RHSA-2017:0455HighCVSS 8.1

Red Hat Security Advisory: Red Hat JBoss Web Server 3.1.0 security and enhancement update

Published
March 7, 2017
Last Modified
November 5, 2026

🔗 CVE IDs covered (11)

CVE-2016-0762 →CVE-2016-1240 →CVE-2016-3092 →CVE-2016-5018 →CVE-2016-6325 →CVE-2016-6796 →CVE-2016-6797 →CVE-2016-6816 →CVE-2016-6794 →CVE-2016-8735 →CVE-2016-8745 →

📋 Description

CVE-2016-0762 — tomcat: timing attack in Realm implementation CVE-2016-1240 — tomcat: unsafe chown of catalina.log in tomcat init script allows privilege escalation CVE-2016-3092 — tomcat: Usage of vulnerable FileUpload package can result in denial of service CVE-2016-5018 — tomcat: security manager bypass via IntrospectHelper utility function CVE-2016-6325 — tomcat: tomcat writable config files allow privilege escalation CVE-2016-6794 — tomcat: system property disclosure CVE-2016-6796 — tomcat: security manager bypass via JSP Servlet config parameters CVE-2016-6797 — tomcat: unrestricted access to global resources CVE-2016-6816 — tomcat: HTTP Request smuggling vulnerability due to permitting invalid character in HTTP requests CVE-2016-8735 — tomcat: Remote code execution vulnerability in JmxRemoteLifecycleListener CVE-2016-8745 — tomcat: information disclosure due to incorrect Processor sharing

🎯 Affected products52

  • Red Hat JBoss Web Server 3.1 for RHEL 6
  • hibernate4-c3p0-eap6-0:4.2.23-1.Final_redhat_1.1.ep6.el6.noarch as a component of Red Hat JBoss Web Server 3.1 for RHEL 6
  • hibernate4-core-eap6-0:4.2.23-1.Final_redhat_1.1.ep6.el6.noarch as a component of Red Hat JBoss Web Server 3.1 for RHEL 6
  • hibernate4-eap6-0:4.2.23-1.Final_redhat_1.1.ep6.el6.noarch as a component of Red Hat JBoss Web Server 3.1 for RHEL 6
  • hibernate4-eap6-0:4.2.23-1.Final_redhat_1.1.ep6.el6.src as a component of Red Hat JBoss Web Server 3.1 for RHEL 6
  • hibernate4-entitymanager-eap6-0:4.2.23-1.Final_redhat_1.1.ep6.el6.noarch as a component of Red Hat JBoss Web Server 3.1 for RHEL 6
  • hibernate4-envers-eap6-0:4.2.23-1.Final_redhat_1.1.ep6.el6.noarch as a component of Red Hat JBoss Web Server 3.1 for RHEL 6
  • jbcs-httpd24-apache-commons-daemon-0:1.0.15-1.redhat_2.1.jbcs.el6.noarch as a component of Red Hat JBoss Web Server 3.1 for RHEL 6
  • jbcs-httpd24-apache-commons-daemon-0:1.0.15-1.redhat_2.1.jbcs.el6.src as a component of Red Hat JBoss Web Server 3.1 for RHEL 6
  • jbcs-httpd24-apache-commons-daemon-jsvc-1:1.0.15-17.redhat_2.jbcs.el6.i686 as a component of Red Hat JBoss Web Server 3.1 for RHEL 6
  • jbcs-httpd24-apache-commons-daemon-jsvc-1:1.0.15-17.redhat_2.jbcs.el6.src as a component of Red Hat JBoss Web Server 3.1 for RHEL 6
  • jbcs-httpd24-apache-commons-daemon-jsvc-1:1.0.15-17.redhat_2.jbcs.el6.x86_64 as a component of Red Hat JBoss Web Server 3.1 for RHEL 6
  • jbcs-httpd24-apache-commons-daemon-jsvc-debuginfo-1:1.0.15-17.redhat_2.jbcs.el6.i686 as a component of Red Hat JBoss Web Server 3.1 for RHEL 6
  • jbcs-httpd24-apache-commons-daemon-jsvc-debuginfo-1:1.0.15-17.redhat_2.jbcs.el6.x86_64 as a component of Red Hat JBoss Web Server 3.1 for RHEL 6
  • jbcs-httpd24-runtime-0:1-3.jbcs.el6.noarch as a component of Red Hat JBoss Web Server 3.1 for RHEL 6
  • mod_cluster-0:1.3.5-2.Final_redhat_2.1.ep7.el6.noarch as a component of Red Hat JBoss Web Server 3.1 for RHEL 6
  • mod_cluster-0:1.3.5-2.Final_redhat_2.1.ep7.el6.src as a component of Red Hat JBoss Web Server 3.1 for RHEL 6
  • mod_cluster-tomcat7-0:1.3.5-2.Final_redhat_2.1.ep7.el6.noarch as a component of Red Hat JBoss Web Server 3.1 for RHEL 6
  • mod_cluster-tomcat8-0:1.3.5-2.Final_redhat_2.1.ep7.el6.noarch as a component of Red Hat JBoss Web Server 3.1 for RHEL 6
  • tomcat-native-0:1.2.8-9.redhat_9.ep7.el6.i686 as a component of Red Hat JBoss Web Server 3.1 for RHEL 6
  • tomcat-native-0:1.2.8-9.redhat_9.ep7.el6.src as a component of Red Hat JBoss Web Server 3.1 for RHEL 6
  • tomcat-native-0:1.2.8-9.redhat_9.ep7.el6.x86_64 as a component of Red Hat JBoss Web Server 3.1 for RHEL 6
  • tomcat-native-debuginfo-0:1.2.8-9.redhat_9.ep7.el6.i686 as a component of Red Hat JBoss Web Server 3.1 for RHEL 6
  • tomcat-native-debuginfo-0:1.2.8-9.redhat_9.ep7.el6.x86_64 as a component of Red Hat JBoss Web Server 3.1 for RHEL 6
  • tomcat-vault-0:1.0.8-9.Final_redhat_2.1.ep7.el6.noarch as a component of Red Hat JBoss Web Server 3.1 for RHEL 6
  • tomcat-vault-0:1.0.8-9.Final_redhat_2.1.ep7.el6.src as a component of Red Hat JBoss Web Server 3.1 for RHEL 6
  • tomcat7-0:7.0.70-16.ep7.el6.noarch as a component of Red Hat JBoss Web Server 3.1 for RHEL 6
  • tomcat7-0:7.0.70-16.ep7.el6.src as a component of Red Hat JBoss Web Server 3.1 for RHEL 6
  • tomcat7-admin-webapps-0:7.0.70-16.ep7.el6.noarch as a component of Red Hat JBoss Web Server 3.1 for RHEL 6
  • tomcat7-docs-webapp-0:7.0.70-16.ep7.el6.noarch as a component of Red Hat JBoss Web Server 3.1 for RHEL 6
  • +22 more not shown

✅ Remediation

Before applying the update, back up your existing Red Hat JBoss Web Server installation (including all applications and configuration files). For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing the updated packages, the httpd daemon will be restarted automatically.

🔗 References (15)