Stay Secure with the Latest Linux Advisories

security advisorycriticalsoftware update

Debian: DSA-3450-4 Severe: Apache2 Security Risk Mitigation

It was discovered that malicious web applications could use the Expression Language to bypass protections of a Security Manager as expressions were evaluated within a privileged code section. . - ------------------------------------------------------------------------- Debian Security Advisory DSA-3447-1 This email address is being protected from spambots. You need JavaScript enabled to view it. https://www.debian.org/security/ Salvatore Bonaccorso January 17, 2016 https://www.debian.org/security/faq - ------------------------------------------------------------------------- Package : tomcat7 CVE ID : CVE-2014-7810 It was discovered that malicious web applications could use the Expression Language to bypass protections of a Security Manager as expressions were evaluated within a privileged code section. For the oldstable distribution (wheezy), this problem has been fixed in version 7.0.28-4+deb7u3. This update also provides fixes for CVE-2013-4444, CVE-2014-0075, CVE-2014-0099, CVE-2014-0227 and CVE-2014-0230, which were all fixed for the stable distribution (jessie) already. For the stable distribution (jessie), this problem has been fixed in version 7.0.56-3+deb8u1. For the testing distribution (stretch), this problem has been fixed in version 7.0.61-1. For the unstable distribution (sid), this problem has been fixed in version 7.0.61-1. We recommend that you upgrade your tomcat7 packages. Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/ Mailing list: This email address is being protected from spambots. You need JavaScript enabled to view it. . Explore strategies to combat harmful web applications that evade security protocols in Tomcat 7 on Debian systems.. Tomcat7 Update, Access Control Bypass, Debian Security, Application Protection. . Severity: Critical. LinuxSecurity.com Team

Jan 17, 2016 •Critical Debian