| Description: | Description:
The remote host is missing an update to tomcat6
announced via advisory FEDORA-2008-7977.
Update Information:
This release fixes several security-related issues. In addition, this release
fixes several user-reported problems related to the startup scripts and file
layout.
ChangeLog:
* Tue Aug 26 2008 David Walluck 0:6.0.18-1.1
- 6.0.18
- Resolves: CVE-2008-1232, CVE-2008-1947, CVE-2008-2370, CVE-2008-2938
- fix definition of java.security.policy with d%{name} start-security
- don't pass $CATALINA_OPTS with d%{name} stop
- redefine tempdir and workdir for tmpwatch workaround
- change eclipse-ecj references to ecj
* Thu Jul 10 2008 Tom spot Callaway - 0:6.0.16-1.8
- drop repotag
References:
[ 1 ] Bug #456120 - CVE-2008-2938 tomcat Unicode directory traversal vulnerability
https://bugzilla.redhat.com/show_bug.cgi?id=456120
[ 2 ] Bug #457934 - CVE-2008-2370 tomcat RequestDispatcher information disclosure vulnerability
https://bugzilla.redhat.com/show_bug.cgi?id=457934
[ 3 ] Bug #446393 - CVE-2008-1947 Tomcat host manager xss - name field
https://bugzilla.redhat.com/show_bug.cgi?id=446393
[ 4 ] Bug #457597 - CVE-2008-1232 tomcat: Cross-Site-Scripting enabled by sendError call
https://bugzilla.redhat.com/show_bug.cgi?id=457597
Solution: Apply the appropriate updates.
This update can be installed with the yum update program. Use
su -c 'yum update tomcat6' at the command line.
For more information, refer to Managing Software with yum,
available at http://docs.fedoraproject.org/yum/.
http://www.securityspace.com/smysecure/catid.html?in=FEDORA-2008-7977
Risk factor : Medium
CVSS Score:
5.0
|
