Loading story…
Red Hat released JBoss Enterprise Application Platform (EAP) 6.2.1 to replace EAP 6.2.0 and remediate three Moderate-impact vulnerabilities. CVE-2013-6440 affects OpenSAML/XMLTooling-J and allows externally supplied XML entities to be resolved, potentially enabling unauthenticated remote attackers to read files accessible to the application-server account and conduct further XXE attacks. CVE-2013-4517 affects Apache Santuario XML Security for Java, where DTD processing during XML transforms can exhaust memory and cause an OutOfMemoryError. CVE-2014-0018 permits deployed code running under a Java Security Manager to access the Modular Service Container service registry without required permission checks and alter JBoss internal server state.
The fixes were delivered through RHSA-2014:0170 for RHEL 5, RHSA-2014:0171 for RHEL 6, and RHSA-2014:0172 for Customer Portal distributions. Organizations operating EAP 6.2.0 should upgrade to EAP 6.2.1, back up installations and deployed applications, review and merge locally modified configuration files preserved as .rpmnew where applicable, and restart the JBoss server process after installation.
See real exploitation activity before you spend the cycle.
16 events from the most recent confirmed update back to the earliest known activity.
Red Hat issued RHSA-2014:1725, RHSA-2014:1726, and RHSA-2014:1728 to remediate the Apache Santuario XML Security denial-of-service flaw CVE-2013-4517 in JBoss EAP 5/5.2 and JBoss Enterprise Web Platform 5 for RHEL 5 and RHEL 6.
Red Hat issued RHSA-2014:1290 for JBoss BRMS 6.0 and RHSA-2014:1291 for JBoss BPMS 6.0, remediating CVE-2014-0018 in both products.
Red Hat issued RHSA-2014:0452 to fix CVE-2013-6440 in affected Fuse ESB Enterprise, Fuse Management Console, and Fuse MQ Enterprise 7.1.0 products.
Red Hat issued Moderate-security advisory RHSA-2014:0195 for Red Hat JBoss Portal 6.1.1, replacing version 6.1.0. The update fixed the OpenSAML XXE vulnerability CVE-2013-6440 and the Apache Santuario XML Security denial-of-service vulnerability CVE-2013-4517.
CVE-2014-0018 was publicly published, documenting that JBoss EAP 6.2.0 and WildFly running under a security manager did not properly restrict deployed-code access to the MSC service registry. A local user could use a crafted deployment to modify the affected server.
Red Hat released JBoss EAP 6.2.1 to replace EAP 6.2.0, rated the update Moderate impact, and fixed CVE-2013-6440, CVE-2013-4517, and CVE-2014-0018. Administrators were instructed to apply the update and restart the JBoss server process.
Red Hat issued RHSA-2014:0171, a Moderate-security update for JBoss EAP 6.2.1 on RHEL 6 replacing EAP 6.2.0. The update fixed CVE-2013-6440, CVE-2013-4517, and CVE-2014-0018.
Red Hat issued a Moderate-security update providing JBoss EAP 6.2.1 for RHEL 5, replacing EAP 6.2.0. It remediated the OpenSAML XXE flaw CVE-2013-6440, the Apache Santuario denial-of-service flaw CVE-2013-4517, and CVE-2014-0018.
Arun Babu Neelicattu reported CVE-2014-0018, involving unchecked access to the Modular Service Container service registry by deployed code when JBoss EAP runs under a Java Security Manager.
Red Hat addressed the OpenSAML/XMLTooling-J XXE vulnerability CVE-2013-6440 in JBoss Fuse Service Works 6.0.0 through RHSA-2014:1995.
Red Hat addressed CVE-2014-0018 in JBoss Fuse Service Works 6.0.0 through RHSA-2014:1995 and in JBoss Portal 6.2.0 through RHSA-2015:1009. These product-specific fixes were not included in the existing timeline.
Red Hat issued RHSA-2014:1290 to remediate the affected xmltooling component and CVE-2013-6440 in Red Hat JBoss BRMS 6.0.
Red Hat issued RHSA-2014:1291 to remediate the affected xmltooling component and CVE-2013-6440 in Red Hat JBoss BPMS 6.0.
