SUSE Security Update: Security update for tomcat
______________________________________________________________________________

Announcement ID:    SUSE-SU-2017:1660-1
Rating:             important
References:         #1007853 #1007854 #1007855 #1007857 #1007858 
                    #1011805 #1011812 #1015119 #1033447 #1033448 
                    #986359 #988489 
Cross-References:   CVE-2016-0762 CVE-2016-3092 CVE-2016-5018
                    CVE-2016-5388 CVE-2016-6794 CVE-2016-6796
                    CVE-2016-6797 CVE-2016-6816 CVE-2016-8735
                    CVE-2016-8745 CVE-2017-5647 CVE-2017-5648
                   
Affected Products:
                    SUSE Linux Enterprise Server for SAP 12
                    SUSE Linux Enterprise Server 12-LTSS
______________________________________________________________________________

   An update that fixes 12 vulnerabilities is now available.

Description:


   Tomcat was updated to version 7.0.78, fixing various bugs and security
   issues.

   For full details see
   https://tomcat.apache.org/tomcat-7.0-doc/changelog.html

   Security issues fixed:

   - CVE-2016-0762: A realm timing attack in tomcat was fixed which could
     disclose existence of users (bsc#1007854)
   - CVE-2016-3092: Usage of vulnerable FileUpload package could have
     resulted in denial of service (bsc#986359)
   - CVE-2016-5018: A security manager bypass via a Tomcat utility method
     that was accessible to web applications was fixed. (bsc#1007855)
   - CVE-2016-5388: Setting HTTP_PROXY environment variable via Proxy header
     (bsc#988489)
   - CVE-2016-6794: A tomcat system property disclosure was fixed.
     (bsc#1007857)
   - CVE-2016-6796: A tomcat security manager bypass via manipulation of the
     configuration parameters for the JSP Servlet. (bsc#1007858)
   - CVE-2016-6797: A tomcat unrestricted access to global resources via
     ResourceLinkFactory was fixed. (bsc#1007853)
   - CVE-2016-6816: A HTTP Request smuggling vulnerability due to permitting
     invalid character in HTTP requests was fixed. (bsc#1011812)
   - CVE-2016-8735: A Remote code execution vulnerability in
     JmxRemoteLifecycleListener was fixed (bsc#1011805)
   - CVE-2016-8745: A Tomcat Information Disclosure in the error handling of
     send file code for the NIO HTTP connector was fixed. (bsc#1015119)
   - CVE-2017-5647: A tomcat information disclosure in pipelined request
     processing was fixed. (bsc#1033448)
   - CVE-2017-5648: A tomcat information disclosure due to using incorrect
     facade objects was fixed (bsc#1033447)


Patch Instructions:

   To install this SUSE Security Update use YaST online_update.
   Alternatively you can run the command listed for your product:

   - SUSE Linux Enterprise Server for SAP 12:

      zypper in -t patch SUSE-SLE-SAP-12-2017-1027=1

   - SUSE Linux Enterprise Server 12-LTSS:

      zypper in -t patch SUSE-SLE-SERVER-12-2017-1027=1

   To bring your system up-to-date, use "zypper patch".


Package List:

   - SUSE Linux Enterprise Server for SAP 12 (noarch):

      tomcat-7.0.78-7.13.4
      tomcat-admin-webapps-7.0.78-7.13.4
      tomcat-docs-webapp-7.0.78-7.13.4
      tomcat-el-2_2-api-7.0.78-7.13.4
      tomcat-javadoc-7.0.78-7.13.4
      tomcat-jsp-2_2-api-7.0.78-7.13.4
      tomcat-lib-7.0.78-7.13.4
      tomcat-servlet-3_0-api-7.0.78-7.13.4
      tomcat-webapps-7.0.78-7.13.4

   - SUSE Linux Enterprise Server 12-LTSS (noarch):

      tomcat-7.0.78-7.13.4
      tomcat-admin-webapps-7.0.78-7.13.4
      tomcat-docs-webapp-7.0.78-7.13.4
      tomcat-el-2_2-api-7.0.78-7.13.4
      tomcat-javadoc-7.0.78-7.13.4
      tomcat-jsp-2_2-api-7.0.78-7.13.4
      tomcat-lib-7.0.78-7.13.4
      tomcat-servlet-3_0-api-7.0.78-7.13.4
      tomcat-webapps-7.0.78-7.13.4


