(RHSA-2015:2557) Important: Red Hat JBoss A-MQ 6.2.1 update

Red Hat JBoss A-MQ, based on Apache ActiveMQ, is a standards-compliant
messaging system that is tailored for use in mission critical applications.

Red Hat JBoss A-MQ 6.2.1 is a micro product release that updates Red Hat
JBoss A-MQ 6.2.0, and includes several bug fixes and enhancements. Refer to
the Release Notes document, available from the link in the References
section, for a list of changes.

The following security fixes are addressed in this release:

It was found that the Apache commons-collections library permitted code
execution when deserializing objects involving a specially constructed
chain of classes. A remote attacker could use this flaw to execute
arbitrary code with the permissions of the application using the
commons-collections library. (CVE-2015-7501)

Further information about this issue may be found at:
https://access.redhat.com/solutions/2045023

A flaw was discovered that when an application uses Groovy (has it on the
classpath) and uses the standard Java serialization mechanism, an attacker
can bake a special serialized object that executes code directly when
deserialized. All applications which rely on serialization and do not
isolate the code which deserializes objects are subject to this
vulnerability. (CVE-2015-3253)

It was found that the JBoss A-MQ console would accept a string containing
JavaScript as the name of a new message queue. Execution of the UI would
subsequently execute the script. An attacker could use this flaw to access
sensitive information or perform other attacks. (CVE-2015-5181)

Red Hat would like to thank Naftali Rosenbaum of Comsec Consulting for
reporting CVE-2015-5181.

All users of Red Hat JBoss A-MQ 6.2.0 as provided from the Red Hat Customer
Portal are advised to apply this update.