Debian 4.0: DSA-1453-1 Critical: Tomcat5 Information Leak Issue

It was discovered that single quotes (') in cookies were treated
as a delimiter, which could lead to an information leak.

CVE-2007-3385

It was discovered that the character sequence \" in cookies was
handled incorrectly, which could lead to an information leak.

CVE-2007-5461

It was discovered that the WebDAV servlet is vulnerable to absolute
path traversal.

For the stable distribution (etch), these problems have been fixed in
version 5.0.30-12etch1.

The old stable distribution (sarge) doesn't contain tomcat5.

The unstable distribution (sid) no longer contains tomcat5.

We recommend that you upgrade your tomcat5 packages.

Upgrade instructions
- --------------------wget url
will fetch the file for you
dpkg -i file.deb
will install the referenced file.

If you are using the apt-get package manager, use the line for
sources.list as given below:

apt-get update
will update the internal database
apt-get upgrade
will install ...