~ubuntu-branches/ubuntu/precise/tomcat6/precise-updates : changes

~ubuntu-branches/ubuntu/precise/tomcat6/precise-updates » Changes from revision 51

From Revision 51 to 32

Rev	Summary	Authors	Tags	Date
51	* SECURITY UPDATE: HTTP request smuggling or denial of servi... * SECURITY UPDATE: HTTP request smuggling or denial of service via streaming with malformed chunked transfer encoding (LP: #1449975) - debian/patches/CVE-2014-0227.patch: add error flag and improve i18n in java/org/apache/coyote/http11/filters/ChunkedInputFilter.java, java/org/apache/coyote/http11/filters/LocalStrings.properties. - CVE-2014-0227 * SECURITY UPDATE: denial of service via aborted upload attempts (LP: #1449975) - debian/patches/CVE-2014-0230.patch: limit amount of data in java/org/apache/coyote/Constants.java, java/org/apache/coyote/http11/filters/ChunkedInputFilter.java, java/org/apache/coyote/http11/filters/IdentityInputFilter.java, java/org/apache/coyote/http11/filters/LocalStrings.properties, webapps/docs/config/systemprops.xml. - CVE-2014-0230 * SECURITY UPDATE: SecurityManager bypass via Expression Language - debian/patches/CVE-2014-7810.patch: handle classes that may not be accessible but have accessible interfaces in java/javax/el/BeanELResolver.java, remove unnecessary code in java/org/apache/jasper/runtime/PageContextImpl.java, java/org/apache/jasper/security/SecurityClassLoad.java. - CVE-2014-7810	Marc Deslauriers	6.0.35-1ubuntu3.6	8 years ago
50	* SECURITY UPDATE: denial of service via malformed chunk siz... * SECURITY UPDATE: denial of service via malformed chunk size - debian/patches/CVE-2014-0075.patch: fix overflow in java/org/apache/coyote/http11/filters/ChunkedInputFilter.java. - CVE-2014-0075 * SECURITY UPDATE: file disclosure via XXE issue - debian/patches/CVE-2014-0096.patch: change globalXsltFile to be a relative path in conf/web.xml, java/org/apache/catalina/servlets/DefaultServlet.java, java/org/apache/catalina/servlets/LocalStrings.properties, webapps/docs/default-servlet.xml. - CVE-2014-0096 * SECURITY UPDATE: HTTP request smuggling attack via crafted Content-Length HTTP header - debian/patches/CVE-2014-0099.patch: correctly handle long values in java/org/apache/tomcat/util/buf/Ascii.java. - CVE-2014-0099	Marc Deslauriers	6.0.35-1ubuntu3.5	9 years ago
49	* SECURITY UPDATE: request smuggling attack via content-leng... * SECURITY UPDATE: request smuggling attack via content-length headers - debian/patches/CVE-2013-4286.patch: handle multiple content lengths in java/org/apache/coyote/ajp/AbstractAjpProcessor.java, java/org/apache/coyote/ajp/AjpProcessor.java, handle content length and chunked encoding being both specified in java/org/apache/coyote/http11/Http11AprProcessor.java, java/org/apache/coyote/http11/Http11NioProcessor.java, java/org/apache/coyote/http11/Http11Processor.java. - CVE-2013-4286 * SECURITY UPDATE: denial of service via chunked transfer coding - debian/patches/CVE-2013-4322.patch: limit length of extension data in java/org/apache/coyote/Constants.java, java/org/apache/coyote/http11/filters/ChunkedInputFilter.java, webapps/docs/config/systemprops.xml. - CVE-2013-4322 * SECURITY UPDATE: session fixation attack via crafted URL - debian/patches/CVE-2014-0033.patch: properly handle disableURLRewriting in java/org/apache/catalina/connector/CoyoteAdapter.java. - CVE-2014-0033	Marc Deslauriers	6.0.35-1ubuntu3.4	10 years ago
