You are here
Home > Preporuke > Ranjivosti programskog paketa tomcat6

Ranjivosti programskog paketa tomcat6

  • Detalji os-a: LMV
  • Važnost: IMP
  • Operativni sustavi: L
  • Kategorije: LMV

Hash: SHA1


Mandriva Linux Security Advisory MDVSA-2014:042

Package : tomcat6
Date : February 19, 2014
Affected: Business Server 1.0

Problem Description:

Updated tomcat6 packages fix security vulnerabilities:

It was discovered that Tomcat incorrectly handled certain requests
submitted using chunked transfer encoding. A remote attacker could
use this flaw to cause the Tomcat server to stop responding, resulting
in a denial of service (CVE-2012-3544).

A frame injection in the Javadoc component in Oracle Java SE 7
Update 21 and earlier, 6 Update 45 and earlier, and 5.0 Update 45
and earlier; JavaFX 2.2.21 and earlier; and OpenJDK 7 allows remote
attackers to affect integrity via unknown vectors related to Javadoc

A flaw was found in the way the tomcat6 init script handled the
tomcat6-initd.log log file. A malicious web application deployed on
Tomcat could use this flaw to perform a symbolic link attack to change
the ownership of an arbitrary system file to that of the tomcat user,
allowing them to escalate their privileges to root (CVE-2013-1976).

It was discovered that Tomcat incorrectly handled certain
authentication requests. A remote attacker could possibly use this
flaw to inject a request that would get executed with a victim’s
credentials (CVE-2013-2067).

Note: With this update, tomcat6-initd.log has been moved from
/var/log/tomcat6/ to the /var/log/ directory.


Updated Packages:

Mandriva Business Server 1/X86_64:
8b304fbd6b68bef47f85ef31d0bea344 mbs1/x86_64/tomcat6-6.0.39-1.mbs1.noarch.rpm
7243145c6a5be3a964e69db023ee71c9 mbs1/x86_64/tomcat6-admin-webapps-6.0.39-1.mbs1.noarch.rpm
f2c3f53c7b0d0418aed86f12a9f6900c mbs1/x86_64/tomcat6-docs-webapp-6.0.39-1.mbs1.noarch.rpm
54db0f145ed365fd226bb9d5fd31ee64 mbs1/x86_64/tomcat6-el-2.1-api-6.0.39-1.mbs1.noarch.rpm
fb001fc02a3c23ea19325c6690aefb36 mbs1/x86_64/tomcat6-javadoc-6.0.39-1.mbs1.noarch.rpm
2db27ac9511a05f7a71ff3d109152e43 mbs1/x86_64/tomcat6-jsp-2.1-api-6.0.39-1.mbs1.noarch.rpm
7c4064e925da652943891f2d7b4e8c2c mbs1/x86_64/tomcat6-lib-6.0.39-1.mbs1.noarch.rpm
d7910e6ac4bb2aa6ac1c482e15ad163f mbs1/x86_64/tomcat6-servlet-2.5-api-6.0.39-1.mbs1.noarch.rpm
4bd7543509316993551b12427a4008b6 mbs1/x86_64/tomcat6-systemv-6.0.39-1.mbs1.noarch.rpm
69887526ca4c9a45b44db36fd5576411 mbs1/x86_64/tomcat6-webapps-6.0.39-1.mbs1.noarch.rpm
e0bfb83180ae8b86c32a4104d643eabd mbs1/SRPMS/tomcat6-6.0.39-1.mbs1.src.rpm

To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.

All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:

gpg –recv-keys –keyserver 0x22458A98

You can view other update advisories for Mandriva Linux at:

If you want to report vulnerabilities, please contact


Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
Version: GnuPG v1.4.12 (GNU/Linux)


To unsubscribe, send a email to
with this subject : unsubscribe security-announce
Want to buy your Pack or Services from Mandriva?
Go to

AutorTomislav Protega
Cert idNCERT-REF-2014-02-0016-ADV
CveCVE-2012-3544 CVE-2013-1571 CVE-2013-1976 CVE-2013-2067
ID izvornikaMDVSA-2014:042
More in Preporuke
Ranjivost programskog paketa python

Otkrivena je ranjivost preljeva spremnika u funkciji "socket.recvfrom_into()" uzrokovana pogrešno definiranim graničnim vrijednostima parametara. Uspješno iskorištavanje ranjivosti dovodi do rušenja...