Debian Security Advisory

DSA-3721-1 tomcat7 -- security update

Date Reported:

21 Nov 2016

Affected Packages:

Vulnerable:

Yes

Security database references:

In the Debian bugtracking system: Bug 841655, Bug 842662, Bug 842663, Bug 842664, Bug 842665, Bug 842666.
In Mitre's CVE dictionary: CVE-2016-0762, CVE-2016-5018, CVE-2016-6794, CVE-2016-6796, CVE-2016-6797.

More information:

Multiple security vulnerabilities have been discovered in the Tomcat servlet and JSP engine, which may result in possible timing attacks to determine valid user names, bypass of the SecurityManager, disclosure of system properties, unrestricted access to global resources, arbitrary file overwrites, and potentially escalation of privileges.

For the stable distribution (jessie), these problems have been fixed in version 7.0.56-3+deb8u5.

We recommend that you upgrade your tomcat7 packages.