-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Thu, 01 Dec 2016 20:01:25 +0000
Source: tomcat6
Binary: tomcat6-common tomcat6 tomcat6-user libtomcat6-java libservlet2.4-java 
libservlet2.5-java libservlet2.5-java-doc tomcat6-admin tomcat6-examples 
tomcat6-docs tomcat6-extras
Architecture: source all
Version: 6.0.45+dfsg-1~deb7u3
Distribution: wheezy-security
Urgency: high
Maintainer: Debian Java Maintainers 
<pkg-java-maintain...@lists.alioth.debian.org>
Changed-By: Markus Koschany <a...@debian.org>
Description: 
 libservlet2.4-java - Transitional package for libservlet2.5-java
 libservlet2.5-java - Servlet 2.5 and JSP 2.1 Java API classes
 libservlet2.5-java-doc - Servlet 2.5 and JSP 2.1 Java API documentation
 libtomcat6-java - Servlet and JSP engine -- core libraries
 tomcat6    - Servlet and JSP engine
 tomcat6-admin - Servlet and JSP engine -- admin web applications
 tomcat6-common - Servlet and JSP engine -- common files
 tomcat6-docs - Servlet and JSP engine -- documentation
 tomcat6-examples - Servlet and JSP engine -- example web applications
 tomcat6-extras - Servlet and JSP engine -- additional components
 tomcat6-user - Servlet and JSP engine -- tools to create user instances
Changes: 
 tomcat6 (6.0.45+dfsg-1~deb7u3) wheezy-security; urgency=high
 .
   * Fixed CVE-2016-0762: The Realm implementations did not process the supplied
     password if the supplied user name did not exist. This made a timing attack
     possible to determine valid user names.
   * Fixed CVE-2016-5018: A malicious web application was able to bypass
     a configured SecurityManager via a Tomcat utility method that was
     accessible to web applications.
   * Fixed CVE-2016-6794: When a SecurityManager is configured, a web
     application's ability to read system properties should be controlled by
     the SecurityManager. Tomcat's system property replacement feature for
     configuration files could be used by a malicious web application to bypass
     the SecurityManager and read system properties that should not be visible.
   * Fixed CVE-2016-6796: A malicious web application was able to bypass
     a configured SecurityManager via manipulation of the configuration
     parameters for the JSP Servlet.
   * Fixed CVE-2016-6797: The ResourceLinkFactory did not limit web application
     access to global JNDI resources to those resources explicitly linked to the
     web application. Therefore, it was possible for a web application to access
     any global JNDI resource whether an explicit ResourceLink had been
     configured or not.
   * Fixed CVE-2016-6816: The code that parsed the HTTP request line permitted
     invalid characters. This could be exploited, in conjunction with a proxy
     that also permitted the invalid characters but with a different
     interpretation, to inject data into the HTTP response. By manipulating the
     HTTP response the attacker could poison a web-cache, perform an XSS attack
     and/or obtain sensitive information from requests other then their own.
   * Fixed CVE-2016-8735: The JmxRemoteLifecycleListener was not updated to take
     account of Oracle's fix for CVE-2016-3427. Therefore, Tomcat installations
     using this listener remained vulnerable to a similar remote code execution
     vulnerability.
   * CVE-2016-1240 follow-up:
     - The previous init.d fix was vulnerable to a race condition that could
       be exploited to make any existing file writable by the tomcat user.
       Thanks to Paul Szabo for the report and the fix.
     - The catalina.policy file generated on startup was affected by a similar
       vulnerability that could be exploited to overwrite any file on the 
system.
       Thanks to Paul Szabo for the report.
   * Hardened the init.d script, thanks to Paul Szabo
   * Fix possible privilege escalation via package purge by removing the chown
     command in postrm maintainer script. See #845385 for more information.
