Scientific Linux Security Update : tomcat on SL7.x (noarch) (20161103)

The following packages have been upgraded to a newer upstream version: tomcat 7.0.69. Security Fixes : - A CSRF flaw was found in Tomcat's the index pages for the Manager and Host Manager applications. These applications included a valid CSRF token when issuing a redirect as a result of an...

SUSE-SU-2016:3079-1 Security update for tomcat

This update for Tomcat provides the following fixes: Feature changes: The embedded Apache Commons DBCP component was updated to version 2.0. bsc1010893 fate321029 Security fixes: - CVE-2016-0762: Realm Timing Attack bsc1007854 - CVE-2016-5018: Security Manager Bypass bsc1007855 - CVE-2016-6794:...

CVE-2016-3028

IBM Security Access Manager for Web 7.0 before IF2 and 8.0 before 8.0.1.4 IF3 and Security Access Manager 9.0 before 9.0.1.0 IF5 allow remote authenticated users to execute arbitrary commands by leveraging LMI admin access...

RHEL 6 / 7 : Red Hat JBoss Web Server 2.1.2 security update for Tomcat 7 (Important) (RHSA-2016:2807)

The remote Redhat Enterprise Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2016:2807 advisory. Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages JSP technologies. This release of Red Hat JBoss Web Serve...

tomcat: security manager bypass via StatusManagerServlet

It was found that Tomcat allowed the StatusManagerServlet to be loaded by a web application when a security manager was configured. This allowed a web application to list all deployed web applications and expose sensitive information such as session IDs...

tomcat: Security Manager bypass via persistence mechanisms

It was found that several Tomcat session persistence mechanisms could allow a remote, authenticated user to bypass intended SecurityManager restrictions and execute arbitrary code in a privileged context via a web application that placed a crafted object in a session...

tomcat: security manager bypass via setGlobalContext()

A security manager bypass flaw was found in Tomcat that could allow remote, authenticated users to access arbitrary application data, potentially resulting in a denial of service...

tomcat: security manager bypass via StatusManagerServlet

It was found that Tomcat allowed the StatusManagerServlet to be loaded by a web application when a security manager was configured. This allowed a web application to list all deployed web applications and expose sensitive information such as session IDs...

tomcat: Security Manager bypass via persistence mechanisms

It was found that several Tomcat session persistence mechanisms could allow a remote, authenticated user to bypass intended SecurityManager restrictions and execute arbitrary code in a privileged context via a web application that placed a crafted object in a session...

Important: Red Hat Security Advisory: Red Hat JBoss Web Server 2.1.2 security update for Tomcat 7

An update is now available for Red Hat JBoss Web Server. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links i...

tomcat: security manager bypass via setGlobalContext()

A security manager bypass flaw was found in Tomcat that could allow remote, authenticated users to access arbitrary application data, potentially resulting in a denial of service...

Multiple F5 BIG-IP Product Denial of Service Vulnerabilities

F5 BIG-IP ASM Application Security Manager is a network security product from F5 Corporation, U.S.A. ASM is a comprehensive web application firewall that protects applications and data from known and unknown threats, defends against Trojans that bypass standard protections, and patches...

F5 BIG-IP ASM Denial of Service Vulnerability

F5 BIG-IP ASM Application Security Manager is a network security product from F5 Corporation, U.S.A. ASM is a comprehensive web application firewall that protects applications and data from known and unknown threats, defends against Trojans that bypass standard protections, and patches...

tomcat security, bug fix, and enhancement update

0:7.0.69-10 - Related: rhbz1368122 0:7.0.69-9 - Resolves: rhbz1362213 Tomcat: CGI sets environmental variable based on user supplied Proxy request header - Resolves: rhbz1368122 0:7.0.69-7 - Resolves: rhbz1362545 0:7.0.69-6 - Related: rhbz1201409 Added /etc/sysconfig/tomcat to the systemd unit fo...

MGASA-2016-0367 Updated tomcat packages fix security vulnerability

The Realm implementations did not process the supplied password if the supplied user name did not exist. This made a timing attack possible to determine valid user names. Note that the default configuration includes the LockOutRealm which makes exploitation of this vulnerability harder...

RHEL 7 : tomcat (RHSA-2016:2599)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2016:2599 advisory. Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages JSP technologies. The following packages have been upgraded t...

tomcat: security manager bypass via setGlobalContext()

A security manager bypass flaw was found in Tomcat that could allow remote, authenticated users to access arbitrary application data, potentially resulting in a denial of service...

tomcat: Security Manager bypass via persistence mechanisms

It was found that several Tomcat session persistence mechanisms could allow a remote, authenticated user to bypass intended SecurityManager restrictions and execute arbitrary code in a privileged context via a web application that placed a crafted object in a session...

tomcat: URL Normalization issue

A directory traversal flaw was found in Tomcat's RequestUtil.java. A remote, authenticated user could use this flaw to bypass intended SecurityManager restrictions and list a parent directory via a '/..' in a pathname used by a web application in a getResource, getResourceAsStream, or...

tomcat: security manager bypass via StatusManagerServlet

It was found that Tomcat allowed the StatusManagerServlet to be loaded by a web application when a security manager was configured. This allowed a web application to list all deployed web applications and expose sensitive information such as session IDs...