RHSA-2015:0234: Important: Red Hat JBoss BPM Suite 6.0.3 security update

Red Hat JBoss BPM Suite is a business rules and processes management systemfor the management, storage, creation, modification, and deployment ofJBoss rules and BPMN2-compliant business processes.This roll up patch serves as a cumulative upgrade for Red Hat JBoss BPMSuite 6.0.3, and includes bug fixes and enhancements. It includes variousbug fixes, which are listed in the README file included with the patchfiles.The following security issues are also fixed with this release,descriptions of which can be found on the respective CVE pages linked inthe References section.CVE-2012-6153 Apache HttpComponents client: SSL hostname verificationbypass, incomplete CVE-2012-5783 fixCVE-2014-3577 Apache HttpComponents client: SSL hostname verificationbypass, incomplete CVE-2012-6153 fixCVE-2013-4002 xerces-j2: Xerces-J2 OpenJDK: XML parsing Denial of Service(JAXP, 8017298)CVE-2013-5855 Mojarra JSF: XSS due to insufficient escaping ofuser-supplied content in outputText tags and EL expressionsCVE-2014-0005 security: PicketBox/JBossSX: Unauthorized access to andmodification of application server configuration and state by applicationCVE-2014-0075 jbossweb: tomcat: Limited DoS in chunked transfer encodinginput filterCVE-2014-0096 jbossweb: Apache Tomcat: XXE vulnerability via user suppliedXSLTsCVE-2014-0099 jbossweb: Apache Tomcat: Request smuggling via maliciouscontent length headerCVE-2014-0119 jbossweb: Apache Tomcat 6: XML parser hijack by malicious webapplicationCVE-2014-0193 netty: DoS via memory exhaustion during data aggregationCVE-2014-0227 Tomcat/JBossWeb: Limited DoS in chunked transfer encoding input filterCVE-2014-3472 jboss-as-controller: JBoss AS Security: Invalid EJB callerrole check implementationCVE-2014-3490 RESTEasy: XXE via parameter entitiesCVE-2014-3530 PicketLink: XXE via insecure DocumentBuilderFactory usageCVE-2014-3558 hibernate-validator: Hibernate Validator: JSM bypass viaReflectionHelperCVE-2014-3578 spring: Spring Framework: Directory traversalCVE-2014-3625 spring: Spring Framework: directory traversal flawCVE-2014-3682 jbpm-designer: XXE in BPMN2 importCVE-2014-8114 UberFire: Information disclosure and RCE via insecure fileupload/download servletsCVE-2014-8115 KIE Workbench: Insufficient authorization constraintsRed Hat would like to thank James Roper of Typesafe for reporting theCVE-2014-0193 issue, CA Technologies for reporting the CVE-2014-3472 issue,Alexander Papadakis for reporting the CVE-2014-3530 issue, and David Jormfor reporting the CVE-2014-8114 and CVE-2014-8115 issues. The CVE-2012-6153issue was discovered by Florian Weimer of Red Hat Product Security; theCVE-2014-0005 issue was discovered by Josef Cacek of the Red Hat JBoss EAPQuality Engineering team; the CVE-2014-0075, CVE-2014-3490, andCVE-2014-3682 issues were discovered by David Jorm of Red Hat ProductSecurity.All users of Red Hat JBoss BPM Suite 6.0.3 as provided from the Red HatCustomer Portal are advised to apply this roll up patch.