Publishing details
Changelog
tomcat6 (6.0.45+dfsg-1) unstable; urgency=medium
* Team upload.
* Imported Upstream version 6.0.45+dfsg.
- Remove all prebuilt jar files.
* Declare compliance with Debian Policy 3.9.7.
* Vcs-fields: Use https.
* This update fixes the following security vulnerabilities in the source
package. Since src:tomcat6 only builds libservlet2.5-java and
documentation, users are not directly affected.
- CVE-2015-5174: Directory traversal vulnerability in RequestUtil.java.
- CVE-2015-5345: The Mapper component in Apache Tomcat before 6.0.45
processes redirects before considering security constraints and Filters.
- CVE-2016-0706: Apache Tomcat before 6.0.45 does not place
org.apache.catalina.manager.StatusManagerServlet on the
org/apache/catalina/core/RestrictedServlets.properties list which allows
remote authenticated users to bypass intended SecurityManager
restrictions.
- CVE-2016-0714: The session-persistence implementation in Apache Tomcat
before 6.0.45 mishandles session attributes, which allows remote
authenticated users to bypass intended SecurityManager restrictions.
- CVE-2016-0763: The setGlobalContext method in
org/apache/naming/factory/ResourceLinkFactory.java in Apache Tomcat does
not consider whether ResourceLinkFactory.setGlobalContext callers are
authorized, which allows remote authenticated users to bypass intended
SecurityManager restrictions and read or write to arbitrary application
data, or cause a denial of service (application disruption), via a web
application that sets a crafted global context.
- CVE-2015-5351: The Manager and Host Manager applications in
Apache Tomcat establish sessions and send CSRF tokens for arbitrary new
requests, which allows remote attackers to bypass a CSRF protection
mechanism by using a token.
-- Markus Koschany <email address hidden> Sat, 27 Feb 2016 19:32:00 +0100
Builds
Built packages
-
libservlet2.5-java
Servlet 2.5 and JSP 2.1 Java API classes
-
libservlet2.5-java-doc
Servlet 2.5 and JSP 2.1 Java API documentation
Package files