Apache Software Foundation Releases Security Updates

The Apache Foundation has released security updates to address vulnerabilities in Apache Tomcat. Exploitation of one of these vulnerabilities may cause a remote attacker to obtain sensitive information. Users and administrators are encouraged to review Apache.org CVE-2017-5648, CVE-2017-5650, and...

VMware Patches Pesky XXE Bug in Flex BlazeDS

VMware has patched an information disclosure vulnerability affecting a number of its products that use Flex BlazeDS. The original vulnerability was discovered and disclosed in August by Matthias Kaiser of Code White GmbH. Researchers there found a XML External Entity flaw in Apache Flex BlazeDS...

apache22 -- chunk header parsing defect

Apache Foundation reports: CVE-2015-3183 core: Fix chunk header parsing defect. Remove aprbrigadeflatten, buffering and duplicated code from the HTTPIN filter, parse chunks in a single pass with zero copy. Limit accepted chunk-size to 2^63-1 and be strict about chunk-ext authorized characters...

Apache Foundation Hit by Targeted XSS Attack

Combining a cross-site scripting XSS vulnerability with a TinyURL redirect, hackers successfully broke into the infrastructure for the open-source Apache Foundation in what is being described as a “direct, targeted attack.” The hackers hit the server hosting the software that Apache.org uses to i...

CVE-2004-2650

The CVE-2004-2650 entry concerns the Apache James spooler. Affected component: James 2.2.0 spooler retrieve function. Root cause: triggering various error conditions in the retrieve function can prevent a lock release, causing a memory leak and resulting in local-denial-of-service impact. The ava...

CVE-2004-2650

Spooler in Apache Foundation James 2.2.0 allows local users to cause a denial of service memory consumption by triggering various error conditions in the retrieve function, which prevents a lock from being released and causes a memory leak...