VARIoT IoT vulnerabilities database

Adobe Flash Player before 10.3.183.86 and 11.x before 11.7.700.202 on Windows and Mac OS X, before 10.3.183.86 and 11.x before 11.2.202.285 on Linux, before 11.1.111.54 on Android 2.x and 3.x, and before 11.1.115.58 on Android 4.x; Adobe AIR before 3.7.0.1860; and Adobe AIR SDK & Compiler before 3.7.0.1860 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2013-2728, CVE-2013-3325, CVE-2013-3326, CVE-2013-3327, CVE-2013-3328, CVE-2013-3329, CVE-2013-3330, CVE-2013-3331, CVE-2013-3332, CVE-2013-3333, CVE-2013-3334, and CVE-2013-3335. This vulnerability CVE-2013-2728 , CVE-2013-3325 , CVE-2013-3326 , CVE-2013-3327 , CVE-2013-3328 , CVE-2013-3329 , CVE-2013-3330 , CVE-2013-3331 , CVE-2013-3332 , CVE-2013-3333 , CVE-2013-3334 ,and CVE-2013-3335 Is a different vulnerability.An attacker could execute arbitrary code or cause a denial of service ( Memory corruption ) There is a possibility of being put into a state. Attackers can exploit this issue to execute arbitrary code within the context of the user running the affected application. Failed exploit attempts will likely cause denial-of-service conditions. Adobe AIR is a cross-operating system runtime environment that can be used to build and configure cross-platform desktop RIA (Rich Internet Applications) applications. Vulnerabilities in versions prior to 0.1860; Adobe AIR SDK & Compiler prior to 3.7.0.1860. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Critical: flash-plugin security update Advisory ID: RHSA-2013:0825-01 Product: Red Hat Enterprise Linux Supplementary Advisory URL: https://rhn.redhat.com/errata/RHSA-2013-0825.html Issue date: 2013-05-15 CVE Names: CVE-2013-2728 CVE-2013-3324 CVE-2013-3325 CVE-2013-3326 CVE-2013-3327 CVE-2013-3328 CVE-2013-3329 CVE-2013-3330 CVE-2013-3331 CVE-2013-3332 CVE-2013-3333 CVE-2013-3334 CVE-2013-3335 ===================================================================== 1. Summary: An updated Adobe Flash Player package that fixes multiple security issues is now available for Red Hat Enterprise Linux 5 and 6 Supplementary. The Red Hat Security Response Team has rated this update as having critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux Desktop Supplementary (v. 5) - i386, x86_64 Red Hat Enterprise Linux Desktop Supplementary (v. 6) - i386, x86_64 Red Hat Enterprise Linux Server Supplementary (v. 5) - i386, x86_64 Red Hat Enterprise Linux Server Supplementary (v. 6) - i386, x86_64 Red Hat Enterprise Linux Workstation Supplementary (v. 6) - i386, x86_64 3. Description: The flash-plugin package contains a Mozilla Firefox compatible Adobe Flash Player web browser plug-in. These vulnerabilities are detailed in the Adobe Security bulletin APSB13-14, listed in the References section. Specially-crafted SWF content could cause flash-plugin to crash or, potentially, execute arbitrary code when a victim loads a page containing the malicious SWF content. 4. Solution: Before applying this update, make sure all previously-released errata relevant to your system have been applied. This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/knowledge/articles/11258 5. Bugs fixed (http://bugzilla.redhat.com/): 962895 - flash-plugin: multiple code execution flaws (APSB13-14) 6. Package List: Red Hat Enterprise Linux Desktop Supplementary (v. 5): i386: flash-plugin-11.2.202.285-1.el5.i386.rpm x86_64: flash-plugin-11.2.202.285-1.el5.i386.rpm Red Hat Enterprise Linux Server Supplementary (v. 5): i386: flash-plugin-11.2.202.285-1.el5.i386.rpm x86_64: flash-plugin-11.2.202.285-1.el5.i386.rpm Red Hat Enterprise Linux Desktop Supplementary (v. 6): i386: flash-plugin-11.2.202.285-1.el6.i686.rpm x86_64: flash-plugin-11.2.202.285-1.el6.i686.rpm Red Hat Enterprise Linux Server Supplementary (v. 6): i386: flash-plugin-11.2.202.285-1.el6.i686.rpm x86_64: flash-plugin-11.2.202.285-1.el6.i686.rpm Red Hat Enterprise Linux Workstation Supplementary (v. 6): i386: flash-plugin-11.2.202.285-1.el6.i686.rpm x86_64: flash-plugin-11.2.202.285-1.el6.i686.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/#package 7. References: https://www.redhat.com/security/data/cve/CVE-2013-2728.html https://www.redhat.com/security/data/cve/CVE-2013-3324.html https://www.redhat.com/security/data/cve/CVE-2013-3325.html https://www.redhat.com/security/data/cve/CVE-2013-3326.html https://www.redhat.com/security/data/cve/CVE-2013-3327.html https://www.redhat.com/security/data/cve/CVE-2013-3328.html https://www.redhat.com/security/data/cve/CVE-2013-3329.html https://www.redhat.com/security/data/cve/CVE-2013-3330.html https://www.redhat.com/security/data/cve/CVE-2013-3331.html https://www.redhat.com/security/data/cve/CVE-2013-3332.html https://www.redhat.com/security/data/cve/CVE-2013-3333.html https://www.redhat.com/security/data/cve/CVE-2013-3334.html https://www.redhat.com/security/data/cve/CVE-2013-3335.html https://access.redhat.com/security/updates/classification/#critical http://www.adobe.com/support/security/bulletins/apsb13-14.html 8. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2013 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.4 (GNU/Linux) iD8DBQFRk0+VXlSAg2UNWIIRAkH8AJ4qnX1dCu9PQZVRQTc+jd80f3eHuQCgpBlA pCXFdmTpNYaaRsAS+FVd7h4= =8nby -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce

mod_rewrite.c in the mod_rewrite module in the Apache HTTP Server 2.2.x before 2.2.25 writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to execute arbitrary commands via an HTTP request containing an escape sequence for a terminal emulator. Apache HTTP Server is prone to a command-injection vulnerability because it fails to adequately sanitize user-supplied input. Attackers can exploit this issue to execute arbitrary commands in the context of the application. ========================================================================== Ubuntu Security Notice USN-1903-1 July 15, 2013 apache2 vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 13.04 - Ubuntu 12.10 - Ubuntu 12.04 LTS - Ubuntu 10.04 LTS Summary: Several security issues were fixed in the Apache HTTP Server. (CVE-2013-1896) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 13.04: apache2.2-common 2.2.22-6ubuntu5.1 Ubuntu 12.10: apache2.2-common 2.2.22-6ubuntu2.3 Ubuntu 12.04 LTS: apache2.2-common 2.2.22-1ubuntu1.4 Ubuntu 10.04 LTS: apache2.2-common 2.2.14-5ubuntu8.12 In general, a standard system update will make all the necessary changes. Solution: The References section of this erratum contains a download link (you must log in to download the update). A buffer overflow when reading digest password file with very long lines in htdigest was discovered (PR 54893). The verification of md5 checksums and GPG signatures is performed automatically for you. All packages are signed by Mandriva for security. You can obtain the GPG public key of the Mandriva Security Team by executing: gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98 You can view other update advisories for Mandriva Linux at: http://www.mandriva.com/en/support/security/advisories/ If you want to report vulnerabilities, please contact security_(at)_mandriva.com _______________________________________________________________________ Type Bits/KeyID Date User ID pub 1024D/22458A98 2000-07-10 Mandriva Security Team <security*mandriva.com> -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.12 (GNU/Linux) iD8DBQFRuwlzmqjQ0CJFipgRAlG7AKDQ3Xy7er2TqLwwKb9yOW9gCndu+gCg9q0k /Izii75hQ+sb7O4WK6l9ghI= =iyY/ -----END PGP SIGNATURE----- . - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 201309-12 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Normal Title: Apache HTTP Server: Multiple vulnerabilities Date: September 23, 2013 Bugs: #275645, #438680, #466502, #476568 ID: 201309-12 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======== Multiple vulnerabilities have been discovered in Apache HTTP Server, possibly allowing remote attackers to execute arbitrary code, cause a Denial of Service condition or perform man-in-the-middle attacks. Please review the CVE identifiers and research paper referenced below for details. Impact ====== A remote attacker could send a specially crafted request to possibly execute arbitrary code, cause Denial of Service, or obtain sensitive information. Workaround ========== There is no known workaround at this time. Resolution ========== All Apache HTTP Server users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose ">=www-servers/apache-2.2.25" References ========== [ 1 ] CVE-2007-6750 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-6750 [ 2 ] CVE-2012-4929 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-4929 [ 3 ] CVE-2013-1862 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-1862 [ 4 ] CVE-2013-1896 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-1896 [ 5 ] Compression and Information Leakage of Plaintext http://www.iacr.org/cryptodb/archive/2002/FSE/3091/3091.pdf Availability ============ This GLSA and any updates to it are available for viewing at the Gentoo Security Website: http://security.gentoo.org/glsa/glsa-201309-12.xml Concerns? ========= Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org. License ======= Copyright 2013 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. http://creativecommons.org/licenses/by-sa/2.5 . It is comprised of the Apache HTTP Server, the Apache Tomcat Servlet container, Apache Tomcat Connector (mod_jk), JBoss HTTP Connector (mod_cluster), Hibernate, and the Tomcat Native library. (CVE-2013-1862) Note: CVE-2013-1862 affects mod_rewrite. In the process of testing this patch, it was found that enabling mod_rewrite on 64-bit versions of Windows Server 2008 and Windows Server 2008 R2 running Red Hat JBoss Web Server 2.0.1 could cause an httpd thread to crash, and the httpd process to restart. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Moderate: Red Hat JBoss Enterprise Application Platform 6.1.1 update Advisory ID: RHSA-2013:1208-01 Product: Red Hat JBoss Enterprise Application Platform Advisory URL: https://rhn.redhat.com/errata/RHSA-2013-1208.html Issue date: 2013-09-04 CVE Names: CVE-2012-3499 CVE-2012-4558 CVE-2013-1862 CVE-2013-1896 CVE-2013-1921 CVE-2013-2172 CVE-2013-4112 ===================================================================== 1. Summary: Red Hat JBoss Enterprise Application Platform 6.1.1, which fixes multiple security issues, various bugs, and adds enhancements, is now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. 2. Relevant releases/architectures: Red Hat JBoss Enterprise Application Platform 6 for RHEL 6 Server - i386, noarch, x86_64 3. Description: Red Hat JBoss Enterprise Application Platform 6 is a platform for Java applications based on JBoss Application Server 7. This release serves as a replacement for Red Hat JBoss Enterprise Application Platform 6.1.0, and includes bug fixes and enhancements. Refer to the 6.1.1 Release Notes for information on the most significant of these changes, available shortly from https://access.redhat.com/site/documentation/ Security fixes: Cross-site scripting (XSS) flaws were found in the mod_info, mod_status, mod_imagemap, mod_ldap, and mod_proxy_ftp modules. An attacker could possibly use these flaws to perform XSS attacks if they were able to make the victim's browser generate an HTTP request with a specially-crafted Host header. (CVE-2012-3499) Cross-site scripting (XSS) flaws were found in the mod_proxy_balancer module's manager web interface. If a remote attacker could trick a user, who was logged into the manager web interface, into visiting a specially-crafted URL, it would lead to arbitrary web script execution in the context of the user's manager interface session. (CVE-2012-4558) A flaw was found in the way the mod_dav module handled merge requests. An attacker could use this flaw to send a crafted merge request that contains URIs that are not configured for DAV, causing the httpd child process to crash. (CVE-2013-1896) A flaw was found in the way Apache Santuario XML Security for Java validated XML signatures. Santuario allowed a signature to specify an arbitrary canonicalization algorithm, which would be applied to the SignedInfo XML fragment. A remote attacker could exploit this to spoof an XML signature via a specially-crafted XML signature block. (CVE-2013-2172) It was found that mod_rewrite did not filter terminal escape sequences from its log file. If a victim viewed the log file with a terminal emulator, it could result in arbitrary command execution with the privileges of that user. (CVE-2013-1862) The data file used by PicketBox Vault to store encrypted passwords contains a copy of its own admin key. The file is encrypted using only this admin key, not the corresponding JKS key. A local attacker with permission to read the vault data file could read the admin key from the file, and use it to decrypt the file and read the stored passwords in clear text. (CVE-2013-1921) A flaw was found in JGroup's DiagnosticsHandler that allowed an attacker on an adjacent network to reuse the credentials from a previous successful authentication. This could be exploited to read diagnostic information (information disclosure) and attain limited remote code execution. (CVE-2013-4112) Warning: Before applying this update, back up your existing Red Hat JBoss Enterprise Application Platform installation and deployed applications. Refer to the Solution section for further details. All users of Red Hat JBoss Enterprise Application Platform 6.1.0 on Red Hat Enterprise Linux 6 are advised to upgrade to these updated packages. The JBoss server process must be restarted for the update to take effect. 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. Also, back up any customized Red Hat JBoss Enterprise Application Platform 6 configuration files. On update, the configuration files that have been locally modified will not be updated. The updated version of such files will be stored as the rpmnew files. Make sure to locate any such files after the update and merge any changes manually. For more details, refer to the Release Notes for Red Hat JBoss Enterprise Application Platform 6.1.1, available shortly from https://access.redhat.com/site/documentation/ This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/site/articles/11258 5. Bugs fixed (http://bugzilla.redhat.com/): 915883 - CVE-2012-3499 httpd: multiple XSS flaws due to unescaped hostnames 915884 - CVE-2012-4558 httpd: XSS flaw in mod_proxy_balancer manager interface 948106 - CVE-2013-1921 JBoss PicketBox: Insecure storage of masked passwords 953729 - CVE-2013-1862 httpd: mod_rewrite allows terminal escape sequences to be written to the log file 983489 - CVE-2013-4112 JGroups: Authentication via cached credentials 983549 - CVE-2013-1896 httpd: mod_dav DoS (httpd child process crash) via a URI MERGE request with source URI not handled by mod_dav 985025 - Upgrade jbossweb to 7.2.2.Final-redhat-1 985061 - Upgrade jboss-as-console to 1.5.5.Final-redhat-1 985173 - Upgrade jboss-hal to 1.5.6.Final-redhat-1 989597 - Upgrade jbossws-common to 2.1.3.Final-redhat-1 989606 - Upgrade jboss-stdio to 1.0.2.GA-redhat-1 990636 - Upgrade jboss-aesh to 0.33.6-redhat-1 990657 - Upgrade jaxbintros to 1.0.2.GA-redhat-5 990662 - Upgrade picketlink-federation to 2.1.6.2.Final-redhat-2 990671 - Upgrade jbossts to 4.17.7.Final-redhat-3 990686 - Upgrade jboss-logmanager to 1.4.3.Final-redhat-1 995115 - Upgrade hornetq to 2.3.5.Final-redhat-1 995290 - Upgrade jgroups to 3.2.10.Final-redhat-1 995563 - Upgrade picketbox to 4.0.17.SP2-redhat-1 996313 - Upgrade hornetq-native to 2.3.5.Final-redhat-1 999263 - CVE-2013-2172 Apache Santuario XML Security for Java: XML signature spoofing 6. Package List: Red Hat JBoss Enterprise Application Platform 6 for RHEL 6 Server: Source: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/JBEAP/SRPMS/apache-commons-beanutils-1.8.3-12.redhat_3.2.ep6.el6.