[ubuntu/precise-updates] tomcat6 6.0.35-1ubuntu3.5 (Accepted)
Ubuntu Archive Robot
cjwatson+ubuntu-archive-robot at chiark.greenend.org.uk
Wed Jul 30 17:58:18 UTC 2014
tomcat6 (6.0.35-1ubuntu3.5) precise-security; urgency=medium
* SECURITY UPDATE: denial of service via malformed chunk size
- debian/patches/CVE-2014-0075.patch: fix overflow in
java/org/apache/coyote/http11/filters/ChunkedInputFilter.java.
- CVE-2014-0075
* SECURITY UPDATE: file disclosure via XXE issue
- debian/patches/CVE-2014-0096.patch: change globalXsltFile to be a
relative path in conf/web.xml,
java/org/apache/catalina/servlets/DefaultServlet.java,
java/org/apache/catalina/servlets/LocalStrings.properties,
webapps/docs/default-servlet.xml.
- CVE-2014-0096
* SECURITY UPDATE: HTTP request smuggling attack via crafted
Content-Length HTTP header
- debian/patches/CVE-2014-0099.patch: correctly handle long values in
java/org/apache/tomcat/util/buf/Ascii.java.
- CVE-2014-0099
Date: 2014-07-24 20:00:34.801017+00:00
Changed-By: Marc Deslauriers <marc.deslauriers at canonical.com>
Signed-By: Ubuntu Archive Robot <cjwatson+ubuntu-archive-robot at chiark.greenend.org.uk>
https://launchpad.net/ubuntu/precise/+source/tomcat6/6.0.35-1ubuntu3.5
-------------- next part --------------
Sorry, changesfile not available.
More information about the Precise-changes
mailing list