SUSE-SU-2017:1382-1

Details

Description of the patch:

This update for tomcat fixes the following issues:

CVE-2017-5647 Pipelined requests could lead to information disclosure (bsc#1033448)
CVE-2017-5648 Untrusted application could retain listener leading to information disclosure (bsc#1033447)
CVE-2016-8745 shared Processor on Connector code could lead to information disclosure (bsc#1015119)

Affected Packages

tomcat

SUSE Linux Enterprise Server 12 SP1SUSE Linux Enterprise Server for SAP Applications 12 SP1

Fixed in:

8.0.43-10.19.1

tomcat-admin-webapps

SUSE Linux Enterprise Server 12 SP1SUSE Linux Enterprise Server for SAP Applications 12 SP1

Fixed in:

8.0.43-10.19.1

tomcat-docs-webapp

SUSE Linux Enterprise Server 12 SP1SUSE Linux Enterprise Server for SAP Applications 12 SP1

Fixed in:

8.0.43-10.19.1

tomcat-el-3_0-api

SUSE Linux Enterprise Server 12 SP1SUSE Linux Enterprise Server for SAP Applications 12 SP1

Fixed in:

8.0.43-10.19.1

tomcat-javadoc

SUSE Linux Enterprise Server 12 SP1SUSE Linux Enterprise Server for SAP Applications 12 SP1

Fixed in:

8.0.43-10.19.1

tomcat-jsp-2_3-api

SUSE Linux Enterprise Server 12 SP1SUSE Linux Enterprise Server for SAP Applications 12 SP1

Fixed in:

8.0.43-10.19.1

tomcat-lib

SUSE Linux Enterprise Server 12 SP1SUSE Linux Enterprise Server for SAP Applications 12 SP1

Fixed in:

8.0.43-10.19.1

tomcat-servlet-3_1-api

SUSE Linux Enterprise Server 12 SP1SUSE Linux Enterprise Server for SAP Applications 12 SP1

Fixed in:

8.0.43-10.19.1

tomcat-webapps

SUSE Linux Enterprise Server 12 SP1SUSE Linux Enterprise Server for SAP Applications 12 SP1

Fixed in:

8.0.43-10.19.1

References

ADVISORY

https://bugzilla.suse.com/1015119

ADVISORY

https://bugzilla.suse.com/1033447

ADVISORY

https://bugzilla.suse.com/1033448

ADVISORY

https://lists.suse.com/pipermail/sle-security-updates/2017-May/002909.html

ADVISORY

https://www.suse.com/security/cve/CVE-2016-8745/

ADVISORY

https://www.suse.com/security/cve/CVE-2017-5647/

ADVISORY

https://www.suse.com/security/cve/CVE-2017-5648/

WEB

https://www.suse.com/support/security/rating/

ADVISORY

https://www.suse.com/support/update/announcement/2017/suse-su-20171382-1/