60759", }, { date: "2007-10-12T04:41:53", db: "PACKETSTORM", id: "60039", }, { date: "2009-08-23T16:31:17", db: "PACKETSTORM", id: "80533", }, { date: "2007-07-07T04:32:02", db: "PACKETSTORM", id: "57507", }, { date: "2007-08-17T06:30:14", db: "PACKETSTORM", id: "58667", }, { date: "2007-05-29T00:00:00", db: "CNNVD", id: "CNNVD-200706-316", }, { date: "2007-06-20T22:30:00", db: "NVD", id: "CVE-2007-3304", }, ], }, sources_update_date: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#", data: { "@container": "@list", }, }, data: [ { date: "2022-09-21T00:00:00", db: "VULMON", id: "CVE-2007-3304", }, { date: "2010-08-05T21:15:00", db: "BID", id: "24215", }, { date: "2009-02-09T00:00:00", db: "JVNDB", id: "JVNDB-2007-000477", }, { date: "2022-09-22T00:00:00", db: "CNNVD", id: "CNNVD-200706-316", }, { date: "2024-11-21T00:32:54.327000", db: "NVD", id: "CVE-2007-3304", }, ], }, threat_type: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/threat_type#", sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, }, }, data: "local", sources: [ { db: "PACKETSTORM", id: "57505", }, { db: "PACKETSTORM", id: "57507", }, { db: "CNNVD", id: "CNNVD-200706-316", }, ], trust: 0.8, }, title: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/title#", sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, }, }, data: "Apache HTTP Server of Prefork MPM Service disruption in modules (DoS) Vulnerabilities", sources: [ { db: "JVNDB", id: "JVNDB-2007-000477", }, ], trust: 0.8, }, type: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/type#", sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, }, }, data: "other", sources: [ { db: "CNNVD", id: "CNNVD-200706-316", }, ], trust: 0.6, }, }
fkie_cve-2007-3304
Vulnerability from fkie_nvd
Published
2007-06-20 22:30
Modified
2025-04-09 00:30
Severity ?
Summary
Apache httpd 1.3.37, 2.0.59, and 2.2.4 with the Prefork MPM module, allows local users to cause a denial of service by modifying the worker_score and process_score arrays to reference an arbitrary process ID, which is sent a SIGUSR1 signal from the master process, aka "SIGUSR1 killer."
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| apache | http_server | * | |
| apache | http_server | * | |
| apache | http_server | * | |
| fedoraproject | fedora | 7 | |
| redhat | enterprise_linux_desktop | 5.0 | |
| redhat | enterprise_linux_server | 5.0 | |
| redhat | enterprise_linux_workstation | 5.0 | |
| canonical | ubuntu_linux | 6.06 | |
| canonical | ubuntu_linux | 6.10 | |
| canonical | ubuntu_linux | 7.04 |
{ configurations: [ { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*", matchCriteriaId: "F369DFA9-7EDE-4244-9BA0-14A64743B6E2", versionEndExcluding: "1.3.39", versionStartIncluding: "1.3.0", vulnerable: true, }, { criteria: "cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*", matchCriteriaId: "9C551481-3F93-4186-85B9-7B07D94B86D9", versionEndExcluding: "2.0.61", versionStartIncluding: "2.0.0", vulnerable: true, }, { criteria: "cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*", matchCriteriaId: "D9EE889E-37B4-4DF6-8327-7D621E287F4F", versionEndExcluding: "2.2.6", versionStartIncluding: "2.2.0", vulnerable: true, }, ], negate: false, operator: "OR", }, ], }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:fedoraproject:fedora:7:*:*:*:*:*:*:*", matchCriteriaId: "E3EFD171-01F7-450B-B6F3-0F7E443A2337", vulnerable: true, }, ], negate: false, operator: "OR", }, ], }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:redhat:enterprise_linux_desktop:5.0:*:*:*:*:*:*:*", matchCriteriaId: "133AAFA7-AF42-4D7B-8822-AA2E85611BF5", vulnerable: true, }, { criteria: "cpe:2.3:o:redhat:enterprise_linux_server:5.0:*:*:*:*:*:*:*", matchCriteriaId: "54D669D4-6D7E-449D-80C1-28FA44F06FFE", vulnerable: true, }, { criteria: "cpe:2.3:o:redhat:enterprise_linux_workstation:5.0:*:*:*:*:*:*:*", matchCriteriaId: "D0AC5CD5-6E58-433C-9EB3-6DFE5656463E", vulnerable: true, }, ], negate: false, operator: "OR", }, ], }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:canonical:ubuntu_linux:6.06:*:*:*:*:*:*:*", matchCriteriaId: "454A5D17-B171-4F1F-9E0B-F18D1E5CA9FD", vulnerable: true, }, { criteria: "cpe:2.3:o:canonical:ubuntu_linux:6.10:*:*:*:*:*:*:*", matchCriteriaId: "23E304C9-F780-4358-A58D-1E4C93977704", vulnerable: true, }, { criteria: "cpe:2.3:o:canonical:ubuntu_linux:7.04:*:*:*:*:*:*:*", matchCriteriaId: "6EBDAFF8-DE44-4E80-B6BD-E341F767F501", vulnerable: true, }, ], negate: false, operator: "OR", }, ], }, ], cveTags: [], descriptions: [ { lang: "en", value: "Apache httpd 1.3.37, 2.0.59, and 2.2.4 with the Prefork MPM module, allows local users to cause a denial of service by modifying the worker_score and process_score arrays to reference an arbitrary process ID, which is sent a SIGUSR1 signal from the master process, aka \"SIGUSR1 killer.\"", }, { lang: "es", value: "Apache httpd versiones 1.3.37, 2.0.59 y 2.2.4 con el módulo Prefork MPM, permite a los usuarios locales causar una denegación de servicio por la modificación de las matrices worker_score y process_score para hacer referencia a un ID de proceso arbitrario, al que se envía una señal SIGUSR1 desde el proceso maestro, también se conoce como \"SIGUSR1 killer\".", }, ], id: "CVE-2007-3304", lastModified: "2025-04-09T00:30:58.490", metrics: { cvssMetricV2: [ { acInsufInfo: false, baseSeverity: "MEDIUM", cvssData: { accessComplexity: "MEDIUM", accessVector: "LOCAL", authentication: "NONE", availabilityImpact: "COMPLETE", baseScore: 4.7, confidentialityImpact: "NONE", integrityImpact: "NONE", vectorString: "AV:L/AC:M/Au:N/C:N/I:N/A:C", version: "2.0", }, exploitabilityScore: 3.4, impactScore: 6.9, obtainAllPrivilege: false, obtainOtherPrivilege: false, obtainUserPrivilege: false, source: "nvd@nist.gov", type: "Primary", userInteractionRequired: false, }, ], }, published: "2007-06-20T22:30:00.000", references: [ { source: "cve@mitre.org", tags: [ "Broken Link", ], url: "ftp://patches.sgi.com/support/free/security/advisories/20070701-01-P.asc", }, { source: "cve@mitre.org", tags: [ "Issue Tracking", "Third Party Advisory", ], url: "http://bugs.gentoo.org/show_bug.cgi?id=186219", }, { source: "cve@mitre.org", tags: [ "Issue Tracking", "Third Party Advisory", ], url: "http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=245111", }, { source: "cve@mitre.org", tags: [ "Third Party Advisory", ], url: "http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01182588", }, { source: "cve@mitre.org", tags: [ "Third Party Advisory", ], url: "http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01182588", }, { source: "cve@mitre.org", tags: [ "Vendor Advisory", ], url: "http://httpd.apache.org/security/vulnerabilities_13.html", }, { source: "cve@mitre.org", tags: [ "Vendor Advisory", ], url: "http://httpd.apache.org/security/vulnerabilities_20.html", }, { source: "cve@mitre.org", tags: [ "Vendor Advisory", ], url: "http://httpd.apache.org/security/vulnerabilities_22.html", }, { source: "cve@mitre.org", tags: [ "Mailing List", "Third Party Advisory", ], url: "http://lists.vmware.com/pipermail/security-announce/2009/000062.html", }, { source: "cve@mitre.org", url: "http://mail-archives.apache.org/mod_mbox/httpd-dev/200706.mbox/%3c20070629141032.GA15192%40redhat.com%3e", }, { source: "cve@mitre.org", tags: [ "Issue Tracking", "Mailing List", "Third Party Advisory", ], url: "http://marc.info/?l=apache-httpd-dev&m=118252946632447&w=2", }, { source: "cve@mitre.org", tags: [ "Broken Link", ], url: "http://osvdb.org/38939", }, { source: "cve@mitre.org", tags: [ "Third Party Advisory", ], url: "http://rhn.redhat.com/errata/RHSA-2007-0556.html", }, { source: "cve@mitre.org", tags: [ "Not Applicable", "Vendor Advisory", ], url: "http://secunia.com/advisories/25827", }, { source: "cve@mitre.org", tags: [ "Not Applicable", "Vendor Advisory", ], url: "http://secunia.com/advisories/25830", }, { source: "cve@mitre.org", tags: [ "Not Applicable", "Vendor Advisory", ], url: "http://secunia.com/advisories/25920", }, { source: "cve@mitre.org", tags: [ "Not Applicable", "Vendor Advisory", ], url: "http://secunia.com/advisories/26211", }, { source: "cve@mitre.org", tags: [ "Not Applicable", "Vendor Advisory", ], url: "http://secunia.com/advisories/26273", }, { source: "cve@mitre.org", tags: [ "Not Applicable", "Vendor Advisory", ], url: "http://secunia.com/advisories/26443", }, { source: "cve@mitre.org", tags: [ "Not Applicable", "Vendor Advisory", ], url: "http://secunia.com/advisories/26508", }, { source: "cve@mitre.org", tags: [ "Not Applicable", "Vendor Advisory", ], url: "http://secunia.com/advisories/26611", }, { source: "cve@mitre.org", tags: [ "Not Applicable", "Vendor Advisory", ], url: "http://secunia.com/advisories/26759", }, { source: "cve@mitre.org", tags: [ "Not Applicable", "Vendor Advisory", ], url: "http://secunia.com/advisories/26790", }, { source: "cve@mitre.org", tags: [ "Not Applicable", "Vendor Advisory", ], url: "http://secunia.com/advisories/26822", }, { source: "cve@mitre.org", tags: [ "Not Applicable", "Vendor Advisory", ], url: "http://secunia.com/advisories/26842", }, { source: "cve@mitre.org", tags: [ "Not Applicable", "Vendor Advisory", ], url: "http://secunia.com/advisories/26993", }, { source: "cve@mitre.org", tags: [ "Not Applicable", ], url: "http://secunia.com/advisories/27121", }, { source: "cve@mitre.org", tags: [ "Not Applicable", ], url: "http://secunia.com/advisories/27209", }, { source: "cve@mitre.org", tags: [ "Not Applicable", ], url: "http://secunia.com/advisories/27563", }, { source: "cve@mitre.org", tags: [ "Not Applicable", ], url: "http://secunia.com/advisories/27732", }, { source: "cve@mitre.org", tags: [ "Not Applicable", ], url: "http://secunia.com/advisories/28212", }, { source: "cve@mitre.org", tags: [ "Not Applicable", ], url: "http://secunia.com/advisories/28224", }, { source: "cve@mitre.org", tags: [ "Not Applicable", ], url: "http://secunia.com/advisories/28606", }, { source: "cve@mitre.org", tags: [ "Third Party Advisory", ], url: "http://security.gentoo.org/glsa/glsa-200711-06.xml", }, { source: "cve@mitre.org", tags: [ "Third Party Advisory", ], url: "http://security.psnc.pl/files/apache_report.pdf", }, { source: "cve@mitre.org", tags: [ "Exploit", "Third Party Advisory", ], url: "http://securityreason.com/securityalert/2814", }, { source: "cve@mitre.org", tags: [ "Broken Link", ], url: "http://sunsolve.sun.com/search/document.do?assetkey=1-26-103179-1", }, { source: "cve@mitre.org", tags: [ "Broken Link", ], url: "http://sunsolve.sun.com/search/document.do?assetkey=1-66-200032-1", }, { source: "cve@mitre.org", tags: [ "Third Party Advisory", ], url: "http://support.avaya.com/elmodocs2/security/ASA-2007-353.htm", }, { source: "cve@mitre.org", tags: [ "Third Party Advisory", ], url: "http://support.avaya.com/elmodocs2/security/ASA-2007-363.htm", }, { source: "cve@mitre.org", tags: [ "Third Party Advisory", ], url: "http://svn.apache.org/viewvc?view=rev&revision=547987", }, { source: "cve@mitre.org", tags: [ "Third Party Advisory", ], url: "http://www-1.ibm.com/support/docview.wss?uid=swg1PK52702", }, { source: "cve@mitre.org", tags: [ "Third Party Advisory", ], url: "http://www-1.ibm.com/support/docview.wss?uid=swg1PK53984", }, { source: "cve@mitre.org", tags: [ "Third Party Advisory", ], url: "http://www-1.ibm.com/support/search.wss?rs=0&q=PK50467&apar=only", }, { source: "cve@mitre.org", tags: [ "Third Party Advisory", ], url: "http://www.fujitsu.com/global/support/software/security/products-f/interstage-200802e.html", }, { source: "cve@mitre.org", tags: [ "Broken Link", ], url: "http://www.mandriva.com/security/advisories?name=MDKSA-2007:140", }, { source: "cve@mitre.org", tags: [ "Broken Link", ], url: "http://www.mandriva.com/security/advisories?name=MDKSA-2007:142", }, { source: "cve@mitre.org", tags: [ "Broken Link", ], url: "http://www.novell.com/linux/security/advisories/2007_61_apache2.html", }, { source: "cve@mitre.org", tags: [ "Mailing List", "Third Party Advisory", ], url: "http://www.redhat.com/archives/fedora-package-announce/2007-September/msg00320.html", }, { source: "cve@mitre.org", tags: [ "Third Party Advisory", ], url: "http://www.redhat.com/errata/RHSA-2007-0532.html", }, { source: "cve@mitre.org", tags: [ "Third Party Advisory", ], url: "http://www.redhat.com/support/errata/RHSA-2007-0557.html", }, { source: "cve@mitre.org", tags: [ "Third Party Advisory", ], url: "http://www.redhat.com/support/errata/RHSA-2007-0662.html", }, { source: "cve@mitre.org", tags: [ "Third Party Advisory", ], url: "http://www.redhat.com/support/errata/RHSA-2008-0261.html", }, { source: "cve@mitre.org", tags: [ "Third Party Advisory", "VDB Entry", ], url: "http://www.securityfocus.com/archive/1/469899/100/0/threaded", }, { source: "cve@mitre.org", tags: [ "Third Party Advisory", "VDB Entry", ], url: "http://www.securityfocus.com/archive/1/471832/100/0/threaded", }, { source: "cve@mitre.org", tags: [ "Third Party Advisory", "VDB Entry", ], url: "http://www.securityfocus.com/archive/1/505990/100/0/threaded", }, { source: "cve@mitre.org", tags: [ "Third Party Advisory", "VDB Entry", ], url: "http://www.securityfocus.com/bid/24215", }, { source: "cve@mitre.org", tags: [ "Broken Link", "Third Party Advisory", "VDB Entry", ], url: "http://www.securitytracker.com/id?1018304", }, { source: "cve@mitre.org", tags: [ "Broken Link", ], url: "http://www.trustix.org/errata/2007/0026/", }, { source: "cve@mitre.org", tags: [ "Third Party Advisory", ], url: "http://www.ubuntu.com/usn/usn-499-1", }, { source: "cve@mitre.org", tags: [ "Permissions Required", ], url: "http://www.vupen.com/english/advisories/2007/2727", }, { source: "cve@mitre.org", tags: [ "Permissions Required", ], url: "http://www.vupen.com/english/advisories/2007/3100", }, { source: "cve@mitre.org", tags: [ "Permissions Required", ], url: "http://www.vupen.com/english/advisories/2007/3283", }, { source: "cve@mitre.org", tags: [ "Permissions Required", ], url: "http://www.vupen.com/english/advisories/2007/3420", }, { source: "cve@mitre.org", tags: [ "Permissions Required", ], url: "http://www.vupen.com/english/advisories/2007/3494", }, { source: "cve@mitre.org", tags: [ "Permissions Required", ], url: "http://www.vupen.com/english/advisories/2007/4305", }, { source: "cve@mitre.org", tags: [ "Permissions Required", ], url: "http://www.vupen.com/english/advisories/2008/0233", }, { source: "cve@mitre.org", tags: [ "Third Party Advisory", "VDB Entry", ], url: "https://exchange.xforce.ibmcloud.com/vulnerabilities/35095", }, { source: "cve@mitre.org", tags: [ "Broken Link", ], url: "https://issues.rpath.com/browse/RPL-1710", }, { source: "cve@mitre.org", url: "https://lists.apache.org/thread.html/54a42d4b01968df1117cea77fc53d6beb931c0e05936ad02af93e9ac%40%3Ccvs.httpd.apache.org%3E", }, { source: "cve@mitre.org", url: "https://lists.apache.org/thread.html/5df9bfb86a3b054bb985a45ff9250b0332c9ecc181eec232489e7f79%40%3Ccvs.httpd.apache.org%3E", }, { source: "cve@mitre.org", url: "https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E", }, { source: "cve@mitre.org", url: "https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E", }, { source: "cve@mitre.org", url: "https://lists.apache.org/thread.html/r0276683d8e1e07153fc8642618830ac0ade85b9ae0dc7b07f63bb8fc%40%3Ccvs.httpd.apache.org%3E", }, { source: "cve@mitre.org", url: "https://lists.apache.org/thread.html/r2cb985de917e7da0848c440535f65a247754db8b2154a10089e4247b%40%3Ccvs.httpd.apache.org%3E", }, { source: "cve@mitre.org", url: "https://lists.apache.org/thread.html/r476d175be0aaf4a17680ef98c5153b4d336eaef76fb2224cc94c463a%40%3Ccvs.httpd.apache.org%3E", }, { source: "cve@mitre.org", url: "https://lists.apache.org/thread.html/r5419c9ba0951ef73a655362403d12bb8d10fab38274deb3f005816f5%40%3Ccvs.httpd.apache.org%3E", }, { source: "cve@mitre.org", url: "https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E", }, { source: "cve@mitre.org", url: "https://lists.apache.org/thread.html/r5f9c22f9c28adbd9f00556059edc7b03a5d5bb71d4bb80257c0d34e4%40%3Ccvs.httpd.apache.org%3E", }, { source: "cve@mitre.org", url: "https://lists.apache.org/thread.html/r652fc951306cdeca5a276e2021a34878a76695a9f3cfb6490b4a6840%40%3Ccvs.httpd.apache.org%3E", }, { source: "cve@mitre.org", url: "https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E", }, { source: "cve@mitre.org", url: "https://lists.apache.org/thread.html/r8828e649175df56f1f9e3919938ac7826128525426e2748f0ab62feb%40%3Ccvs.httpd.apache.org%3E", }, { source: "cve@mitre.org", url: "https://lists.apache.org/thread.html/r9e8622254184645bc963a1d47c5d47f6d5a36d6f080d8d2c43b2b142%40%3Ccvs.httpd.apache.org%3E", }, { source: "cve@mitre.org", url: "https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E", }, { source: "cve@mitre.org", url: "https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E", }, { source: "cve@mitre.org", url: "https://lists.apache.org/thread.html/rad01d817195e6cc871cb1d73b207ca326379a20a6e7f30febaf56d24%40%3Ccvs.httpd.apache.org%3E", }, { source: "cve@mitre.org", url: "https://lists.apache.org/thread.html/rafd145ba6cd0a4ced113a5823cdaff45aeb36eb09855b216401c66d6%40%3Ccvs.httpd.apache.org%3E", }, { source: "cve@mitre.org", url: "https://lists.apache.org/thread.html/rb9c9f42dafa25d2f669dac2a536a03f2575bc5ec1be6f480618aee10%40%3Ccvs.httpd.apache.org%3E", }, { source: "cve@mitre.org", url: "https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E", }, { source: "cve@mitre.org", url: "https://lists.apache.org/thread.html/reb542d2038e9c331506e0cbff881b47e40fbe2bd93ff00979e60cdf7%40%3Ccvs.httpd.apache.org%3E", }, { source: "cve@mitre.org", url: "https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E", }, { source: "cve@mitre.org", url: "https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E", }, { source: "cve@mitre.org", tags: [ "Third Party Advisory", ], url: "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11589", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Broken Link", ], url: "ftp://patches.sgi.com/support/free/security/advisories/20070701-01-P.asc", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Issue Tracking", "Third Party Advisory", ], url: "http://bugs.gentoo.org/show_bug.cgi?id=186219", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Issue Tracking", "Third Party Advisory", ], url: "http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=245111", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Third Party Advisory", ], url: "http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01182588", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Third Party Advisory", ], url: "http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01182588", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Vendor Advisory", ], url: "http://httpd.apache.org/security/vulnerabilities_13.html", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Vendor Advisory", ], url: "http://httpd.apache.org/security/vulnerabilities_20.html", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Vendor Advisory", ], url: "http://httpd.apache.org/security/vulnerabilities_22.html", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Mailing List", "Third Party Advisory", ], url: "http://lists.vmware.com/pipermail/security-announce/2009/000062.html", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "http://mail-archives.apache.org/mod_mbox/httpd-dev/200706.mbox/%3c20070629141032.GA15192%40redhat.com%3e", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Issue Tracking", "Mailing List", "Third Party Advisory", ], url: "http://marc.info/?l=apache-httpd-dev&m=118252946632447&w=2", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Broken Link", ], url: "http://osvdb.org/38939", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Third Party Advisory", ], url: "http://rhn.redhat.com/errata/RHSA-2007-0556.html", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Not Applicable", "Vendor Advisory", ], url: "http://secunia.com/advisories/25827", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Not Applicable", "Vendor Advisory", ], url: "http://secunia.com/advisories/25830", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Not Applicable", "Vendor Advisory", ], url: "http://secunia.com/advisories/25920", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Not Applicable", "Vendor Advisory", ], url: "http://secunia.com/advisories/26211", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Not Applicable", "Vendor Advisory", ], url: "http://secunia.com/advisories/26273", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Not Applicable", "Vendor Advisory", ], url: "http://secunia.com/advisories/26443", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Not Applicable", "Vendor Advisory", ], url: "http://secunia.com/advisories/26508", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Not Applicable", "Vendor Advisory", ], url: "http://secunia.com/advisories/26611", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Not Applicable", "Vendor Advisory", ], url: "http://secunia.com/advisories/26759", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Not Applicable", "Vendor Advisory", ], url: "http://secunia.com/advisories/26790", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Not Applicable", "Vendor Advisory", ], url: "http://secunia.com/advisories/26822", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Not Applicable", "Vendor Advisory", ], url: "http://secunia.com/advisories/26842", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Not Applicable", "Vendor Advisory", ], url: "http://secunia.com/advisories/26993", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Not Applicable", ], url: "http://secunia.com/advisories/27121", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Not Applicable", ], url: "http://secunia.com/advisories/27209", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Not Applicable", ], url: "http://secunia.com/advisories/27563", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Not Applicable", ], url: "http://secunia.com/advisories/27732", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Not Applicable", ], url: "http://secunia.com/advisories/28212", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Not Applicable", ], url: "http://secunia.com/advisories/28224", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Not Applicable", ], url: "http://secunia.com/advisories/28606", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Third Party Advisory", ], url: "http://security.gentoo.org/glsa/glsa-200711-06.xml", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Third Party Advisory", ], url: "http://security.psnc.pl/files/apache_report.pdf", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Exploit", "Third Party Advisory", ], url: "http://securityreason.com/securityalert/2814", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Broken Link", ], url: "http://sunsolve.sun.com/search/document.do?assetkey=1-26-103179-1", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Broken Link", ], url: "http://sunsolve.sun.com/search/document.do?assetkey=1-66-200032-1", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Third Party Advisory", ], url: "http://support.avaya.com/elmodocs2/security/ASA-2007-353.htm", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Third Party Advisory", ], url: "http://support.avaya.com/elmodocs2/security/ASA-2007-363.htm", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Third Party Advisory", ], url: "http://svn.apache.org/viewvc?view=rev&revision=547987", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Third Party Advisory", ], url: "http://www-1.ibm.com/support/docview.wss?uid=swg1PK52702", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Third Party Advisory", ], url: "http://www-1.ibm.com/support/docview.wss?uid=swg1PK53984", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Third Party Advisory", ], url: "http://www-1.ibm.com/support/search.wss?rs=0&q=PK50467&apar=only", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Third Party Advisory", ], url: "http://www.fujitsu.com/global/support/software/security/products-f/interstage-200802e.html", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Broken Link", ], url: "http://www.mandriva.com/security/advisories?name=MDKSA-2007:140", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Broken Link", ], url: "http://www.mandriva.com/security/advisories?name=MDKSA-2007:142", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Broken Link", ], url: "http://www.novell.com/linux/security/advisories/2007_61_apache2.html", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Mailing List", "Third Party Advisory", ], url: "http://www.redhat.com/archives/fedora-package-announce/2007-September/msg00320.html", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Third Party Advisory", ], url: "http://www.redhat.com/errata/RHSA-2007-0532.html", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Third Party Advisory", ], url: "http://www.redhat.com/support/errata/RHSA-2007-0557.html", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Third Party Advisory", ], url: "http://www.redhat.com/support/errata/RHSA-2007-0662.html", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Third Party Advisory", ], url: "http://www.redhat.com/support/errata/RHSA-2008-0261.html", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Third Party Advisory", "VDB Entry", ], url: "http://www.securityfocus.com/archive/1/469899/100/0/threaded", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Third Party Advisory", "VDB Entry", ], url: "http://www.securityfocus.com/archive/1/471832/100/0/threaded", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Third Party Advisory", "VDB Entry", ], url: "http://www.securityfocus.com/archive/1/505990/100/0/threaded", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Third Party Advisory", "VDB Entry", ], url: "http://www.securityfocus.com/bid/24215", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Broken Link", "Third Party Advisory", "VDB Entry", ], url: "http://www.securitytracker.com/id?1018304", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Broken Link", ], url: "http://www.trustix.org/errata/2007/0026/", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Third Party Advisory", ], url: "http://www.ubuntu.com/usn/usn-499-1", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Permissions Required", ], url: "http://www.vupen.com/english/advisories/2007/2727", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Permissions Required", ], url: "http://www.vupen.com/english/advisories/2007/3100", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Permissions Required", ], url: "http://www.vupen.com/english/advisories/2007/3283", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Permissions Required", ], url: "http://www.vupen.com/english/advisories/2007/3420", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Permissions Required", ], url: "http://www.vupen.com/english/advisories/2007/3494", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Permissions Required", ], url: "http://www.vupen.com/english/advisories/2007/4305", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Permissions Required", ], url: "http://www.vupen.com/english/advisories/2008/0233", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Third Party Advisory", "VDB Entry", ], url: "https://exchange.xforce.ibmcloud.com/vulnerabilities/35095", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Broken Link", ], url: "https://issues.rpath.com/browse/RPL-1710", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "https://lists.apache.org/thread.html/54a42d4b01968df1117cea77fc53d6beb931c0e05936ad02af93e9ac%40%3Ccvs.httpd.apache.org%3E", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "https://lists.apache.org/thread.html/5df9bfb86a3b054bb985a45ff9250b0332c9ecc181eec232489e7f79%40%3Ccvs.httpd.apache.org%3E", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "https://lists.apache.org/thread.html/r0276683d8e1e07153fc8642618830ac0ade85b9ae0dc7b07f63bb8fc%40%3Ccvs.httpd.apache.org%3E", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "https://lists.apache.org/thread.html/r2cb985de917e7da0848c440535f65a247754db8b2154a10089e4247b%40%3Ccvs.httpd.apache.org%3E", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "https://lists.apache.org/thread.html/r476d175be0aaf4a17680ef98c5153b4d336eaef76fb2224cc94c463a%40%3Ccvs.httpd.apache.org%3E", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "https://lists.apache.org/thread.html/r5419c9ba0951ef73a655362403d12bb8d10fab38274deb3f005816f5%40%3Ccvs.httpd.apache.org%3E", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "https://lists.apache.org/thread.html/r5f9c22f9c28adbd9f00556059edc7b03a5d5bb71d4bb80257c0d34e4%40%3Ccvs.httpd.apache.org%3E", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "https://lists.apache.org/thread.html/r652fc951306cdeca5a276e2021a34878a76695a9f3cfb6490b4a6840%40%3Ccvs.httpd.apache.org%3E", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "https://lists.apache.org/thread.html/r8828e649175df56f1f9e3919938ac7826128525426e2748f0ab62feb%40%3Ccvs.httpd.apache.org%3E", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "https://lists.apache.org/thread.html/r9e8622254184645bc963a1d47c5d47f6d5a36d6f080d8d2c43b2b142%40%3Ccvs.httpd.apache.org%3E", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "https://lists.apache.org/thread.html/rad01d817195e6cc871cb1d73b207ca326379a20a6e7f30febaf56d24%40%3Ccvs.httpd.apache.org%3E", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "https://lists.apache.org/thread.html/rafd145ba6cd0a4ced113a5823cdaff45aeb36eb09855b216401c66d6%40%3Ccvs.httpd.apache.org%3E", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "https://lists.apache.org/thread.html/rb9c9f42dafa25d2f669dac2a536a03f2575bc5ec1be6f480618aee10%40%3Ccvs.httpd.apache.org%3E", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "https://lists.apache.org/thread.html/reb542d2038e9c331506e0cbff881b47e40fbe2bd93ff00979e60cdf7%40%3Ccvs.httpd.apache.org%3E", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Third Party Advisory", ], url: "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11589", }, ], sourceIdentifier: "cve@mitre.org", vendorComments: [ { comment: "Fixed in Apache HTTP Server 2.2.6, 2.0.61, and 1.3.39:\nhttp://httpd.apache.org/security/vulnerabilities_22.html\nhttp://httpd.apache.org/security/vulnerabilities_20.html\nhttp://httpd.apache.org/security/vulnerabilities_13.html", lastModified: "2008-07-02T00:00:00", organization: "Apache", }, ], vulnStatus: "Deferred", weaknesses: [ { description: [ { lang: "en", value: "NVD-CWE-noinfo", }, ], source: "nvd@nist.gov", type: "Primary", }, ], }
ghsa-f63r-c37x-f6mg
Vulnerability from github
Published
2022-05-03 03:18
Modified
2022-05-03 03:18
Details
Apache httpd 1.3.37, 2.0.59, and 2.2.4 with the Prefork MPM module, allows local users to cause a denial of service by modifying the worker_score and process_score arrays to reference an arbitrary process ID, which is sent a SIGUSR1 signal from the master process, aka "SIGUSR1 killer."