References:

   https://www.suse.com/security/cve/CVE-2016-0762.html
   https://www.suse.com/security/cve/CVE-2016-3092.html
   https://www.suse.com/security/cve/CVE-2016-5018.html
   https://www.suse.com/security/cve/CVE-2016-5388.html
   https://www.suse.com/security/cve/CVE-2016-6794.html
   https://www.suse.com/security/cve/CVE-2016-6796.html
   https://www.suse.com/security/cve/CVE-2016-6797.html
   https://www.suse.com/security/cve/CVE-2016-6816.html
   https://www.suse.com/security/cve/CVE-2016-8735.html
   https://www.suse.com/security/cve/CVE-2016-8745.html
   https://www.suse.com/security/cve/CVE-2017-5647.html
   https://www.suse.com/security/cve/CVE-2017-5648.html
   https://bugzilla.suse.com/1007853
   https://bugzilla.suse.com/1007854
   https://bugzilla.suse.com/1007855
   https://bugzilla.suse.com/1007857
   https://bugzilla.suse.com/1007858
   https://bugzilla.suse.com/1011805
   https://bugzilla.suse.com/1011812
   https://bugzilla.suse.com/1015119
   https://bugzilla.suse.com/1033447
   https://bugzilla.suse.com/1033448
   https://bugzilla.suse.com/986359
   https://bugzilla.suse.com/988489

SuSE: 2017:1660-1: important: tomcat

June 23, 2017
An update that fixes 12 vulnerabilities is now available

Summary

Tomcat was updated to version 7.0.78, fixing various bugs and security issues. For full details see https://tomcat.apache.org/tomcat-7.0-doc/changelog.html Security issues fixed: - CVE-2016-0762: A realm timing attack in tomcat was fixed which could disclose existence of users (bsc#1007854) - CVE-2016-3092: Usage of vulnerable FileUpload package could have resulted in denial of service (bsc#986359) - CVE-2016-5018: A security manager bypass via a Tomcat utility method that was accessible to web applications was fixed. (bsc#1007855) - CVE-2016-5388: Setting HTTP_PROXY environment variable via Proxy header (bsc#988489) - CVE-2016-6794: A tomcat system property disclosure was fixed. (bsc#1007857) - CVE-2016-6796: A tomcat security manager bypass via manipulation of the configuration parameters for the JSP Servlet. (bsc#1007858) - CVE-2016-6797: A tomcat unrestricted access to global resources via ResourceLinkFactory was fixed. (bsc#1007853) - CVE-2016-6816: A HTTP Request smuggling vulnerability due to permitting invalid character in HTTP requests was fixed. (bsc#1011812) - CVE-2016-8735: A Remote code execution vulnerability in JmxRemoteLifecycleListener was fixed (bsc#1011805) - CVE-2016-8745: A Tomcat Information Disclosure in the error handling of send file code for the NIO HTTP connector was fixed. (bsc#1015119) - CVE-2017-5647: A tomcat information disclosure in pipelined request processing was fixed. (bsc#1033448) - CVE-2017-5648: A tomcat information disclosure due to using incorrect facade objects was fixed (bsc#1033447) Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server for SAP 12: zypper in -t patch SUSE-SLE-SAP-12-2017-1027=1 - SUSE Linux Enterprise Server 12-LTSS: zypper in -t patch SUSE-SLE-SERVER-12-2017-1027=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server for SAP 12 (noarch): tomcat-7.0.78-7.13.4 tomcat-admin-webapps-7.0.78-7.13.4 tomcat-docs-webapp-7.0.78-7.13.4 tomcat-el-2_2-api-7.0.78-7.13.4 tomcat-javadoc-7.0.78-7.13.4 tomcat-jsp-2_2-api-7.0.78-7.13.4 tomcat-lib-7.0.78-7.13.4 tomcat-servlet-3_0-api-7.0.78-7.13.4 tomcat-webapps-7.0.78-7.13.4 - SUSE Linux Enterprise Server 12-LTSS (noarch): tomcat-7.0.78-7.13.4 tomcat-admin-webapps-7.0.78-7.13.4 tomcat-docs-webapp-7.0.78-7.13.4 tomcat-el-2_2-api-7.0.78-7.13.4 tomcat-javadoc-7.0.78-7.13.4 tomcat-jsp-2_2-api-7.0.78-7.13.4 tomcat-lib-7.0.78-7.13.4 tomcat-servlet-3_0-api-7.0.78-7.13.4 tomcat-webapps-7.0.78-7.13.4