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/JBEAP/SRPMS/apache-commons-daemon-jsvc-eap6-1.0.15-2.redhat_2.ep6.el6.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/JBEAP/SRPMS/apache-cxf-2.6.8-8.redhat_7.1.ep6.el6.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/JBEAP/SRPMS/apache-cxf-xjc-utils-2.6.0-2.redhat_4.1.ep6.el6.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/JBEAP/SRPMS/hibernate4-4.2.0-7.SP1_redhat_1.ep6.el6.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/JBEAP/SRPMS/hornetq-2.3.5-2.Final_redhat_2.1.ep6.el6.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/JBEAP/SRPMS/hornetq-native-2.3.5-1.Final_redhat_1.ep6.el6.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/JBEAP/SRPMS/httpd-2.2.22-25.ep6.el6.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/JBEAP/SRPMS/infinispan-5.2.7-1.Final_redhat_1.ep6.el6.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/JBEAP/SRPMS/ironjacamar-1.0.19-1.Final_redhat_2.ep6.el6.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/JBEAP/SRPMS/jaxbintros-1.0.2-16.GA_redhat_6.ep6.el6.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/JBEAP/SRPMS/jboss-aesh-0.33.7-2.redhat_2.1.ep6.el6.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/JBEAP/SRPMS/jboss-as-appclient-7.2.1-5.Final_redhat_10.1.ep6.el6.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/JBEAP/SRPMS/jboss-as-cli-7.2.1-5.Final_redhat_10.1.ep6.el6.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/JBEAP/SRPMS/jboss-as-client-all-7.2.1-5.Final_redhat_10.1.ep6.el6.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/JBEAP/SRPMS/jboss-as-clustering-7.2.1-5.Final_redhat_10.1.ep6.el6.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/JBEAP/SRPMS/jboss-as-cmp-7.2.1-5.Final_redhat_10.1.ep6.el6.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/JBEAP/SRPMS/jboss-as-configadmin-7.2.1-5.Final_redhat_10.1.ep6.el6.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/JBEAP/SRPMS/jboss-as-connector-7.2.1-5.Final_redhat_10.1.ep6.el6.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/JBEAP/SRPMS/jboss-as-console-1.5.6-2.Final_redhat_2.1.ep6.el6.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/JBEAP/SRPMS/jboss-as-controller-7.2.1-5.Final_redhat_10.1.ep6.el6.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/JBEAP/SRPMS/jboss-as-controller-client-7.2.1-5.Final_redhat_10.1.ep6.el6.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/JBEAP/SRPMS/jboss-as-deployment-repository-7.2.1-5.Final_redhat_10.1.ep6.el6.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/JBEAP/SRPMS/jboss-as-deployment-scanner-7.2.1-5.Final_redhat_10.1.ep6.el6.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/JBEAP/SRPMS/jboss-as-domain-http-7.2.1-5.Final_redhat_10.1.ep6.el6.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/JBEAP/SRPMS/jboss-as-domain-management-7.2.1-5.Final_redhat_10.1.ep6.el6.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/JBEAP/SRPMS/jboss-as-ee-7.2.1-5.Final_redhat_10.1.ep6.el6.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/JBEAP/SRPMS/jboss-as-ee-deployment-7.2.1-5.Final_redhat_10.1.ep6.el6.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/JBEAP/SRPMS/jboss-as-ejb3-7.2.1-5.Final_redhat_10.1.ep6.el6.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/JBEAP/SRPMS/jboss-as-embedded-7.2.1-5.Final_redhat_10.1.ep6.el6.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/JBEAP/SRPMS/jboss-as-host-controller-7.2.1-5.Final_redhat_10.1.ep6.el6.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/JBEAP/SRPMS/jboss-as-jacorb-7.2.1-5.Final_redhat_10.1.ep6.el6.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/JBEAP/SRPMS/jboss-as-jaxr-7.2.1-5.Final_redhat_10.1.ep6.el6.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/JBEAP/SRPMS/jboss-as-jaxrs-7.2.1-5.Final_redhat_10.1.ep6.el6.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/JBEAP/SRPMS/jboss-as-jdr-7.2.1-5.Final_redhat_10.1.ep6.el6.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/JBEAP/SRPMS/jboss-as-jmx-7.2.1-5.Final_redhat_10.1.ep6.el6.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/JBEAP/SRPMS/jboss-as-jpa-7.2.1-5.Final_redhat_10.1.ep6.el6.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/JBEAP/SRPMS/jboss-as-jsf-7.2.1-5.Final_redhat_10.1.ep6.el6.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/JBEAP/SRPMS/jboss-as-jsr77-7.2.1-5.Final_redhat_10.1.ep6.el6.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/JBEAP/SRPMS/jboss-as-logging-7.2.1-5.Final_redhat_10.1.ep6.el6.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/JBEAP/SRPMS/jboss-as-mail-7.2.1-5.Final_redhat_10.1.ep6.el6.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/JBEAP/SRPMS/jboss-as-management-client-content-7.2.1-5.Final_redhat_10.1.ep6.el6.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/JBEAP/SRPMS/jboss-as-messaging-7.2.1-5.Final_redhat_10.1.ep6.el6.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/JBEAP/SRPMS/jboss-as-modcluster-7.2.1-5.Final_redhat_10.1.ep6.el6.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/JBEAP/SRPMS/jboss-as-naming-7.2.1-5.Final_redhat_10.1.ep6.el6.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/JBEAP/SRPMS/jboss-as-network-7.2.1-5.Final_redhat_10.1.ep6.el6.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/JBEAP/SRPMS/jboss-as-osgi-7.2.1-5.Final_redhat_10.1.ep6.el6.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/JBEAP/SRPMS/jboss-as-osgi-configadmin-7.2.1-5.Final_redhat_10.1.ep6.el6.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/JBEAP/SRPMS/jboss-as-osgi-service-7.2.1-5.Final_redhat_10.1.ep6.el6.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/JBEAP/SRPMS/jboss-as-platform-mbean-7.2.1-5.Final_redhat_10.1.ep6.el6.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/JBEAP/SRPMS/jboss-as-pojo-7.2.1-5.Final_redhat_10.1.ep6.el6.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/JBEAP/SRPMS/jboss-as-process-controller-7.2.1-5.Final_redhat_10.1.ep6.el6.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/JBEAP/SRPMS/jboss-as-protocol-7.2.1-5.Final_redhat_10.1.ep6.el6.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/JBEAP/SRPMS/jboss-as-remoting-7.2.1-5.Final_redhat_10.1.ep6.el6.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/JBEAP/SRPMS/jboss-as-sar-7.2.1-5.Final_redhat_10.1.ep6.el6.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/JBEAP/SRPMS/jboss-as-security-7.2.1-5.Final_redhat_10.1.ep6.el6.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/JBEAP/SRPMS/jboss-as-server-7.2.1-5.Final_redhat_10.1.ep6.el6.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/JBEAP/SRPMS/jboss-as-system-jmx-7.2.1-5.Final_redhat_10.1.ep6.el6.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/JBEAP/SRPMS/jboss-as-threads-7.2.1-5.Final_redhat_10.1.ep6.el6.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/JBEAP/SRPMS/jboss-as-transactions-7.2.1-5.Final_redhat_10.1.ep6.el6.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/JBEAP/SRPMS/jboss-as-version-7.2.1-5.Final_redhat_10.1.ep6.el6.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/JBEAP/SRPMS/jboss-as-web-7.2.1-5.Final_redhat_10.1.ep6.el6.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/JBEAP/SRPMS/jboss-as-webservices-7.2.1-5.Final_redhat_10.1.ep6.el6.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/JBEAP/SRPMS/jboss-as-weld-7.2.1-5.Final_redhat_10.1.ep6.el6.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/JBEAP/SRPMS/jboss-as-xts-7.2.1-5.Final_redhat_10.1.ep6.el6.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/JBEAP/SRPMS/jboss-ejb-client-1.0.23-1.Final_redhat_1.ep6.el6.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/JBEAP/SRPMS/jboss-hal-1.5.7-1.Final_redhat_1.1.ep6.el6.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/JBEAP/SRPMS/jboss-invocation-1.1.2-1.Final_redhat_1.ep6.el6.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/JBEAP/SRPMS/jboss-jsp-api_2.2_spec-1.0.1-6.Final_redhat_2.ep6.el6.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/JBEAP/SRPMS/jboss-logmanager-1.4.3-1.Final_redhat_1.ep6.el6.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/JBEAP/SRPMS/jboss-marshalling-1.3.18-1.GA_redhat_1.1.ep6.el6.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/JBEAP/SRPMS/jboss-modules-1.2.2-1.Final_redhat_1.ep6.el6.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/JBEAP/SRPMS/jboss-remote-naming-1.0.7-1.Final_redhat_1.ep6.el6.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/JBEAP/SRPMS/jboss-security-negotiation-2.2.5-2.Final_redhat_2.ep6.el6.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/JBEAP/SRPMS/jboss-stdio-1.0.2-1.GA_redhat_1.ep6.el6.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/JBEAP/SRPMS/jbossas-appclient-7.2.1-5.Final_redhat_10.1.ep6.el6.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/JBEAP/SRPMS/jbossas-bundles-7.2.1-5.Final_redhat_10.1.ep6.el6.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/JBEAP/SRPMS/jbossas-core-7.2.1-6.Final_redhat_10.1.ep6.el6.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/JBEAP/SRPMS/jbossas-domain-7.2.1-5.Final_redhat_10.1.ep6.el6.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/JBEAP/SRPMS/jbossas-javadocs-7.2.1-2.Final_redhat_10.ep6.el6.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/JBEAP/SRPMS/jbossas-modules-eap-7.2.1-9.Final_redhat_10.1.ep6.el6.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/JBEAP/SRPMS/jbossas-product-eap-7.2.1-5.Final_redhat_10.1.ep6.el6.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/JBEAP/SRPMS/jbossas-standalone-7.2.1-6.Final_redhat_10.1.ep6.el6.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/JBEAP/SRPMS/jbossas-welcome-content-eap-7.2.1-5.Final_redhat_10.1.ep6.el6.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/JBEAP/SRPMS/jbossts-4.17.7-4.Final_redhat_4.ep6.el6.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/JBEAP/SRPMS/jbossweb-7.2.2-1.Final_redhat_1.1.ep6.el6.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/JBEAP/SRPMS/jbossws-common-2.1.3-1.Final_redhat_1.ep6.el6.