Mapping oldstable-security to oldstable-proposed-updates.
Accepted:
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Format: 1.8
Date: Mon, 11 Jan 2016 12:38:23 +0100
Source: tomcat7
Binary: tomcat7-common tomcat7 tomcat7-user libtomcat7-java libservlet3.0-java
libservlet3.0-java-doc tomcat7-admin tomcat7-examples tomcat7-docs
Architecture: source all
Version: 7.0.28-4+deb7u3
Distribution: wheezy-security
Urgency: high
Maintainer: Debian Java Maintainers
<pkg-java-maintainers@lists.alioth.debian.org>
Changed-By: Emmanuel Bourg <ebo...@apache.org>
Description:
libservlet3.0-java - Servlet 3.0 and JSP 2.2 Java API classes
libservlet3.0-java-doc - Servlet 3.0 and JSP 2.2 Java API documentation
libtomcat7-java - Servlet and JSP engine -- core libraries
tomcat7 - Servlet and JSP engine
tomcat7-admin - Servlet and JSP engine -- admin web applications
tomcat7-common - Servlet and JSP engine -- common files
tomcat7-docs - Servlet and JSP engine -- documentation
tomcat7-examples - Servlet and JSP engine -- example web applications
tomcat7-user - Servlet and JSP engine -- tools to create user instances
Changes:
tomcat7 (7.0.28-4+deb7u3) wheezy-security; urgency=high
.
* Team upload.
* Fixed CVE-2014-7810: Malicious web applications could use expression
language to bypass the protections of a Security Manager as expressions
were evaluated within a privileged code section.
* Fixed CVE-2014-0099: Check for overflow when parsing the request content
length header. This exposed a request smuggling vulnerability when Tomcat
was located behind a reverse proxy that correctly processed the content
length header.
* Fixed CVE-2013-4444: Remove serialization support from FileItem to prevent
a remote code execution vulnerablity in very limited circumstances.
* Fixed CVE-2014-0075: Malformed chunk size as part of a chuncked request
could enable the streaming of an unlimited amount of data to the server,
bypassing the various size limits enforced on a request. This enabled
a denial of service attack.
* Fixed CVE-2014-0227: Add an error flag in ChunkedInputFilter to allow
subsequent attempts at reading after an error to fail fast. This prevents
remote attackers from conducting HTTP request smuggling attacks or causing
a denial of service by streaming data with malformed chunked requests.
* Fixed CVE-2014-0230: Add a new limit for the amount of data Tomcat will
swallow for an aborted upload. This prevents remote attackers from causing
a denial of service (thread consumption) via a series of aborted upload
attempts.
Checksums-Sha1:
ff165fdc4c9f1d2180a6a7c3a3b1bdf0e6f8fa08 2645 tomcat7_7.0.28-4+deb7u3.dsc
cb25b647f297663c30bf20b5e49cf46f45bc2831 105422
tomcat7_7.0.28-4+deb7u3.debian.tar.gz
08d06711d9067789a0948b1f99d45334588211c8 61260
tomcat7-common_7.0.28-4+deb7u3_all.deb
455549997df0a281fc8b7f1ba3717db90f34ee50 50408 tomcat7_7.0.28-4+deb7u3_all.deb
113a59a4686c860a9be5307290d2c159af135bb5 38986
tomcat7-user_7.0.28-4+deb7u3_all.deb
cee0a2c45781f7c50a24eca765bab470f9b8a011 3501052
libtomcat7-java_7.0.28-4+deb7u3_all.deb
d51b41a2c28889f90422496a9c0b85ec07f96aba 305092
libservlet3.0-java_7.0.28-4+deb7u3_all.deb
c432fe5990dfcb11eae863c99c936e40a971ff59 302038
libservlet3.0-java-doc_7.0.28-4+deb7u3_all.deb
04afeecb76f58f8925ccf3f267761c3eb6fba55f 51378
tomcat7-admin_7.0.28-4+deb7u3_all.deb
5defbe79deebf8cf4346203996f1795411934079 201624
tomcat7-examples_7.0.28-4+deb7u3_all.deb