{ affected: [], aliases: [ "CVE-2007-3304", ], database_specific: { cwe_ids: [], github_reviewed: false, github_reviewed_at: null, nvd_published_at: "2007-06-20T22:30:00Z", severity: "MODERATE", }, details: "Apache httpd 1.3.37, 2.0.59, and 2.2.4 with the Prefork MPM module, allows local users to cause a denial of service by modifying the worker_score and process_score arrays to reference an arbitrary process ID, which is sent a SIGUSR1 signal from the master process, aka \"SIGUSR1 killer.\"", id: "GHSA-f63r-c37x-f6mg", modified: "2022-05-03T03:18:13Z", published: "2022-05-03T03:18:13Z", references: [ { type: "ADVISORY", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-3304", }, { type: "WEB", url: "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11589", }, { type: "WEB", url: "https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b@%3Ccvs.httpd.apache.org%3E", }, { type: "WEB", url: "https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9@%3Ccvs.httpd.apache.org%3E", }, { type: "WEB", url: "https://lists.apache.org/thread.html/reb542d2038e9c331506e0cbff881b47e40fbe2bd93ff00979e60cdf7@%3Ccvs.httpd.apache.org%3E", }, { type: "WEB", url: "https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064@%3Ccvs.httpd.apache.org%3E", }, { type: "WEB", url: "https://lists.apache.org/thread.html/rb9c9f42dafa25d2f669dac2a536a03f2575bc5ec1be6f480618aee10@%3Ccvs.httpd.apache.org%3E", }, { type: "WEB", url: "https://lists.apache.org/thread.html/rafd145ba6cd0a4ced113a5823cdaff45aeb36eb09855b216401c66d6@%3Ccvs.httpd.apache.org%3E", }, { type: "WEB", url: "https://lists.apache.org/thread.html/rad01d817195e6cc871cb1d73b207ca326379a20a6e7f30febaf56d24@%3Ccvs.httpd.apache.org%3E", }, { type: "WEB", url: "https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920@%3Ccvs.httpd.apache.org%3E", }, { type: "WEB", url: "https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b@%3Ccvs.httpd.apache.org%3E", }, { type: "WEB", url: "https://lists.apache.org/thread.html/r9e8622254184645bc963a1d47c5d47f6d5a36d6f080d8d2c43b2b142@%3Ccvs.httpd.apache.org%3E", }, { type: "WEB", url: "https://lists.apache.org/thread.html/r8828e649175df56f1f9e3919938ac7826128525426e2748f0ab62feb@%3Ccvs.httpd.apache.org%3E", }, { type: "WEB", url: "https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f@%3Ccvs.httpd.apache.org%3E", }, { type: "WEB", url: "https://lists.apache.org/thread.html/r652fc951306cdeca5a276e2021a34878a76695a9f3cfb6490b4a6840@%3Ccvs.httpd.apache.org%3E", }, { type: "WEB", url: "https://lists.apache.org/thread.html/r5f9c22f9c28adbd9f00556059edc7b03a5d5bb71d4bb80257c0d34e4@%3Ccvs.httpd.apache.org%3E", }, { type: "WEB", url: "https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7@%3Ccvs.httpd.apache.org%3E", }, { type: "WEB", url: "https://lists.apache.org/thread.html/r5419c9ba0951ef73a655362403d12bb8d10fab38274deb3f005816f5@%3Ccvs.httpd.apache.org%3E", }, { type: "WEB", url: "https://lists.apache.org/thread.html/r476d175be0aaf4a17680ef98c5153b4d336eaef76fb2224cc94c463a@%3Ccvs.httpd.apache.org%3E", }, { type: "WEB", url: "https://lists.apache.org/thread.html/r2cb985de917e7da0848c440535f65a247754db8b2154a10089e4247b@%3Ccvs.httpd.apache.org%3E", }, { type: "WEB", url: "https://lists.apache.org/thread.html/r0276683d8e1e07153fc8642618830ac0ade85b9ae0dc7b07f63bb8fc@%3Ccvs.httpd.apache.org%3E", }, { type: "WEB", url: "https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53@%3Ccvs.httpd.apache.org%3E", }, { type: "WEB", url: "https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f@%3Ccvs.httpd.apache.org%3E", }, { type: "WEB", url: "https://lists.apache.org/thread.html/5df9bfb86a3b054bb985a45ff9250b0332c9ecc181eec232489e7f79@%3Ccvs.httpd.apache.org%3E", }, { type: "WEB", url: "https://lists.apache.org/thread.html/54a42d4b01968df1117cea77fc53d6beb931c0e05936ad02af93e9ac@%3Ccvs.httpd.apache.org%3E", }, { type: "WEB", url: "https://issues.rpath.com/browse/RPL-1710", }, { type: "WEB", url: "https://exchange.xforce.ibmcloud.com/vulnerabilities/35095", }, { type: "WEB", url: "http://bugs.gentoo.org/show_bug.cgi?id=186219", }, { type: "WEB", url: "http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=245111", }, { type: "WEB", url: "http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01182588", }, { type: "WEB", url: "http://httpd.apache.org/security/vulnerabilities_13.html", }, { type: "WEB", url: "http://httpd.apache.org/security/vulnerabilities_20.html", }, { type: "WEB", url: "http://httpd.apache.org/security/vulnerabilities_22.html", }, { type: "WEB", url: "http://lists.vmware.com/pipermail/security-announce/2009/000062.html", }, { type: "WEB", url: "http://mail-archives.apache.org/mod_mbox/httpd-dev/200706.mbox/%3c20070629141032.GA15192@redhat.com%3e", }, { type: "WEB", url: "http://marc.info/?l=apache-httpd-dev&m=118252946632447&w=2", }, { type: "WEB", url: "http://osvdb.org/38939", }, { type: "WEB", url: "http://rhn.redhat.com/errata/RHSA-2007-0556.html", }, { type: "WEB", url: "http://secunia.com/advisories/25827", }, { type: "WEB", url: "http://secunia.com/advisories/25830", }, { type: "WEB", url: "http://secunia.com/advisories/25920", }, { type: "WEB", url: "http://secunia.com/advisories/26211", }, { type: "WEB", url: "http://secunia.com/advisories/26273", }, { type: "WEB", url: "http://secunia.com/advisories/26443", }, { type: "WEB", url: "http://secunia.com/advisories/26508", }, { type: "WEB", url: "http://secunia.com/advisories/26611", }, { type: "WEB", url: "http://secunia.com/advisories/26759", }, { type: "WEB", url: "http://secunia.com/advisories/26790", }, { type: "WEB", url: "http://secunia.com/advisories/26822", }, { type: "WEB", url: "http://secunia.com/advisories/26842", }, { type: "WEB", url: "http://secunia.com/advisories/26993", }, { type: "WEB", url: "http://secunia.com/advisories/27121", }, { type: "WEB", url: "http://secunia.com/advisories/27209", }, { type: "WEB", url: "http://secunia.com/advisories/27563", }, { type: "WEB", url: "http://secunia.com/advisories/27732", }, { type: "WEB", url: "http://secunia.com/advisories/28212", }, { type: "WEB", url: "http://secunia.com/advisories/28224", }, { type: "WEB", url: "http://secunia.com/advisories/28606", }, { type: "WEB", url: "http://security.gentoo.org/glsa/glsa-200711-06.xml", }, { type: "WEB", url: "http://security.psnc.pl/files/apache_report.pdf", }, { type: "WEB", url: "http://securityreason.com/securityalert/2814", }, { type: "WEB", url: "http://sunsolve.sun.com/search/document.do?assetkey=1-26-103179-1", }, { type: "WEB", url: "http://sunsolve.sun.com/search/document.do?assetkey=1-66-200032-1", }, { type: "WEB", url: "http://support.avaya.com/elmodocs2/security/ASA-2007-353.htm", }, { type: "WEB", url: "http://support.avaya.com/elmodocs2/security/ASA-2007-363.htm", }, { type: "WEB", url: "http://svn.apache.org/viewvc?view=rev&revision=547987", }, { type: "WEB", url: "http://www-1.ibm.com/support/docview.wss?uid=swg1PK52702", }, { type: "WEB", url: "http://www-1.ibm.com/support/docview.wss?uid=swg1PK53984", }, { type: "WEB", url: "http://www-1.ibm.com/support/search.wss?rs=0&q=PK50467&apar=only", }, { type: "WEB", url: "http://www.fujitsu.com/global/support/software/security/products-f/interstage-200802e.html", }, { type: "WEB", url: "http://www.mandriva.com/security/advisories?name=MDKSA-2007:140", }, { type: "WEB", url: "http://www.mandriva.com/security/advisories?name=MDKSA-2007:142", }, { type: "WEB", url: "http://www.novell.com/linux/security/advisories/2007_61_apache2.html", }, { type: "WEB", url: "http://www.redhat.com/archives/fedora-package-announce/2007-September/msg00320.html", }, { type: "WEB", url: "http://www.redhat.com/errata/RHSA-2007-0532.html", }, { type: "WEB", url: "http://www.redhat.com/support/errata/RHSA-2007-0557.html", }, { type: "WEB", url: "http://www.redhat.com/support/errata/RHSA-2007-0662.html", }, { type: "WEB", url: "http://www.redhat.com/support/errata/RHSA-2008-0261.html", }, { type: "WEB", url: "http://www.securityfocus.com/archive/1/469899/100/0/threaded", }, { type: "WEB", url: "http://www.securityfocus.com/archive/1/471832/100/0/threaded", }, { type: "WEB", url: "http://www.securityfocus.com/archive/1/505990/100/0/threaded", }, { type: "WEB", url: "http://www.securityfocus.com/bid/24215", }, { type: "WEB", url: "http://www.securitytracker.com/id?1018304", }, { type: "WEB", url: "http://www.trustix.org/errata/2007/0026", }, { type: "WEB", url: "http://www.ubuntu.com/usn/usn-499-1", }, { type: "WEB", url: "http://www.vupen.com/english/advisories/2007/2727", }, { type: "WEB", url: "http://www.vupen.com/english/advisories/2007/3100", }, { type: "WEB", url: "http://www.vupen.com/english/advisories/2007/3283", }, { type: "WEB", url: "http://www.vupen.com/english/advisories/2007/3420", }, { type: "WEB", url: "http://www.vupen.com/english/advisories/2007/3494", }, { type: "WEB", url: "http://www.vupen.com/english/advisories/2007/4305", }, { type: "WEB", url: "http://www.vupen.com/english/advisories/2008/0233", }, ], schema_version: "1.4.0", severity: [], }
gsd-2007-3304
Vulnerability from gsd
Modified
2023-12-13 01:21
Details
Apache httpd 1.3.37, 2.0.59, and 2.2.4 with the Prefork MPM module, allows local users to cause a denial of service by modifying the worker_score and process_score arrays to reference an arbitrary process ID, which is sent a SIGUSR1 signal from the master process, aka "SIGUSR1 killer."