Checksums-Sha1: 
 b3fe056968e7ceb67264f5d1ceefc19246030d83 2905 tomcat6_6.0.45+dfsg-1~deb7u3.dsc
 70dc7c53dbed3b50678f545698b0ad80975c48e7 61037 
tomcat6_6.0.45+dfsg-1~deb7u3.debian.tar.gz
 a3bd5baed94319c6a6fdcbf9d44e81ead3da3d36 58480 
tomcat6-common_6.0.45+dfsg-1~deb7u3_all.deb
 e99cd9a752ebc8f6bafd979b381ad714270f5473 52114 
tomcat6_6.0.45+dfsg-1~deb7u3_all.deb
 31c97d44f2f4bbec74ab25816e17c69117390d8a 41810 
tomcat6-user_6.0.45+dfsg-1~deb7u3_all.deb
 3501815b97019e970e837b78f41374c1fbb10192 3167254 
libtomcat6-java_6.0.45+dfsg-1~deb7u3_all.deb
 b2bb8e4006cf441d16619d19a9d63cacb0edc2bf 15698 
libservlet2.4-java_6.0.45+dfsg-1~deb7u3_all.deb
 2890606a9cc9c1d477f0c7043da19caeac17e1d6 242038 
libservlet2.5-java_6.0.45+dfsg-1~deb7u3_all.deb
 17bcf0eaa6bed7f8e2eb759e1a159a7ec2975354 274038 
libservlet2.5-java-doc_6.0.45+dfsg-1~deb7u3_all.deb
 aa55de8ffed190335633275221723828cbf5cc7f 51256 
tomcat6-admin_6.0.45+dfsg-1~deb7u3_all.deb
 007957bfca3759add1223d983cce66ab34651352 166250 
tomcat6-examples_6.0.45+dfsg-1~deb7u3_all.deb
 8d7b50ac8dbef798838fd8cddb4126bdd59548db 605090 
tomcat6-docs_6.0.45+dfsg-1~deb7u3_all.deb
 84f2c6e5ae89985556d358287c6d804ff5155b29 15912 
tomcat6-extras_6.0.45+dfsg-1~deb7u3_all.deb
Checksums-Sha256: 
 8e1c560ea0373e82b381a6e205b4277ec5f557c052c800505fd4c3c4680c7c00 2905 
tomcat6_6.0.45+dfsg-1~deb7u3.dsc
 0a4db99599d226f84a99e39505ad378c3ae314a8a5b3d6aa08fa320735fac91e 61037 
tomcat6_6.0.45+dfsg-1~deb7u3.debian.tar.gz
 6630bbb355fbea8dd111e3c0d87e2d1d708621bdc7c1ad35a03277431c3cbdd1 58480 
tomcat6-common_6.0.45+dfsg-1~deb7u3_all.deb
 de48ed66b419a074080da01bbda78175efa97fb5cf194e503ea25b54120b6bb2 52114 
tomcat6_6.0.45+dfsg-1~deb7u3_all.deb
 673c6c6a1bf47aeb1282885c05bbb767c3473d2c941402a63ae0c965c6c9a9fe 41810 
tomcat6-user_6.0.45+dfsg-1~deb7u3_all.deb
 8271c31cbc89a3b5875b8adc74a8a40008ed84dd46b7b18f6a0665667242177d 3167254 
libtomcat6-java_6.0.45+dfsg-1~deb7u3_all.deb
 3702588efbb6a429eb3eb01103ddce8ea61e62eddb2e36e2e5601c93bde6870f 15698 
libservlet2.4-java_6.0.45+dfsg-1~deb7u3_all.deb
 aaa2c2d8d5b785666f12bc7295d0500df58901dc8e961827240a16c602ab8ddb 242038 
libservlet2.5-java_6.0.45+dfsg-1~deb7u3_all.deb
 0e151eea9ecbaef336a47d4b29e61af33f6af430672606c2df5478b6b1a6b7ff 274038 
libservlet2.5-java-doc_6.0.45+dfsg-1~deb7u3_all.deb
 26f29db4087536ae5bd031037109e0970308a0065361eab12ffb9eafcc87f3cb 51256 
tomcat6-admin_6.0.45+dfsg-1~deb7u3_all.deb
 8eb44da1eb154bcbeb305955f61dbd02c468997d5f995979df6fe88ad0396a47 166250 
tomcat6-examples_6.0.45+dfsg-1~deb7u3_all.deb
