title: Red Hat Security Advisory: Red Hat JBoss Core Services Apache HTTP Server 2.4.29 security update
description: expat: Out-of-bounds heap read on crafted input causing crash httpd: CRLF injection allowing HTTP response splitting attacks for sites which use mod_userdir libxml2: Use after free triggered by XPointer paths beginning with range-to curl: escape and unescape integer overflows curl: Cookie injection for other servers curl: Case insensitive password comparison curl: Out-of-bounds write via unchecked multiplication curl: Double-free in curl_maprintf curl: Double-free in krb5 code curl: curl_getdate out-of-bounds read curl: URL unescape heap overflow via integer truncation curl: Use-after-free via shared cookies curl: Invalid URL parsing with '#' curl: IDNA 2003 makes curl use wrong host libxml2: XML External Entity vulnerability libxml2: stack exhaustion while parsing xml files in recovery mode (unfixed CVE-2016-3627 in JBCS) libxml2: stack overflow before detecting invalid XML file (unfixed CVE-2016-3705 in JBCS) libxml2: out-of-bounds read (unfixed CVE-2016-4483 in JBCS) pcre: Out-of-bounds read in compile_bracket_matchingpath function (8.41/3) pcre: Invalid Unicode property lookup (8.41/7, 10.24/2) pcre: invalid memory read in _pcre32_xclass (pcre_xclass.c) pcre: stack-based buffer overflow write in pcre32_copy_substring pcre: stack-based buffer overflow write in pcre32_copy_substring libxml2: Buffer overflow in function xmlSnprintfElementContent libxml2: Stack-based buffer overflow in function xmlSnprintfElementContent libxml2: Heap-based buffer over-read in function xmlDictComputeFastKey libxml2: Heap-based buffer over-read in function xmlDictAddString libxml2: Unrestricted memory usage in xz_head() function in xzlib.c curl: FTP PWD response parser out of bounds read curl: IMAP FETCH response out of bounds read curl: Heap-based buffer overflow in Curl_smtp_escape_eob() when uploading data over SMTP
cpes: cpe:/a:redhat:jboss_core_services:1