Aliases
Aliases
{ GSD: { alias: "CVE-2007-3304", description: "Apache httpd 1.3.37, 2.0.59, and 2.2.4 with the Prefork MPM module, allows local users to cause a denial of service by modifying the worker_score and process_score arrays to reference an arbitrary process ID, which is sent a SIGUSR1 signal from the master process, aka \"SIGUSR1 killer.\"", id: "GSD-2007-3304", references: [ "https://www.suse.com/security/cve/CVE-2007-3304.html", "https://access.redhat.com/errata/RHSA-2010:0602", "https://access.redhat.com/errata/RHSA-2008:0524", "https://access.redhat.com/errata/RHSA-2008:0523", "https://access.redhat.com/errata/RHSA-2008:0263", "https://access.redhat.com/errata/RHSA-2008:0261", "https://access.redhat.com/errata/RHSA-2007:0662", "https://access.redhat.com/errata/RHSA-2007:0557", "https://access.redhat.com/errata/RHSA-2007:0556", "https://access.redhat.com/errata/RHSA-2007:0532", "https://linux.oracle.com/cve/CVE-2007-3304.html", ], }, gsd: { metadata: { exploitCode: "unknown", remediation: "unknown", reportConfidence: "confirmed", type: "vulnerability", }, osvSchema: { aliases: [ "CVE-2007-3304", ], details: "Apache httpd 1.3.37, 2.0.59, and 2.2.4 with the Prefork MPM module, allows local users to cause a denial of service by modifying the worker_score and process_score arrays to reference an arbitrary process ID, which is sent a SIGUSR1 signal from the master process, aka \"SIGUSR1 killer.\"", id: "GSD-2007-3304", modified: "2023-12-13T01:21:41.522028Z", schema_version: "1.4.0", }, }, namespaces: { "cve.org": { CVE_data_meta: { ASSIGNER: "cve@mitre.org", ID: "CVE-2007-3304", STATE: "PUBLIC", }, affects: { vendor: { vendor_data: [ { product: { product_data: [ { product_name: "n/a", version: { version_data: [ { version_value: "n/a", }, ], }, }, ], }, vendor_name: "n/a", }, ], }, }, data_format: "MITRE", data_type: "CVE", data_version: "4.0", description: { description_data: [ { lang: "eng", value: "Apache httpd 1.3.37, 2.0.59, and 2.2.4 with the Prefork MPM module, allows local users to cause a denial of service by modifying the worker_score and process_score arrays to reference an arbitrary process ID, which is sent a SIGUSR1 signal from the master process, aka \"SIGUSR1 killer.\"", }, ], }, problemtype: { problemtype_data: [ { description: [ { lang: "eng", value: "n/a", }, ], }, ], }, references: { reference_data: [ { name: "28606", refsource: "SECUNIA", url: "http://secunia.com/advisories/28606", }, { name: "http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=245111", refsource: "MISC", url: "http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=245111", }, { name: "MDKSA-2007:142", refsource: "MANDRIVA", url: "http://www.mandriva.com/security/advisories?name=MDKSA-2007:142", }, { name: "26822", refsource: "SECUNIA", url: "http://secunia.com/advisories/26822", }, { name: "ADV-2007-4305", refsource: "VUPEN", url: "http://www.vupen.com/english/advisories/2007/4305", }, { name: "ADV-2007-3420", refsource: "VUPEN", url: "http://www.vupen.com/english/advisories/2007/3420", }, { name: "RHSA-2007:0557", refsource: "REDHAT", url: "http://www.redhat.com/support/errata/RHSA-2007-0557.html", }, { name: "38939", refsource: "OSVDB", url: "http://osvdb.org/38939", }, { name: "PK52702", refsource: "AIXAPAR", url: "http://www-1.ibm.com/support/docview.wss?uid=swg1PK52702", }, { name: "MDKSA-2007:140", refsource: "MANDRIVA", url: "http://www.mandriva.com/security/advisories?name=MDKSA-2007:140", }, { name: "HPSBUX02273", refsource: "HP", url: "http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01182588", }, { name: "25827", refsource: "SECUNIA", url: "http://secunia.com/advisories/25827", }, { name: "25920", refsource: "SECUNIA", url: "http://secunia.com/advisories/25920", }, { name: "26993", refsource: "SECUNIA", url: "http://secunia.com/advisories/26993", }, { name: "28212", refsource: "SECUNIA", url: "http://secunia.com/advisories/28212", }, { name: "http://security.psnc.pl/files/apache_report.pdf", refsource: "MISC", url: "http://security.psnc.pl/files/apache_report.pdf", }, { name: "1018304", refsource: "SECTRACK", url: "http://www.securitytracker.com/id?1018304", }, { name: "27563", refsource: "SECUNIA", url: "http://secunia.com/advisories/27563", }, { name: "27732", refsource: "SECUNIA", url: "http://secunia.com/advisories/27732", }, { name: "http://svn.apache.org/viewvc?view=rev&revision=547987", refsource: "CONFIRM", url: "http://svn.apache.org/viewvc?view=rev&revision=547987", }, { name: "103179", refsource: "SUNALERT", url: "http://sunsolve.sun.com/search/document.do?assetkey=1-26-103179-1", }, { name: "27209", refsource: "SECUNIA", url: "http://secunia.com/advisories/27209", }, { name: "RHSA-2007:0662", refsource: "REDHAT", url: "http://www.redhat.com/support/errata/RHSA-2007-0662.html", }, { name: "26790", refsource: "SECUNIA", url: "http://secunia.com/advisories/26790", }, { name: "RHSA-2007:0556", refsource: "REDHAT", url: "http://rhn.redhat.com/errata/RHSA-2007-0556.html", }, { name: "http://httpd.apache.org/security/vulnerabilities_20.html", refsource: "CONFIRM", url: "http://httpd.apache.org/security/vulnerabilities_20.html", }, { name: "SUSE-SA:2007:061", refsource: "SUSE", url: "http://www.novell.com/linux/security/advisories/2007_61_apache2.html", }, { name: "20070529 Apache httpd vulenrabilities", refsource: "BUGTRAQ", url: "http://www.securityfocus.com/archive/1/469899/100/0/threaded", }, { name: "FEDORA-2007-2214", refsource: "FEDORA", url: "http://www.redhat.com/archives/fedora-package-announce/2007-September/msg00320.html", }, { name: "[apache-httpd-dev] 20070622 Re: PID table changes (was Re: svn commit: r547987 - in /httpd/httpd/trunk)", refsource: "MLIST", url: "http://marc.info/?l=apache-httpd-dev&m=118252946632447&w=2", }, { name: "26759", refsource: "SECUNIA", url: "http://secunia.com/advisories/26759", }, { name: "ADV-2007-3494", refsource: "VUPEN", url: "http://www.vupen.com/english/advisories/2007/3494", }, { name: "PK50467", refsource: "AIXAPAR", url: "http://www-1.ibm.com/support/search.wss?rs=0&q=PK50467&apar=only", }, { name: "2007-0026", refsource: "TRUSTIX", url: "http://www.trustix.org/errata/2007/0026/", }, { name: "RHSA-2007:0532", refsource: "REDHAT", url: "http://www.redhat.com/errata/RHSA-2007-0532.html", }, { name: "http://httpd.apache.org/security/vulnerabilities_22.html", refsource: "CONFIRM", url: "http://httpd.apache.org/security/vulnerabilities_22.html", }, { name: "https://issues.rpath.com/browse/RPL-1710", refsource: "CONFIRM", url: "https://issues.rpath.com/browse/RPL-1710", }, { name: "[apache-httpd-dev] 20070629 Re: [PATCH] pid safety checks for 2.2.x", refsource: "MLIST", url: "http://mail-archives.apache.org/mod_mbox/httpd-dev/200706.mbox/%3c20070629141032.GA15192@redhat.com%3e", }, { name: "20090821 VMSA-2009-0010 VMware Hosted products update libpng and Apache HTTP Server", refsource: "BUGTRAQ", url: "http://www.securityfocus.com/archive/1/505990/100/0/threaded", }, { name: "2814", refsource: "SREASON", url: "http://securityreason.com/securityalert/2814", }, { name: "oval:org.mitre.oval:def:11589", refsource: "OVAL", url: "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11589", }, { name: "27121", refsource: "SECUNIA", url: "http://secunia.com/advisories/27121", }, { name: "20070619 Apache Prefork MPM vulnerabilities - Report", refsource: "BUGTRAQ", url: "http://www.securityfocus.com/archive/1/471832/100/0/threaded", }, { name: "ADV-2008-0233", refsource: "VUPEN", url: "http://www.vupen.com/english/advisories/2008/0233", }, { name: "http://www.fujitsu.com/global/support/software/security/products-f/interstage-200802e.html", refsource: "CONFIRM", url: "http://www.fujitsu.com/global/support/software/security/products-f/interstage-200802e.html", }, { name: "26211", refsource: "SECUNIA", url: "http://secunia.com/advisories/26211", }, { name: "apache-child-process-dos(35095)", refsource: "XF", url: "https://exchange.xforce.ibmcloud.com/vulnerabilities/35095", }, { name: "26443", refsource: "SECUNIA", url: "http://secunia.com/advisories/26443", }, { name: "[security-announce] 20090820 VMSA-2009-0010 VMware Hosted products update libpng and Apache HTTP Server", refsource: "MLIST", url: "http://lists.vmware.com/pipermail/security-announce/2009/000062.html", }, { name: "http://httpd.apache.org/security/vulnerabilities_13.html", refsource: "CONFIRM", url: "http://httpd.apache.org/security/vulnerabilities_13.html", }, { name: "GLSA-200711-06", refsource: "GENTOO", url: "http://security.gentoo.org/glsa/glsa-200711-06.xml", }, { name: "28224", refsource: "SECUNIA", url: "http://secunia.com/advisories/28224", }, { name: "200032", refsource: "SUNALERT", url: "http://sunsolve.sun.com/search/document.do?assetkey=1-66-200032-1", }, { name: "25830", refsource: "SECUNIA", url: "http://secunia.com/advisories/25830", }, { name: "24215", refsource: "BID", url: "http://www.securityfocus.com/bid/24215", }, { name: "http://support.avaya.com/elmodocs2/security/ASA-2007-363.htm", refsource: "CONFIRM", url: "http://support.avaya.com/elmodocs2/security/ASA-2007-363.htm", }, { name: "USN-499-1", refsource: "UBUNTU", url: "http://www.ubuntu.com/usn/usn-499-1", }, { name: "RHSA-2008:0261", refsource: "REDHAT", url: "http://www.redhat.com/support/errata/RHSA-2008-0261.html", }, { name: "26508", refsource: "SECUNIA", url: "http://secunia.com/advisories/26508", }, { name: "http://support.avaya.com/elmodocs2/security/ASA-2007-353.htm", refsource: "CONFIRM", url: "http://support.avaya.com/elmodocs2/security/ASA-2007-353.htm", }, { name: "26842", refsource: "SECUNIA", url: "http://secunia.com/advisories/26842", }, { name: "ADV-2007-3283", refsource: "VUPEN", url: "http://www.vupen.com/english/advisories/2007/3283", }, { name: "20070701-01-P", refsource: "SGI", url: "ftp://patches.sgi.com/support/free/security/advisories/20070701-01-P.asc", }, { name: "PK53984", refsource: "AIXAPAR", url: "http://www-1.ibm.com/support/docview.wss?uid=swg1PK53984", }, { name: "ADV-2007-2727", refsource: "VUPEN", url: "http://www.vupen.com/english/advisories/2007/2727", }, { name: "26611", refsource: "SECUNIA", url: "http://secunia.com/advisories/26611", }, { name: "26273", refsource: "SECUNIA", url: "http://secunia.com/advisories/26273", }, { name: "http://bugs.gentoo.org/show_bug.cgi?id=186219", refsource: "CONFIRM", url: "http://bugs.gentoo.org/show_bug.cgi?id=186219", }, { name: "ADV-2007-3100", refsource: "VUPEN", url: "http://www.vupen.com/english/advisories/2007/3100", }, { name: "SSRT071476", refsource: "HP", url: "http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01182588", }, { name: "[httpd-cvs] 20190815 svn commit: r1048742 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html", refsource: "MLIST", url: "https://lists.apache.org/thread.html/54a42d4b01968df1117cea77fc53d6beb931c0e05936ad02af93e9ac@%3Ccvs.httpd.apache.org%3E", }, { name: "[httpd-cvs] 20190815 svn commit: r1048743 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html", refsource: "MLIST", url: "https://lists.apache.org/thread.html/5df9bfb86a3b054bb985a45ff9250b0332c9ecc181eec232489e7f79@%3Ccvs.httpd.apache.org%3E", }, { name: "[httpd-cvs] 20190815 svn commit: r1048743 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html", refsource: "MLIST", url: "https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f@%3Ccvs.httpd.apache.org%3E", }, { name: "[httpd-cvs] 20190815 svn commit: r1048742 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html", refsource: "MLIST", url: "https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53@%3Ccvs.httpd.apache.org%3E", }, { name: "[httpd-cvs] 20200401 svn commit: r1058586 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html", refsource: "MLIST", url: "https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7@%3Ccvs.httpd.apache.org%3E", }, { name: "[httpd-cvs] 20200401 svn commit: r1058586 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html", refsource: "MLIST", url: "https://lists.apache.org/thread.html/r0276683d8e1e07153fc8642618830ac0ade85b9ae0dc7b07f63bb8fc@%3Ccvs.httpd.apache.org%3E", }, { name: "[httpd-cvs] 20200401 svn commit: r1058587 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html", refsource: "MLIST", url: "https://lists.apache.org/thread.html/r8828e649175df56f1f9e3919938ac7826128525426e2748f0ab62feb@%3Ccvs.httpd.apache.org%3E", }, { name: "[httpd-cvs] 20200401 svn commit: r1058587 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html", refsource: "MLIST", url: "https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b@%3Ccvs.httpd.apache.org%3E", }, { name: "[httpd-cvs] 20210330 svn commit: r1073139 [1/13] - in /websites/staging/httpd/trunk/content: ./ security/json/", refsource: "MLIST", url: "https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9@%3Ccvs.httpd.apache.org%3E", }, { name: "[httpd-cvs] 20210330 svn commit: r1073140 [1/4] - in /websites/staging/httpd/trunk/content: ./ security/cvejsontohtml.py security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html", refsource: "MLIST", url: "https://lists.apache.org/thread.html/r5419c9ba0951ef73a655362403d12bb8d10fab38274deb3f005816f5@%3Ccvs.httpd.apache.org%3E", }, { name: "[httpd-cvs] 20210330 svn commit: r1073140 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/cvejsontohtml.py security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html", refsource: "MLIST", url: "https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b@%3Ccvs.httpd.apache.org%3E", }, { name: "[httpd-cvs] 20210330 svn commit: r1888194 [4/13] - /httpd/site/trunk/content/security/json/", refsource: "MLIST", url: "https://lists.apache.org/thread.html/r652fc951306cdeca5a276e2021a34878a76695a9f3cfb6490b4a6840@%3Ccvs.httpd.apache.org%3E", }, { name: "[httpd-cvs] 20210330 svn commit: r1073140 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/cvejsontohtml.py security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html", refsource: "MLIST", url: "https://lists.apache.org/thread.html/r2cb985de917e7da0848c440535f65a247754db8b2154a10089e4247b@%3Ccvs.httpd.apache.org%3E", }, { name: "[httpd-cvs] 20210330 svn commit: r1073143 [2/3] - in /websites/staging/httpd/trunk/content: ./ security/", refsource: "MLIST", url: "https://lists.apache.org/thread.html/r9e8622254184645bc963a1d47c5d47f6d5a36d6f080d8d2c43b2b142@%3Ccvs.httpd.apache.org%3E", }, { name: "[httpd-cvs] 20210330 svn commit: r1073139 [4/13] - in /websites/staging/httpd/trunk/content: ./ security/json/", refsource: "MLIST", url: "https://lists.apache.org/thread.html/reb542d2038e9c331506e0cbff881b47e40fbe2bd93ff00979e60cdf7@%3Ccvs.httpd.apache.org%3E", }, { name: "[httpd-cvs] 20210330 svn commit: r1073149 [5/13] - in /websites/staging/httpd/trunk/content: ./ security/ security/json/", refsource: "MLIST", url: "https://lists.apache.org/thread.html/rafd145ba6cd0a4ced113a5823cdaff45aeb36eb09855b216401c66d6@%3Ccvs.httpd.apache.org%3E", }, { name: "[httpd-cvs] 20210330 svn commit: r1073146 [2/3] - in /websites/staging/httpd/trunk/content: ./ security/cvejsontohtml.py security/vulnerabilities-httpd.xml security/vulnerabilities_22.html security/vulnerabilities_24.html", refsource: "MLIST", url: "https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064@%3Ccvs.httpd.apache.org%3E", }, { name: "[httpd-cvs] 20210330 svn commit: r1073149 [1/13] - in /websites/staging/httpd/trunk/content: ./ security/ security/json/", refsource: "MLIST", url: "https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920@%3Ccvs.httpd.apache.org%3E", }, { name: "[httpd-cvs] 20210603 svn commit: r1075360 [2/3] - in /websites/staging/httpd/trunk/content: ./ security/json/CVE-2021-31618.json security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html", refsource: "MLIST", url: "https://lists.apache.org/thread.html/rad01d817195e6cc871cb1d73b207ca326379a20a6e7f30febaf56d24@%3Ccvs.httpd.apache.org%3E", }, { name: "[httpd-cvs] 20210603 svn commit: r1075360 [1/3] - in /websites/staging/httpd/trunk/content: ./ security/json/CVE-2021-31618.json security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html", refsource: "MLIST", url: "https://lists.apache.org/thread.html/r5f9c22f9c28adbd9f00556059edc7b03a5d5bb71d4bb80257c0d34e4@%3Ccvs.httpd.apache.org%3E", }, { name: "[httpd-cvs] 20210606 svn commit: r1075467 [2/2] - in /websites/staging/httpd/trunk/content: ./ security/json/CVE-2021-31618.json security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html", refsource: "MLIST", url: "https://lists.apache.org/thread.html/r476d175be0aaf4a17680ef98c5153b4d336eaef76fb2224cc94c463a@%3Ccvs.httpd.apache.org%3E", }, { name: "[httpd-cvs] 20210606 svn commit: r1075467 [1/2] - in /websites/staging/httpd/trunk/content: ./ security/json/CVE-2021-31618.json security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html", refsource: "MLIST", url: "https://lists.apache.org/thread.html/rb9c9f42dafa25d2f669dac2a536a03f2575bc5ec1be6f480618aee10@%3Ccvs.httpd.apache.org%3E", }, { name: "[httpd-cvs] 20210606 svn commit: r1075470 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/json/CVE-2020-13938.json security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html", refsource: "MLIST", url: "https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f@%3Ccvs.httpd.apache.org%3E", }, ], }, }, "nvd.nist.gov": { configurations: { CVE_data_version: "4.0", nodes: [ { children: [], cpe_match: [ { cpe23Uri: "cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*", cpe_name: [], versionEndExcluding: "2.2.6", versionStartIncluding: "2.2.0", vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*", cpe_name: [], versionEndExcluding: "2.0.61", versionStartIncluding: "2.0.0", vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*", cpe_name: [], versionEndExcluding: "1.3.39", versionStartIncluding: "1.3.0", vulnerable: true, }, ], operator: "OR", }, { children: [], cpe_match: [ { cpe23Uri: "cpe:2.3:o:fedoraproject:fedora:7:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, ], operator: "OR", }, { children: [], cpe_match: [ { cpe23Uri: "cpe:2.3:o:redhat:enterprise_linux_server:5.0:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:o:redhat:enterprise_linux_workstation:5.0:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:o:redhat:enterprise_linux_desktop:5.0:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, ], operator: "OR", }, { children: [], cpe_match: [ { cpe23Uri: "cpe:2.3:o:canonical:ubuntu_linux:7.04:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:o:canonical:ubuntu_linux:6.10:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:o:canonical:ubuntu_linux:6.06:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, ], operator: "OR", }, ], }, cve: { CVE_data_meta: { ASSIGNER: "cve@mitre.org", ID: "CVE-2007-3304", }, data_format: "MITRE", data_type: "CVE", data_version: "4.0", description: { description_data: [ { lang: "en", value: "Apache httpd 1.3.37, 2.0.59, and 2.2.4 with the Prefork MPM module, allows local users to cause a denial of service by modifying the worker_score and process_score arrays to reference an arbitrary process ID, which is sent a SIGUSR1 signal from the master process, aka \"SIGUSR1 killer.