SUSE Security Update: Security update for tomcat6
______________________________________________________________________________

Announcement ID:    SUSE-SU-2017:1632-1
Rating:             important
References:         #1007853 #1007854 #1007855 #1007857 #1007858 
                    #1011805 #1011812 #1015119 #1033448 #1036642 
                    #988489 
Cross-References:   CVE-2016-0762 CVE-2016-5018 CVE-2016-5388
                    CVE-2016-6794 CVE-2016-6796 CVE-2016-6797
                    CVE-2016-6816 CVE-2016-8735 CVE-2016-8745
                    CVE-2017-5647
Affected Products:
                    SUSE Linux Enterprise Server 11-SP4
                    SUSE Linux Enterprise Server 11-SP3-LTSS
                    SUSE Linux Enterprise Point of Sale 11-SP3
______________________________________________________________________________

   An update that solves 10 vulnerabilities and has one errata
   is now available.

Description:

   This update for tomcat6 fixes the following issues:

   Tomcat was updated to version 6.0.53:

   The full changelog is:
   http://tomcat.apache.org/tomcat-6.0-doc/changelog.html

   Security issues fixed:

   - CVE-2017-5647: A bug in the handling of pipelined requests could lead to
     information disclosure (bsc#1036642)
   - CVE-2016-8745: Regression in the error handling methods could lead to
     information disclosure (bsc#1015119)
   - CVE-2016-8735: Remote code execution vulnerability in
     JmxRemoteLifecycleListener (bsc#1011805)
   - CVE-2016-6816: HTTP Request smuggling vulnerability due to permitting
     invalid character in HTTP requests (bsc#1011812)
   - CVE-2016-6797: Unrestricted Access to Global Resources (bsc#1007853)
   - CVE-2016-6796: Manager Bypass (bsc#1007858)
   - CVE-2016-6794: System Property Disclosure (bsc#1007857)
   - CVE-2016-5018: Security Manager Bypass (bsc#1007855)
   - CVE-2016-0762: Realm Timing Attack (bsc#1007854)
   - CVE-2016-5388: an arbitrary HTTP_PROXY environment variable might allow
     remote attackers to redirect  outbound HTTP traffic (bsc#988489)


Patch Instructions:

   To install this SUSE Security Update use YaST online_update.
   Alternatively you can run the command listed for your product:

   - SUSE Linux Enterprise Server 11-SP4:

      zypper in -t patch slessp4-tomcat6-13162=1

   - SUSE Linux Enterprise Server 11-SP3-LTSS:

      zypper in -t patch slessp3-tomcat6-13162=1

   - SUSE Linux Enterprise Point of Sale 11-SP3:

      zypper in -t patch sleposp3-tomcat6-13162=1

   To bring your system up-to-date, use "zypper patch".


Package List:

   - SUSE Linux Enterprise Server 11-SP4 (noarch):

      tomcat6-6.0.53-0.56.1
      tomcat6-admin-webapps-6.0.53-0.56.1
      tomcat6-docs-webapp-6.0.53-0.56.1
      tomcat6-javadoc-6.0.53-0.56.1
      tomcat6-jsp-2_1-api-6.0.53-0.56.1
      tomcat6-lib-6.0.53-0.56.1
      tomcat6-servlet-2_5-api-6.0.53-0.56.1
      tomcat6-webapps-6.0.53-0.56.1

   - SUSE Linux Enterprise Server 11-SP3-LTSS (noarch):

      tomcat6-6.0.53-0.56.1
      tomcat6-admin-webapps-6.0.53-0.56.1
      tomcat6-docs-webapp-6.0.53-0.56.1
      tomcat6-javadoc-6.0.53-0.56.1
      tomcat6-jsp-2_1-api-6.0.53-0.56.1
      tomcat6-lib-6.0.53-0.56.1
      tomcat6-servlet-2_5-api-6.0.53-0.56.1
      tomcat6-webapps-6.0.53-0.56.1

