File _patchinfo of Package patchinfo.2154

<patchinfo incident="2154">
  <issue id="967965" tracker="bnc">VUL-0: CVE-2015-5345: tomcat6, tomcat: directory disclosure</issue>
  <issue id="967964" tracker="bnc">VUL-0: CVE-2016-0714: tomcat6, tomcat: Security Manager bypass via persistence mechanisms</issue>
  <issue id="967967" tracker="bnc">VUL-0: CVE-2015-5174: tomcat6, tomcat: URL Normalization issue</issue>
  <issue id="967966" tracker="bnc">VUL-0: CVE-2016-0763: tomcat6, tomcat: security manager bypass via setGlobalContext()</issue>
  <issue id="967815" tracker="bnc">VUL-0: CVE-2016-0706: tomcat6, tomcat: security manager bypass via StatusManagerServlet</issue>
  <issue id="967814" tracker="bnc">VUL-0: CVE-2015-5346: tomcat6, tomcat: Session fixation</issue>
  <issue id="967812" tracker="bnc">VUL-0: CVE-2015-5351: tomcat6, tomcat: CSRF token leak</issue>
  <issue id="CVE-2015-5174" tracker="cve" />
  <issue id="CVE-2015-5346" tracker="cve" />
  <issue id="CVE-2015-5345" tracker="cve" />
  <issue id="CVE-2016-0714" tracker="cve" />
  <issue id="CVE-2016-0706" tracker="cve" />
  <issue id="CVE-2016-0763" tracker="cve" />
  <issue id="CVE-2015-5351" tracker="cve" />
  <category>security</category>
  <rating>important</rating>
  <packager>dmacvicar</packager>
  <description>
This update for tomcat fixes the following security issues.

Tomcat has been updated from 7.0.55 to 7.0.68.

* CVE-2015-5174: Directory traversal vulnerability in RequestUtil.java
  in Apache Tomcat allowed remote authenticated users to bypass intended
  SecurityManager restrictions and list a parent directory via a /.. (slash
  dot dot) in a pathname used by a web application in a getResource,
  getResourceAsStream, or getResourcePaths call, as demonstrated by the
  $CATALINA_BASE/webapps directory.  (bsc#967967)
* CVE-2015-5346: Session fixation vulnerability in Apache Tomcat when
  different session settings are used for deployments of multiple versions
  of the same web application, might have allowed remote attackers
  to hijack web sessions by leveraging use of a requestedSessionSSL
  field for an unintended request, related to CoyoteAdapter.java and
  Request.java. (bsc#967814)
* CVE-2015-5345: The Mapper component in Apache Tomcat processes redirects
  before considering security constraints and Filters, which allowed remote
  attackers to determine the existence of a directory via a URL that lacks
  a trailing / (slash) character. (bsc#967965)
* CVE-2015-5351: The (1) Manager and (2) Host Manager applications in
  Apache Tomcat established sessions and send CSRF tokens for arbitrary
  new requests, which allowed remote attackers to bypass a CSRF protection
  mechanism by using a token. (bsc#967812)
* CVE-2016-0706: Apache Tomcat did not place
  org.apache.catalina.manager.StatusManagerServlet on the
  org/apache/catalina/core/RestrictedServlets.properties list, which
  allowed remote authenticated users to bypass intended SecurityManager
  restrictions and read arbitrary HTTP requests, and consequently discover
  session ID values, via a crafted web application.  (bsc#967815)
* CVE-2016-0714: The session-persistence implementation in Apache Tomcat
  mishandled session attributes, which allowed remote authenticated users
  to bypass intended SecurityManager restrictions and execute arbitrary
  code in a privileged context via a web application that places a crafted
  object in a session. (bsc#967964)
* CVE-2016-0763: The setGlobalContext method in
  org/apache/naming/factory/ResourceLinkFactory.java in Apache Tomcat did
  not consider whether ResourceLinkFactory.setGlobalContext callers are
  authorized, which allowed remote authenticated users to bypass intended
  SecurityManager restrictions and read or write to arbitrary application
  data, or cause a denial of service (application disruption), via a web
  application that sets a crafted global context.  (bsc#967966)

See https://tomcat.apache.org/tomcat-7.0-doc/changelog.html
  for other fixes since 7.0.55
</description>
  <summary>Security update for tomcat</summary>
</patchinfo>