\"", }, ], }, problemtype: { problemtype_data: [ { description: [ { lang: "en", value: "NVD-CWE-noinfo", }, ], }, ], }, references: { reference_data: [ { name: "http://security.psnc.pl/files/apache_report.pdf", refsource: "MISC", tags: [ "Third Party Advisory", ], url: "http://security.psnc.pl/files/apache_report.pdf", }, { name: "[apache-httpd-dev] 20070622 Re: PID table changes (was Re: svn commit: r547987 - in /httpd/httpd/trunk)", refsource: "MLIST", tags: [ "Issue Tracking", "Mailing List", "Third Party Advisory", ], url: "http://marc.info/?l=apache-httpd-dev&m=118252946632447&w=2", }, { name: "[apache-httpd-dev] 20070629 Re: [PATCH] pid safety checks for 2.2.x", refsource: "MLIST", tags: [ "Vendor Advisory", ], url: "http://mail-archives.apache.org/mod_mbox/httpd-dev/200706.mbox/%3c20070629141032.GA15192@redhat.com%3e", }, { name: "http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=245111", refsource: "MISC", tags: [ "Issue Tracking", "Third Party Advisory", ], url: "http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=245111", }, { name: "http://svn.apache.org/viewvc?view=rev&revision=547987", refsource: "CONFIRM", tags: [ "Third Party Advisory", ], url: "http://svn.apache.org/viewvc?view=rev&revision=547987", }, { name: "http://httpd.apache.org/security/vulnerabilities_13.html", refsource: "CONFIRM", tags: [ "Vendor Advisory", ], url: "http://httpd.apache.org/security/vulnerabilities_13.html", }, { name: "http://httpd.apache.org/security/vulnerabilities_20.html", refsource: "CONFIRM", tags: [ "Vendor Advisory", ], url: "http://httpd.apache.org/security/vulnerabilities_20.html", }, { name: "http://httpd.apache.org/security/vulnerabilities_22.html", refsource: "CONFIRM", tags: [ "Vendor Advisory", ], url: "http://httpd.apache.org/security/vulnerabilities_22.html", }, { name: "http://support.avaya.com/elmodocs2/security/ASA-2007-353.htm", refsource: "CONFIRM", tags: [ "Third Party Advisory", ], url: "http://support.avaya.com/elmodocs2/security/ASA-2007-353.htm", }, { name: "http://support.avaya.com/elmodocs2/security/ASA-2007-363.htm", refsource: "CONFIRM", tags: [ "Third Party Advisory", ], url: "http://support.avaya.com/elmodocs2/security/ASA-2007-363.htm", }, { name: "https://issues.rpath.com/browse/RPL-1710", refsource: "CONFIRM", tags: [ "Broken Link", ], url: "https://issues.rpath.com/browse/RPL-1710", }, { name: "http://bugs.gentoo.org/show_bug.cgi?id=186219", refsource: "CONFIRM", tags: [ "Issue Tracking", "Third Party Advisory", ], url: "http://bugs.gentoo.org/show_bug.cgi?id=186219", }, { name: "PK50467", refsource: "AIXAPAR", tags: [ "Third Party Advisory", ], url: "http://www-1.ibm.com/support/search.wss?rs=0&q=PK50467&apar=only", }, { name: "PK52702", refsource: "AIXAPAR", tags: [ "Third Party Advisory", ], url: "http://www-1.ibm.com/support/docview.wss?uid=swg1PK52702", }, { name: "PK53984", refsource: "AIXAPAR", tags: [ "Third Party Advisory", ], url: "http://www-1.ibm.com/support/docview.wss?uid=swg1PK53984", }, { name: "FEDORA-2007-2214", refsource: "FEDORA", tags: [ "Mailing List", "Third Party Advisory", ], url: "http://www.redhat.com/archives/fedora-package-announce/2007-September/msg00320.html", }, { name: "GLSA-200711-06", refsource: "GENTOO", tags: [ "Third Party Advisory", ], url: "http://security.gentoo.org/glsa/glsa-200711-06.xml", }, { name: "MDKSA-2007:140", refsource: "MANDRIVA", tags: [ "Broken Link", ], url: "http://www.mandriva.com/security/advisories?name=MDKSA-2007:140", }, { name: "MDKSA-2007:142", refsource: "MANDRIVA", tags: [ "Broken Link", ], url: "http://www.mandriva.com/security/advisories?name=MDKSA-2007:142", }, { name: "RHSA-2007:0532", refsource: "REDHAT", tags: [ "Third Party Advisory", ], url: "http://www.redhat.com/errata/RHSA-2007-0532.html", }, { name: "RHSA-2007:0556", refsource: "REDHAT", tags: [ "Third Party Advisory", ], url: "http://rhn.redhat.com/errata/RHSA-2007-0556.html", }, { name: "RHSA-2007:0557", refsource: "REDHAT", tags: [ "Third Party Advisory", ], url: "http://www.redhat.com/support/errata/RHSA-2007-0557.html", }, { name: "RHSA-2007:0662", refsource: "REDHAT", tags: [ "Third Party Advisory", ], url: "http://www.redhat.com/support/errata/RHSA-2007-0662.html", }, { name: "20070701-01-P", refsource: "SGI", tags: [ "Broken Link", ], url: "ftp://patches.sgi.com/support/free/security/advisories/20070701-01-P.asc", }, { name: "SUSE-SA:2007:061", refsource: "SUSE", tags: [ "Broken Link", ], url: "http://www.novell.com/linux/security/advisories/2007_61_apache2.html", }, { name: "2007-0026", refsource: "TRUSTIX", tags: [ "Broken Link", ], url: "http://www.trustix.org/errata/2007/0026/", }, { name: "USN-499-1", refsource: "UBUNTU", tags: [ "Third Party Advisory", ], url: "http://www.ubuntu.com/usn/usn-499-1", }, { name: "24215", refsource: "BID", tags: [ "Third Party Advisory", "VDB Entry", ], url: "http://www.securityfocus.com/bid/24215", }, { name: "1018304", refsource: "SECTRACK", tags: [ "Broken Link", "Third Party Advisory", "VDB Entry", ], url: "http://www.securitytracker.com/id?1018304", }, { name: "25827", refsource: "SECUNIA", tags: [ "Not Applicable", "Vendor Advisory", ], url: "http://secunia.com/advisories/25827", }, { name: "25830", refsource: "SECUNIA", tags: [ "Not Applicable", "Vendor Advisory", ], url: "http://secunia.com/advisories/25830", }, { name: "25920", refsource: "SECUNIA", tags: [ "Not Applicable", "Vendor Advisory", ], url: "http://secunia.com/advisories/25920", }, { name: "26211", refsource: "SECUNIA", tags: [ "Not Applicable", "Vendor Advisory", ], url: "http://secunia.com/advisories/26211", }, { name: "26273", refsource: "SECUNIA", tags: [ "Not Applicable", "Vendor Advisory", ], url: "http://secunia.com/advisories/26273", }, { name: "26443", refsource: "SECUNIA", tags: [ "Not Applicable", "Vendor Advisory", ], url: "http://secunia.com/advisories/26443", }, { name: "26508", refsource: "SECUNIA", tags: [ "Not Applicable", "Vendor Advisory", ], url: "http://secunia.com/advisories/26508", }, { name: "26611", refsource: "SECUNIA", tags: [ "Not Applicable", "Vendor Advisory", ], url: "http://secunia.com/advisories/26611", }, { name: "26759", refsource: "SECUNIA", tags: [ "Not Applicable", "Vendor Advisory", ], url: "http://secunia.com/advisories/26759", }, { name: "26790", refsource: "SECUNIA", tags: [ "Not Applicable", "Vendor Advisory", ], url: "http://secunia.com/advisories/26790", }, { name: "26822", refsource: "SECUNIA", tags: [ "Not Applicable", "Vendor Advisory", ], url: "http://secunia.com/advisories/26822", }, { name: "26842", refsource: "SECUNIA", tags: [ "Not Applicable", "Vendor Advisory", ], url: "http://secunia.com/advisories/26842", }, { name: "26993", refsource: "SECUNIA", tags: [ "Not Applicable", "Vendor Advisory", ], url: "http://secunia.com/advisories/26993", }, { name: "27121", refsource: "SECUNIA", tags: [ "Not Applicable", ], url: "http://secunia.com/advisories/27121", }, { name: "27209", refsource: "SECUNIA", tags: [ "Not Applicable", ], url: "http://secunia.com/advisories/27209", }, { name: "27563", refsource: "SECUNIA", tags: [ "Not Applicable", ], url: "http://secunia.com/advisories/27563", }, { name: "27732", refsource: "SECUNIA", tags: [ "Not Applicable", ], url: "http://secunia.com/advisories/27732", }, { name: "2814", refsource: "SREASON", tags: [ "Exploit", "Third Party Advisory", ], url: "http://securityreason.com/securityalert/2814", }, { name: "103179", refsource: "SUNALERT", tags: [ "Broken Link", ], url: "http://sunsolve.sun.com/search/document.do?assetkey=1-26-103179-1", }, { name: "28212", refsource: "SECUNIA", tags: [ "Not Applicable", ], url: "http://secunia.com/advisories/28212", }, { name: "28224", refsource: "SECUNIA", tags: [ "Not Applicable", ], url: "http://secunia.com/advisories/28224", }, { name: "http://www.fujitsu.com/global/support/software/security/products-f/interstage-200802e.html", refsource: "CONFIRM", tags: [ "Third Party Advisory", ], url: "http://www.fujitsu.com/global/support/software/security/products-f/interstage-200802e.html", }, { name: "28606", refsource: "SECUNIA", tags: [ "Not Applicable", ], url: "http://secunia.com/advisories/28606", }, { name: "200032", refsource: "SUNALERT", tags: [ "Broken Link", ], url: "http://sunsolve.sun.com/search/document.do?assetkey=1-66-200032-1", }, { name: "RHSA-2008:0261", refsource: "REDHAT", tags: [ "Third Party Advisory", ], url: "http://www.redhat.com/support/errata/RHSA-2008-0261.html", }, { name: "[security-announce] 20090820 VMSA-2009-0010 VMware Hosted products update libpng and Apache HTTP Server", refsource: "MLIST", tags: [ "Mailing List", "Third Party Advisory", ], url: "http://lists.vmware.com/pipermail/security-announce/2009/000062.html", }, { name: "ADV-2008-0233", refsource: "VUPEN", tags: [ "Permissions Required", ], url: "http://www.vupen.com/english/advisories/2008/0233", }, { name: "HPSBUX02273", refsource: "HP", tags: [ "Third Party Advisory", ], url: "http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01182588", }, { name: "ADV-2007-3494", refsource: "VUPEN", tags: [ "Permissions Required", ], url: "http://www.vupen.com/english/advisories/2007/3494", }, { name: "ADV-2007-3100", refsource: "VUPEN", tags: [ "Permissions Required", ], url: "http://www.vupen.com/english/advisories/2007/3100", }, { name: "ADV-2007-3420", refsource: "VUPEN", tags: [ "Permissions Required", ], url: "http://www.vupen.com/english/advisories/2007/3420", }, { name: "ADV-2007-4305", refsource: "VUPEN", tags: [ "Permissions Required", ], url: "http://www.vupen.com/english/advisories/2007/4305", }, { name: "ADV-2007-3283", refsource: "VUPEN", tags: [ "Permissions Required", ], url: "http://www.vupen.com/english/advisories/2007/3283", }, { name: "ADV-2007-2727", refsource: "VUPEN", tags: [ "Permissions Required", ], url: "http://www.vupen.com/english/advisories/2007/2727", }, { name: "38939", refsource: "OSVDB", tags: [ "Broken Link", ], url: "http://osvdb.org/38939", }, { name: "apache-child-process-dos(35095)", refsource: "XF", tags: [ "Third Party Advisory", "VDB Entry", ], url: "https://exchange.xforce.ibmcloud.com/vulnerabilities/35095", }, { name: "oval:org.mitre.oval:def:11589", refsource: "OVAL", tags: [ "Third Party Advisory", ], url: "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11589", }, { name: "20090821 VMSA-2009-0010 VMware Hosted products update libpng and Apache HTTP Server", refsource: "BUGTRAQ", tags: [ "Third Party Advisory", "VDB Entry", ], url: "http://www.securityfocus.com/archive/1/505990/100/0/threaded", }, { name: "20070619 Apache Prefork MPM vulnerabilities - Report", refsource: "BUGTRAQ", tags: [ "Third Party Advisory", "VDB Entry", ], url: "http://www.securityfocus.com/archive/1/471832/100/0/threaded", }, { name: "20070529 Apache httpd vulenrabilities", refsource: "BUGTRAQ", tags: [ "Third Party Advisory", "VDB Entry", ], url: "http://www.securityfocus.com/archive/1/469899/100/0/threaded", }, { name: "[httpd-cvs] 20190815 svn commit: r1048743 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html", refsource: "MLIST", tags: [ "Mailing List", "Vendor Advisory", ], url: "https://lists.apache.org/thread.html/5df9bfb86a3b054bb985a45ff9250b0332c9ecc181eec232489e7f79@%3Ccvs.httpd.apache.org%3E", }, { name: "[httpd-cvs] 20190815 svn commit: r1048742 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html", refsource: "MLIST", tags: [ "Mailing List", "Vendor Advisory", ], url: "https://lists.apache.org/thread.html/54a42d4b01968df1117cea77fc53d6beb931c0e05936ad02af93e9ac@%3Ccvs.httpd.apache.org%3E", }, { name: "[httpd-cvs] 20200401 svn commit: r1058586 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html", refsource: "MLIST", tags: [ "Mailing List", "Vendor Advisory", ], url: "https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7@%3Ccvs.httpd.apache.org%3E", }, { name: "[httpd-cvs] 20190815 svn commit: r1048743 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html", refsource: "MLIST", tags: [ "Mailing List", "Vendor Advisory", ], url: "https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f@%3Ccvs.httpd.apache.org%3E", }, { name: "[httpd-cvs] 20190815 svn commit: r1048742 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html", refsource: "MLIST", tags: [ "Mailing List", "Vendor Advisory", ], url: "https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53@%3Ccvs.httpd.apache.org%3E", }, { name: "[httpd-cvs] 20200401 svn commit: r1058586 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html", refsource: "MLIST", tags: [ "Mailing List", "Vendor Advisory", ], url: "https://lists.apache.org/thread.html/r0276683d8e1e07153fc8642618830ac0ade85b9ae0dc7b07f63bb8fc@%3Ccvs.httpd.apache.org%3E", }, { name: "[httpd-cvs] 20200401 svn commit: r1058587 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html", refsource: "MLIST", tags: [ "Mailing List", "Vendor Advisory", ], url: "https://lists.apache.org/thread.html/r8828e649175df56f1f9e3919938ac7826128525426e2748f0ab62feb@%3Ccvs.httpd.apache.org%3E", }, { name: "[httpd-cvs] 20200401 svn commit: r1058587 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html", refsource: "MLIST", tags: [ "Mailing List", "Vendor Advisory", ], url: "https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b@%3Ccvs.httpd.apache.org%3E", }, { name: "[httpd-cvs] 20210330 svn commit: r1073139 [1/13] - in /websites/staging/httpd/trunk/content: ./ security/json/", refsource: "MLIST", tags: [ "Mailing List", "Vendor Advisory", ], url: "https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9@%3Ccvs.httpd.apache.org%3E", }, { name: "[httpd-cvs] 20210330 svn commit: r1073140 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/cvejsontohtml.py security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html", refsource: "MLIST", tags: [ "Mailing List", "Vendor Advisory", ], url: "https://lists.apache.org/thread.html/r2cb985de917e7da0848c440535f65a247754db8b2154a10089e4247b@%3Ccvs.httpd.apache.org%3E", }, { name: "[httpd-cvs] 20210330 svn commit: r1073140 [1/4] - in /websites/staging/httpd/trunk/content: ./ security/cvejsontohtml.py security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html", refsource: "MLIST", tags: [ "Mailing List", "Vendor Advisory", ], url: "https://lists.apache.org/thread.html/r5419c9ba0951ef73a655362403d12bb8d10fab38274deb3f005816f5@%3Ccvs.httpd.apache.org%3E", }, { name: "[httpd-cvs] 20210330 svn commit: r1888194 [4/13] - /httpd/site/trunk/content/security/json/", refsource: "MLIST", tags: [ "Mailing List", "Vendor Advisory", ], url: "https://lists.apache.org/thread.html/r652fc951306cdeca5a276e2021a34878a76695a9f3cfb6490b4a6840@%3Ccvs.httpd.apache.org%3E", }, { name: "[httpd-cvs] 20210330 svn commit: r1073140 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/cvejsontohtml.py security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html", refsource: "MLIST", tags: [ "Mailing List", "Vendor Advisory", ], url: "https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b@%3Ccvs.httpd.apache.org%3E", }, { name: "[httpd-cvs] 20210330 svn commit: r1073149 [5/13] - in /websites/staging/httpd/trunk/content: ./ security/ security/json/", refsource: "MLIST", tags: [ "Mailing List", "Vendor Advisory", ], url: "https://lists.apache.org/thread.html/rafd145ba6cd0a4ced113a5823cdaff45aeb36eb09855b216401c66d6@%3Ccvs.httpd.apache.org%3E", }, { name: "[httpd-cvs] 20210330 svn commit: r1073143 [2/3] - in /websites/staging/httpd/trunk/content: ./ security/", refsource: "MLIST", tags: [ "Mailing List", "Vendor Advisory", ], url: "https://lists.apache.org/thread.html/r9e8622254184645bc963a1d47c5d47f6d5a36d6f080d8d2c43b2b142@%3Ccvs.httpd.apache.org%3E", }, { name: "[httpd-cvs] 20210330 svn commit: r1073139 [4/13] - in /websites/staging/httpd/trunk/content: ./ security/json/", refsource: "MLIST", tags: [ "Mailing List", "Vendor Advisory", ], url: "https://lists.apache.org/thread.html/reb542d2038e9c331506e0cbff881b47e40fbe2bd93ff00979e60cdf7@%3Ccvs.httpd.apache.org%3E", }, { name: "[httpd-cvs] 20210603 svn commit: r1075360 [1/3] - in /websites/staging/httpd/trunk/content: ./ security/json/CVE-2021-31618.json security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html", refsource: "MLIST", tags: [ "Mailing List", "Vendor Advisory", ], url: "https://lists.apache.org/thread.html/r5f9c22f9c28adbd9f00556059edc7b03a5d5bb71d4bb80257c0d34e4@%3Ccvs.httpd.apache.org%3E", }, { name: "[httpd-cvs] 20210330 svn commit: r1073146 [2/3] - in /websites/staging/httpd/trunk/content: ./ security/cvejsontohtml.py security/vulnerabilities-httpd.xml security/vulnerabilities_22.html security/vulnerabilities_24.html", refsource: "MLIST", tags: [ "Mailing List", "Vendor Advisory", ], url: "https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064@%3Ccvs.httpd.apache.org%3E", }, { name: "[httpd-cvs] 20210330 svn commit: r1073149 [1/13] - in /websites/staging/httpd/trunk/content: ./ security/ security/json/", refsource: "MLIST", tags: [ "Mailing List", "Vendor Advisory", ], url: "https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920@%3Ccvs.httpd.apache.org%3E", }, { name: "[httpd-cvs] 20210603 svn commit: r1075360 [2/3] - in /websites/staging/httpd/trunk/content: ./ security/json/CVE-2021-31618.json security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html", refsource: "MLIST", tags: [ "Mailing List", "Vendor Advisory", ], url: "https://lists.apache.org/thread.html/rad01d817195e6cc871cb1d73b207ca326379a20a6e7f30febaf56d24@%3Ccvs.httpd.apache.org%3E", }, { name: "[httpd-cvs] 20210606 svn commit: r1075467 [2/2] - in /websites/staging/httpd/trunk/content: ./ security/json/CVE-2021-31618.json security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html", refsource: "MLIST", tags: [ "Mailing List", "Vendor Advisory", ], url: "https://lists.apache.org/thread.html/r476d175be0aaf4a17680ef98c5153b4d336eaef76fb2224cc94c463a@%3Ccvs.httpd.apache.org%3E", }, { name: "[httpd-cvs] 20210606 svn commit: r1075467 [1/2] - in /websites/staging/httpd/trunk/content: ./ security/json/CVE-2021-31618.json security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html", refsource: "MLIST", tags: [ "Mailing List", "Vendor Advisory", ], url: "https://lists.apache.org/thread.html/rb9c9f42dafa25d2f669dac2a536a03f2575bc5ec1be6f480618aee10@%3Ccvs.httpd.apache.org%3E", }, { name: "[httpd-cvs] 20210606 svn commit: r1075470 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/json/CVE-2020-13938.json security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html", refsource: "MLIST", tags: [ "Mailing List", "Vendor Advisory", ], url: "https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f@%3Ccvs.httpd.apache.org%3E", }, ], }, }, impact: { baseMetricV2: { cvssV2: { accessComplexity: "MEDIUM", accessVector: "LOCAL", authentication: "NONE", availabilityImpact: "COMPLETE", baseScore: 4.7, confidentialityImpact: "NONE", integrityImpact: "NONE", vectorString: "AV:L/AC:M/Au:N/C:N/I:N/A:C", version: "2.0", }, exploitabilityScore: 3.4, impactScore: 6.9, obtainAllPrivilege: false, obtainOtherPrivilege: false, obtainUserPrivilege: false, severity: "MEDIUM", userInteractionRequired: false, }, }, lastModifiedDate: "2022-09-21T19:34Z", publishedDate: "2007-06-20T22:30Z", }, }, }
Log in or create an account to share your comment.
Security Advisory comment format.
This schema specifies the format of a comment related to a security advisory.
UUIDv4 of the comment
UUIDv4 of the Vulnerability-Lookup instance
When the comment was created originally
When the comment was last updated
Title of the comment
Description of the comment
The identifier of the vulnerability (CVE ID, GHSA-ID, PYSEC ID, etc.).
Loading…
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.