svn commit: r430842 - head/security/vuxml
Jason Unovitch
junovitch at FreeBSD.org
Sat Jan 7 22:55:05 UTC 2017
Author: junovitch
Date: Sat Jan 7 22:55:03 2017
New Revision: 430842
URL: https://svnweb.freebsd.org/changeset/ports/430842
Log:
Document last quarter of Tomcat security advisories
Latest advisory is awaiting upstream release
PR: 214599
PR: 215865
Security: CVE-2016-0762
Security: CVE-2016-5018
Security: CVE-2016-6794
Security: CVE-2016-6796
Security: CVE-2016-6797
Security: CVE-2016-6816
Security: CVE-2016-8735
Security: CVE-2016-8745
Security: https://vuxml.FreeBSD.org/freebsd/0b9af110-d529-11e6-ae1b-002590263bf5.html
Security: https://vuxml.FreeBSD.org/freebsd/3ae106e2-d521-11e6-ae1b-002590263bf5.html
Security: https://vuxml.FreeBSD.org/freebsd/e5ec2767-d529-11e6-ae1b-002590263bf5.html
Modified:
head/security/vuxml/vuln.xml
Modified: head/security/vuxml/vuln.xml
==============================================================================
--- head/security/vuxml/vuln.xml Sat Jan 7 21:47:14 2017 (r430841)
+++ head/security/vuxml/vuln.xml Sat Jan 7 22:55:03 2017 (r430842)
@@ -58,6 +58,126 @@ Notes:
* Do not forget port variants (linux-f10-libxml2, libxml2, etc.)
-->
<vuxml xmlns="http://www.vuxml.org/apps/vuxml-1">
+ <vuln vid="e5ec2767-d529-11e6-ae1b-002590263bf5">
+ <topic>tomcat -- information disclosure vulnerability</topic>
+ <affects>
+ <package>
+ <name>tomcat6</name>
+ <range><lt>6.0.49</lt></range>
+ </package>
+ <package>
+ <name>tomcat7</name>
+ <range><lt>7.0.74</lt></range>
+ </package>
+ <package>
+ <name>tomcat8</name>
+ <range><lt>8.0.40</lt></range>
+ </package>
+ </affects>
+ <description>
+ <body xmlns="http://www.w3.org/1999/xhtml">
+ <p>The Apache Software Foundation reports:</p>
+ <blockquote cite="http://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.0.40">
+ <p>Important: Information Disclosure CVE-2016-8745</p>
+ </blockquote>
+ </body>
+ </description>
+ <references>
+ <cvename>CVE-2016-8745</cvename>
+ <freebsdpr>ports/215865</freebsdpr>
+ <url>http://tomcat.apache.org/security-6.html#Fixed_in_Apache_Tomcat_6.0.49</url>
+ <url>http://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.74</url>
+ <url>http://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.0.40</url>
+ </references>
+ <dates>
+ <discovery>2017-01-05</discovery>
+ <entry>2017-01-07</entry>
+ </dates>
+ </vuln>
+
+ <vuln vid="0b9af110-d529-11e6-ae1b-002590263bf5">
+ <topic>tomcat -- multiple vulnerabilities</topic>
+ <affects>
+ <package>
+ <name>tomcat6</name>
+ <range><lt>6.0.48</lt></range>
+ </package>
+ <package>
+ <name>tomcat7</name>
+ <range><lt>7.0.73</lt></range>
+ </package>
+ <package>
+ <name>tomcat8</name>
+ <range><lt>8.0.39</lt></range>
+ </package>
+ </affects>
+ <description>
+ <body xmlns="http://www.w3.org/1999/xhtml">
+ <p>The Apache Software Foundation reports:</p>
+ <blockquote cite="http://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.0.39">
+ <p>Important: Remote Code Execution CVE-2016-8735</p>
+ <p>Important: Information Disclosure CVE-2016-6816</p>
+ </blockquote>
+ </body>
+ </description>
+ <references>
+ <cvename>CVE-2016-8735</cvename>
+ <cvename>CVE-2016-6816</cvename>
+ <freebsdpr>ports/214599</freebsdpr>
+ <url>http://tomcat.apache.org/security-6.html#Fixed_in_Apache_Tomcat_6.0.48</url>
+ <url>http://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.73</url>
+ <url>http://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.0.39</url>
+ </references>
+ <dates>
+ <discovery>2016-11-22</discovery>
+ <entry>2017-01-07</entry>
+ </dates>
+ </vuln>
+
+ <vuln vid="3ae106e2-d521-11e6-ae1b-002590263bf5">
+ <topic>tomcat -- multiple vulnerabilities</topic>
+ <affects>
+ <package>
+ <name>tomcat6</name>
+ <range><lt>6.0.47</lt></range>
+ </package>
+ <package>
+ <name>tomcat7</name>
+ <range><lt>7.0.72</lt></range>
+ </package>
+ <package>
+ <name>tomcat8</name>
+ <range><lt>8.0.37</lt></range>
+ </package>
+ </affects>
+ <description>
+ <body xmlns="http://www.w3.org/1999/xhtml">
+ <p>The Apache Software Foundation reports:</p>
+ <blockquote cite="http://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.5_and_8.0.37">
+ <p>Low: Unrestricted Access to Global Resources CVE-2016-6797</p>
+ <p>Low: Security Manager Bypass CVE-2016-6796</p>
+ <p>Low: System Property Disclosure CVE-2016-6794</p>
+ <p>Low: Security Manager Bypass CVE-2016-5018</p>
+ <p>Low: Timing Attack CVE-2016-0762</p>
+ </blockquote>
+ </body>
+ </description>
+ <references>
+ <cvename>CVE-2016-6797</cvename>
+ <cvename>CVE-2016-6796</cvename>
+ <cvename>CVE-2016-6794</cvename>
+ <cvename>CVE-2016-5018</cvename>
+ <cvename>CVE-2016-0762</cvename>
+ <url>http://tomcat.apache.org/security-6.html#Fixed_in_Apache_Tomcat_6.0.47</url>
+ <url>http://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.72</url>
+ <url>http://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.5_and_8.0.37</url>
+ </references>
+ <dates>
+ <discovery>2016-10-27</discovery>
+ <entry>2017-01-07</entry>
+ </dates>
+ </vuln>
+
<vuln vid="3d6be69b-d365-11e6-a071-001e67f15f5a">
<topic>Irssi -- multiple vulnerabilities</topic>
<affects>
More information about the svn-ports-all
mailing list