bugtraq - [SECURITY] [DSA 3669-1] tomcat7 security update

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20160915172702.GA32051@pisco.westfalen.local>
Date: Thu, 15 Sep 2016 19:27:02 +0200
From: Moritz Muehlenhoff <jmm@...ian.org>
To: bugtraq@...urityfocus.com
Subject: [SECURITY] [DSA 3669-1] tomcat7 security update

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- -------------------------------------------------------------------------
Debian Security Advisory DSA-3669-1                   security@...ian.org
https://www.debian.org/security/                       Moritz Muehlenhoff
September 15, 2016                    https://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package        : tomcat7
CVE ID         : CVE-2016-1240

Dawid Golunski of LegalHackers discovered that the Tomcat init script
performed unsafe file handling, which could result in local privilege
escalation.

For the stable distribution (jessie), this problem has been fixed in
version 7.0.56-3+deb8u4.

We recommend that you upgrade your tomcat7 packages.

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

Mailing list: debian-security-announce@...ts.debian.org
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBAgAGBQJX2tmaAAoJEBDCk7bDfE42DpQP/RkxwGV4Ba6NeuL7OuttEOJG
FZui69MkIZeZ00SiIQ/bhFSIYEMsQy3Do836P4VM1evtwsdXEGBS+Ljuudqdiiiv
SJVdLEgJYgMDRxRC2xNXCFpyfJuyNd7RDjuOurg6kWULUb2ySToAL87SgUXcAlle
LP7fJmVyZYRw8ce0M7eVXW/JtEUb0YdDiSHQso6eXnLOzduozKmVP9QOtx6XmLpG
5jVUjU01AZpJGFdH2pQqpi84DGdkYPcLCEeA5WpPmSpaAqo9Y8/cB1nXeXGG1S7T
d8Cv3//7V3yexorT7orEZtTe/qFlVvITMcHyZO/Y1zrPtOBbFxrJ5PChAK24MXeF
RerzJHf3ynPA4jMeMm4jwL/43GREkoBPyFsa4FqqjtRKgpk7q3u/UaHAR7FkHTYj
w17aqZ9Sc8pVSojE51yE7togVrRL3LjQEUmRzXRpYqpWHkY1snlKgxGAxZ7VznAU
ZIh2gEyOWPgreVjhYKnvRq4QQkErSgHiCxDbXHvtLQ0nQTe/vQflCUrgZJ5M7IcN
amXrio/PV9RdHnaiG6Y8ewcfBBurcHD3qbXZcuFzlJxeGjATAzKoG21M3P8QZ5x7
dRvHcL6bnICloFIFhMHgj4UxNCkmR2EWaFIJ3p60eTgFE8NPA/9tvvDDqM1tROZV
H75JDuIVeXA4oAS5G0il
=l0Dd
-----END PGP SIGNATURE-----