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/JBEAP/SRPMS/jbossws-cxf-4.1.4-7.Final_redhat_7.ep6.el6.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/JBEAP/SRPMS/jbossws-spi-2.1.3-1.Final_redhat_1.ep6.el6.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/JBEAP/SRPMS/jcip-annotations-eap6-1.0-4.redhat_4.ep6.el6.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/JBEAP/SRPMS/jgroups-3.2.10-1.Final_redhat_2.2.ep6.el6.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/JBEAP/SRPMS/log4j-jboss-logmanager-1.0.2-1.Final_redhat_1.ep6.el6.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/JBEAP/SRPMS/netty-3.6.6-2.Final_redhat_1.1.ep6.el6.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/JBEAP/SRPMS/opensaml-2.5.1-2.redhat_2.1.ep6.el6.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/JBEAP/SRPMS/openws-1.4.2-10.redhat_4.1.ep6.el6.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/JBEAP/SRPMS/picketbox-4.0.17-3.SP2_redhat_2.1.ep6.el6.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/JBEAP/SRPMS/picketlink-federation-2.1.6.3-2.Final_redhat_2.2.ep6.el6.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/JBEAP/SRPMS/wss4j-1.6.10-1.redhat_1.ep6.el6.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/JBEAP/SRPMS/xml-security-1.5.5-1.redhat_1.ep6.el6.src.rpm i386: apache-commons-daemon-jsvc-eap6-1.0.15-2.redhat_2.ep6.el6.i386.rpm apache-commons-daemon-jsvc-eap6-debuginfo-1.0.15-2.redhat_2.ep6.el6.i386.rpm hornetq-native-2.3.5-1.Final_redhat_1.ep6.el6.i386.rpm hornetq-native-debuginfo-2.3.5-1.Final_redhat_1.ep6.el6.i386.rpm httpd-2.2.22-25.ep6.el6.i386.rpm httpd-debuginfo-2.2.22-25.ep6.el6.i386.rpm httpd-devel-2.2.22-25.ep6.el6.i386.rpm httpd-tools-2.2.22-25.ep6.el6.i386.rpm jbossas-hornetq-native-2.3.5-1.Final_redhat_1.ep6.el6.i386.rpm mod_ssl-2.2.22-25.ep6.el6.i386.rpm noarch: apache-commons-beanutils-1.8.3-12.redhat_3.2.ep6.el6.noarch.rpm apache-cxf-2.6.8-8.redhat_7.1.ep6.el6.noarch.rpm apache-cxf-xjc-utils-2.6.0-2.redhat_4.1.ep6.el6.noarch.rpm cxf-xjc-boolean-2.6.0-2.redhat_4.1.ep6.el6.noarch.rpm cxf-xjc-dv-2.6.0-2.redhat_4.1.ep6.el6.noarch.rpm cxf-xjc-ts-2.6.0-2.redhat_4.1.ep6.el6.noarch.rpm hibernate4-4.2.0-7.SP1_redhat_1.ep6.el6.noarch.rpm hibernate4-core-4.2.0-7.SP1_redhat_1.ep6.el6.noarch.rpm hibernate4-entitymanager-4.2.0-7.SP1_redhat_1.ep6.el6.noarch.rpm hibernate4-envers-4.2.0-7.SP1_redhat_1.ep6.el6.noarch.rpm hibernate4-infinispan-4.2.0-7.SP1_redhat_1.ep6.el6.noarch.rpm hornetq-2.3.5-2.Final_redhat_2.1.ep6.el6.noarch.rpm infinispan-5.2.7-1.Final_redhat_1.ep6.el6.noarch.rpm infinispan-cachestore-jdbc-5.2.7-1.Final_redhat_1.ep6.el6.noarch.rpm infinispan-cachestore-remote-5.2.7-1.Final_redhat_1.ep6.el6.noarch.rpm infinispan-client-hotrod-5.2.7-1.Final_redhat_1.ep6.el6.noarch.rpm infinispan-core-5.2.7-1.Final_redhat_1.ep6.el6.noarch.rpm ironjacamar-1.0.19-1.Final_redhat_2.ep6.el6.noarch.rpm ironjacamar-common-api-1.0.19-1.Final_redhat_2.ep6.el6.noarch.rpm ironjacamar-common-impl-1.0.19-1.Final_redhat_2.ep6.el6.noarch.rpm ironjacamar-common-spi-1.0.19-1.Final_redhat_2.ep6.el6.noarch.rpm ironjacamar-core-api-1.0.19-1.Final_redhat_2.ep6.el6.noarch.rpm ironjacamar-core-impl-1.0.19-1.Final_redhat_2.ep6.el6.noarch.rpm ironjacamar-deployers-common-1.0.19-1.Final_redhat_2.ep6.el6.noarch.rpm ironjacamar-jdbc-1.0.19-1.Final_redhat_2.ep6.el6.noarch.rpm ironjacamar-spec-api-1.0.19-1.Final_redhat_2.ep6.el6.noarch.rpm ironjacamar-validator-1.0.19-1.Final_redhat_2.ep6.el6.noarch.rpm jaxbintros-1.0.2-16.GA_redhat_6.ep6.el6.noarch.rpm jboss-aesh-0.33.7-2.redhat_2.1.ep6.el6.noarch.rpm jboss-as-appclient-7.2.1-5.Final_redhat_10.1.ep6.el6.noarch.rpm jboss-as-cli-7.2.1-5.Final_redhat_10.1.ep6.el6.noarch.rpm jboss-as-client-all-7.2.1-5.Final_redhat_10.1.ep6.el6.noarch.rpm jboss-as-clustering-7.2.1-5.Final_redhat_10.1.ep6.el6.noarch.rpm jboss-as-cmp-7.2.1-5.Final_redhat_10.1.ep6.el6.noarch.rpm jboss-as-configadmin-7.2.1-5.Final_redhat_10.1.ep6.el6.noarch.rpm jboss-as-connector-7.2.1-5.Final_redhat_10.1.ep6.el6.noarch.rpm jboss-as-console-1.5.6-2.Final_redhat_2.1.ep6.el6.noarch.rpm jboss-as-controller-7.2.1-5.Final_redhat_10.1.ep6.el6.noarch.rpm jboss-as-controller-client-7.2.1-5.Final_redhat_10.1.ep6.el6.noarch.rpm jboss-as-deployment-repository-7.2.1-5.Final_redhat_10.1.ep6.el6.noarch.rpm jboss-as-deployment-scanner-7.2.1-5.Final_redhat_10.1.ep6.el6.noarch.rpm jboss-as-domain-http-7.2.1-5.Final_redhat_10.1.ep6.el6.noarch.rpm jboss-as-domain-management-7.2.1-5.Final_redhat_10.1.ep6.el6.noarch.rpm jboss-as-ee-7.2.1-5.Final_redhat_10.1.ep6.el6.noarch.rpm jboss-as-ee-deployment-7.2.1-5.Final_redhat_10.1.ep6.el6.noarch.rpm jboss-as-ejb3-7.2.1-5.Final_redhat_10.1.ep6.el6.noarch.rpm jboss-as-embedded-7.2.1-5.Final_redhat_10.1.ep6.el6.noarch.rpm jboss-as-host-controller-7.2.1-5.Final_redhat_10.1.ep6.el6.noarch.rpm jboss-as-jacorb-7.2.1-5.Final_redhat_10.1.ep6.el6.noarch.rpm jboss-as-jaxr-7.2.1-5.Final_redhat_10.1.ep6.el6.noarch.rpm jboss-as-jaxrs-7.2.1-5.Final_redhat_10.1.ep6.el6.noarch.rpm jboss-as-jdr-7.2.1-5.Final_redhat_10.1.ep6.el6.noarch.rpm jboss-as-jmx-7.2.1-5.Final_redhat_10.1.ep6.el6.noarch.rpm jboss-as-jpa-7.2.1-5.Final_redhat_10.1.ep6.el6.noarch.rpm jboss-as-jsf-7.2.1-5.Final_redhat_10.1.ep6.el6.noarch.rpm jboss-as-jsr77-7.2.1-5.Final_redhat_10.1.ep6.el6.noarch.rpm jboss-as-logging-7.2.1-5.Final_redhat_10.1.ep6.el6.noarch.rpm jboss-as-mail-7.2.1-5.Final_redhat_10.1.ep6.el6.noarch.rpm jboss-as-management-client-content-7.2.1-5.Final_redhat_10.1.ep6.el6.noarch.rpm jboss-as-messaging-7.2.1-5.Final_redhat_10.1.ep6.el6.noarch.rpm jboss-as-modcluster-7.2.1-5.Final_redhat_10.1.ep6.el6.noarch.rpm jboss-as-naming-7.2.1-5.Final_redhat_10.1.ep6.el6.noarch.rpm jboss-as-network-7.2.1-5.Final_redhat_10.1.ep6.el6.noarch.rpm jboss-as-osgi-7.2.1-5.Final_redhat_10.1.ep6.el6.noarch.rpm jboss-as-osgi-configadmin-7.2.1-5.Final_redhat_10.1.ep6.el6.noarch.rpm jboss-as-osgi-service-7.2.1-5.Final_redhat_10.1.ep6.el6.noarch.rpm jboss-as-platform-mbean-7.2.1-5.Final_redhat_10.1.ep6.el6.noarch.rpm jboss-as-pojo-7.2.1-5.Final_redhat_10.1.ep6.el6.noarch.rpm jboss-as-process-controller-7.2.1-5.Final_redhat_10.1.ep6.el6.noarch.rpm jboss-as-protocol-7.2.1-5.Final_redhat_10.1.ep6.el6.noarch.rpm jboss-as-remoting-7.2.1-5.Final_redhat_10.1.ep6.el6.noarch.rpm jboss-as-sar-7.2.1-5.Final_redhat_10.1.ep6.el6.noarch.rpm jboss-as-security-7.2.1-5.Final_redhat_10.1.ep6.el6.noarch.rpm jboss-as-server-7.2.1-5.Final_redhat_10.1.ep6.el6.noarch.rpm jboss-as-system-jmx-7.2.1-5.Final_redhat_10.1.ep6.el6.noarch.rpm jboss-as-threads-7.2.1-5.Final_redhat_10.1.ep6.el6.noarch.rpm jboss-as-transactions-7.2.1-5.Final_redhat_10.1.ep6.el6.noarch.rpm jboss-as-version-7.2.1-5.Final_redhat_10.1.ep6.el6.noarch.rpm jboss-as-web-7.2.1-5.Final_redhat_10.1.ep6.el6.noarch.rpm jboss-as-webservices-7.2.1-5.Final_redhat_10.1.ep6.el6.noarch.rpm jboss-as-weld-7.2.1-5.Final_redhat_10.1.ep6.el6.noarch.rpm jboss-as-xts-7.2.1-5.Final_redhat_10.1.ep6.el6.noarch.rpm jboss-ejb-client-1.0.23-1.Final_redhat_1.ep6.el6.noarch.rpm jboss-hal-1.5.7-1.Final_redhat_1.1.ep6.el6.noarch.rpm jboss-invocation-1.1.2-1.Final_redhat_1.ep6.el6.noarch.rpm jboss-jsp-api_2.2_spec-1.0.1-6.Final_redhat_2.ep6.el6.noarch.rpm jboss-logmanager-1.4.3-1.Final_redhat_1.ep6.el6.noarch.rpm jboss-marshalling-1.3.18-1.GA_redhat_1.1.ep6.el6.noarch.rpm jboss-modules-1.2.2-1.Final_redhat_1.ep6.el6.noarch.rpm jboss-remote-naming-1.0.7-1.Final_redhat_1.ep6.el6.noarch.rpm jboss-security-negotiation-2.2.5-2.Final_redhat_2.ep6.el6.noarch.rpm jboss-stdio-1.0.2-1.GA_redhat_1.ep6.el6.noarch.rpm jbossas-appclient-7.2.1-5.Final_redhat_10.1.ep6.el6.noarch.rpm jbossas-bundles-7.2.1-5.Final_redhat_10.1.ep6.el6.noarch.rpm jbossas-core-7.2.1-6.Final_redhat_10.1.ep6.el6.noarch.rpm jbossas-domain-7.2.1-5.Final_redhat_10.1.ep6.el6.noarch.rpm jbossas-javadocs-7.2.1-2.Final_redhat_10.ep6.el6.noarch.rpm jbossas-modules-eap-7.2.1-9.Final_redhat_10.1.ep6.el6.noarch.rpm jbossas-product-eap-7.2.1-5.Final_redhat_10.1.ep6.el6.noarch.rpm jbossas-standalone-7.2.1-6.Final_redhat_10.1.ep6.el6.noarch.rpm jbossas-welcome-content-eap-7.2.1-5.Final_redhat_10.1.ep6.el6.noarch.rpm jbossts-4.17.7-4.Final_redhat_4.ep6.el6.noarch.rpm jbossweb-7.2.2-1.Final_redhat_1.1.ep6.el6.noarch.rpm jbossws-common-2.1.3-1.Final_redhat_1.ep6.el6.noarch.rpm jbossws-cxf-4.1.4-7.Final_redhat_7.ep6.el6.noarch.rpm jbossws-spi-2.1.3-1.Final_redhat_1.ep6.el6.noarch.rpm jcip-annotations-eap6-1.0-4.redhat_4.ep6.el6.noarch.rpm jgroups-3.2.10-1.Final_redhat_2.2.ep6.el6.noarch.rpm log4j-jboss-logmanager-1.0.2-1.Final_redhat_1.ep6.el6.noarch.rpm netty-3.6.6-2.Final_redhat_1.1.ep6.el6.noarch.rpm opensaml-2.5.1-2.redhat_2.1.ep6.el6.noarch.rpm openws-1.4.2-10.redhat_4.1.ep6.el6.noarch.rpm picketbox-4.0.17-3.SP2_redhat_2.1.ep6.el6.noarch.rpm picketlink-federation-2.1.6.3-2.Final_redhat_2.2.ep6.el6.noarch.rpm wss4j-1.6.10-1.redhat_1.ep6.el6.noarch.rpm xml-security-1.5.5-1.redhat_1.ep6.el6.noarch.rpm x86_64: apache-commons-daemon-jsvc-eap6-1.0.15-2.redhat_2.ep6.el6.x86_64.rpm apache-commons-daemon-jsvc-eap6-debuginfo-1.0.15-2.redhat_2.ep6.el6.x86_64.rpm hornetq-native-2.3.5-1.Final_redhat_1.ep6.el6.x86_64.rpm hornetq-native-debuginfo-2.3.5-1.Final_redhat_1.ep6.el6.x86_64.rpm httpd-2.2.22-25.ep6.el6.x86_64.rpm httpd-debuginfo-2.2.22-25.ep6.el6.x86_64.rpm httpd-devel-2.2.22-25.ep6.el6.x86_64.rpm httpd-tools-2.2.22-25.ep6.el6.x86_64.rpm jbossas-hornetq-native-2.3.5-1.Final_redhat_1.ep6.el6.x86_64.rpm mod_ssl-2.2.22-25.ep6.el6.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/#package 7. References: https://www.redhat.com/security/data/cve/CVE-2012-3499.html https://www.redhat.com/security/data/cve/CVE-2012-4558.html https://www.redhat.com/security/data/cve/CVE-2013-1862.html https://www.redhat.com/security/data/cve/CVE-2013-1896.html https://www.redhat.com/security/data/cve/CVE-2013-1921.html https://www.redhat.com/security/data/cve/CVE-2013-2172.html https://www.redhat.com/security/data/cve/CVE-2013-4112.html https://access.redhat.com/security/updates/classification/#moderate https://access.redhat.com/site/documentation/ 8. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2013 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.4 (GNU/Linux) iD8DBQFSJ4RUXlSAg2UNWIIRAkONAJ9Gj4TeEJd7Dh9Yjd2ixoHf3Ww08wCgmeRo TN/pCGYMRQOd86d72g1mzjI= =8oZG -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce

http/modules/ngx_http_proxy_module.c in nginx 1.1.4 through 1.2.8 and 1.3.0 through 1.4.0, when proxy_pass is used with untrusted HTTP servers, allows remote attackers to cause a denial of service (crash) and obtain sensitive information from worker process memory via a crafted proxy response, a similar vulnerability to CVE-2013-2028. Nginx is prone to a remote security vulnerability. Attackers can exploit this issue to a cause a denial-of-service condition or obtain sensitive information. nginx is a lightweight web server/reverse proxy server and email (IMAP/POP3) proxy server developed by Russian programmer Igor Sysoev. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 201310-04 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Normal Title: nginx: Multiple vulnerabilities Date: October 06, 2013 Bugs: #458726, #468870 ID: 201310-04 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======== Multiple vulnerabilities have been found in nginx, the worst of which may allow execution of arbitrary code. Background ========== nginx is a robust, small, and high performance HTTP and reverse proxy server. Affected packages ================= ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 www-servers/nginx < 1.4.1-r2 >= 1.4.1-r2 Description =========== Multiple vulnerabilities have been discovered in nginx. Please review the CVE identifiers referenced below for details. Impact ====== A remote attacker could send a specially crafted request, possibly resulting in execution of arbitrary code with the privileges of the process, or a Denial of Service condition. Workaround ========== There is no known workaround at this time. Resolution ========== All nginx users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose ">=www-servers/nginx-1.4.1-r2" References ========== [ 1 ] CVE-2013-0337 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-0337 [ 2 ] CVE-2013-2028 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-2028 [ 3 ] CVE-2013-2070 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-2070 Availability ============ This GLSA and any updates to it are available for viewing at the Gentoo Security Website: http://security.gentoo.org/glsa/glsa-201310-04.xml Concerns? ========= Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org. License ======= Copyright 2013 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. http://creativecommons.org/licenses/by-sa/2.5 . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 - ------------------------------------------------------------------------- Debian Security Advisory DSA-2721-1 security@debian.org http://www.debian.org/security/ Nico Golde July 07, 2013 http://www.debian.org/security/faq - ------------------------------------------------------------------------- Package : nginx Vulnerability : buffer overflow Problem type : remote Debian-specific: no CVE ID : CVE-2013-2070 Debian Bug : 708164 A buffer overflow has been identified in nginx, a small, powerful, scalable web/proxy server, when processing certain chunked transfer encoding requests if proxy_pass to untrusted upstream HTTP servers is used. The oldstable distribution (squeeze), is not affected by this problem. For the stable distribution (wheezy), this problem has been fixed in version 1.2.1-2.2+wheezy1. For the unstable distribution (sid), this problem has been fixed in version 1.4.1-1. We recommend that you upgrade your nginx packages. Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: http://www.debian.org/security/ Mailing list: debian-security-announce@lists.debian.org -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.12 (GNU/Linux) iQIcBAEBCgAGBQJR2ZOuAAoJEM1LKvOgoKqqTjsQAMKVFfBMx5Xu6XB6jXXM+2CL +m0TyjQp9oKTlTkZpE18fbQviCVk+A1jZZbHdEZlJnEdy0XvXvJpaN6DiNi10IVi kRQkMBtusXI7Bshh4Z/xWh6on9s//06mQzQzymnMQfcKDcg91Z159xPYi86mlxH5 dnf9/XirRwCokM5PI8duw1YJg2aMUpr5wYi14LVpC93ic5UoL3olwtbWcIAJy6VP auORGQLFTUCljpyEtZXku8mD168RnSubP6FZGRfar3JvywBX4MgK/+KnGXuZKZ6H MNDgVrb8hrkzQJQWvycZjhYUhurqSkR17VgJnwiyHxOxP9Sw6adWoH5aRGwoklhH 0d48CMlunJFvYtFEY8rQqiXBLAyZ09CnrEwgQa3hlugGWkRPVxnKmaghOwXZNXez o8RjCYEOdD2BppUc8RJZYz3UYq+WdVKv499HcgKGscol9aJ8XCYoq/G67697EaPF NUFaL3ApZ7rGiuUsx82FujIRs2rjuvQTe9Wiz2jRh0/BjuKarL/TG3r3SVD5/nDX 6j4ngF8eFDmf2ZfxQM1/Ug2ReO+gglnVZyYy4Kn/fxTTwFMLvznR+2lygAJQs/aM CsRN7KQhDdL1FgELvapLYyfcweeq41NJGwIvD7y3O7JKAlO44IO3XcvdAOHWLY2f 8xcpghy474tAclbQPQUi =4eCV -----END PGP SIGNATURE-----