   - SUSE Linux Enterprise Point of Sale 11-SP3 (noarch):

      tomcat6-6.0.53-0.56.1
      tomcat6-admin-webapps-6.0.53-0.56.1
      tomcat6-docs-webapp-6.0.53-0.56.1
      tomcat6-javadoc-6.0.53-0.56.1
      tomcat6-jsp-2_1-api-6.0.53-0.56.1
      tomcat6-lib-6.0.53-0.56.1
      tomcat6-servlet-2_5-api-6.0.53-0.56.1
      tomcat6-webapps-6.0.53-0.56.1


References:

   https://www.suse.com/security/cve/CVE-2016-0762.html
   https://www.suse.com/security/cve/CVE-2016-5018.html
   https://www.suse.com/security/cve/CVE-2016-5388.html
   https://www.suse.com/security/cve/CVE-2016-6794.html
   https://www.suse.com/security/cve/CVE-2016-6796.html
   https://www.suse.com/security/cve/CVE-2016-6797.html
   https://www.suse.com/security/cve/CVE-2016-6816.html
   https://www.suse.com/security/cve/CVE-2016-8735.html
   https://www.suse.com/security/cve/CVE-2016-8745.html
   https://www.suse.com/security/cve/CVE-2017-5647.html
   https://bugzilla.suse.com/1007853
   https://bugzilla.suse.com/1007854
   https://bugzilla.suse.com/1007855
   https://bugzilla.suse.com/1007857
   https://bugzilla.suse.com/1007858
   https://bugzilla.suse.com/1011805
   https://bugzilla.suse.com/1011812
   https://bugzilla.suse.com/1015119
   https://bugzilla.suse.com/1033448
   https://bugzilla.suse.com/1036642
   https://bugzilla.suse.com/988489

SuSE: 2017:1632-1: important: tomcat6

June 21, 2017
An update that solves 10 vulnerabilities and has one errata An update that solves 10 vulnerabilities and has one errata An update that solves 10 vulnerabilities and has one errata ...

Summary

This update for tomcat6 fixes the following issues: Tomcat was updated to version 6.0.53: The full changelog is: http://tomcat.apache.org/tomcat-6.0-doc/changelog.html Security issues fixed: - CVE-2017-5647: A bug in the handling of pipelined requests could lead to information disclosure (bsc#1036642) - CVE-2016-8745: Regression in the error handling methods could lead to information disclosure (bsc#1015119) - CVE-2016-8735: Remote code execution vulnerability in JmxRemoteLifecycleListener (bsc#1011805) - CVE-2016-6816: HTTP Request smuggling vulnerability due to permitting invalid character in HTTP requests (bsc#1011812) - CVE-2016-6797: Unrestricted Access to Global Resources (bsc#1007853) - CVE-2016-6796: Manager Bypass (bsc#1007858) - CVE-2016-6794: System Property Disclosure (bsc#1007857) - CVE-2016-5018: Security Manager Bypass (bsc#1007855) - CVE-2016-0762: Realm Timing Attack (bsc#1007854) - CVE-2016-5388: an arbitrary HTTP_PROXY environment variable might allow remote attackers to redirect outbound HTTP traffic (bsc#988489) Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 11-SP4: zypper in -t patch slessp4-tomcat6-13162=1 - SUSE Linux Enterprise Server 11-SP3-LTSS: zypper in -t patch slessp3-tomcat6-13162=1 - SUSE Linux Enterprise Point of Sale 11-SP3: zypper in -t patch sleposp3-tomcat6-13162=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 11-SP4 (noarch): tomcat6-6.0.53-0.56.1 tomcat6-admin-webapps-6.0.53-0.56.1 tomcat6-docs-webapp-6.0.53-0.56.1 tomcat6-javadoc-6.0.53-0.56.1 tomcat6-jsp-2_1-api-6.0.53-0.56.1 tomcat6-lib-6.0.53-0.56.1 tomcat6-servlet-2_5-api-6.0.53-0.56.1 tomcat6-webapps-6.0.53-0.56.1 - SUSE Linux Enterprise Server 11-SP3-LTSS (noarch): tomcat6-6.0.53-0.56.1 tomcat6-admin-webapps-6.0.53-0.56.1 tomcat6-docs-webapp-6.0.53-0.56.1 tomcat6-javadoc-6.0.53-0.56.1 tomcat6-jsp-2_1-api-6.0.53-0.56.1 tomcat6-lib-6.0.53-0.56.1 tomcat6-servlet-2_5-api-6.0.53-0.56.1 tomcat6-webapps-6.0.53-0.56.1 - SUSE Linux Enterprise Point of Sale 11-SP3 (noarch): tomcat6-6.0.53-0.56.1 tomcat6-admin-webapps-6.0.53-0.56.1 tomcat6-docs-webapp-6.0.53-0.56.1 tomcat6-javadoc-6.0.53-0.56.1 tomcat6-jsp-2_1-api-6.0.53-0.56.1 tomcat6-lib-6.0.53-0.56.1 tomcat6-servlet-2_5-api-6.0.53-0.56.1 tomcat6-webapps-6.0.53-0.56.1

