Security Bulletin: IBM InfoSphere Information Server is affected by multiple vulnerabilities in Apache Jackrabbit Core and Apache Jackrabbit JCR Commons

Summary Multiple vulnerabilities in Apache Jackrabbit Core and Apache Jackrabbit JCR Commons that are used by InfoSphere Information Server were addressed. Vulnerability Details CVEID:CVE-2025-58782 DESCRIPTION: Deserialization of Untrusted Data vulnerability in Apache Jackrabbit Core and Apache...

com.day.cq:cq-compat-codeupgrade (>=1.0.4, <=1.2.10), org.apache.jackrabbit:jackrabbit-jca (>=2.0-beta1, <=2.0.5) +1 more potentially affected by CVE-2015-1833 via org.apache.jackrabbit:jackrabbit-core (>=2.0-beta1, <=2.0.5)

org.apache.jackrabbit:jackrabbit-core MAVEN version =2.0-beta1, =1.0.4, =2.0-beta1, =2.0-beta1, =2.0.5 Source cves: CVE-2015-1833 Source advisory: GHSA-9284-J4C9-779Q...

org.apache.jackrabbit:jackrabbit-jca (1.5.2), org.apache.jackrabbit:jackrabbit-webapp (1.5.2) potentially affected by CVE-2015-1833 via org.apache.jackrabbit:jackrabbit-core (1.5.2)

org.apache.jackrabbit:jackrabbit-core MAVEN version 1.5.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.jackrabbit:jackrabbit-core and may be impacted: - org.apache.jackrabbit:jackrabbit-jca 1.5.2 - org.apache.jackrabbit:jackrabbit-webapp...

org.apache.camel:camel-jcr (>=1.3.0, <=1.4.0), org.apache.jackrabbit:jackrabbit-jca (1.3.3) +4 more potentially affected by CVE-2015-1833 via org.apache.jackrabbit:jackrabbit-core (1.3.3)

org.apache.jackrabbit:jackrabbit-core MAVEN version 1.3.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.jackrabbit:jackrabbit-core and may be impacted: - org.apache.camel:camel-jcr =1.3.0, =5.7.0, =5.7.0, =5.7.0, =5.7.3 Source cves:...

org.apache.jackrabbit:jackrabbit-jca (1.5.7), org.apache.jackrabbit:jackrabbit-webapp (1.5.7) potentially affected by CVE-2015-1833 via org.apache.jackrabbit:jackrabbit-core (1.5.7)

org.apache.jackrabbit:jackrabbit-core MAVEN version 1.5.7 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.jackrabbit:jackrabbit-core and may be impacted: - org.apache.jackrabbit:jackrabbit-jca 1.5.7 - org.apache.jackrabbit:jackrabbit-webapp...

org.apache.jackrabbit:jackrabbit-index-filters (1.2.1), org.apache.jackrabbit:jackrabbit-jca (1.2.1) +1 more potentially affected by CVE-2015-1833 via org.apache.jackrabbit:jackrabbit-core (1.2.1)

org.apache.jackrabbit:jackrabbit-core MAVEN version 1.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.jackrabbit:jackrabbit-core and may be impacted: - org.apache.jackrabbit:jackrabbit-index-filters 1.2.1 -...

org.apache.jackrabbit:jackrabbit-index-filters (1.2.2), org.apache.jackrabbit:jackrabbit-jca (1.2.2) +1 more potentially affected by CVE-2015-1833 via org.apache.jackrabbit:jackrabbit-core (1.2.2)

org.apache.jackrabbit:jackrabbit-core MAVEN version 1.2.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.jackrabbit:jackrabbit-core and may be impacted: - org.apache.jackrabbit:jackrabbit-index-filters 1.2.2 -...

com.composum.sling.core:composum-sling-core-commons (>=1.3.1, <=1.12.4), com.composum.sling.core:composum-sling-core-console (>=1.6.0, <=1.12.4) +15 more potentially affected by CVE-2015-1833 via org.apache.jackrabbit:jackrabbit-core (>=2.6.0, <=2.6.5)

org.apache.jackrabbit:jackrabbit-core MAVEN version =2.6.0, =1.3.1, =1.6.0, =1.4.0, =2.4.30, =2.4.30, =1.4-m4, =1.4-m4, =2.6.0, =2.6.0, =2.6.0, =1.3.0-beta3, =1.0.0-beta1, =1.2.0-cr9, =1.3.0-beta2 and more Source cves: CVE-2015-1833 Source advisory: GHSA-9284-J4C9-779Q...

com.day.crx:crx-auth-ldap (2.3.15), com.day.crx:crx-spellchecker (>=2.3.14, <=2.3.64) +14 more potentially affected by CVE-2015-1833 via org.apache.jackrabbit:jackrabbit-core (>=2.4.0, <=2.4.5)

org.apache.jackrabbit:jackrabbit-core MAVEN version =2.4.0, =2.3.14, =2.3.14, =0.6.0, =2.4.0, =2.4.0, =2.4.0, =5.12.0, =5.11.0, =5.11.0, =5.11.0, =5.12.2 and more Source cves: CVE-2015-1833 Source advisory: GHSA-9284-J4C9-779Q...

