tomcat6 (6.0.24-2ubuntu1.11) lucid-security; urgency=low
* SECURITY UPDATE: denial of service via large header data
- debian/patches/0012-CVE-2012-2733.patch: improve size logic in
java/org/apache/coyote/http11/InternalNioInputBuffer.java.
- CVE-2012-2733
* SECURITY UPDATE: multiple HTTP Digest Access Authentication flaws
- debian/patches/0013-CVE-2012-588x.patch: disable caching of an
authenticated user in the session by default, track server rather
than client nonces, better handling of stale nonce values in
java/org/apache/catalina/authenticator/DigestAuthenticator.java.
- CVE-2012-3439
- CVE-2012-5885
- CVE-2012-5886
- CVE-2012-5887
Date: 2012-11-21 16:10:16.034099+00:00
Changed-By: Marc Deslauriers <[email protected]>
https://launchpad.net/ubuntu/lucid/+source/tomcat6/6.0.24-2ubuntu1.11
Sorry, changesfile not available.
--
Lucid-changes mailing list
[email protected]
Modify settings or unsubscribe at:
https://lists.ubuntu.com/mailman/listinfo/lucid-changes
