Explore top 10 tips to secure your open-source projects now. Read More

×
Alerts This Week
Warning Icon 1 496
Alerts This Week
Warning Icon 1 496

SUSE: 2016:3079-1 Critical: Tomcat Remote Code Execution Threat

suse
Calendar Grey December 10, 2016
Scroller Suse
Crucial SUSE patch addresses significant Apache Tomcat security flaws, including risks of remote code execution and problems related to HTTP request smuggling.
An update that solves 7 vulnerabilities and has four fixes An update that solves 7 vulnerabilities and has four fixes An update that solves 7 vulnerabilities and has four fixes is ...

Summary

This update for Tomcat provides the following fixes: Feature changes: The embedded Apache Commons DBCP component was updated to version 2.0. (bsc#1010893 fate#321029) Security fixes: - CVE-2016-0762: Realm Timing Attack (bsc#1007854) - CVE-2016-5018: Security Manager Bypass (bsc#1007855) - CVE-2016-6794: System Property Disclosure (bsc#1007857) - CVE-2016-6796: Manager Bypass (bsc#1007858) - CVE-2016-6797: Unrestricted Access to Global Resources (bsc#1007853) - CVE-2016-8735: Remote code execution vulnerability in JmxRemoteLifecycleListener (bsc#1011805) - CVE-2016-6816: HTTP Request smuggling vulnerability due to permitting invalid character in HTTP requests (bsc#1011812) Bugs fixed: - Fixed StringIndexOutOfBoundsException in WebAppClassLoaderBase.filter(). (bsc#974407)

Topics%20covered

Topics Covered

security advisory security update critical remote execution SUSE tomcat HTTP smuggling

References

#1002639 #1004728 #1007853 #1007854 #1007855

#1007857 #1007858 #1010893 #1011805 #1011812

#974407

Cross- CVE-2016-0762 CVE-2016-5018 CVE-2016-6794

CVE-2016-6796 CVE-2016-6797 CVE-2016-6816

CVE-2016-8735

Affected Products:

SUSE Linux Enterprise Server 12-SP1

https://www.suse.com/security/cve/CVE-2016-0762.html

https://www.suse.com/security/cve/CVE-2016-5018.html

https://www.suse.com/security/cve/CVE-2016-6794.html

https://www.suse.com/security/cve/CVE-2016-6796.html

https://www.suse.com/security/cve/CVE-2016-6797.html

https://www.suse.com/security/cve/CVE-2016-6816.html

https://www.suse.com/security/cve/CVE-2016-8735.html

https://bugzilla.suse.com/1002639

https://bugzilla.suse.com/1004728

https://bugzilla.suse.com/1007853

Severity
important
Lowest
Low
Medium
High
Critical

Announcement ID: SUSE-SU-2016:3079-1
Rating: important

Topics%20covered

Topics Covered

security advisory security update critical remote execution SUSE tomcat HTTP smuggling

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.