title: Red Hat Security Advisory: Red Hat JBoss BPM Suite 6.4.12 security update
description: jackson-databind: Unsafe deserialization due to incomplete black list (incomplete fix for CVE-2017-15095) jackson-databind: improper polymorphic deserialization of types from Jodd-db library jackson-databind: improper polymorphic deserialization of types from Oracle JDBC driver jackson-databind: arbitrary code execution in slf4j-ext class jackson-databind: arbitrary code execution in blaze-ds-opt and blaze-ds-core classes jackson-databind: improper polymorphic deserialization in axis2-transport-jms class jackson-databind: improper polymorphic deserialization in openjpa class jackson-databind: improper polymorphic deserialization in jboss-common-core class
cpes: cpe:/a:redhat:jboss_bpms:6.4