bugtraq - [SECURITY] [DSA 3738-1] tomcat7 security update

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <E1cIXVq-0001uL-V1@seger.debian.org>
Date: Sun, 18 Dec 2016 09:12:10 +0000
From: Sebastien Delafond <seb@...ian.org>
To: bugtraq@...urityfocus.com
Subject: [SECURITY] [DSA 3738-1] tomcat7 security update

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

- -------------------------------------------------------------------------
Debian Security Advisory DSA-3738-1                   security@...ian.org
https://www.debian.org/security/                       Sebastien Delafond
December 18, 2016                     https://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package        : tomcat7
CVE ID         : CVE-2016-6816 CVE-2016-8735 CVE-2016-9774 CVE-2016-9775
Debian Bug     : 802312 845385 845393

Multiple security vulnerabilities were discovered in the Tomcat
servlet and JSP engine, as well as in its Debian-specific maintainer
scripts. Those flaws allowed for privilege escalation, information
disclosure, and remote code execution.

As part of this update, several regressions stemming from incomplete
fixes for previous vulnerabilities were also fixed.

For the stable distribution (jessie), these problems have been fixed in
version 7.0.56-3+deb8u6.

For the testing (stretch) and unstable (sid) distributions, these
problems have been fixed in version 7.0.72-3.

We recommend that you upgrade your tomcat7 packages.

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

Mailing list: debian-security-announce@...ts.debian.org
-----BEGIN PGP SIGNATURE-----

iQEcBAEBCgAGBQJYVk8kAAoJEBC+iYPz1Z1kuVIH/1J+j7DspsRlgD8hqF4qM7cL
XBQ03Dv6cBdGSYk6kUNB+UUG7aBm7ulAginjc3Q6b6Aj/b+0+tPke6N9EH4+l6dL
zifZyjtTq+ftzYwLdrUoRzp3bLZ45JdPWxdcRWtwDqr6HIKhWKQtO/5zibVr24mC
jn/owRfDC8NqBaPkgPmasB+0YioOaenLtL9FjA7zBr2LzYkxb8eK0HGcjed0+x4m
32wl3uwTx7wciMO6dAcvDhpG1AoWXfyoOAIf017d64bwXvyYsUm2UM01H9TSuNGX
g4dNg1BUyvUJfKYZJnxk9sHuGhWKU7zLVClFUNBv7CKMmh5repDxjAMGAHzeSq4=
=klGn
-----END PGP SIGNATURE-----