title: Red Hat Security Advisory: Red Hat JBoss Data Virtualization 6.1.0 update
description: CXF: SSL hostname verification bypass, incomplete CVE-2012-5783 fix OpenJDK: XML parsing Denial of Service (JAXP, 8017298) Java: Java XML Signature DoS Attack JSF: XSS due to insufficient escaping of user-supplied content in outputText tags and EL expressions JBossSX/PicketBox: World readable audit.log file Tomcat/JBossWeb: Limited DoS in chunked transfer encoding input filter Tomcat/JBossWeb: XXE vulnerability via user supplied XSLTs Tomcat/JBossWeb: Request smuggling via malicious content length header Tomcat/JBossWeb: XML parser hijack by malicious web application netty: DoS via memory exhaustion during data aggregation Tomcat/JBossWeb: request smuggling and limited DoS in ChunkedInputFilter JAX-RS: Information disclosure via XML eXternal Entity (XXE) RESTEasy: XXE via parameter entities PicketLink: XXE via insecure DocumentBuilderFactory usage CXF: SSL hostname verification bypass, incomplete CVE-2012-6153 fix Framework: Directory traversal CXF: Improper security semantics enforcement of SAML SubjectConfirmation methods RESTeasy: External entities expanded by DocumentProvider Weld: Limited information disclosure via stale thread state
cpes: cpe:/a:redhat:jboss_data_virtualization:6.1