References

#1007853 #1007854 #1007855 #1007857 #1007858

#1011805 #1011812 #1015119 #1033448 #1036642

#988489

Cross- CVE-2016-0762 CVE-2016-5018 CVE-2016-5388

CVE-2016-6794 CVE-2016-6796 CVE-2016-6797

CVE-2016-6816 CVE-2016-8735 CVE-2016-8745

CVE-2017-5647

Affected Products:

SUSE Linux Enterprise Server 11-SP4

SUSE Linux Enterprise Server 11-SP3-LTSS

SUSE Linux Enterprise Point of Sale 11-SP3

https://www.suse.com/security/cve/CVE-2016-0762.html

https://www.suse.com/security/cve/CVE-2016-5018.html

https://www.suse.com/security/cve/CVE-2016-5388.html

https://www.suse.com/security/cve/CVE-2016-6794.html

https://www.suse.com/security/cve/CVE-2016-6796.html

https://www.suse.com/security/cve/CVE-2016-6797.html

https://www.suse.com/security/cve/CVE-2016-6816.html

https://www.suse.com/security/cve/CVE-2016-8735.html

https://www.suse.com/security/cve/CVE-2016-8745.html

https://www.suse.com/security/cve/CVE-2017-5647.html

https://bugzilla.suse.com/1007853

https://bugzilla.suse.com/1007854

https://bugzilla.suse.com/1007855

https://bugzilla.suse.com/1007857

https://bugzilla.suse.com/1007858

https://bugzilla.suse.com/1011805

https://bugzilla.suse.com/1011812

https://bugzilla.suse.com/1015119

https://bugzilla.suse.com/1033448

https://bugzilla.suse.com/1036642

https://bugzilla.suse.com/988489

Severity
Announcement ID: SUSE-SU-2017:1632-1
Rating: important

Related News

24.Key Code Esm H320
2 - 3 min read
The Akira ransomware group has extorted approximately $42 million from over 250 victims since January 1, 2024. The group initially focused on
5.ShakingHands Esm H320
2 - 3 min read
At The Linux Foundation's Open Source Summit North America , Linus Torvalds, the creator of Linux, discussed various topics related to Linux
30.Lock Globe Motherboard Esm H320
1 - 2 min read
The SPDX 3.0 release marks a significant milestone in software management, particularly for Linux admins, infosec professionals, internet security
11.Locks IsometricPattern Esm H320
2 - 3 min read
Open Source maintainers and developers have been warned about the continued wave of attacks aimed at project maintainers similar to those recently
28.Lock Globe Esm H320
1 - 2 min read
A resurgence of cyberattacks targeting Linux systems in Asian campaigns through the utilization of the Pupy Remote Access Trojan (RAT) has been
27.Tablet Connections Blocks Lock Esm H320
2 - 4 min read
Canonical has recently announced the Beta release of Ubuntu Linux 24.04 LTS , codenamed "Noble Numbat." This release aims to continue Ubuntu's
21.Globe RadiatingCode Esm H320
2 - 3 min read
The open-source movement has come a long way, from its origins in the 1960s and 1970s to becoming an integral part of organizations worldwide.
13.Lock StylizedMotherboard Esm H320
2 - 3 min read
The Rust-based Edera project demonstrates a unique approach to container security that addresses cloud-native computing challenges. Let's examine
Sign Up

Get the Latest News & Insights

Sign up to get the latest security news affecting Linux and open source delivered straight to your inbox.

© 2024 Guardian Digital, Inc All Rights Reserved