Bug 25067 - CVE-2010-3718, CVE-2010-4172, CVE-2011-0013, CVE-2011-0534: misc vulnerabilities
Summary: CVE-2010-3718, CVE-2010-4172, CVE-2011-0013, CVE-2011-0534: misc vulnerabilities
Status: CLOSED FIXED
Alias: None
Product: Sisyphus
Classification: Development
Component: tomcat6 (show other bugs)
Version: unstable
Hardware: all Linux
: P3 blocker
Assignee: Nobody's working on this, feel free to take it
QA Contact: qa-sisyphus
URL: http://tomcat.apache.org/security-6.html
Keywords: security
Depends on:
Blocks:
 
Reported: 2011-02-10 19:19 MSK by Slava Semushin
Modified: 2011-09-08 20:11 MSK (History)
0 users

See Also:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Slava Semushin 2011-02-10 19:19:06 MSK 
Наш Tomcat давно не обновлялся, а неделю назад вышел 6.0.32 в котором исправлена в т.ч. Remote Denial Of Service (CVE-2011-0534)

Кроме, того (скорее всего) актуальны:

low: Cross-site scripting (CVE-2011-0013)
moderate: Cross-site scripting (CVE-2010-4172)
low: SecurityManager file permission bypass (CVE-2010-3718)

Хотелось бы увидеть фиксы, либо новую версию.
Comment 1 viy 2011-02-10 21:28:40 MSK 
уже после обновления ant до 1.8, чтобы не патчить build.xml
Comment 2 viy 2011-03-10 20:50:44 MSK 
пока залил 6.0.30
Comment 3 viy 2011-09-08 20:11:24 MSK 
tomcat6-6.0.32-alt1_15jpp6.src.rpm