SUSE-SU-2016:3079-1

    Dashboard / Vulnerabilities / SUSE-SU-2016:3079-1

    SUSE-SU-2016:3079-1

    Published: 10 Dec 2016Last Modified: 4 Feb 2026

    Summary: Security update for tomcat

    Details: This update for Tomcat provides the following fixes: Feature changes: The embedded Apache Commons DBCP component was updated to version 2.0. (bsc#1010893 fate#321029) Security fixes: - CVE-2016-0762: Realm Timing Attack (bsc#1007854) - CVE-2016-5018: Security Manager Bypass (bsc#1007855) - CVE-2016-6794: System Property Disclosure (bsc#1007857) - CVE-2016-6796: Manager Bypass (bsc#1007858) - CVE-2016-6797: Unrestricted Access to Global Resources (bsc#1007853) - CVE-2016-8735: Remote code execution vulnerability in JmxRemoteLifecycleListener (bsc#1011805) - CVE-2016-6816: HTTP Request smuggling vulnerability due to permitting invalid character in HTTP requests (bsc#1011812) Bugs fixed: - Fixed StringIndexOutOfBoundsException in WebAppClassLoaderBase.filter(). (bsc#974407) - Fixed a deployment error in the examples webapp by changing the context.xml format to the new one introduced by Tomcat 8. (bsc#1004728) - Enabled optional setenv.sh script. See section '(3.4) Using the 'setenv' script' in http://tomcat.apache.org/tomcat-8.0-doc/RUNNING.txt. (bsc#1002639) - Fixed regression caused by CVE-2016-6816.

    References: https://www.suse.com/support/update/announcement/2016/suse-su-20163079-1/, https://bugzilla.suse.com/1002639, https://bugzilla.suse.com/1004728, https://bugzilla.suse.com/1007853, https://bugzilla.suse.com/1007854, https://bugzilla.suse.com/1007855, https://bugzilla.suse.com/1007857, https://bugzilla.suse.com/1007858, https://bugzilla.suse.com/1010893, https://bugzilla.suse.com/1011805, https://bugzilla.suse.com/1011812, https://bugzilla.suse.com/974407, https://www.suse.com/security/cve/CVE-2016-0762, https://www.suse.com/security/cve/CVE-2016-5018, https://www.suse.com/security/cve/CVE-2016-6794, https://www.suse.com/security/cve/CVE-2016-6796, https://www.suse.com/security/cve/CVE-2016-6797, https://www.suse.com/security/cve/CVE-2016-6816, https://www.suse.com/security/cve/CVE-2016-8735

    Affected packages

    Package

    Name: tomcat

    Purl: pkg:rpm/suse/tomcat&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP1

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -8.0.32-10.13.2

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High