title: Red Hat Security Advisory: Red Hat JBoss Web Server 3.0.3 security update
description: openssl: use-after-free on invalid EC private key import libxml2: CPU exhaustion when processing specially crafted XML input tomcat: directory disclosure tomcat: Session fixation tomcat: CSRF token leak libxml2: Heap-based buffer overflow in xmlDictComputeFastQKey libxml2: Heap-based buffer overflow in xmlParseXmlDecl libxml2: Heap-based buffer overflow in xmlGROW libxml2: Heap buffer overflow in xmlParseMisc libxml2: Out-of-bounds memory access libxml2: heap-based buffer overflow in xmlParseConditionalSections() libxml2: DoS caused by incorrect error detection during XZ decompression libxml2: Buffer overread with XML parser in xmlNextChar libxml2: Buffer overread with HTML parser in push mode in xmlSAX2TextNode libxml2: Out-of-bounds heap read when parsing file with unfinished xml declaration libxml2: out-of-bounds memory access when parsing an unclosed HTML comment tomcat: security manager bypass via StatusManagerServlet tomcat: Security Manager bypass via persistence mechanisms tomcat: security manager bypass via setGlobalContext()
cpes: cpe:/a:redhat:jboss_enterprise_web_server:3.0