biz.netcentric.cq.tools.accesscontroltool:sling-minimum-version-environment (>=4.2.0, <=4.2.4), com.adobe.cq.testing:cq-it-framework (2.0.130) +25 more potentially affected by CVE-2015-1833 via org.apache.jackrabbit:jackrabbit-core (>=2.2.0, <=2.2.13)

org.apache.jackrabbit:jackrabbit-core MAVEN version =2.2.0, =4.2.0, =2.2.0, =1.0.0, =0.2.0, =0.2.0, =2.9.0, =2.2.0, =2.2.0, =2.2.13 - org.apache.james:apache-james 3.0-beta3 and more Source cves: CVE-2015-1833 Source advisory: OSV:GHSA-9284-J4C9-779Q...

org.apache.jackrabbit:jackrabbit-jca (1.6.5), org.apache.jackrabbit:jackrabbit-webapp (1.6.5) potentially affected by CVE-2015-1833 via org.apache.jackrabbit:jackrabbit-core (1.6.5)

org.apache.jackrabbit:jackrabbit-core MAVEN version 1.6.5 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.jackrabbit:jackrabbit-core and may be impacted: - org.apache.jackrabbit:jackrabbit-jca 1.6.5 - org.apache.jackrabbit:jackrabbit-webapp...

org.apache.jackrabbit:jackrabbit-bundle (2.10.0), org.apache.jackrabbit:jackrabbit-jca (2.10.0) +2 more potentially affected by CVE-2015-1833 via org.apache.jackrabbit:jackrabbit-core (2.10.0)

org.apache.jackrabbit:jackrabbit-core MAVEN version 2.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.jackrabbit:jackrabbit-core and may be impacted: - org.apache.jackrabbit:jackrabbit-bundle 2.10.0 - org.apache.jackrabbit:jackrabbit-jc...

org.apache.sling:org.apache.sling.commons.testing (2.0.2-incubator), org.apache.sling:org.apache.sling.jcr.jackrabbit.server (2.0.2-incubator) potentially affected by CVE-2015-1833 via org.apache.jackrabbit:jackrabbit-core (1.4.3)

org.apache.jackrabbit:jackrabbit-core MAVEN version 1.4.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.jackrabbit:jackrabbit-core and may be impacted: - org.apache.sling:org.apache.sling.commons.testing 2.0.2-incubator -...

org.apache.jackrabbit:jackrabbit-jca (1.6.0), org.apache.jackrabbit:jackrabbit-webapp (1.6.0) +2 more potentially affected by CVE-2015-1833 via org.apache.jackrabbit:jackrabbit-core (1.6.0)

org.apache.jackrabbit:jackrabbit-core MAVEN version 1.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.jackrabbit:jackrabbit-core and may be impacted: - org.apache.jackrabbit:jackrabbit-jca 1.6.0 - org.apache.jackrabbit:jackrabbit-webapp...

biz.netcentric.cq.tools.accesscontroltool:sling-minimum-version-environment (>=4.2.0, <=4.2.4), com.adobe.cq.testing:cq-it-framework (2.0.130) +25 more potentially affected by CVE-2015-1833 via org.apache.jackrabbit:jackrabbit-core (>=2.2.0, <=2.2.13)

org.apache.jackrabbit:jackrabbit-core MAVEN version =2.2.0, =4.2.0, =2.2.0, =1.0.0, =0.2.0, =0.2.0, =2.9.0, =2.2.0, =2.2.0, =2.2.13 - org.apache.james:apache-james 3.0-beta3 and more Source cves: CVE-2015-1833 Source advisory: GHSA-9284-J4C9-779Q...

Mageia: Security Advisory (MGASA-2015-0242)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

MGASA-2015-0242 Updated jackrabbit packages fix CVE-2015-1833

Updated jackrabbit packages fix security vulnerability: In Apache Jackrabbit before 2.4.6, When processing a WebDAV request body containing XML, the XML parser can be instructed to read content from network resources accessible to the host, identified by URI schemes such as "https" or "file"...

CVE-2015-1833 &#40;Jackrabbit WebDAV XXE vulnerability&#41;

Dear readers, we just fixed a recently reported vulnerability in Apache Jackrabbit's WebDAV module; see - the attached CVE report - patches for all currently maintained Jackrabbit branches We just released Jackrabbit 2.10.1 see below and we'll get to the other branches shortly. Check the CVE for...

CVE-2015-1833

XML external entity XXE vulnerability in Apache Jackrabbit before 2.0.6, 2.2.x before 2.2.14, 2.4.x before 2.4.6, 2.6.x before 2.6.6, 2.8.x before 2.8.1, and 2.10.x before 2.10.1 allows remote attackers to read arbitrary files and send requests to intranet servers via a crafted WebDAV request...

CVE-2015-1833

XML external entity XXE vulnerability in Apache Jackrabbit before 2.0.6, 2.2.x before 2.2.14, 2.4.x before 2.4.6, 2.6.x before 2.6.6, 2.8.x before 2.8.1, and 2.10.x before 2.10.1 allows remote attackers to read arbitrary files and send requests to intranet servers via a crafted WebDAV request...