Security update for tomcat6 (important)

This update fixes a regression in parameter passing (in
urldecoding of parameters that contain spaces).

In addition, multiple weaknesses in HTTP DIGESTS have been
fixed (CVE-2011-1184):

• CVE-2011-5062: The HTTP Digest Access Authentication
  implementation in Apache Tomcat 5.5.x before 5.5.34, 6.x
  before 6.0.33 and 7.x before 7.0.12 does not check qop
  values, which might allow remote attackers to bypass
  intended integrity-protection requirements via a qop=auth
  value, a different vulnerability than CVE-2011-1184.
• CVE-2011-5063: The HTTP Digest Access Authentication
  implementation in Apache Tomcat 5.5.x before 5.5.34, 6.x
  before 6.0.33, and 7.x before 7.0.12 does not check realm
  values, which might allow remote attackers to bypass
  intended access restrictions by leveraging the availability
  of a protection space with weaker authentication or
  authorization requirements, a different vulnerability than
  CVE-2011-1184.
• CVE-2011-5064: DigestAuthenticator.java in the HTTP
  Digest Access Authentication implementation in Apache
  Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x
  before 7.0.12 uses Catalina as the hard-coded server secret
  (aka private key), which makes it easier for remote
  attackers to bypass cryptographic protection mechanisms by
  leveraging knowledge of this string, a different
  vulnerability than CVE-2011-1184.