Loading story…
Red Hat released Moderate-severity updates for Apache POI bundled with JBoss BRMS 6.0.3, JBoss BPM Suite 6.0.3, JBoss Data Virtualization 6.0.0, and JBoss Fuse Service Works 6.0.0. The updates remediate CVE-2014-3529, an XML external entity (XXE) vulnerability in OOXML parsing that could allow an attacker who supplies a crafted document to read files accessible to the application-server user and potentially perform further XXE attacks.
The releases also fix CVE-2014-3574, in which uncontrolled XML entity expansion in OOXML documents could exhaust CPU and memory, causing denial of service. Red Hat advised affected customers to install the applicable updates; deployments should be backed up and the JBoss Application Server stopped before installation. Fedora also shipped Apache POI 3.10.1 updates containing upstream fixes.
See real exploitation activity before you spend the cycle.
8 events from the most recent confirmed update back to the earliest known activity.
Red Hat published RHSA-2014:1398 for JBoss Data Virtualization 6.0.0, remediating CVE-2014-3529 and CVE-2014-3574 in its Apache POI component.
Red Hat issued RHSA-2014:1399 for JBoss BPM Suite 6.0.3. The Moderate-severity update addressed the Apache POI XXE and unlimited entity-expansion vulnerabilities.
Red Hat issued RHSA-2014:1400, a Moderate-severity Apache POI security update for JBoss BRMS 6.0.3, fixing CVE-2014-3529 and CVE-2014-3574.
Red Hat published RHSA-2014:1370 for JBoss Fuse Service Works 6.0.0. The Moderate-severity update remediated CVE-2014-3529 and CVE-2014-3574.
Fedora published apache-poi-3.10.1-1.fc20 to the Fedora 20 stable repository, addressing the Apache POI OOXML XXE and entity-expansion vulnerabilities.
Red Hat addressed CVE-2014-3529 and CVE-2014-3574 in JBoss Portal 6.2.0 through RHSA-2015:1009. Red Hat determined JBoss Portal Platform was not exploitable by default unless a custom application processed user-supplied XML with its bundled Apache POI library.
Fedora published apache-poi-3.10.1-2.fc21 to the Fedora 21 stable repository for CVE-2014-3529.
Apache POI issued upstream source fixes for CVE-2014-3529, which allowed external-entity resolution in OOXML documents, and CVE-2014-3574, an unlimited entity-expansion denial-of-service flaw.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
12 references tracked. Mallory keeps watching after this page renders.
access.redhat.com
Open sourceaccess.redhat.com
Open sourcerhn.redhat.com
Open sourcerhn.redhat.com
Open sourceredhat.com
Open sourceredhat.com
Open sourcebugzilla.redhat.com
Open sourcebugzilla.redhat.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat issued Important-security updates across JBoss BPM Suite, JBoss BRMS, JBoss Fuse Service Works, and JBoss Data Grid, addressing flaws that could lead to remote or authenticated arbitrary Java code execution. Affected components included Xalan-Java XSLT secure-processing bypasses, insecure XStream XML deserialization, Apache Camel XSLT handling, and MVEL/JBoss Rules expression evaluation; several releases also corrected XML external entity (XXE) weaknesses in OpenSAML, Camel, and RESTEasy. The updates additionally fixed Java Security Manager policy failures that could grant deployed applications `java.security.AllPermission`, JBoss MSC service-registry access-control issues, HawtJNI temporary-file risks, plaintext authentication-parameter logging, Smack XMPP spoofing, WebSocket memory-exhaustion denial of service, and TLS CBC padding-oracle exposure. Red Hat instructed customers to back up installations, stop the JBoss Application Server, apply the applicable upgraded release or roll-up patch, and restart services; organizations using rule-authoring or externally exposed environments were advised to retain Java Security Manager sandboxing for MVEL evaluation.
Aug 31, 2026
Red Hat released Important cumulative roll-up patches for JBoss BPM Suite 6.0.3, JBoss BRMS 6.0.3, and JBoss Fuse Service Works 6.0.0. The updates—RHSA-2015:0234, RHSA-2015:0235, and RHSA-2015:0720—remediate 18 to 20 vulnerabilities in bundled components including Apache HttpComponents, JBossWeb/Tomcat, Spring Framework, RESTEasy, PicketBox/PicketLink, Netty, UberFire, KIE Workbench, and JBoss AS. The vulnerabilities include SSL hostname-verification bypasses, XML external entity (XXE) processing, directory traversal, authorization bypass, information disclosure, denial of service, request smuggling, cross-site scripting, Java Security Manager bypass, and remote code execution. Red Hat instructed affected customers to back up their installations, stop the JBoss Application Server, apply the appropriate roll-up patch, and restart the service.
Aug 29, 2026
Red Hat released Moderate-impact updates for Apache Tomcat, JBoss Web Server, JBoss EAP 6.2.4, and JBoss Data Grid to remediate **CVE-2014-0075**, **CVE-2014-0099**, and **CVE-2014-0096**. The flaws could permit remote denial of service through unbounded chunked-transfer input, HTTP request smuggling via integer overflow while parsing `Content-Length` headers—particularly where a vulnerable server sits behind a reverse proxy—and XML external entity (XXE) processing in Tomcat DefaultServlet handling of user-supplied XSLTs. JBoss EAP and Data Grid updates additionally addressed XML parser abuse that could bypass XXE restrictions and expose XML files belonging to other applications on the same instance. Affected RHEL 6 and 7 Tomcat deployments, JBoss Web Server 2.0.1 installations, and EAP 6.2.4 environments should install the applicable vendor packages or upgrades and restart Tomcat or the JBoss server process. Red Hat supplied patched builds including `tomcat-7.0.42-6.el7_0` for RHEL 7 and `tomcat6-6.0.24-72.el6_5` for RHEL 6; JBoss Data Grid 6.2.1 users were directed to upgrade to 6.3.0. Administrators should back up JBoss installations, applications, and configurations before applying updates, and prioritize externally reachable services deployed behind reverse proxies.
Aug 29, 2026