References

#1007853 #1007854 #1007855 #1007857 #1007858

#1011805 #1011812 #1015119 #1033447 #1033448

#986359 #988489

Cross- CVE-2016-0762 CVE-2016-3092 CVE-2016-5018

CVE-2016-5388 CVE-2016-6794 CVE-2016-6796

CVE-2016-6797 CVE-2016-6816 CVE-2016-8735

CVE-2016-8745 CVE-2017-5647 CVE-2017-5648

Affected Products:

SUSE Linux Enterprise Server for SAP 12

SUSE Linux Enterprise Server 12-LTSS

https://www.suse.com/security/cve/CVE-2016-0762.html

https://www.suse.com/security/cve/CVE-2016-3092.html

https://www.suse.com/security/cve/CVE-2016-5018.html

https://www.suse.com/security/cve/CVE-2016-5388.html

https://www.suse.com/security/cve/CVE-2016-6794.html

https://www.suse.com/security/cve/CVE-2016-6796.html

https://www.suse.com/security/cve/CVE-2016-6797.html

https://www.suse.com/security/cve/CVE-2016-6816.html

https://www.suse.com/security/cve/CVE-2016-8735.html

https://www.suse.com/security/cve/CVE-2016-8745.html

https://www.suse.com/security/cve/CVE-2017-5647.html

https://www.suse.com/security/cve/CVE-2017-5648.html

https://bugzilla.suse.com/1007853

https://bugzilla.suse.com/1007854

https://bugzilla.suse.com/1007855

https://bugzilla.suse.com/1007857

https://bugzilla.suse.com/1007858

https://bugzilla.suse.com/1011805

https://bugzilla.suse.com/1011812

https://bugzilla.suse.com/1015119

https://bugzilla.suse.com/1033447

https://bugzilla.suse.com/1033448

https://bugzilla.suse.com/986359

https://bugzilla.suse.com/988489

Severity
Announcement ID: SUSE-SU-2017:1660-1
Rating: important

Related News

19.Laptop Bed Esm H320
2 - 3 min read
The release of Google Chrome 124 addresses four vulnerabilities, including a critical security flaw that can enable attackers to execute arbitrary
23.Tablet Connections Esm H320
2 - 3 min read
The release of Ubuntu 24.04 LTS , also known as Noble Numbat, brings various security enhancements and exciting new features . These improvements
4.Lock AbstractDigital Esm H320
2 - 3 min read
Tails 6.2 is a new Linux distribution release that expands its multilingual support and improves security features. The distribution is a
19.Laptop Bed Esm H320
2 - 3 min read
AlmaLinux 9.4 beta has been released and provides compelling reasons to consider it for desktop usage. While AlmaLinux is primarily known as a
32.Lock Code Circular Esm H320
2 - 3 min read
Linux admins and security practitioners face significant challenges in keeping their Linux systems secure amidst the constant threat of kernel bugs.
1.Penguin Landscape Esm H320
2 - 3 min read
A significant security threat, known as the Spectre v2 exploit, has been observed targeting Linux systems running on modern Intel processors. Let's
10.FingerPrint Locks Esm H320
2 - 3 min read
The recent release of I2P 2.5.0 , an anonymous P2P network that protects against online censorship, surveillance, and monitoring, has brought a slew
24.Key Code Esm H320
2 - 3 min read
The Akira ransomware group has extorted approximately $42 million from over 250 victims since January 1, 2024. The group initially focused on
Sign Up

Get the Latest News & Insights

Sign up to get the latest security news affecting Linux and open source delivered straight to your inbox.

© 2024 Guardian Digital, Inc All Rights Reserved