Lucene search

K
amazonAmazonALAS-2016-776
HistoryDec 15, 2016 - 12:41 a.m.

Important: tomcat6

2016-12-1500:41:00
alas.aws.amazon.com
32

0.251 Low

EPSS

Percentile

96.7%

Issue Overview:

CVE-2016-6816 tomcat: HTTP Request smuggling vulnerability due to permitting invalid character in HTTP requests

CVE-2016-8735 tomcat: Remote code execution vulnerability in JmxRemoteLifecycleListener

Affected Packages:

tomcat6

Issue Correction:
Run yum update tomcat6 to update your system.

New Packages:

noarch:  
    tomcat6-admin-webapps-6.0.48-1.8.amzn1.noarch  
    tomcat6-el-2.1-api-6.0.48-1.8.amzn1.noarch  
    tomcat6-servlet-2.5-api-6.0.48-1.8.amzn1.noarch  
    tomcat6-javadoc-6.0.48-1.8.amzn1.noarch  
    tomcat6-jsp-2.1-api-6.0.48-1.8.amzn1.noarch  
    tomcat6-webapps-6.0.48-1.8.amzn1.noarch  
    tomcat6-docs-webapp-6.0.48-1.8.amzn1.noarch  
    tomcat6-lib-6.0.48-1.8.amzn1.noarch  
    tomcat6-6.0.48-1.8.amzn1.noarch  
  
src:  
    tomcat6-6.0.48-1.8.amzn1.src  

Additional References

Red Hat: CVE-2016-6816, CVE-2016-8735

Mitre: CVE-2016-6816, CVE-2016-8735