{"id":"MGASA-2014-0082","summary":"Updated tomcat6 packages fix multiple vulnerabilities and logging","details":"Updated tomcat6 packages fix security vulnerabilities:\n\nIt was discovered that Tomcat incorrectly handled certain requests\nsubmitted using chunked transfer encoding. A remote attacker could use this\nflaw to cause the Tomcat server to stop responding, resulting in a denial\nof service (CVE-2012-3544).\n\nA frame injection in the Javadoc component in Oracle Java SE 7 Update 21\nand earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier;\nJavaFX 2.2.21 and earlier; and OpenJDK 7 allows remote attackers to affect\nintegrity via unknown vectors related to Javadoc (CVE-2013-1571)\n\nA flaw was found in the way the tomcat6 init script handled the\ntomcat6-initd.log log file. A malicious web application deployed on Tomcat\ncould use this flaw to perform a symbolic link attack to change the\nownership of an arbitrary system file to that of the tomcat user, allowing\nthem to escalate their privileges to root (CVE-2013-1976).\n\nIt was discovered that Tomcat incorrectly handled certain authentication\nrequests. A remote attacker could possibly use this flaw to inject a\nrequest that would get executed with a victim's credentials (CVE-2013-2067).\n\nNote: With this update, tomcat6-initd.log has been moved from\n/var/log/tomcat6/ to the /var/log/ directory.\n","modified":"2026-04-16T06:25:08.521378458Z","published":"2014-02-17T18:13:24Z","upstream":["CVE-2012-3544","CVE-2013-1571","CVE-2013-1976","CVE-2013-2067"],"references":[{"type":"ADVISORY","url":"https://advisories.mageia.org/MGASA-2014-0082.html"},{"type":"WEB","url":"http://www.ubuntu.com/usn/usn-1841-1/"},{"type":"WEB","url":"https://rhn.redhat.com/errata/RHSA-2013-0869.html"},{"type":"WEB","url":"http://tomcat.apache.org/security-6.html#Fixed_in_Apache_Tomcat_6.0.39"},{"type":"REPORT","url":"https://bugs.mageia.org/show_bug.cgi?id=10201"}],"affected":[{"package":{"name":"tomcat6","ecosystem":"Mageia:3","purl":"pkg:rpm/mageia/tomcat6?arch=source&distro=mageia-3"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.39-1.1.mga3"}]}],"ecosystem_specific":{"section":"core"},"database_specific":{"source":"https://advisories.mageia.org/MGASA-2014-0082.json"}}],"schema_version":"1.7.5","credits":[{"name":"Mageia","contact":["https://wiki.mageia.org/en/Packages_Security_Team"],"type":"COORDINATOR"}]}