48	* SECURITY UPDATE: denial of service via chunked transfer en... * SECURITY UPDATE: denial of service via chunked transfer encoding - debian/patches/CVE-2012-3544.patch: properly parse CRLF in requests in java/org/apache/coyote/http11/filters/ChunkedInputFilter.java. - CVE-2012-3544 * SECURITY UPDATE: FORM authentication request injection - debian/patches/CVE-2013-2067.patch: properly change session ID in java/org/apache/catalina/authenticator/FormAuthenticator.java. - CVE-2013-2067	Marc Deslauriers	6.0.35-1ubuntu3.3	10 years ago
47	* SECURITY UPDATE: security-constraint bypass with FORM auth * SECURITY UPDATE: security-constraint bypass with FORM auth - debian/patches/CVE-2012-3546.patch: remove unneeded code in java/org/apache/catalina/realm/RealmBase.java. - CVE-2012-3546 * SECURITY UPDATE: CSRF bypass via request with no session identifier - debian/patches/CVE-2012-4431.patch: check for session identifier in java/org/apache/catalina/filters/CsrfPreventionFilter.java. - CVE-2012-4431 * SECURITY UPDATE: denial of service with NIO connector - debian/patches/CVE-2012-4534.patch: properly handle connection breaks in java/org/apache/tomcat/util/net/NioEndpoint.java. - CVE-2012-4534	Marc Deslauriers	6.0.35-1ubuntu3.2	11 years ago
46	* SECURITY UPDATE: denial of service via large header data * SECURITY UPDATE: denial of service via large header data - debian/patches/0012-CVE-2012-2733.patch: improve size logic in java/org/apache/coyote/http11/InternalNioInputBuffer.java. - CVE-2012-2733 * SECURITY UPDATE: multiple HTTP Digest Access Authentication flaws - debian/patches/0013-CVE-2012-588x.patch: disable caching of an authenticated user in the session by default, track server rather than client nonces, better handling of stale nonce values in java/org/apache/catalina/authenticator/DigestAuthenticator.java. - CVE-2012-3439 - CVE-2012-5885 - CVE-2012-5886 - CVE-2012-5887	Marc Deslauriers	6.0.35-1ubuntu3.1	11 years ago
45	* Handle creation of user instances with pathnames containin... * Handle creation of user instances with pathnames containing spaces (LP: #977498): - d/tomcat6-instance-create: Quote access to files and directories so that spaces can be used when creating user instances.	James Page	6.0.35-1ubuntu3	12 years ago
44	init: Make NAME dynamic, to allow starting multiple instance... init: Make NAME dynamic, to allow starting multiple instances.	Timo Aaltonen	6.0.35-1ubuntu2	12 years ago
43	debian/patches/0011-CVE-2012-0022-regression-fix.patch: fix ... debian/patches/0011-CVE-2012-0022-regression-fix.patch: fix regression from the CVE-2012-0022 security fix that went into 6.0.35.	Marc Deslauriers	6.0.35-1ubuntu1	12 years ago
42	[ Miguel Landaeta ] [ Miguel Landaeta ] * New upstream release. * Add myself to Uploaders. * Remove 0013-CVE-2011-3190.patch since it was included upstream. * Add mh_clean call in clean target. * Fix error in debian/rules that caused tomcat to report no version. Thanks to Jorge Barreiro for the patch. (Closes: #650656). [ tony mancill ] * Update Vcs-* fields in debian/control for switch to git. * Update to run with openjdk-7 and openjdk-6 when not default-jdk is not present. (Closes: #651448) * Allow java?-runtime-headless to satisfy Depends. * Add myself to Uploaders.	tony mancill	6.0.35-1	12 years ago
41	* Team upload. * Team upload. * New upstream release. * Remove the following patches (included upstream): - 0011-623242.patch - 0012-CVE-2011-2204.patch - 0015-CVE-2011-2526.patch - 0014-CVE-2011-1184.patch * Add patch for multi-instance startup. CATALINA_HOME no longer depends on the instance $NAME. JVM_TMP is now $NAME-specific. - Thank you to Julien Wajsberg. (Closes: #644365) * Add dependency on JRE to tomcat6-common (Closes: #644340) * Modify init script to look for JVM in /usr/lib/jvm/default-java	tony mancill	6.0.33-1	12 years ago
