CVE-2012-5370

Related Files

Red Hat Security Advisory 2013-0533-01

Posted Feb 21, 2013

Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2013-0533-01 - Security: JBoss Web Services leaked side-channel data when distributing symmetric keys, allowing a remote attacker to recover the entire plain text form of a symmetric key. Spring framework could possibly evaluate Expression Language expressions twice, allowing a remote attacker to execute arbitrary code in the context of the application server, or to obtain sensitive information from the server.

tags | advisory, remote, web, arbitrary

systems | linux, redhat

advisories | CVE-2009-5066, CVE-2011-2487, CVE-2011-2730, CVE-2011-4575, CVE-2012-0034, CVE-2012-0874, CVE-2012-3369, CVE-2012-3370, CVE-2012-5370, CVE-2012-5478

SHA-256 | d0d6dd86868163ea86659cbce4e62fa346ab23fec9600a6fe72c27a787121386

Download | Favorite | View

Red Hat Security Advisory 2012-1604-01

Posted Dec 22, 2012

Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2012-1604-01 - Fuse ESB Enterprise, based on Apache ServiceMix, provides an integration platform. This release of Fuse ESB Enterprise 7.1.0 serves as a replacement for Fuse ESB Enterprise 7.0.2, and includes bug fixes and enhancements.

tags | advisory

systems | linux, redhat

advisories | CVE-2011-4461, CVE-2012-5370

SHA-256 | 355e8a5fdfe3ea070ff988aa4b566b717d66a674b49dbf113cb41eb1e4e2c68c

Download | Favorite | View

MurmurHash Algorithm Collision Denial Of Service

Posted Nov 24, 2012

Authored by Andrea Barisani, Open Source CERT | Site ocert.org

A variety of programming languages suffer from a denial-of-service (DoS) condition against storage functions of key/value pairs in hash data structures, the condition can be leveraged by exploiting predictable collisions in the underlying hashing algorithms. The issue is similar to the one reported in oCERT-2011-003 and concerns the MurmurHash algorithm family. The condition for predictable collisions in the hashing functions has been reported for the following language implementations: JRuby (MurmurHash2), Ruby (MurmurHash2), Rubinius (MurmurHash3), Oracle JDK (MurmurHash), OpenJDK (MurmurHash). In the case of Java OpenJDK the hash function affected by the reported issue is not enabled by default, the default function is however reported vulnerable to oCERT-2011-003.

tags | advisory, java, ruby

advisories | CVE-2012-5370, CVE-2011-5371, CVE-2011-5372, CVE-2011-5373

SHA-256 | 6158aaf285af06ef9ef0b5c3fb1ac4513de61a3ac22d037a2d66fa0654d3a613

Download | Favorite | View