5538be8c8d0149e7af082a719595390d8b4461a1 647416
tomcat7-docs_7.0.28-4+deb7u3_all.deb
Checksums-Sha256:
c0a33f44259c0bb6da6a730050ba90c43c36b4f33f66cc46b041de40978e956f 2645
tomcat7_7.0.28-4+deb7u3.dsc
483d6dbd5b29e6c5ff44d93104042adf57f3c3e9657be030f3ca18563bfbb738 105422
tomcat7_7.0.28-4+deb7u3.debian.tar.gz
dfdcfbd3e7d1c2eb910d90d97775f7110f1af2a023918867e3488fd27f72f9db 61260
tomcat7-common_7.0.28-4+deb7u3_all.deb
477783c136b4b0a7fe3a6338fa956873c53ce70b04a802b0c0f8ffffe692faaf 50408
tomcat7_7.0.28-4+deb7u3_all.deb
c0a620eeb5806a55c3c3fc378ca2c5bb12f3b50c4e44df86ba6a541e4e5381e3 38986
tomcat7-user_7.0.28-4+deb7u3_all.deb
97ef8316c1936731adc403029d1f1098007f611f4dddc1c4159390956bdce70c 3501052
libtomcat7-java_7.0.28-4+deb7u3_all.deb
f98aedbf0f296ebe0cc3a25ba1e8eca3bcbc59276f4052c90fefe3f8696cfca3 305092
libservlet3.0-java_7.0.28-4+deb7u3_all.deb
57d6f79dab613865f2f38859eda910e992cdebb8fd607477a33aae2792dbf40c 302038
libservlet3.0-java-doc_7.0.28-4+deb7u3_all.deb
9c43cc7a66cb249db4d6027aed766e3babadf8b50ac211d6da8deeaa7554858a 51378
tomcat7-admin_7.0.28-4+deb7u3_all.deb
a63c0cd87c96225e09aaab976dd72db6c138975c50c3cd6820132c1fbe96e671 201624
tomcat7-examples_7.0.28-4+deb7u3_all.deb
8fd38037bc0a23368c8646574d38e9e619686edd3ff810eab79262766242cd46 647416
tomcat7-docs_7.0.28-4+deb7u3_all.deb
Files:
0c55247ee9ae7a71f707d7462d470ecd 2645 java optional tomcat7_7.0.28-4+deb7u3.dsc
e15b76034d914449f3078857a29382c9 105422 java optional
tomcat7_7.0.28-4+deb7u3.debian.tar.gz
180ed07180d1968f4a834c7c50b99aad 61260 java optional
tomcat7-common_7.0.28-4+deb7u3_all.deb
90ab6c6a75d807f38b69cad205f2e920 50408 java optional
tomcat7_7.0.28-4+deb7u3_all.deb
4d5fad06e665745a002c50744835e752 38986 java optional
tomcat7-user_7.0.28-4+deb7u3_all.deb
546daeb73ca0860d2e74677a531561bc 3501052 java optional
libtomcat7-java_7.0.28-4+deb7u3_all.deb
d930497fda41f8b1d7f5f12d01c2b07a 305092 java optional
libservlet3.0-java_7.0.28-4+deb7u3_all.deb
afc6a24c369258a301711a0f9d0ca1c4 302038 doc optional
libservlet3.0-java-doc_7.0.28-4+deb7u3_all.deb
e3ad44f43ac5f4d440d14d77bc553294 51378 java optional
tomcat7-admin_7.0.28-4+deb7u3_all.deb
bbb5299da82a4fc17e181b0d5e3babe1 201624 java optional
tomcat7-examples_7.0.28-4+deb7u3_all.deb
89ac5898458784efd11259207a77e491 647416 doc optional
tomcat7-docs_7.0.28-4+deb7u3_all.deb
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)
iQIcBAEBAgAGBQJWk5hAAAoJEPUTxBnkudCszw8P/0B4M77ycaftVt1pnv1052s4
BOMgJc7xaqaDqI8vEfT6KsMRspmCaoCsR6IVSO8a+IiRqzIUuLnFMufBsLFJe6rJ
C8FpKstAyoS2gqaxQixwoxbkrdUqyT6zB3efQ4bk09e7VEzkzsoLvBsTXTJlOqb3
DTE0eGvEZszbHy/lb/Fzyc662F16WMTOv6sn+AopHnzibTRWyaVPymNgdvAfZbwD
pe7o8TVtEQ04xSMN5oa0PXghCxjqgQQwFUovQVxv2fgE6GSA4UYFr/1SDt6zQ5vU
PCrNP/rh7o5rWCNJjdjg+E6bffs9XdoVBIhIn/cfSlVvXpsL2LIawIkd2fTk2YmC
efr5vQUoFd2JN92TjAvnpEeeaVEsaQ7srIrx9vKgx23BZLkDGrk1wQFVwmmdAA4z
I3bquiZ9ts8qPjaWaPOSKJ4OGz6OTpRJQkk68hx+niBqh1foysSKGVqcy0IUZWWE
ASV8oSHCONDkh4a4VFta3TcKXAwospsWdKYHfHM9ENQsn/6oOXOLERn00M9Xi+hL
oE5dDmIQ0cVCSZRU6vzvMcuUsiKWbpqYMLRj5x4ufLhkNjsoOkzQnRS5tCBnL6o4
2pFw9++D9EXc2kJKUU/bEsNWk4f9N4GzmiVAqODdKnfvO2E+ntD+bs5GPXHklMda
mzBaaGapVN+CdYhNz69F
=D4PK
-----END PGP SIGNATURE-----
Thank you for your contribution to Debian.
__
This is the maintainer address of Debian's Java team
<http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/pkg-java-maintainers>.
Please use
debian-j...@lists.debian.org for discussions and questions.
