Package "tomcat8"

Name: tomcat8


This package is just an umbrella for a group of other packages, it has no description.
Description samples from packages in group:

  • Apache Tomcat 8 - Servlet and JSP engine -- tools to create user instances

Latest version: 8.0.32-1ubuntu1.10
Release: xenial (16.04)
Level: security
Repository: universe


Save this URL for the latest version of "tomcat8": https://www.ubuntuupdates.org/tomcat8

Other versions of "tomcat8" in Xenial

Repository Area Version
base universe 8.0.32-1ubuntu1
base main 8.0.32-1ubuntu1
security main 8.0.32-1ubuntu1.10
updates main 8.0.32-1ubuntu1.10
updates universe 8.0.32-1ubuntu1.10

Packages in group

Deleted packages are displayed in grey.


Version: 8.0.32-1ubuntu1.3 2017-01-23 19:06:55 UTC

  tomcat8 (8.0.32-1ubuntu1.3) xenial-security; urgency=medium

  * SECURITY UPDATE: timing attack in realm implementations
    - debian/patches/CVE-2016-0762.patch: add time delays to
    - CVE-2016-0762
  * SECURITY UPDATE: SecurityManager bypass via a Tomcat utility method
    - debian/patches/CVE-2016-5018.patch: remove unnecessary code in
    - CVE-2016-5018
  * SECURITY UPDATE: mitigaton for httpoxy issue
    - debian/patches/CVE-2016-5388.patch: add envHttpHeaders initialization
      parameter to conf/web.xml, webapps/docs/cgi-howto.xml,
    - CVE-2016-5388
  * SECURITY UPDATE: system properties read SecurityManager bypass
    - debian/patches/CVE-2016-6794.patch: extend SecurityManager protection
      to the system property replacement feature of the digester in
    - CVE-2016-6794
  * SECURITY UPDATE: SecurityManager bypass via JSP Servlet configuration
    - debian/patches/CVE-2016-6796.patch: ignore some JSP options when
      running under a SecurityManager in conf/web.xml,
    - CVE-2016-6796
  * SECURITY UPDATE: web application global JNDI resource access
    - debian/patches/CVE-2016-6797.patch: ensure that the global resource
      is only visible via the ResourceLinkFactory when it is meant to be in
    - CVE-2016-6797
  * SECURITY UPDATE: HTTP response injection via invalid characters
    - debian/patches/CVE-2016-6816.patch: add additional checks for valid
      characters in java/org/apache/coyote/http11/AbstractInputBuffer.java,
    - CVE-2016-6816
  * SECURITY UPDATE: remote code execution via JmxRemoteLifecycleListener
    - debian/patches/CVE-2016-8735.patch: explicitly configure allowed
      credential types in
    - CVE-2016-8735
  * SECURITY UPDATE: information leakage between requests
    - debian/patches/CVE-2016-8745.patch: properly handle cache when unable
      to complete sendfile request in
    - CVE-2016-8745
  * SECURITY UPDATE: privilege escalation during package upgrade
    - debian/rules, debian/tomcat8.postinst: properly set permissions on
    - CVE-2016-9774
  * SECURITY UPDATE: privilege escalation during package removal
    - debian/tomcat8.postrm.in: don't reset permissions before removing
    - CVE-2016-9775
  * debian/tomcat8.init: further hardening.

 -- Marc Deslauriers <email address hidden> Mon, 16 Jan 2017 08:18:27 -0500

Source diff to previous version
CVE-2016-0762 Apache Tomcat Realm Timing Attack
CVE-2016-5018 Apache Tomcat Security Manager Bypass
CVE-2016-5388 Apache Tomcat through 8.5.4, when the CGI Servlet is enabled, follows RFC 3875 section 4.1.18 and therefore does not protect applications from the pr
CVE-2016-6794 Apache Tomcat System Property Disclosure
CVE-2016-6796 Apache Tomcat Security Manager Bypass
CVE-2016-6797 Apache Tomcat Unrestricted Access to Global Resources
CVE-2016-6816 information disclosure
CVE-2016-8735 remote code execution
CVE-2016-9774 tomcat8: privilege escalation during package upgrade
CVE-2016-9775 tomcat8: privilege escalation during package removal

Version: 8.0.32-1ubuntu1.2 2016-09-19 20:06:30 UTC

  tomcat8 (8.0.32-1ubuntu1.2) xenial-security; urgency=medium

  * SECURITY UPDATE: privilege escalation via insecure init script
    - debian/tomcat8.init: don't follow symlinks when handling the
      catalina.out file.
    - CVE-2016-1240

 -- Marc Deslauriers <email address hidden> Fri, 16 Sep 2016 09:11:41 -0400

Source diff to previous version

Version: 8.0.32-1ubuntu1.1 2016-07-06 19:06:42 UTC

  tomcat8 (8.0.32-1ubuntu1.1) xenial-security; urgency=medium

  * SECURITY UPDATE: denial of service in FileUpload
    - debian/patches/CVE-2016-3092.patch: properly handle size in
    - CVE-2016-3092

 -- Marc Deslauriers <email address hidden> Wed, 06 Jul 2016 07:49:29 -0400

CVE-2016-3092 The MultipartStream class in Apache Commons Fileupload before 1.3.2, as used in Apache Tomcat 7.x before 7.0.70, 8.x before 8.0.36, 8.5.x before 8.5.

About   -   Send Feedback to @ubuntu_updates