Bugtraq: [SECURITY] [DSA 3843-1] tomcat8 security update

—–BEGIN PGP SIGNED MESSAGE—–

Hash: SHA512

– ————————————————————————

Debian Security Advisory DSA-3843-1 security (at) debian (dot) org [email concealed]

https://www.debian.org/security/ Sebastien Delafond

May 03, 2017 https://www.debian.org/security/faq

– ————————————————————————

Package : tomcat8

CVE ID : CVE-2017-5647 CVE-2017-5648

Debian Bug : 860068 860069

Two vulnerabilities were discovered in tomcat8, a servlet and JSP

engine.

CVE-2017-5647

Pipelined requests were processed incorrectly, which could result in

some responses appearing to be sent for the wrong request.

CVE-2017-5648

Some application listeners calls were issued against the wrong

objects, allowing untrusted applications running under a

SecurityManager to bypass that protection mechanism and access or

modify information associated with other web applications.

For the stable distribution (jessie), these problems have been fixed in

version 8.0.14-1+deb8u9.

For the upcoming stable (stretch) and unstable (sid) distributions,

these problems have been fixed in version 8.5.11-2.

We recommend that you upgrade your tomcat8 packages.

Further information about Debian Security Advisories, how to apply

these updates to your system and frequently asked questions can be

found at: https://www.debian.org/security/

Mailing list: debian-security-announce (at) lists.debian (dot) org [email concealed]

—–BEGIN PGP SIGNATURE—–

iQEzBAEBCgAdFiEEAqSkbVtrXP4xJMh3EL6Jg/PVnWQFAlkJchYACgkQEL6Jg/PV

nWT3Owf9HbKVZ3njtW4sa/RxYE07N6Apof+2sHisXJ57Rlz9BnOEXHMpu+9Q/w/R

2ehJE2ZjDHED3MESLq0tnQ2lSLq4KlmNuonlylRvDsxh2h1I7l7th3WU8iiLmmF2

IXwUXAmXKncSCdrgrCi5M02+7KjT6vtBqTCTJLFQBKai0UStknp5fW/gh1Fn+XFz

6/6QbCUVsUeJpiwjtGewQqlOPkXcJZb8POd88ow6xt01fA83ElXVpNXWRX7EL+LQ

BHXYNV4MHAtyMC6199bejfbHZtJ1OEaSZOdWyKGLe76aOMx7LO5JO9ZqOY4ZjVKN

9oAdNFCoBo5sW4sGoAWnpebkLpbiGA==

=q/eg

—–END PGP SIGNATURE—–

[ reply ]

Source: SecurityFocus Vulnerabilities @ May 3, 2017 at 04:19AM

0
Share