Описание
Security update for tomcat6
This update of tomcat6 fixes:
Security Issue references:
Список пакетов
SUSE Linux Enterprise Server 11 SP3
SUSE Linux Enterprise Server 11 SP3-TERADATA
SUSE Linux Enterprise Server for SAP Applications 11 SP3
Ссылки
- Link for SUSE-SU-2015:1337-1
- E-Mail link for SUSE-SU-2015:1337-1
- SUSE Security Ratings
- SUSE Bug 768772
- SUSE Bug 804992
- SUSE Bug 818948
- SUSE Bug 822177
- SUSE Bug 831119
- SUSE Bug 906152
- SUSE Bug 917127
- SUSE Bug 918195
- SUSE Bug 926762
- SUSE Bug 931442
- SUSE Bug 932698
- SUSE CVE CVE-2012-0022 page
- SUSE CVE CVE-2012-3544 page
- SUSE CVE CVE-2013-1976 page
- SUSE CVE CVE-2014-0227 page
- SUSE CVE CVE-2014-0230 page
- SUSE CVE CVE-2014-7810 page
Описание
Apache Tomcat 5.5.x before 5.5.35, 6.x before 6.0.34, and 7.x before 7.0.23 uses an inefficient approach for handling parameters, which allows remote attackers to cause a denial of service (CPU consumption) via a request that contains many parameters and parameter values, a different vulnerability than CVE-2011-4858.
Затронутые продукты
Ссылки
- CVE-2012-0022
- SUSE Bug 742477
- SUSE Bug 745056
Описание
Apache Tomcat 6.x before 6.0.37 and 7.x before 7.0.30 does not properly handle chunk extensions in chunked transfer coding, which allows remote attackers to cause a denial of service by streaming data.
Затронутые продукты
Ссылки
- CVE-2012-3544
- SUSE Bug 822177
- SUSE Bug 831119
- SUSE Bug 865746
Описание
The (1) tomcat5, (2) tomcat6, and (3) tomcat7 init scripts, as used in the RPM distribution of Tomcat for JBoss Enterprise Web Server 1.0.2 and 2.0.0, and Red Hat Enterprise Linux 5 and 6, allow local users to change the ownership of arbitrary files via a symlink attack on (a) tomcat5-initd.log, (b) tomcat6-initd.log, (c) catalina.out, or (d) tomcat7-initd.log.
Затронутые продукты
Ссылки
- CVE-2013-1976
- SUSE Bug 822177
Описание
java/org/apache/coyote/http11/filters/ChunkedInputFilter.java in Apache Tomcat 6.x before 6.0.42, 7.x before 7.0.55, and 8.x before 8.0.9 does not properly handle attempts to continue reading data after an error has occurred, which allows remote attackers to conduct HTTP request smuggling attacks or cause a denial of service (resource consumption) by streaming data with malformed chunked transfer coding.
Затронутые продукты
Ссылки
- CVE-2014-0227
- SUSE Bug 917127
- SUSE Bug 926762
- SUSE Bug 988489
Описание
Apache Tomcat 6.x before 6.0.44, 7.x before 7.0.55, and 8.x before 8.0.9 does not properly handle cases where an HTTP response occurs before finishing the reading of an entire request body, which allows remote attackers to cause a denial of service (thread consumption) via a series of aborted upload attempts.
Затронутые продукты
Ссылки
- CVE-2014-0230
- SUSE Bug 926762
- SUSE Bug 988489
Описание
The Expression Language (EL) implementation in Apache Tomcat 6.x before 6.0.44, 7.x before 7.0.58, and 8.x before 8.0.16 does not properly consider the possibility of an accessible interface implemented by an inaccessible class, which allows attackers to bypass a SecurityManager protection mechanism via a web application that leverages use of incorrect privileges during EL evaluation.
Затронутые продукты
Ссылки
- CVE-2014-7810
- SUSE Bug 931442