[ https://issues.jboss.org/browse/TOOLSDOC-694?page=com.atlassian.jira.plug... ] Martin Malina commented on TOOLSDOC-694: ---------------------------------------- Hi [~supriya.bharadwaj], I discussed this with Len and we agreed that the doc could bring more confusion than clarity. It is called "Update Red Hat JBoss Developer Studio 9.0.0 Containing Patched JBoss Enterprise Application Platform 6.4" which is misleading - there is no update. There is a new installer. And this title sounds as if you could update the new installer (to what?). But anyway, we don't need instructions how to install it. We just need information about the patched EAP. And I think this is exactly what is already there on the CSP page: https://access.redhat.com/jbossnetwork/restricted/softwareDetail.html?sof... "This Red Hat JBoss Developer Studio 9.0.0 Installer includes everything you need to install JBoss Developer Studio, as well as a copy of Red Hat JBoss Enterprise Application Platform 6.4.0. This patched version of Red Hat JBoss Enterprise Application Platform 6.4.0 includes this fix: BZ-1281963 - CVE-2015-7501 Apache commons-collections: InvokerTransformer code execution during deserialisation" So the solution is to include this note somehow on the other pages where you can get this installer: http://tools.jboss.org/downloads/devstudio/mars/9.0.0.GA.html http://www.jboss.org/products/devstudio/download/ -- This message was sent by Atlassian JIRA (v6.4.11#64026)