Security update for tomcat6

Announcement ID:	SUSE-SU-2017:1632-1
Rating:	important
References:	bsc#1007853 bsc#1007854 bsc#1007855 bsc#1007857 bsc#1007858 bsc#1011805 bsc#1011812 bsc#1015119 bsc#1033448 bsc#1036642 bsc#988489
Cross-References:	CVE-2016-0762 CVE-2016-5018 CVE-2016-5388 CVE-2016-6794 CVE-2016-6796 CVE-2016-6797 CVE-2016-6816 CVE-2016-8735 CVE-2016-8745 CVE-2017-5647
CVSS scores:	CVE-2016-0762 ( NVD ): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N CVE-2016-0762 ( NVD ): 5.9 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N CVE-2016-5018 ( NVD ): 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N CVE-2016-5018 ( NVD ): 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N CVE-2016-5388 ( NVD ): 8.1 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2016-6794 ( NVD ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CVE-2016-6794 ( NVD ): 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CVE-2016-6796 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N CVE-2016-6796 ( NVD ): 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N CVE-2016-6797 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVE-2016-6797 ( NVD ): 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVE-2016-6816 ( NVD ): 7.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L CVE-2016-8735 ( NVD ): 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2016-8745 ( NVD ): 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVE-2017-5647 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVE-2017-5647 ( NVD ): 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected Products:	SLES for SAP Applications 11-SP4 SUSE Linux Enterprise Point of Service 11 SP3 SUSE Linux Enterprise Server 11 SP3 LTSS 11-SP3 SUSE Linux Enterprise Server 11 SP4

An update that solves 10 vulnerabilities and has one security fix can now be installed.

Description:

This update for tomcat6 fixes the following issues:

Tomcat was updated to version 6.0.53:

The full changelog is: http://tomcat.apache.org/tomcat-6.0-doc/changelog.html

Security issues fixed:

• CVE-2017-5647: A bug in the handling of pipelined requests could lead to information disclosure (bsc#1036642)
• CVE-2016-8745: Regression in the error handling methods could lead to information disclosure (bsc#1015119)
• CVE-2016-8735: Remote code execution vulnerability in JmxRemoteLifecycleListener (bsc#1011805)
• CVE-2016-6816: HTTP Request smuggling vulnerability due to permitting invalid character in HTTP requests (bsc#1011812)
• CVE-2016-6797: Unrestricted Access to Global Resources (bsc#1007853)
• CVE-2016-6796: Manager Bypass (bsc#1007858)
• CVE-2016-6794: System Property Disclosure (bsc#1007857)
• CVE-2016-5018: Security Manager Bypass (bsc#1007855)
• CVE-2016-0762: Realm Timing Attack (bsc#1007854)
• CVE-2016-5388: an arbitrary HTTP_PROXY environment variable might allow remote attackers to redirect outbound HTTP traffic (bsc#988489)

Patch Instructions:

To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:

• SUSE Linux Enterprise Point of Service 11 SP3
  zypper in -t patch sleposp3-tomcat6-13162=1
• SUSE Linux Enterprise Server 11 SP3 LTSS 11-SP3
  zypper in -t patch slessp3-tomcat6-13162=1
• SUSE Linux Enterprise Server 11 SP4
  zypper in -t patch slessp4-tomcat6-13162=1
• SLES for SAP Applications 11-SP4
  zypper in -t patch slessp4-tomcat6-13162=1

Package List:

• SUSE Linux Enterprise Point of Service 11 SP3 (noarch)
  • tomcat6-webapps-6.0.53-0.56.1
  • tomcat6-6.0.53-0.56.1
  • tomcat6-docs-webapp-6.0.53-0.56.1
  • tomcat6-javadoc-6.0.53-0.56.1
  • tomcat6-admin-webapps-6.0.53-0.56.1
  • tomcat6-jsp-2_1-api-6.0.53-0.56.1
  • tomcat6-servlet-2_5-api-6.0.53-0.56.1
  • tomcat6-lib-6.0.53-0.56.1
• SUSE Linux Enterprise Server 11 SP3 LTSS 11-SP3 (noarch)
  • tomcat6-webapps-6.0.53-0.56.1
  • tomcat6-6.0.53-0.56.1
  • tomcat6-docs-webapp-6.0.53-0.56.1
  • tomcat6-javadoc-6.0.53-0.56.1
  • tomcat6-admin-webapps-6.0.53-0.56.1
  • tomcat6-jsp-2_1-api-6.0.53-0.56.1
  • tomcat6-servlet-2_5-api-6.0.53-0.56.1
  • tomcat6-lib-6.0.53-0.56.1
• SUSE Linux Enterprise Server 11 SP4 (noarch)
  • tomcat6-webapps-6.0.53-0.56.1
  • tomcat6-6.0.53-0.56.1
  • tomcat6-docs-webapp-6.0.53-0.56.1
  • tomcat6-javadoc-6.0.53-0.56.1
  • tomcat6-admin-webapps-6.0.53-0.56.1
  • tomcat6-jsp-2_1-api-6.0.53-0.56.1
  • tomcat6-servlet-2_5-api-6.0.53-0.56.1
  • tomcat6-lib-6.0.53-0.56.1
• SLES for SAP Applications 11-SP4 (noarch)
  • tomcat6-webapps-6.0.53-0.56.1
  • tomcat6-6.0.53-0.56.1
  • tomcat6-docs-webapp-6.0.53-0.56.1
  • tomcat6-javadoc-6.0.53-0.56.1
  • tomcat6-admin-webapps-6.0.53-0.56.1
  • tomcat6-jsp-2_1-api-6.0.53-0.56.1
  • tomcat6-servlet-2_5-api-6.0.53-0.56.1
  • tomcat6-lib-6.0.53-0.56.1

References:

• https://www.suse.com/security/cve/CVE-2016-0762.html
• https://www.suse.com/security/cve/CVE-2016-5018.html
• https://www.suse.com/security/cve/CVE-2016-5388.html
• https://www.suse.com/security/cve/CVE-2016-6794.html
• https://www.suse.com/security/cve/CVE-2016-6796.html
• https://www.suse.com/security/cve/CVE-2016-6797.html
• https://www.suse.com/security/cve/CVE-2016-6816.html
• https://www.suse.com/security/cve/CVE-2016-8735.html
• https://www.suse.com/security/cve/CVE-2016-8745.html
• https://www.suse.com/security/cve/CVE-2017-5647.html
• https://bugzilla.suse.com/show_bug.cgi?id=1007853
• https://bugzilla.suse.com/show_bug.cgi?id=1007854
• https://bugzilla.suse.com/show_bug.cgi?id=1007855
• https://bugzilla.suse.com/show_bug.cgi?id=1007857
• https://bugzilla.suse.com/show_bug.cgi?id=1007858
• https://bugzilla.suse.com/show_bug.cgi?id=1011805
• https://bugzilla.suse.com/show_bug.cgi?id=1011812
• https://bugzilla.suse.com/show_bug.cgi?id=1015119
• https://bugzilla.suse.com/show_bug.cgi?id=1033448
• https://bugzilla.suse.com/show_bug.cgi?id=1036642
• https://bugzilla.suse.com/show_bug.cgi?id=988489