The Huawei viewpoint VP9610 and VP9620 units for the Huawei Video Conference system do not update the Session ID upon successful establishment of a login session, which allows remote authenticated users to hijack sessions via an unspecified interception method. Huawei VP9610 and VP9620 are prone to a session-hijacking vulnerability. An attacker can exploit this issue to hijack user sessions and gain unauthorized access to the affected applications

The crypto engine process in Cisco IOS on Aggregation Services Router (ASR) Route Processor 2 does not properly manage memory, which allows local users to cause a denial of service (route processor crash) by creating multiple tunnels and then examining encryption statistics, aka Bug ID CSCuc52193. Cisco IOS is the interconnected network operating system used on most Cisco system routers and network switches. Cisco IOS is prone to a local denial-of-service vulnerability. A local attacker can exploit this issue to crash the system, resulting in denial-of-service conditions. This issue is being tracked by Cisco bug ID CSCuc52193

Fujitsu is an ICT integrated service provider that provides industry solutions for the global market. There is a privilege elevation vulnerability in Fujitsu Desktop Update that allows malicious programs to execute in the context of the current user. The application is registered as control panel item via [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ControlPanel\NameSpace\{070B64FF-795D-4DAA-88AD-6D3277C7E445}] @="Fujitsu DeskUpdate" The "shell object" with GUID {070B64FF-795D-4DAA-88AD-6D3277C7E445} is registered with [HKLM\SOFTWARE\Classes\CLSID\{070B64FF-795D-4DAA-88AD-6D3277C7E445}] @="Fujitsu DeskUpdate" "InfoTip"=expand:"@C:\\Program Files (x86)\\Fujitsu\\DeskUpdate\\DeskUpdate.exe,-132" "System.ControlPanel.Category"=dword:00000005 "System.Software.TasksFileUrl"="C:\\Program Files (x86)\\Fujitsu\DeskUpdate\\duconfig.xml" [HKLM\SOFTWARE\Classes\CLSID\{070B64FF-795D-4DAA-88AD-6D3277C7E445}\DefaultIcon] @=expand:"C:\\Program Files (x86)\\Fujitsu\\DeskUpdate\\DeskUpdate.exe,-0" [HKLM\SOFTWARE\Classes\CLSID\{070B64FF-795D-4DAA-88AD-6D3277C7E445}\Shell\Open\Command] @="C:\\Program Files (x86)\\Fujitsu\\DeskUpdate\\DeskUpdate.exe" The last entry is a pathname with unquoted spaces and allows the execution of the rogue programs "C:\Program.exe" and/or "C:\Program Files.exe", as documented in <http://msdn.microsoft.com/library/ms682425.aspx> Stefan Kanthak PS: long pathnames containing spaces exist for about 20 years now in Windows, EVERY developer should know how to use them properly, and EVERY QA should check their proper use!

