Red Hat Security Advisory: Red Hat JBoss Core Services Apache HTTP 2.4.23 Release
expat: hash table collisions CPU usage DoS expat: Memory leak in poolGrow httpd: WinNT MPM denial of service OpenSSL: Invalid free in DTLS openssl: use-after-free on invalid EC private key import openssl: invalid pointer use in ASN1_TYPE_cmp() httpd: ap_some_auth_required() does not properly indicate authenticated request in 2.4 OpenSSL: Certificate verify crash with missing PSS parameter OpenSSL: X509_ATTRIBUTE memory leak OpenSSL: Race condition handling PSK identify hint openssl: Crash in ssleay_rand_bytes due to locking regression OpenSSL: Side channel attack on modular exponentiation OpenSSL: Double-free in DSA code OpenSSL: BN_hex2bn/BN_dec2bn NULL pointer deref/heap corruption OpenSSL: Fix memory issues in BIO_*printf functions libxml2: Heap-based buffer-overread in xmlNextChar libxml2: Heap-based buffer overread in htmlCurrentChar libxml2: Heap-buffer-overflow in xmlStrncat libxml2: Heap use-after-free in xmlSAX2AttributeNs libxml2: Heap use-after-free in xmlDictComputeFastKey libxml2: Heap use-after-free in htmlPArsePubidLiteral and htmlParseSystemiteral libxml2: Heap-based buffer overread in xmlPArserPrintFileContextInternal libxml2: Heap-based buffer overread in xmlDictAddString libxml2: Heap-buffer-overflow in xmlFAParserPosCharGroup openssl: EVP_EncodeUpdate overflow openssl: EVP_EncryptUpdate overflow openssl: Padding oracle in AES-NI CBC MAC check openssl: Memory corruption in the ASN.1 encoder openssl: ASN.1 BIO handling of large amounts of data openssl: Possible integer overflow vulnerabilities in codebase openssl: Non-constant time codepath followed for certain operations in DSA implementation openssl: doapr_outch function does not verify that certain memory allocation succeeds libxml2: stack exhaustion while parsing xml files in recovery mode libxml2: stack overflow before detecting invalid XML file libxml2: Heap-based buffer underreads due to xmlParseName libxml2: Format string vulnerability libxml2: Inappropriate fetch of entities content mod_cluster: Buffer overflow in mod_manager when sending request with long JVMRoute libxml2: out-of-bounds read curl: TLS session resumption client cert bypass curl: Re-using connection with wrong client cert mod_jk: Buffer overflow when concatenating virtual host name and URI curl: Incorrect reuse of client certificates mod_cluster: Protocol parsing logic error
cpe:/a:redhat:jboss_core_services:1