#25067 – CVE-2010-3718, CVE-2010-4172, CVE-2011-0013, CVE-2011-0534: misc vulnerabilities

Bug 25067 - CVE-2010-3718, CVE-2010-4172, CVE-2011-0013, CVE-2011-0534: misc vulnerabilities

Summary: CVE-2010-3718, CVE-2010-4172, CVE-2011-0013, CVE-2011-0534: misc vulnerabilities

Status:	CLOSED FIXED

Alias:	None

Product:	Sisyphus
Classification:	Development
Component:	tomcat6 (show other bugs)
Version:	unstable
Hardware:	all Linux

Importance:	P3 blocker
Assignee:	Nobody's working on this, feel free to take it
QA Contact:	qa-sisyphus

URL:	http://tomcat.apache.org/security-6.html
Keywords:	security

Depends on:
Blocks:

Reported:	2011-02-10 19:19 MSK by Slava Semushin
Modified:	2011-09-08 20:11 MSK (History)
CC List:	0 users

See Also:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description

Slava Semushin 2011-02-10 19:19:06 MSK

Наш Tomcat давно не обновлялся, а неделю назад вышел 6.0.32 в котором исправлена в т.ч. Remote Denial Of Service (CVE-2011-0534)

Кроме, того (скорее всего) актуальны:

low: Cross-site scripting (CVE-2011-0013)
moderate: Cross-site scripting (CVE-2010-4172)
low: SecurityManager file permission bypass (CVE-2010-3718)

Хотелось бы увидеть фиксы, либо новую версию.

Comment 1

viy 2011-02-10 21:28:40 MSK

уже после обновления ant до 1.8, чтобы не патчить build.xml

Comment 2

viy 2011-03-10 20:50:44 MSK

пока залил 6.0.30

Comment 3

viy 2011-09-08 20:11:24 MSK

tomcat6-6.0.32-alt1_15jpp6.src.rpm