Loading story…
Red Hat released JBoss Enterprise Application Platform (EAP) 7.0.2 updates for RHEL 6, RHEL 7, and the eap7-jboss-ec2-eap package to remediate three security flaws: CVE-2016-5406, a domain-management RBAC propagation failure that can grant full administrative privileges on EAP 6.2–6.4 slave hosts; CVE-2016-4993, Undertow HTTP header injection and response splitting through unsanitized header input; and CVE-2015-0254, an XXE flaw in JSTL that can expose host resources and may enable arbitrary code execution.
The fixes were delivered in RHSA-2016:1838 for RHEL 6, RHSA-2016:1839 for RHEL 7, and RHSA-2016:1840 for EAP EC2 deployments. Affected organizations should back up EAP installations and deployed applications, apply the appropriate EAP 7.0.2 packages, and restart JBoss server processes to activate the remediations.
See real exploitation activity before you spend the cycle.
7 events from the most recent confirmed update back to the earliest known activity.
Red Hat released RHSA-2016:1841 to fix CVE-2016-4993 and CVE-2016-5406 in JBoss EAP 7 products.
Red Hat released RHSA-2016:1840 for the eap7-jboss-ec2-eap package on RHEL 6 and RHEL 7, making it compatible with EAP 7.0.2. The Important update addressed CVE-2016-4993 and CVE-2016-5406, as well as CVE-2015-0254.
Red Hat published RHSA-2016:1839, an Important advisory delivering JBoss EAP 7.0.2 packages for RHEL 7. It fixed the Undertow header-injection issue CVE-2016-4993 and the EAP domain-management RBAC privilege-escalation issue CVE-2016-5406.
Red Hat issued RHSA-2016:1838, an Important advisory providing JBoss EAP 7.0.2 for RHEL 6. The update remediated CVE-2016-4993 HTTP header injection/response splitting and CVE-2016-5406 privilege escalation, alongside CVE-2015-0254.
Red Hat issued RHSA-2015:1695 for Red Hat Enterprise Linux 6 and 7 packages containing jakarta-taglibs-standard, fixing CVE-2015-0254. The Important JSTL XML external-entity vulnerability could allow access to host resources and potentially arbitrary code execution through XSL extensions.
Red Hat issued RHSA-2017:3456 as a subsequent JBoss EAP 7 erratum fixing CVE-2016-4993 and CVE-2016-5406.
Red Hat issued RHSA-2016:0121, RHSA-2016:0122, RHSA-2016:0123, and RHSA-2016:0124 to remediate CVE-2015-0254 in JBoss EAP 6.4.z on RHEL 5, RHEL 6, and RHEL 7. Red Hat advised users to upgrade to at least EAP 6.4.9 and set org.apache.taglibs.standard.xml.accessExternalEntity=false to prevent JSTL XXE attacks.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
8 references tracked. Mallory keeps watching after this page renders.
rhn.redhat.com
Open sourcerhn.redhat.com
Open sourcerhn.redhat.com
Open sourcebugzilla.redhat.com
Open sourceredhat.com
Open sourceredhat.com
Open sourcebugzilla.redhat.com
Open sourceredhat.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat released moderate-severity updates for **JBoss Enterprise Application Platform (EAP) 6.3.3/6.3.z** on Red Hat Enterprise Linux 5, 6, and 7, addressing five flaws in RESTEasy XML handling, RBAC, JacORB, security-domain selection, and Weld conversation-state processing. The most externally reachable issue, `CVE-2014-7839`, allowed XML external entity expansion through a RESTEasy endpoint, potentially exposing files readable by the application-server account. The updates also remediate `CVE-2014-7849`, through which an authenticated RBAC Maintainer could alter a limited set of protected attributes, and `CVE-2014-7853`, which exposed sensitive security-domain data to authenticated users with incorrectly sufficient attribute permissions. Organizations should apply the relevant RHSA-2015:0215, RHSA-2015:0216, or RHSA-2015:0218 packages—including the RHEL 5 component updates—and restart JBoss server processes to activate the fixes.
Aug 29, 2026
Red Hat released **RHSA-2017:0247** to update JBoss Enterprise Application Platform 6 from 6.4.12 to 6.4.13, addressing HTTP request smuggling (`CVE-2016-6816`), log-download resource exhaustion (`CVE-2016-8627`), and sensitive-information disclosure through role-based access control (`CVE-2016-7061`). The log-download flaw could allow cross-origin GET requests to consume server resources and impair service availability, while the RBAC flaw let Monitor-role users in domain mode view sensitive socket-binding and internal network configuration at the server level. For EAP 6.4 deployments on RHEL 6 using the EC2 package, **RHSA-2017:0250** supplied `jboss-ec2-eap-7.5.13-1.Final_redhat_2.ep6.el6` and included fixes for these issues plus a local privilege-escalation issue. Red Hat later clarified that `CVE-2016-8656`, an unsafe-file-handling flaw in JBoss initialization scripts affecting RPM installations, was incorrectly listed as resolved by RHSA-2017:0247 because that advisory covered ZIP-distributed EAP files; affected organizations should apply the applicable supported EAP and package updates after backing up installations and deployed applications.
Aug 28, 2026
Red Hat released **JBoss Enterprise Application Platform (EAP) 6.4.14** to replace 6.4.13 and remediate three security flaws across EAP 6 packages for supported RHEL 5, 6, and 7 deployments, including `jboss-ec2-eap`. **CVE-2016-8657** allowed local members of the `jboss` group to modify the group-writable `/etc/sysconfig/jbossas` file; on RHEL 6 and earlier systems using legacy `/etc/init.d` service scripts, that file was sourced with root privileges during JBoss service operations, enabling local privilege escalation. The release also fixes **CVE-2017-6056**, an Apache Tomcat HTTPS request-processing flaw that could trigger an infinite loop and denial of service, and **CVE-2016-6346**, where RESTEasy's `GZIPInterceptor` could be unnecessarily enabled and permit denial of service. Red Hat advised customers to back up EAP installations and deployed applications before updating. The vendor clarified that the initial ZIP-distribution advisory did not resolve CVE-2016-8657, because the affected writable configuration file was present in RPM-based installations.
Aug 28, 2026