 ecde2b8713f4350b3fdc650ab151ce08c03f22472c32c4394e4fe2667897dfee 605090 
tomcat6-docs_6.0.45+dfsg-1~deb7u3_all.deb
 33c11c0a37a375461e568001e1b2d3608e2353c974ca30c2ffce0197a51ed0e0 15912 
tomcat6-extras_6.0.45+dfsg-1~deb7u3_all.deb
Files: 
 3fe1e9477ed4f6499774cd0baeeed45a 2905 java optional 
tomcat6_6.0.45+dfsg-1~deb7u3.dsc
 3845b41f1ecaca43e21236bc3ca36d35 61037 java optional 
tomcat6_6.0.45+dfsg-1~deb7u3.debian.tar.gz
 d1dd1593f4b86c004b152e3f3e8460ee 58480 java optional 
tomcat6-common_6.0.45+dfsg-1~deb7u3_all.deb
 46776adb24228fa9927fb69db231e5f3 52114 java optional 
tomcat6_6.0.45+dfsg-1~deb7u3_all.deb
 f7326853376962e8f88495122ff51688 41810 java optional 
tomcat6-user_6.0.45+dfsg-1~deb7u3_all.deb
 57be7f58343e2e3e45fabb0dba421920 3167254 java optional 
libtomcat6-java_6.0.45+dfsg-1~deb7u3_all.deb
 f680bdadea3c65f2c11fbe5e94f348f9 15698 oldlibs extra 
libservlet2.4-java_6.0.45+dfsg-1~deb7u3_all.deb
 a26d9d42ef98495a1b71bb148faa762c 242038 java optional 
libservlet2.5-java_6.0.45+dfsg-1~deb7u3_all.deb
 90672bc3a8b42c0643cd0d7622a8e4ab 274038 doc optional 
libservlet2.5-java-doc_6.0.45+dfsg-1~deb7u3_all.deb
 5f8c0c0145fee2ec6e6fe6d4ed450ef6 51256 java optional 
tomcat6-admin_6.0.45+dfsg-1~deb7u3_all.deb
 4b304ffb1f72777eb95edde43329e5e1 166250 java optional 
tomcat6-examples_6.0.45+dfsg-1~deb7u3_all.deb
 40af23215dcf3aaa83d7d614f2ffa580 605090 doc optional 
tomcat6-docs_6.0.45+dfsg-1~deb7u3_all.deb
 23d7e8bafad77805ba50037b70f853b6 15912 java optional 
tomcat6-extras_6.0.45+dfsg-1~deb7u3_all.deb

-----BEGIN PGP SIGNATURE-----

iQKjBAEBCgCNFiEErPPQiO8y7e9qGoNf2a0UuVE7UeQFAlhAiRNfFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldEFD
RjNEMDg4RUYzMkVERUY2QTFBODM1RkQ5QUQxNEI5NTEzQjUxRTQPHGFwb0BkZWJp
YW4ub3JnAAoJENmtFLlRO1Hk1QAQAL6UOraPf7/89YzggopWIS6gfgvPjRH6eASN
0+c111I371p4iLqGLaD2AeEHr0rlmA4C/hZvo5yVV+AJ3lPA8sPsdNOHvOWpki8W
VtCrzqLMp8WZYJ50Z0+1e+eWnEtSP2BP0TJ9LWTwJtI1/xrbEAHdQWRLYjP69nQr
Vj3b4ocg4epReALc+NRr1leXPH92Mh9K2ppYxRG0WYXMqj7TTQB89MIqe2ynA7j1
qXgFTiLmgwjix4frhfz3tSCMi8Chi+4Rs5HWN2iteBoh3TXNANIwqdLv9A7xYfED
5S9w7EM4bpskeCXTUgyo30jPyMYwctuAISnPj3DPWeQJXUHnm5KpY2lcVamZgjb0
F8XmJcfA8vHN/yAyDPjeDnVt9tpZF84+rGtPphBFLt2sE0QoVLfe1hCKw2re2It0
7LKmhBGvmpaFYO56Q+I3mtwmv4h/iISZERaEu4qNNOsTGob31vCswF8x0Ko41fBa
6s++OWoeffa/88HXoXhi2qy9qjVMvzuutqXesMV0gxFl2HTkPuVFWmsvJ0wYuKB1
/OvePP4poRbJ3BvtdgGamCU0vxE62wNeboSn8WJKKs5hWJ0+P5RRPaxGqcWsXjz8
ECoIm3fposrZPBAIvEfJAcVCnNTidOShY/VltM9rloqPRkL3DQyY1H8qzUC98FpA
LfDaYxG4
=mAUo
-----END PGP SIGNATURE-----

Reply via email to