[ubuntu/precise-security] tomcat6 6.0.35-1ubuntu3.4 (Accepted)

Marc Deslauriers marc.deslauriers at canonical.com
Thu Mar 6 13:13:34 UTC 2014


tomcat6 (6.0.35-1ubuntu3.4) precise-security; urgency=medium

  * SECURITY UPDATE: request smuggling attack via content-length headers
    - debian/patches/CVE-2013-4286.patch: handle multiple content lengths
      in java/org/apache/coyote/ajp/AbstractAjpProcessor.java, 
      java/org/apache/coyote/ajp/AjpProcessor.java, handle content length
      and chunked encoding being both specified in
      java/org/apache/coyote/http11/Http11AprProcessor.java,
      java/org/apache/coyote/http11/Http11NioProcessor.java,
      java/org/apache/coyote/http11/Http11Processor.java.
    - CVE-2013-4286
  * SECURITY UPDATE: denial of service via chunked transfer coding
    - debian/patches/CVE-2013-4322.patch: limit length of extension data in
      java/org/apache/coyote/Constants.java,
      java/org/apache/coyote/http11/filters/ChunkedInputFilter.java,
      webapps/docs/config/systemprops.xml.
    - CVE-2013-4322
  * SECURITY UPDATE: session fixation attack via crafted URL
    - debian/patches/CVE-2014-0033.patch: properly handle
      disableURLRewriting in
      java/org/apache/catalina/connector/CoyoteAdapter.java.
    - CVE-2014-0033

Date: 2014-03-04 16:47:13.562798+00:00
Changed-By: Marc Deslauriers <marc.deslauriers at canonical.com>
https://launchpad.net/ubuntu/precise/+source/tomcat6/6.0.35-1ubuntu3.4
-------------- next part --------------
Sorry, changesfile not available.


More information about the Precise-changes mailing list