The CallServer component in Cisco Unified Customer Voice Portal (CVP) Software before 9.0.1 ES 11 allows remote attackers to cause a denial of service (call-acceptance outage) via malformed SIP INVITE messages, aka Bug ID CSCua65148. Vendors have confirmed this vulnerability Bug ID CSCua65148 It is released as.Malformed by a third party SIP INVITE Service disruption via message ( Stop receiving ) There is a possibility of being put into a state. Successfully exploiting this issue allows remote attackers to cause denial-of-service conditions. This issue is being tracked by Cisco Bug ID CSCua65148. A remote attacker can exploit this vulnerability through malformed SIP INVITE packets to cause denial of service (interruption of call reception)

The Tomcat Web Management feature in Cisco Unified Customer Voice Portal (CVP) Software before 9.0.1 ES 11 does not properly configure Tomcat components, which allows remote attackers to execute arbitrary code via a crafted (1) HTTP or (2) HTTPS request, aka Bug ID CSCub38384. Vendors have confirmed this vulnerability Bug ID CSCub38384 It is released as.Skillfully crafted by a third party (1) HTTP Or (2) HTTPS Arbitrary code may be executed via a request. Cisco Unified Customer Voice Portal is prone to a remote privilege-escalation vulnerability. Attackers can exploit this issue to gain elevated privileges in the context of the affected application. Successful exploits may aid in further attacks. This issue is being tracked by Cisco Bug ID CSCub38384. Versions prior to Unified Customer Voice Portal (CVP) 9.0.1 ES 11 are vulnerable. The vulnerability stems from the fact that the program does not properly configure the Tomcat component

