Basic search

K
debianDebianDEBIAN:DLA-728-1:A9D65
HistoryDec 01, 2016 - 10:52 p.m.

[SECURITY] [DLA 728-1] tomcat6 security update

2016-12-0122:52:34
lists.debian.org
36

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

0.001 Low

EPSS

Percentile

43.1%

Package : tomcat6
Version : 6.0.45+dfsg-1~deb7u3
CVE ID : CVE-2016-0762 CVE-2016-5018 CVE-2016-6794
CVE-2016-6796 CVE-2016-6797 CVE-2016-6816
CVE-2016-8735
Debian Bug : 841655 842662 842663 842664 842665 842666 845385

Multiple security vulnerabilities have been discovered in the Tomcat
servlet and JSP engine, which may result in possible timing attacks to
determine valid user names, bypass of the SecurityManager, disclosure of
system properties, unrestricted access to global resources, arbitrary
file overwrites, and potentially escalation of privileges.

In addition this update further hardens Tomcat's init and maintainer
scripts to prevent possible privilege escalations. Thanks to Paul
Szabo for the report.

This is probably the last security update of Tomcat 6 which will reach
its end-of-life exactly in one month. We strongly recommend to switch
to another supported version such as Tomcat 7 at your earliest
convenience.

For Debian 7 "Wheezy", these problems have been fixed in version
6.0.45+dfsg-1~deb7u3.

We recommend that you upgrade your tomcat6 packages.

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

0.001 Low

EPSS

Percentile

43.1%

Related for DEBIAN:DLA-728-1:A9D65