Ubuntu 16.04 LTS USN-3024-1 Moderate: Tomcat Security Issues Overview

ubuntu

July 5, 2016

Several security issues were fixed in Tomcat.

Summary

Several security issues were fixed in Tomcat.

Software Description:

- tomcat7: Servlet and JSP engine

- tomcat6: Servlet and JSP engine

Details:

It was discovered that Tomcat incorrectly handled pathnames used by web

applications in a getResource, getResourceAsStream, or getResourcePaths

call. A remote attacker could use this issue to possibly list a parent

directory . This issue only affected Ubuntu 12.04 LTS, Ubuntu 14.04 LTS and

Ubuntu 15.10. (CVE-2015-5174)

It was discovered that the Tomcat mapper component incorrectly handled

redirects. A remote attacker could use this issue to determine the

existence of a directory. This issue only affected Ubuntu 12.04 LTS,

Ubuntu 14.04 LTS and Ubuntu 15.10. (CVE-2015-5345)

It was discovered that Tomcat incorrectly handled different session

settings when multiple versions of the same web application was deployed. A

remote attacker could possibly use this issue to hijack web sessions. This

issue only affected Ubunt...

Read the Full Advisory

Topics Covered

security advisory moderate denial of service remote access Ubuntu Tomcat session hijacking

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 16.04 LTS:
  libtomcat7-java                 7.0.68-1ubuntu0.1

Ubuntu 15.10:
  libtomcat7-java                 7.0.64-1ubuntu0.3

Ubuntu 14.04 LTS:
  libtomcat7-java                 7.0.52-1ubuntu0.6

Ubuntu 12.04 LTS:
  libtomcat6-java                 6.0.35-1ubuntu3.7

In general, a standard system update will make all the necessary changes.