The Tomcat Web Management feature in Cisco Unified Customer Voice Portal (CVP) Software before 9.0.1 ES 11 does not properly configure Tomcat components, which allows remote attackers to launch arbitrary custom web applications via a crafted (1) HTTP or (2) HTTPS request, aka Bug ID CSCub38379. Cisco Unified Customer Voice Portal is prone to a security-bypass vulnerability. Exploiting this issue could allow an attacker to bypass certain security restrictions and gain unauthorized access to the affected device. This issue is being tracked by Cisco Bug ID CSCub38379. Versions prior to Unified Customer Voice Portal (CVP) 9.0.1 ES 11 are vulnerable. The vulnerability is caused by the program not configuring the Tomcat component correctly

The log viewer in Cisco Unified Customer Voice Portal (CVP) Software before 9.0.1 ES 11 does not properly validate an unspecified parameter, which allows remote attackers to read arbitrary files via a crafted (1) HTTP or (2) HTTPS request, aka Bug ID CSCub38372. Successfully exploiting this issue may allow attackers to read arbitrary files. This may lead to further attacks. This issue is being tracked by Cisco Bug ID CSCub38372. Versions prior to Unified Customer Voice Portal (CVP) 9.0.1 ES 11 are vulnerable

Directory traversal vulnerability in the Resource Manager in Cisco Unified Customer Voice Portal (CVP) Software before 9.0.1 ES 11 allows remote attackers to overwrite arbitrary files via a crafted (1) HTTP or (2) HTTPS request that triggers incorrect parameter validation, aka Bug ID CSCub38369. A remote attacker can use directory-traversal strings to modify arbitrary system files in the context of the affected application. This may aid in further attacks. This issue is being tracked by Cisco Bug ID CSCub38369

Cisco Unified Customer Voice Portal (CVP) Software before 9.0.1 ES 11 allows remote attackers to read arbitrary files via a Resource Manager (1) HTTP or (2) HTTPS request containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue, aka Bug ID CSCub38366. Cisco Unified Customer Voice Portal (CVP) Contains a vulnerability in which arbitrary files can be read. This case XML External entity (XXE) Vulnerability related to the problem. Remote attackers can exploit this issue to read arbitrary files. This may lead to further attacks. This issue is being tracked by Cisco Bug ID CSCub38366

Multiple cross-site scripting (XSS) vulnerabilities in administrative-interface pages in the management console in Symantec Brightmail Gateway 9.5.x allow remote authenticated users to inject arbitrary web script or HTML via unspecified vectors. Symantec Brightmail Gateway is prone to multiple HTML-injection vulnerabilities because it fails to properly sanitize user-supplied input. Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or control how the site is rendered to the user. Other attacks are also possible. Symantec Brightmail Gateway 9.5.x are vulnerable

Cross-site scripting (XSS) vulnerability in Juniper SmartPass WLAN Security Management before 7.7 MR3 and 8.0 before MR2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Juniper Networks SmartPass is prone to an unspecified cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. SmartPass 8.0 MR1 and 7.7 MR2 are vulnerable. Juniper Networks SmartPass is a security management application of Juniper Networks (Juniper Networks), which can implement dynamic access control on all users and devices on the wireless LAN

Juniper Junos Space before 12.3P2.8, as used on the JA1500 appliance and in other contexts, includes a cleartext password in a configuration tab, which makes it easier for physically proximate attackers to obtain the password by reading the workstation screen. Multiple Juniper Networks Products are prone to a password-disclosure vulnerability. Local attackers can exploit this issue to obtain sensitive information that may lead to further attacks. The solution supports automated configuration, monitoring, and troubleshooting of devices and services throughout their lifecycle

Unspecified vulnerability in Adobe ColdFusion 9.0, 9.0.1, 9.0.2, and 10 allows remote attackers to read arbitrary files via unknown vectors. Adobe ColdFusion is prone to an information-disclosure vulnerability. Attackers can exploit this issue to retrieve files stored on the server and obtain sensitive information. This may aid in launching further attacks. Adobe ColdFusion is a dynamic web server product of Adobe (Adobe) in the United States, and the CFML (ColdFusion Markup Language) it runs is a programming language for web applications

Invensys Wonderware Information Server (WIS) 4.0 SP1SP1, 4.5- Portal, and 5.0- Portal does not restrict unspecified size and amount values, which allows remote attackers to execute arbitrary code or cause a denial of service (resource consumption) via unknown vectors. Invensys Wonderware Information Server is a graphical visualization, reporting and analysis of real-time network-based plant operations data that helps drive productivity across the enterprise. Invensys Wonderware Information Server is prone to a denial-of-service vulnerability. Successful exploits may allow an attacker to trigger high CPU consumption and make the application unresponsive. Note that this issue could be exploited to execute arbitrary code, however, Symantec has not been confirmed. The following versions are vulnerable: Wonderware Information Server 4.0 SP1 Wonderware Information Server 4.5 Portal Wonderware Information Server 5.0 Portal. Through the network solution, this product can conveniently display the factory performance indicators and production data to the operation, operation and maintenance and engineering personnel, and is widely used in petroleum, natural gas, chemical and other industries

Cross-site scripting (XSS) vulnerability in Invensys Wonderware Information Server (WIS) 4.0 SP1SP1, 4.5- Portal, and 5.0- Portal allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Invensys Wonderware Information Server can centrally reflect web management solutions for production management. There are security vulnerabilities in the implementation of Wonderware Information Server 4.0 SP1, Wonderware Information Server 4.5 Portal, and Wonderware Information Server 5.0 Portal. An attacker could exploit this vulnerability to execute arbitrary script code in the user's browser of the affected site context. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks. Through the network solution, this product can conveniently display the factory performance indicators and production data to the operation, operation and maintenance and engineering personnel, and is widely used in petroleum, natural gas, chemical and other industries

SQL injection vulnerability in Invensys Wonderware Information Server (WIS) 4.0 SP1SP1, 4.5- Portal, and 5.0- Portal allows remote attackers to execute arbitrary SQL commands via unspecified vectors. Invensys Wonderware Information Server can centrally reflect web management solutions for production management. There are security vulnerabilities in the implementation of Wonderware Information Server 4.0 SP1, Wonderware Information Server 4.5 Portal, and Wonderware Information Server 5.0 Portal. An attacker can exploit a vulnerability to compromise an application and perform unauthorized operations. Through the network solution, this product can conveniently display the factory performance indicators and production data to the operation, operation and maintenance and engineering personnel, and is widely used in petroleum, natural gas, chemical and other industries

Invensys Wonderware Information Server (WIS) 4.0 SP1SP1, 4.5- Portal, and 5.0- Portal allows remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service (CPU and memory consumption) via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue. Invensys Wonderware Information Server can centrally reflect web management solutions for production management. There are security vulnerabilities in the implementation of Wonderware Information Server 4.0 SP1, Wonderware Information Server 4.5 Portal, and Wonderware Information Server 5.0 Portal. A local attacker exploited this vulnerability to obtain sensitive information. Through the network solution, this product can conveniently display the factory performance indicators and production data to the operation, operation and maintenance and engineering personnel, and is widely used in petroleum, natural gas, chemical and other industries. Entity (XXE) issues