40	* SECURITY UPDATE: HTTP DIGEST authentication weaknesses * SECURITY UPDATE: HTTP DIGEST authentication weaknesses - debian/patches/0014-CVE-2011-1184.patch: add new nonce options in java/org/apache/catalina/authenticator/DigestAuthenticator.java, java/org/apache/catalina/authenticator/LocalStrings.properties, java/org/apache/catalina/authenticator/mbeans-descriptors.xml, java/org/apache/catalina/realm/RealmBase.java, webapps/docs/config/valve.xml. - CVE-2011-1184 * SECURITY UPDATE: file restriction bypass or denial of service via untrusted web application. - debian/patches/0015-CVE-2011-2526.patch: check canonical name in java/org/apache/catalina/connector/LocalStrings.properties, java/org/apache/catalina/connector/Request.java, java/org/apache/catalina/servlets/DefaultServlet.java, java/org/apache/coyote/http11/Http11AprProcessor.java, java/org/apache/coyote/http11/LocalStrings.properties, java/org/apache/tomcat/util/net/AprEndpoint.java, java/org/apache/tomcat/util/net/NioEndpoint.java. - CVE-2011-2526	Marc Deslauriers	6.0.32-6ubuntu1	12 years ago
39	[ tony mancill ] [ tony mancill ] * Team upload. * Update Korean debconf translation. (Closes: #630950, 631482) Thanks to si-cheol Ko. * Add Dutch debconf translation. (Closes: #637507) Thanks to Jeroen Schot. [ Niels Thykier ] * Removed myself from uploaders. [ James Page ] * Added patch for CVE-2011-3190 (LP: #843701).	tony mancill	6.0.32-6	12 years ago
38	Added patch for CVE-2011-3190 (LP: #843701). Added patch for CVE-2011-3190 (LP: #843701).	James Page	6.0.32-5ubuntu1	12 years ago
37	* Team upload. * Team upload. * Add Catalan debconf translation ca.po (Closes: #630073). * Correct Suggests for libtcnative-1 (tomcat-native) (Closes: #631919) * Add patch for CVE-2011-2204 (Closes: #632882)	tony mancill	6.0.32-5	12 years ago
36	* Team upload. * Team upload. * Add Italian debconf translation. Thanks to Dario Santamaria (Closes: #624376) * Add logrotate for catalina.out (Closes: 607050) * Bump standards version to 3.9.2 (no changes needed).	tony mancill	6.0.32-4	12 years ago
35	* Team upload. * Team upload. * Include upstream patch for ASF Bugzilla - Bug 50700 (Context parameters are being overridden with parameters from the web application deployment descriptor) (Closes: #623242)	tony mancill	6.0.32-3	13 years ago
34	debian/tomcat6-instance-create: Eclipse can now be configure... debian/tomcat6-instance-create: Eclipse can now be configured to use a user instance of tomcat6 using tomcat6-instance-create without any additional work. tomcat6-instance-create will setup all the necessary symlinks to make eclipse work. (Closes: #551091) (LP: #297675)	Abhinav Upadhyay	6.0.28-10ubuntu2	13 years ago
33	[ Abhinav Upadhyay ] [ Abhinav Upadhyay ] * tomcat6-instance-create should accept -1 as the value of -c option as per http://tomcat.apache.org/tomcat-6.0-doc/config/server.html (LP: #707405) [ Dave Walker (Daviey) ] * debian/control: Updated Maintainer as per policy.	Abhinav Upadhyay	6.0.28-10ubuntu1	13 years ago
32	* Team upload. * Team upload. * Add Portuguese/Brazilian debconf translation. Thanks to José de Figueiredo (Closes: #608527) * Add patches for CVE-2011-0534, CVE-2010-3718, CVE-2011-0013 (Closes: #612257)	tony mancill	6.0.28-10	13 years ago

Older »