[ubuntu/trusty-security] tomcat7 7.0.52-1ubuntu0.1 (Accepted)

[Marc Deslauriers]

tomcat7 (7.0.52-1ubuntu0.1) trusty-security; urgency=medium

  * SECURITY UPDATE: denial of service via malformed chunk size
    - debian/patches/CVE-2014-0075.patch: fix overflow and added tests to
      java/org/apache/coyote/http11/filters/ChunkedInputFilter.java,
      test/org/apache/coyote/http11/filters/TestChunkedInputFilter.java.
    - CVE-2014-0075
  * SECURITY UPDATE: file disclosure via XXE issue
    - debian/patches/CVE-2014-0096.patch: change globalXsltFile to be a
      relative path in conf/web.xml,
      java/org/apache/catalina/servlets/DefaultServlet.java,
      java/org/apache/catalina/servlets/LocalStrings.properties,
      webapps/docs/default-servlet.xml.
    - CVE-2014-0096
  * SECURITY UPDATE: HTTP request smuggling attack via crafted
    Content-Length HTTP header
    - debian/patches/CVE-2014-0099.patch: correctly handle long values in
      java/org/apache/tomcat/util/buf/Ascii.java, added test to
      test/org/apache/tomcat/util/buf/TestAscii.java.
    - CVE-2014-0099

Date: 2014-07-24 20:33:13.075001+00:00
Changed-By: Marc Deslauriers <marc.deslauriers at canonical.com>
https://launchpad.net/ubuntu/trusty/+source/tomcat7/7.0.52-1ubuntu0.1
-------------- next part --------------
Sorry, changesfile not available.