[ MDVSA-2015:052 ] tomcat

Mandriva Linux Security Advisory                         MDVSA-2015:052
 http://www.mandriva.com/en/support/security/
 ____________________________________________________________
___________

 Package : tomcat
 Date    : March 3, 2015
 Affected: Business Server 1.0
 _______________________________________________________________________

 Problem Description:

 Updated tomcat packages fix security vulnerabilities:

 Apache Tomcat 7.x before 7.0.47, when an HTTP connector or AJP
 connector is used, does not properly handle certain inconsistent HTTP
 request headers, which allows remote attackers to trigger incorrect
 identification of a request's length and conduct request-smuggling
 attacks via (1) multiple Content-Length headers or (2) a Content-Length
 header and a Transfer-Encoding: chunked header (CVE-2013-4286).

 Apache Tomcat 7.x before 7.0.50 processes chunked transfer coding
 without properly handling (1) a large total amount of chunked data or
 (2) whitespace characters in an HTTP header value within a trailer
 field, which allows remote attackers to cause a denial of service by
 streaming data  (CVE-2013-4322).

 Apache Tomcat 7.x before 7.0.50 allows attackers to obtain Tomcat
 internals information by leveraging the presence of an untrusted web
 application with a context.xml, web.xml, *.jspx, *.tagx, or *.tld XML
 document containing an external entity declaration in conjunction
 with an entity reference, related to an XML External Entity (XXE)
 issue (CVE-2013-4590).

 Integer overflow in the parseChunkHeader function in
 java/org/apache/coyote/http11/filters/ChunkedInputFilter.java in
 Apache Tomcat before 6.0.40 and 7.x before 7.0.53 allows remote
 attackers to cause a denial of service (resource consumption) via a
 malformed chunk size in chunked transfer coding of a request during
 the streaming of data (CVE-2014-0075).

 java/org/apache/catalina/servlets/DefaultServlet.java in the default
 servlet in Apache Tomcat before 6.0.40 and 7.x before 7.0.53 does not
 properly restrict XSLT stylesheets, which allows remote attackers
 to bypass security-manager restrictions and read arbitrary files
 via a crafted web application that provides an XML external entity
 declaration in conjunction with an entity reference, related to an
 XML External Entity (XXE) issue (CVE-2014-0096).

 Integer overflow in java/org/apache/tomcat/util/buf/Ascii.java in
 Apache Tomcat before 6.0.40 and 7.x before 7.0.53, when operated
 behind a reverse proxy, allows remote attackers to conduct HTTP
 request smuggling attacks via a crafted Content-Length HTTP header
 (CVE-2014-0099).

 Apache Tomcat before 6.0.40 and 7.x before 7.0.54 does not properly
 constrain the class loader that accesses the XML parser used with
 an XSLT stylesheet, which allows remote attackers to read arbitrary
 files via a crafted web application that provides an XML external
 entity declaration in conjunction with an entity reference, related
 to an XML External Entity (XXE) issue, or read files associated with
 different web applications on a single Tomcat instance via a crafted
 web application (CVE-2014-0119).

 In Apache Tomcat 7.x before 7.0.55, it was possible to craft a
 malformed chunk as part of a chunked request that caused Tomcat to
 read part of the request body as a new request (CVE-2014-0227).
 _______________________________________________________________________

 References:

 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4286
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4322
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4590
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0075
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0096
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0099
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0119
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0227
 http://advisories.mageia.org/MGASA-2014-0148.html
 http://advisories.mageia.org/MGASA-2014-0268.html
 http://advisories.mageia.org/MGASA-2015-0081.html
 _______________________________________________________________________

 Updated Packages:

 Mandriva Business Server 1/X86_64:
 dce2bd5077a8e201da2a52717f3ef3a4  mbs1/x86_64/tomcat-7.0.59-1.mbs1.noarch.rpm
 7908cc5facecb5c65c976cdff41b1d7c  mbs1/x86_64/tomcat-admin-webapps-7.0.59-1.mbs1.noarch.rpm
 21d8b843398fa256f05b1ad8464b6787  mbs1/x86_64/tomcat-docs-webapp-7.0.59-1.mbs1.noarch.rpm
 27218eccc1ba454ef1cafea51976475a  mbs1/x86_64/tomcat-el-2.2-api-7.0.59-1.mbs1.noarch.rpm
 cc0f94bb899c3a82ecb1daa0cccd40b9  mbs1/x86_64/tomcat-javadoc-7.0.59-1.mbs1.noarch.rpm
 60c451802ce55df14445d2a560f544f8  mbs1/x86_64/tomcat-jsp-2.2-api-7.0.59-1.mbs1.noarch.rpm
 d7598284719161790f2617b715dbe444  mbs1/x86_64/tomcat-jsvc-7.0.59-1.mbs1.noarch.rpm
 90279c92333646b38010bcf54f488e4a  mbs1/x86_64/tomcat-lib-7.0.59-1.mbs1.noarch.rpm
 e8b29b53c91bee0b3ffdd224c6b00038  mbs1/x86_64/tomcat-log4j-7.0.59-1.mbs1.noarch.rpm
 a648279678ad5c804e8f7f9145ec794c  mbs1/x86_64/tomcat-servlet-3.0-api-7.0.59-1.mbs1.noarch.rpm
 f0cb2c5e57edc0c4f7cda66d393165fb  mbs1/x86_64/tomcat-webapps-7.0.59-1.mbs1.noarch.rpm
 cdaa6216b605cc23635cdeb4f77d32f9  mbs1/SRPMS/tomcat-7.0.59-1.mbs1.src.rpm
 _______________________________________________________________________

 To upgrade automatically use MandrivaUpdate or urpmi.  The verification
 of md5 checksums and GPG signatures is performed automatically for you.

 All packages are signed by Mandriva for security.  You can obtain the
 GPG public key of the Mandriva Security Team by executing:

  gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

 You can view other update advisories for Mandriva Linux at:

  http://www.mandriva.com/en/support/security/advisories/

 If you want to report vulnerabilities, please contact

  security_(at)_mandriva.com