Summary
[0:7.0.42-8]
- Resolves: CVE-2013-4590
- Resolves: CVE-2014-0119
[0:7.0.42-7]
- Related: CVE-2014-0099 incrementing release so rpmdiff doesn't complain about
- no new entries in the changelog
[0:7.0.42-6]
- Resolves: CVE-2014-0099 Fix possible overflow when parsing
- long values from byte array
- Resolves: CVE-2014-0096 Information discloser process XSLT
- files not subject to same constraint running under
- java security manager
- Resolves: CVE-2014-0075 Avoid overflow in ChunkedInputFilter.
Fixed packages 10
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 7 | tomcat | 0:7.0.42-8.el7_0 |
| Oracle Linux · 7 | tomcat-admin-webapps | 0:7.0.42-8.el7_0 |
| Oracle Linux · 7 | tomcat-docs-webapp | 0:7.0.42-8.el7_0 |
| Oracle Linux · 7 | tomcat-el-2.2-api | 0:7.0.42-8.el7_0 |
| Oracle Linux · 7 | tomcat-javadoc | 0:7.0.42-8.el7_0 |
| Oracle Linux · 7 | tomcat-jsp-2.2-api | 0:7.0.42-8.el7_0 |
| Oracle Linux · 7 | tomcat-jsvc | 0:7.0.42-8.el7_0 |
| Oracle Linux · 7 | tomcat-lib | 0:7.0.42-8.el7_0 |
| Oracle Linux · 7 | tomcat-servlet-3.0-api | 0:7.0.42-8.el7_0 |
| Oracle Linux · 7 | tomcat-webapps | 0:7.0.42-8.el7_0 |
Vulnerabilities 1
-
Medium —
Missing XML Validation in Apache Tomcat
Apache Tomcat before 6.0.40, 7.x before 7.0.54, and 8.x before 8.0.6 does not properly constrain the class loader that accesses the XML parser used with an XSLT stylesheet, which allows remote attackers to (1) read arbitrary files via a crafted web applicatio…