Описание
ELSA-2008-0042: Moderate: tomcat security update (MODERATE)
[5.5.23-0jpp.3.0.3]
- Patch for CVE-2007-5342 Resolves: bz# 427776
- Patch for CVE-2007-5461 Resolves: bz# 334561
Обновленные пакеты
Oracle Linux 5
Oracle Linux x86_64
tomcat5
5.5.23-0jpp.3.0.3.el5_1
tomcat5-admin-webapps
5.5.23-0jpp.3.0.3.el5_1
tomcat5-common-lib
5.5.23-0jpp.3.0.3.el5_1
tomcat5-jasper
5.5.23-0jpp.3.0.3.el5_1
tomcat5-jasper-javadoc
5.5.23-0jpp.3.0.3.el5_1
tomcat5-jsp-2.0-api
5.5.23-0jpp.3.0.3.el5_1
tomcat5-jsp-2.0-api-javadoc
5.5.23-0jpp.3.0.3.el5_1
tomcat5-server-lib
5.5.23-0jpp.3.0.3.el5_1
tomcat5-servlet-2.4-api
5.5.23-0jpp.3.0.3.el5_1
tomcat5-servlet-2.4-api-javadoc
5.5.23-0jpp.3.0.3.el5_1
tomcat5-webapps
5.5.23-0jpp.3.0.3.el5_1
Oracle Linux i386
tomcat5
5.5.23-0jpp.3.0.3.el5_1
tomcat5-admin-webapps
5.5.23-0jpp.3.0.3.el5_1
tomcat5-common-lib
5.5.23-0jpp.3.0.3.el5_1
tomcat5-jasper
5.5.23-0jpp.3.0.3.el5_1
tomcat5-jasper-javadoc
5.5.23-0jpp.3.0.3.el5_1
tomcat5-jsp-2.0-api
5.5.23-0jpp.3.0.3.el5_1
tomcat5-jsp-2.0-api-javadoc
5.5.23-0jpp.3.0.3.el5_1
tomcat5-server-lib
5.5.23-0jpp.3.0.3.el5_1
tomcat5-servlet-2.4-api
5.5.23-0jpp.3.0.3.el5_1
tomcat5-servlet-2.4-api-javadoc
5.5.23-0jpp.3.0.3.el5_1
tomcat5-webapps
5.5.23-0jpp.3.0.3.el5_1
Связанные CVE
Связанные уязвимости
Absolute path traversal vulnerability in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0, 5.0.0, 5.5.0 through 5.5.25, and 6.0.0 through 6.0.14, under certain configurations, allows remote authenticated users to read arbitrary files via a WebDAV write request that specifies an entity with a SYSTEM tag.
Absolute path traversal vulnerability in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0, 5.0.0, 5.5.0 through 5.5.25, and 6.0.0 through 6.0.14, under certain configurations, allows remote authenticated users to read arbitrary files via a WebDAV write request that specifies an entity with a SYSTEM tag.
Absolute path traversal vulnerability in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0, 5.0.0, 5.5.0 through 5.5.25, and 6.0.0 through 6.0.14, under certain configurations, allows remote authenticated users to read arbitrary files via a WebDAV write request that specifies an entity with a SYSTEM tag.
Absolute path traversal vulnerability in Apache Tomcat 4.0.0 through 4 ...
The default catalina.policy in the JULI logging component in Apache Tomcat 5.5.9 through 5.5.25 and 6.0.0 through 6.0.15 does not restrict certain permissions for web applications, which allows attackers to modify logging configuration options and overwrite arbitrary files, as demonstrated by changing the (1) level, (2) directory, and (3) prefix attributes in the org.apache.juli.FileHandler handler.