tomcat6 (6.0.35-1ubuntu3.8) precise-security; urgency=medium
* SECURITY UPDATE: privilege escalation via insecure init script
- debian/tomcat6.init: don't follow symlinks when handling the
catalina.out file.
- CVE-2016-1240
* SECURITY REGRESSION: change in behaviour after security update
- debian/patches/CVE-2015-5345-2.patch: change
mapperContextRootRedirectEnabled default to true in
java/org/apache/catalina/core/StandardContext.java,
webapps/docs/config/context.xml. This reverts the change in behaviour
following the CVE-2015-5345 security update and was also done
upstream in later releases.
Date: 2016-09-16 14:58:17.478425+00:00
Changed-By: Marc Deslauriers <marc.deslauri...@canonical.com>
https://launchpad.net/ubuntu/+source/tomcat6/6.0.35-1ubuntu3.8
Sorry, changesfile not available.
--
Precise-changes mailing list
Precise-changes@lists.ubuntu.com
Modify settings or unsubscribe at:
https://lists.ubuntu.com/mailman/listinfo/precise-changes
