- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 201705-09 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: High Title: Apache Tomcat: Multiple vulnerabilities Date: May 18, 2017 Bugs: #575796, #586966, #595978, #615868 ID: 201705-09 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======== Multiple vulnerabilities have been found in Apache Tomcat, the worst of which could lead to privilege escalation. Background ========== Apache Tomcat is a Servlet-3.0/JSP-2.2 Container. Affected packages ================= ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 www-servers/tomcat < 8.0.36 >= 7.0.70 >= 8.0.36 Description =========== Multiple vulnerabilities have been discovered in Tomcat. Please review the CVE identifiers referenced below for details. Impact ====== A remote attacker may be able to cause a Denial of Service condition, obtain sensitive information, bypass protection mechanisms and authentication restrictions. A local attacker, who is a tomcat's system user or belongs to tomcat=E2=80= =99s group, could potentially escalate privileges. Workaround ========== There is no known workaround at this time. Resolution ========== All Apache Tomcat users have to manually check their Tomcat runscripts to make sure that they don't use an old, vulnerable runscript. In addition: All Apache Tomcat 7 users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose ">=www-servers/tomcat-7.0.70:7" All Apache Tomcat 8 users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose ">=www-servers/tomcat-8.0.36:8" References ========== [ 1 ] CVE-2015-5174 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5174 [ 2 ] CVE-2015-5345 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5345 [ 3 ] CVE-2015-5346 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5346 [ 4 ] CVE-2015-5351 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5351 [ 5 ] CVE-2016-0706 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-0706 [ 6 ] CVE-2016-0714 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-0714 [ 7 ] CVE-2016-0763 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-0763 [ 8 ] CVE-2016-1240 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-1240 [ 9 ] CVE-2016-3092 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-3092 [ 10 ] CVE-2016-8745 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-8745 [ 11 ] CVE-2017-5647 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-5647 [ 12 ] CVE-2017-5648 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-5648 [ 13 ] CVE-2017-5650 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-5650 [ 14 ] CVE-2017-5651 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-5651 Availability ============ This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/201705-09 Concerns? ========= Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org. License ======= Copyright 2017 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. http://creativecommons.org/licenses/by-sa/2.5 --SKKBd9VlC8wusCVbXKC9aaUtloHAjIa1g--