Security update for tomcat6

SUSE Security Update: Security update for tomcat6
Announcement ID: SUSE-SU-2015:1565-1
Rating: moderate
References: #906152 #917127 #926762 #931442 #932698 #934219
Affected Products:
  • SUSE Linux Enterprise Server 11-SP4
    		•

    An update that solves three vulnerabilities and has three fixes is now available.

    Description:

    This update for Tomcat fixes the following security issues:

    - CVE-2014-7810: Security manager bypass via EL expressions. (bsc#931442)
    It was found that the expression language resolver evaluated expressions
    within a privileged code section. A malicious web application could have
    used this flaw to bypass security manager protections.

    - CVE-2014-0227: Limited DoS in chunked transfer encoding input filter.
    (bsc#917127) It was discovered that the ChunkedInputFilter
    implementation did not fail subsequent attempts to read input early
    enough. A remote attacker could have used this flaw to perform a denial
    of service attack, by streaming an unlimited quantity of data, leading
    to consumption of server resources.

    - CVE-2014-0230: Non-persistent DoS attack by feeding data by aborting an
    upload It was possible for a remote attacker to trigger a non-persistent
    DoS attack by feeding data by aborting an upload. (bsc#926762)

    Additionally, the following non-security issues have been fixed:

    - Fix rights of all files within /usr/share/tomcat6/bin. (bsc#906152)
    - Don't overwrite /var/run/tomcat6.pid when Tomcat is already running.
    (bsc#934219)
    - Miscellaneous fixes and improvements to Tomcat's init script.
    (bsc#932698)

    Patch Instructions:

    To install this SUSE Security Update use YaST online_update.
    Alternatively you can run the command listed for your product:

    • SUSE Linux Enterprise Server 11-SP4:
      zypper in -t patch slessp4-tomcat6-12092=1

    To bring your system up-to-date, use "zypper patch".

    Package List:

    • SUSE Linux Enterprise Server 11-SP4 (noarch):
      • tomcat6-6.0.41-0.47.1
      • tomcat6-admin-webapps-6.0.41-0.47.1
      • tomcat6-docs-webapp-6.0.41-0.47.1
      • tomcat6-javadoc-6.0.41-0.47.1
      • tomcat6-jsp-2_1-api-6.0.41-0.47.1
      • tomcat6-lib-6.0.41-0.47.1
      • tomcat6-servlet-2_5-api-6.0.41-0.47.1
      • tomcat6-webapps-6.0.41-0.47.1

    References: