Security update for tomcat6
Announcement ID: | SUSE-SU-2015:1565-1 |
---|---|
Rating: | moderate |
References: | |
Cross-References: | |
CVSS scores: |
|
Affected Products: |
|
An update that solves three vulnerabilities and has three security fixes can now be installed.
Description:
This update for Tomcat fixes the following security issues:
-
CVE-2014-7810: Security manager bypass via EL expressions. (bsc#931442) It was found that the expression language resolver evaluated expressions within a privileged code section. A malicious web application could have used this flaw to bypass security manager protections.
-
CVE-2014-0227: Limited DoS in chunked transfer encoding input filter. (bsc#917127) It was discovered that the ChunkedInputFilter implementation did not fail subsequent attempts to read input early enough. A remote attacker could have used this flaw to perform a denial of service attack, by streaming an unlimited quantity of data, leading to consumption of server resources.
-
CVE-2014-0230: Non-persistent DoS attack by feeding data by aborting an upload It was possible for a remote attacker to trigger a non-persistent DoS attack by feeding data by aborting an upload. (bsc#926762)
Additionally, the following non-security issues have been fixed:
- Fix rights of all files within /usr/share/tomcat6/bin. (bsc#906152)
- Don't overwrite /var/run/tomcat6.pid when Tomcat is already running. (bsc#934219)
- Miscellaneous fixes and improvements to Tomcat's init script. (bsc#932698)
Patch Instructions:
To install this SUSE update use the SUSE recommended
installation methods like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
-
SUSE Linux Enterprise Server 11 SP4
zypper in -t patch slessp4-tomcat6-12092=1
-
SLES for SAP Applications 11-SP4
zypper in -t patch slessp4-tomcat6-12092=1
Package List:
-
SUSE Linux Enterprise Server 11 SP4 (noarch)
- tomcat6-docs-webapp-6.0.41-0.47.1
- tomcat6-javadoc-6.0.41-0.47.1
- tomcat6-jsp-2_1-api-6.0.41-0.47.1
- tomcat6-lib-6.0.41-0.47.1
- tomcat6-webapps-6.0.41-0.47.1
- tomcat6-6.0.41-0.47.1
- tomcat6-admin-webapps-6.0.41-0.47.1
- tomcat6-servlet-2_5-api-6.0.41-0.47.1
-
SLES for SAP Applications 11-SP4 (noarch)
- tomcat6-docs-webapp-6.0.41-0.47.1
- tomcat6-javadoc-6.0.41-0.47.1
- tomcat6-jsp-2_1-api-6.0.41-0.47.1
- tomcat6-lib-6.0.41-0.47.1
- tomcat6-webapps-6.0.41-0.47.1
- tomcat6-6.0.41-0.47.1
- tomcat6-admin-webapps-6.0.41-0.47.1
- tomcat6-servlet-2_5-api-6.0.41-0.47.1
References:
- https://www.suse.com/security/cve/CVE-2014-0227.html
- https://www.suse.com/security/cve/CVE-2014-0230.html
- https://www.suse.com/security/cve/CVE-2014-7810.html
- https://bugzilla.suse.com/show_bug.cgi?id=906152
- https://bugzilla.suse.com/show_bug.cgi?id=917127
- https://bugzilla.suse.com/show_bug.cgi?id=926762
- https://bugzilla.suse.com/show_bug.cgi?id=931442
- https://bugzilla.suse.com/show_bug.cgi?id=932698
- https://bugzilla.suse.com/show_bug.cgi?id=934219