This bug was fixed in the package tomcat7 - 7.0.52-1ubuntu0.3 --------------- tomcat7 (7.0.52-1ubuntu0.3) trusty-security; urgency=medium
* SECURITY UPDATE: arbitrary file disclosure via XML parser (LP: #1449975) - debian/patches/CVE-2014-0119.patch: add defensive coding and ensure TLD parser obtained from cache has correct value of blockExternal in java/org/apache/catalina/security/SecurityClassLoad.java, java/org/apache/catalina/servlets/DefaultServlet.java, java/org/apache/catalina/startup/TldConfig.java, java/org/apache/jasper/compiler/JspDocumentParser.java, java/org/apache/jasper/xmlparser/ParserUtils.java, java/org/apache/tomcat/util/security/PrivilegedGetTccl.java, java/org/apache/tomcat/util/security/PrivilegedSetTccl.java. - CVE-2014-0119 * SECURITY UPDATE: HTTP request smuggling or denial of service via streaming with malformed chunked transfer encoding (LP: #1449975) - debian/patches/CVE-2014-0227.patch: add error flag and improve i18n in java/org/apache/coyote/http11/filters/ChunkedInputFilter.java, java/org/apache/coyote/http11/filters/LocalStrings.properties. - CVE-2014-0227 * SECURITY UPDATE: denial of service via aborted upload attempts (LP: #1449975) - debian/patches/CVE-2014-0230.patch: limit amount of data in java/org/apache/coyote/http11/AbstractHttp11Processor.java, java/org/apache/coyote/http11/AbstractHttp11Protocol.java, java/org/apache/coyote/http11/Http11AprProcessor.java, java/org/apache/coyote/http11/Http11AprProtocol.java, java/org/apache/coyote/http11/Http11NioProcessor.java, java/org/apache/coyote/http11/Http11NioProtocol.java, java/org/apache/coyote/http11/Http11Processor.java, java/org/apache/coyote/http11/Http11Protocol.java, java/org/apache/coyote/http11/filters/ChunkedInputFilter.java, java/org/apache/coyote/http11/filters/IdentityInputFilter.java, java/org/apache/coyote/http11/filters/LocalStrings.properties, test/org/apache/catalina/core/TestSwallowAbortedUploads.java, webapps/docs/config/http.xml. - CVE-2014-0230 * SECURITY UPDATE: SecurityManager bypass via Expression Language - debian/patches/CVE-2014-7810.patch: handle classes that may not be accessible but have accessible interfaces in java/javax/el/BeanELResolver.java, remove unnecessary code in java/org/apache/jasper/runtime/PageContextImpl.java, java/org/apache/jasper/security/SecurityClassLoad.java. - CVE-2014-7810 * Replace expired ssl certs and use TLS to fix tests causing FTBFS: - debian/patches/0022-use-tls-in-ssl-unit-tests.patch - debian/patches/0023-replace-expired-ssl-certificates.patch - debian/source/include-binaries -- Marc Deslauriers <marc.deslauri...@ubuntu.com> Fri, 19 Jun 2015 12:30:21 -0400 ** Changed in: tomcat7 (Ubuntu) Status: Triaged => Fix Released ** CVE added: http://www.cve.mitre.org/cgi- bin/cvename.cgi?name=2014-7810 -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to the bug report. https://bugs.launchpad.net/bugs/1449975 Title: Outstanding low priority security bugs in the tomcat7 packages To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/tomcat7/+bug/1449975/+subscriptions -- Ubuntu-server-bugs mailing list Ubuntu-server-bugs@lists.ubuntu.com Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-server-bugs