* SECURITY UPDATE: arbitrary file disclosure via XML parser
(LP: #1449975)
- debian/patches/CVE-2014-0119.patch: add defensive coding and ensure
TLD parser obtained from cache has correct value of blockExternal in
java/org/apache/catalina/security/SecurityClassLoad.java,
java/org/apache/catalina/servlets/DefaultServlet.java,
java/org/apache/catalina/startup/TldConfig.java,
java/org/apache/jasper/compiler/JspDocumentParser.java,
java/org/apache/jasper/xmlparser/ParserUtils.java,
java/org/apache/tomcat/util/security/PrivilegedGetTccl.java,
java/org/apache/tomcat/util/security/PrivilegedSetTccl.java.
- CVE-2014-0119
* SECURITY UPDATE: HTTP request smuggling or denial of service via
streaming with malformed chunked transfer encoding (LP: #1449975)
- debian/patches/CVE-2014-0227.patch: add error flag and improve i18n
in java/org/apache/coyote/http11/filters/ChunkedInputFilter.java,
java/org/apache/coyote/http11/filters/LocalStrings.properties.
- CVE-2014-0227
* SECURITY UPDATE: denial of service via aborted upload attempts
(LP: #1449975)
- debian/patches/CVE-2014-0230.patch: limit amount of data in
java/org/apache/coyote/http11/AbstractHttp11Processor.java,
java/org/apache/coyote/http11/AbstractHttp11Protocol.java,
java/org/apache/coyote/http11/Http11AprProcessor.java,
java/org/apache/coyote/http11/Http11AprProtocol.java,
java/org/apache/coyote/http11/Http11NioProcessor.java,
java/org/apache/coyote/http11/Http11NioProtocol.java,
java/org/apache/coyote/http11/Http11Processor.java,
java/org/apache/coyote/http11/Http11Protocol.java,
java/org/apache/coyote/http11/filters/ChunkedInputFilter.java,
java/org/apache/coyote/http11/filters/IdentityInputFilter.java,
java/org/apache/coyote/http11/filters/LocalStrings.properties,
test/org/apache/catalina/core/TestSwallowAbortedUploads.java,
webapps/docs/config/http.xml.
- CVE-2014-0230
* SECURITY UPDATE: SecurityManager bypass via Expression Language
- debian/patches/CVE-2014-7810.patch: handle classes that may not be
accessible but have accessible interfaces in
java/javax/el/BeanELResolver.java, remove unnecessary code in
java/org/apache/jasper/runtime/PageContextImpl.java,
java/org/apache/jasper/security/SecurityClassLoad.java.
- CVE-2014-7810
* Replace expired ssl certs and use TLS to fix tests causing FTBFS:
- debian/patches/0022-use-tls-in-ssl-unit-tests.patch
- debian/patches/0023-replace-expired-ssl-certificates.patch
- debian/source/include-binaries
-- Marc Deslauriers <email address hidden> Fri, 19 Jun 2015 12:30:21 -0400
This bug was fixed in the package tomcat7 - 7.0.52-1ubuntu0.3
---------------
tomcat7 (7.0.52-1ubuntu0.3) trusty-security; urgency=medium
* SECURITY UPDATE: arbitrary file disclosure via XML parser patches/ CVE-2014- 0119.patch: add defensive coding and ensure org/apache/ catalina/ security/ SecurityClassLo ad.java, org/apache/ catalina/ servlets/ DefaultServlet. java, org/apache/ catalina/ startup/ TldConfig. java, org/apache/ jasper/ compiler/ JspDocumentPars er.java, org/apache/ jasper/ xmlparser/ ParserUtils. java, org/apache/ tomcat/ util/security/ PrivilegedGetTc cl.java, org/apache/ tomcat/ util/security/ PrivilegedSetTc cl.java. patches/ CVE-2014- 0227.patch: add error flag and improve i18n apache/ coyote/ http11/ filters/ ChunkedInputFil ter.java, org/apache/ coyote/ http11/ filters/ LocalStrings. properties. patches/ CVE-2014- 0230.patch: limit amount of data in org/apache/ coyote/ http11/ AbstractHttp11P rocessor. java, org/apache/ coyote/ http11/ AbstractHttp11P rotocol. java, org/apache/ coyote/ http11/ Http11AprProces sor.java, org/apache/ coyote/ http11/ Http11AprProtoc ol.java, org/apache/ coyote/ http11/ Http11NioProces sor.java, org/apache/ coyote/ http11/ Http11NioProtoc ol.java, org/apache/ coyote/ http11/ Http11Processor .java, org/apache/ coyote/ http11/ Http11Protocol. java, org/apache/ coyote/ http11/ filters/ ChunkedInputFil ter.java, org/apache/ coyote/ http11/ filters/ IdentityInputFi lter.java, org/apache/ coyote/ http11/ filters/ LocalStrings. properties, org/apache/ catalina/ core/TestSwallo wAbortedUploads .java, docs/config/ http.xml. patches/ CVE-2014- 7810.patch: handle classes that may not be javax/el/ BeanELResolver. java, remove unnecessary code in org/apache/ jasper/ runtime/ PageContextImpl .java, org/apache/ jasper/ security/ SecurityClassLo ad.java. patches/ 0022-use- tls-in- ssl-unit- tests.patch patches/ 0023-replace- expired- ssl-certificate s.patch source/ include- binaries
(LP: #1449975)
- debian/
TLD parser obtained from cache has correct value of blockExternal in
java/
java/
java/
java/
java/
java/
java/
- CVE-2014-0119
* SECURITY UPDATE: HTTP request smuggling or denial of service via
streaming with malformed chunked transfer encoding (LP: #1449975)
- debian/
in java/org/
java/
- CVE-2014-0227
* SECURITY UPDATE: denial of service via aborted upload attempts
(LP: #1449975)
- debian/
java/
java/
java/
java/
java/
java/
java/
java/
java/
java/
java/
test/
webapps/
- CVE-2014-0230
* SECURITY UPDATE: SecurityManager bypass via Expression Language
- debian/
accessible but have accessible interfaces in
java/
java/
java/
- CVE-2014-7810
* Replace expired ssl certs and use TLS to fix tests causing FTBFS:
- debian/
- debian/
- debian/
-- Marc Deslauriers <email address hidden> Fri, 19 Jun 2015 12:30:21 -0400