Red Hat required an upgrade to HornetQ to resolve Bugzilla issue 1053215 and verified the fix in a CR3 build. The issue was closed as ERRATA, with updated files referenced through RHSA-2014:0171.
Red Hat upgraded JBoss Marshalling to jboss-marshalling-1.4.3-1.Final_redhat_1.1.ep6.el6, sourced from commit 2e75ea5c71ba7ec6f4315e9e78fe642bfc41949f. The update was verified in a CR3 build and Bugzilla issue 1053230 was closed as ERRATA, with updated files provided through RHSA-2014:0171.
Red Hat upgraded Weld Core to weld-core-1.1.17-1.Final_redhat_1.1.ep6.el6 from commit 1b99e8142ee55ff1280fe10538987eec1415c0c4. Bugzilla 1053778 was verified in a CR3 build and closed as ERRATA, with updated files provided through RHSA-2014:0171.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
30 references tracked. Mallory keeps watching after this page renders.
rhn.redhat.com
Open sourcerhn.redhat.com
Open sourcerhn.redhat.com
Open sourceaccess.redhat.com
Open sourcebugzilla.redhat.com
Open sourcebugzilla.redhat.com
Open sourcebugzilla.redhat.com
Open sourcebugzilla.redhat.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat released Moderate-severity updates for JBoss Enterprise Application Platform (EAP) 6.2 on Red Hat Enterprise Linux 5 and 6, advancing deployments from version 6.2.3 to 6.2.4. The fixes address five vulnerabilities affecting Apache CXF and the JBoss JAX-RS implementation, including a SAML-token validation bypass, XML external entity (XXE) information disclosure, denial-of-service conditions, and potential plaintext credential exposure in a specific Apache CXF client-policy configuration. The XXE flaw, tracked as `CVE-2014-3481`, affects RESTEasy applications using JBoss EAP default context parameters that did not explicitly disable external-entity expansion. Unauthenticated attackers could submit crafted XML to applications accepting XML input to read local files, cause server-side HTTP requests that bypass network restrictions, or exhaust CPU and memory. Red Hat advised affected administrators to install the updated EAP packages, restart JBoss, preserve customized configurations, and review and merge any generated `.rpmnew` configuration changes.
Aug 29, 2026
Red Hat released **JBoss Enterprise Application Platform (EAP) 6.4.14** to replace 6.4.13 and remediate three security flaws across EAP 6 packages for supported RHEL 5, 6, and 7 deployments, including `jboss-ec2-eap`. **CVE-2016-8657** allowed local members of the `jboss` group to modify the group-writable `/etc/sysconfig/jbossas` file; on RHEL 6 and earlier systems using legacy `/etc/init.d` service scripts, that file was sourced with root privileges during JBoss service operations, enabling local privilege escalation. The release also fixes **CVE-2017-6056**, an Apache Tomcat HTTPS request-processing flaw that could trigger an infinite loop and denial of service, and **CVE-2016-6346**, where RESTEasy's `GZIPInterceptor` could be unnecessarily enabled and permit denial of service. Red Hat advised customers to back up EAP installations and deployed applications before updating. The vendor clarified that the initial ZIP-distribution advisory did not resolve CVE-2016-8657, because the affected writable configuration file was present in RPM-based installations.
Aug 28, 2026
Red Hat released moderate-severity updates for **JBoss Enterprise Application Platform (EAP) 6.3.3/6.3.z** on Red Hat Enterprise Linux 5, 6, and 7, addressing five flaws in RESTEasy XML handling, RBAC, JacORB, security-domain selection, and Weld conversation-state processing. The most externally reachable issue, `CVE-2014-7839`, allowed XML external entity expansion through a RESTEasy endpoint, potentially exposing files readable by the application-server account. The updates also remediate `CVE-2014-7849`, through which an authenticated RBAC Maintainer could alter a limited set of protected attributes, and `CVE-2014-7853`, which exposed sensitive security-domain data to authenticated users with incorrectly sufficient attribute permissions. Organizations should apply the relevant RHSA-2015:0215, RHSA-2015:0216, or RHSA-2015:0218 packages—including the RHEL 5 component updates—and restart JBoss server processes to activate the fixes.
Aug 29, 2026