[ubuntu/precise-updates] tomcat6 6.0.35-1ubuntu3.7 (Accepted)
Ubuntu Archive Robot
cjwatson+ubuntu-archive-robot at chiark.greenend.org.uk
Tue Jul 5 17:58:32 UTC 2016
tomcat6 (6.0.35-1ubuntu3.7) precise-security; urgency=medium
* SECURITY UPDATE: directory traversal vulnerability in RequestUtil.java
- debian/patches/CVE-2015-5174.patch: fix normalization edge cases in
java/org/apache/tomcat/util/http/RequestUtil.java.
- CVE-2015-5174
* SECURITY UPDATE: information disclosure via redirects by mapper
- debian/patches/CVE-2015-5345.patch: fix redirect logic in
java/org/apache/catalina/Context.java,
java/org/apache/catalina/authenticator/FormAuthenticator.java,
java/org/apache/catalina/connector/MapperListener.java,
java/org/apache/catalina/core/StandardContext.java,
java/org/apache/catalina/core/mbeans-descriptors.xml,
java/org/apache/catalina/servlets/DefaultServlet.java,
java/org/apache/catalina/servlets/WebdavServlet.java,
java/org/apache/tomcat/util/http/mapper/Mapper.java,
webapps/docs/config/context.xml.
- CVE-2015-5345
* SECURITY UPDATE: securityManager restrictions bypass via
StatusManagerServlet
- debian/patches/CVE-2016-0706.patch: place servlet in restricted list
in java/org/apache/catalina/core/RestrictedServlets.properties.
- CVE-2016-0706
* SECURITY UPDATE: securityManager restrictions bypass via
session-persistence implementation
- debian/patches/CVE-2016-0714.patch: extend the session attribute
filtering options in
java/org/apache/catalina/ha/session/mbeans-descriptors.xml,
java/org/apache/catalina/session/LocalStrings.properties,
java/org/apache/catalina/session/ManagerBase.java,
java/org/apache/catalina/session/mbeans-descriptors.xml,
webapps/docs/config/cluster-manager.xml,
webapps/docs/config/manager.xml,
java/org/apache/catalina/session/StandardManager.java,
java/org/apache/catalina/util/CustomObjectInputStream.java.
- CVE-2016-0714
* SECURITY UPDATE: securityManager restrictions bypass via crafted global
context
- debian/patches/CVE-2016-0763.patch: protect initialization in
java/org/apache/naming/factory/ResourceLinkFactory.java.
- CVE-2016-0763
* SECURITY UPDATE: denial of service in FileUpload
- debian/patches/CVE-2016-3092.patch: properly handle size in
java/org/apache/tomcat/util/http/fileupload/MultipartStream.java.
- CVE-2016-3092
Date: 2016-06-30 13:43:17.985595+00:00
Changed-By: Marc Deslauriers <marc.deslauriers at canonical.com>
Signed-By: Ubuntu Archive Robot <cjwatson+ubuntu-archive-robot at chiark.greenend.org.uk>
https://launchpad.net/ubuntu/+source/tomcat6/6.0.35-1ubuntu3.7
-------------- next part --------------
Sorry, changesfile not available.
More information about the Precise-changes
mailing list