-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Package : tomcat7 Version : 7.0.28-4+deb7u9 CVE ID : CVE-2016-8745 Debian Bug : 849949
A bug in the error handling of the send file code for the NIO HTTP connector resulted in the current Processor object being added to the Processor cache multiple times. This in turn meant that the same Processor could be used for concurrent requests. Sharing a Processor can result in information leakage between requests including, not limited to, session ID and the response body. In addition this update also addresses a regression when running Tomcat 7 with SecurityManager enabled due to an incomplete fix for CVE-2016-6816. For Debian 7 "Wheezy", these problems have been fixed in version 7.0.28-4+deb7u9. We recommend that you upgrade your tomcat7 packages. Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS -----BEGIN PGP SIGNATURE----- iQKTBAEBCgB9FiEErPPQiO8y7e9qGoNf2a0UuVE7UeQFAlh1cCpfFIAAAAAALgAo aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldEFD RjNEMDg4RUYzMkVERUY2QTFBODM1RkQ5QUQxNEI5NTEzQjUxRTQACgkQ2a0UuVE7 UeQpmg//dnHKU2B2sAjkPqOWI/mhfx/f6oIwvvafPwX8TlJV1sD8VkcxFhvRZEN0 Twgi7vwQPRg5tej8AUjJ6WfCcCVYx9l9+0YwFvKNN0nLEORCG1DUCB+VFLMWpLx9 VLJ+dYaS4AxcBFyBA1QEGmIZrbSHXCFw874N+R05XtIZMW2+AQ4n3DwYslDFEMBM sYmjqOHV1lKNmF+e9dmTgNk1+hGBIhAH5VQvuSSdjomTPG91/D0gfVP+dCXVxQ6z kuHXsEqR/7TuNoYQs4falw9NL69p8BEkUoHfwBL3W0KmzcPR40zGOs8H/q2PJkwW FHm8jd03MZL8bNlycWqrgCTy/JB56iL3Xa7GHCrNn10iGMchxSTwQdxmOLUWOk09 nDrkLuXS0VgsqkXV6JpWaJm/U3y3U2lg7UbbLZjDg4t1G9+AbCpU2B0gLr7RMQHh tZm/VR29aor9dNpyP6/k0xvfjBFFU/q4UZiWYKzYe1w0pfrvPPrhWkE6md8gA27F fCSv0D+VPhdVJbrkJcEYI2nKN4n7It6w95sxddKc6wFBZ9F2L19j7P30/koPyU6D +4F+fKAzhHN+Tc/TdBPMdqwXThgFJI+KTAzrtixhDA228mpPUSOkBCzbhNHuSJhG VKdo4D+6XBvoEiFLDrhSKlUylydx8xuJzhLAluBh2SepTpA6amI= =4zrd -----END PGP SIGNATURE-----