Red Hat Security Advisory

RHSA-2011:0791

tomcat6 security and bug fix update

Released 2011-05-19 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat Enterprise Linux Desktop Optional (v. 6) tomcat6-6.0.24-33.el6, tomcat6-admin-webapps-6.0.24-33.el6, tomcat6-docs-webapp-6.0.24-33.el6 +6
Red Hat Enterprise Linux HPC Node Optional (v. 6) tomcat6-6.0.24-33.el6, tomcat6-admin-webapps-6.0.24-33.el6, tomcat6-docs-webapp-6.0.24-33.el6 +6
Red Hat Enterprise Linux Server (v. 6) tomcat6-6.0.24-33.el6, tomcat6-el-2.1-api-6.0.24-33.el6, tomcat6-jsp-2.1-api-6.0.24-33.el6 +2
Red Hat Enterprise Linux Server Optional (v. 6) tomcat6-6.0.24-33.el6, tomcat6-admin-webapps-6.0.24-33.el6, tomcat6-docs-webapp-6.0.24-33.el6 +2
Red Hat Enterprise Linux Workstation (v. 6) tomcat6-6.0.24-33.el6, tomcat6-el-2.1-api-6.0.24-33.el6, tomcat6-jsp-2.1-api-6.0.24-33.el6 +2
Red Hat Enterprise Linux Workstation Optional (v. 6) tomcat6-6.0.24-33.el6, tomcat6-admin-webapps-6.0.24-33.el6, tomcat6-docs-webapp-6.0.24-33.el6 +2

Fixes 3 records

TI-2010-03927 CVE-2010-4172 · GHSA-c78g-qwpw-2jgv

Multiple cross-site scripting (XSS) vulnerabilities in the Manager application in Apache…

MEDIUM 48

Multiple cross-site scripting (XSS) vulnerabilities in the Manager application in Apache Tomcat 6.0.12 through 6.0.29 and 7.0.0 through 7.0.4 allow remote attackers to inject arbitrary web script or HTML via the (1) orde…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.42009 Published 2010-11-26 Fixed in 7.0.5 CWE-79

TI-2011-00013 CVE-2011-0013 · GHSA-3p86-xgrq-m6p6

Multiple cross-site scripting (XSS) vulnerabilities in the HTML Manager Interface in…

LOW 32

Multiple cross-site scripting (XSS) vulnerabilities in the HTML Manager Interface in Apache Tomcat 5.5 before 5.5.32, 6.0 before 6.0.30, and 7.0 before 7.0.6 allow remote attackers to inject arbitrary web script or HTML,…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.10009 Published 2011-02-18 Fixed in 5.5.32, 6.0.30 +1 CWE-79

TI-2010-03542 CVE-2010-3718 · GHSA-fj6c-prgj-gr3r

Apache Tomcat 7.0.0 through 7.0.3, 6.0.x, and 5.5.x, when running within a…

LOW 10

Apache Tomcat 7.0.0 through 7.0.3, 6.0.x, and 5.5.x, when running within a SecurityManager, does not make the ServletContext attribute read-only, which allows local web applications to read or write files outside of the…

CVSS 2.0LOW 1.2 Local No auth Interaction — EPSS 0.013 Published 2011-02-10 Fixed in 7.0.4, 6.0.30 +1 CWE-22