Red Hat Security Advisory 2017-1833-01 - Chromium is an open-source web browser, powered by WebKit. This update upgrades Chromium to version 60.0.3112.78. Security Fix: Multiple flaws were found in the processing of malformed web content. A web page containing malicious content could cause Chromium to crash, execute arbitrary code, or disclose sensitive information when visited by the victim.
1353fd8d2deddb910e8700dee9e46a94525d8a937157e32db4ea34204c38bf58
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
=====================================================================
Red Hat Security Advisory
Synopsis: Important: Red Hat JBoss Enterprise Application Platform 7.0.7
Advisory ID: RHSA-2017:1836-01
Product: Red Hat JBoss Enterprise Application Platform
Advisory URL: https://access.redhat.com/errata/RHSA-2017:1836
Issue date: 2017-07-31
CVE Names: CVE-2016-4978 CVE-2017-7525
=====================================================================
1. Summary:
An update is now available for Red Hat JBoss Enterprise Application
Platform.
Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.
2. Description:
Red Hat JBoss Enterprise Application Platform is a platform for Java
applications based on the JBoss Application Server.
This release of Red Hat JBoss Enterprise Application Platform 7.0.7 serves
as a replacement for Red Hat JBoss Enterprise Application Platform 7.0.6,
and includes bug fixes and enhancements, which are documented in the
Release Notes document linked to in the References.
Security Fix(es):
* A deserialization flaw was discovered in jackson-databind which could
allow an unauthenticated user to perform code execution by sending
maliciously crafted input to the readValue method of the ObjectMapper.
(CVE-2017-7525)
* It was found that use of a JMS ObjectMessage does not safely handle
user-supplied data when deserializing objects. A remote attacker could use
this flaw to execute arbitrary code with the permissions of the application
using the JMS ObjectMessage. (CVE-2016-4978)
Red Hat would like to thank Liao Xinxi (NSFOCUS) for reporting
CVE-2017-7525.
3. Solution:
Before applying this update, back up your existing Red Hat JBoss Enterprise
Application Platform installation and deployed applications.
The References section of this erratum contains a download link (you must
log in to download the update).
4. Bugs fixed (https://bugzilla.redhat.com/):
1379207 - CVE-2016-4978 Apache ActiveMQ Artemis: Deserialization of untrusted input vulnerability
1462702 - CVE-2017-7525 jackson-databind: Deserialization vulnerability via readValue method of ObjectMapper
5. References:
https://access.redhat.com/security/cve/CVE-2016-4978
https://access.redhat.com/security/cve/CVE-2017-7525
https://access.redhat.com/security/updates/classification/#important
https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=appplatform&downloadType=securityPatches&version=7.0
https://access.redhat.com/documentation/en/red-hat-jboss-enterprise-application-platform/version-7.0/
https://access.redhat.com/documentation/en/jboss-enterprise-application-platform/
6. Contact:
The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/
Copyright 2017 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iD8DBQFZf0Q5XlSAg2UNWIIRAtUtAKCWq1DaaLDVfu+tlaIMQTKfUw6SDACfabQp
MpnEvHHPoWII54nU7gLH5YI=
=iy7P
-----END PGP SIGNATURE-----
--
RHSA-announce mailing list
RHSA-announce@redhat.com
https://www.redhat.com/mailman/listinfo/rhsa-announce