tomcat6 (6.0.45+dfsg-1ubuntu0.2) xenial-security; urgency=medium

  * SECURITY UPDATE: privilege escalation via insecure init script
    - debian/tomcat6.init: don't follow symlinks when handling the
      catalina.out file.
    - CVE-2016-1240

 -- Emilia Torino <emilia.torino@canonical.com>  Mon, 26 Oct 2020 11:52:05 -0300

tomcat6 (6.0.45+dfsg-1ubuntu0.1) xenial-security; urgency=medium

  * Merge patches from Debian.
  * SECURITY UPDATE: Timing attack.
    - debian/patches/CVE-2016-0762.patch: Make timing attacks against the
      Realm implementations harder.
    - CVE-2016-0762
  * SECURITY UPDATE: SecurityManager bypass.
    - debian/patches/CVE-2016-5018.patch: Remove unnecessary code.
    - debian/patches/CVE-2016-5018-part2.patch: Fix regression.
    - debian/patches/CVE-2016-6794.patch: Provide a mechanism that enables
      the container to check if a component has been granted a given
      permission when running under a SecurityManager.
    - debian/patches/CVE-2016-6796.patch: Ignore some JSP options when
      running under a SecurityManager.
    - CVE-2016-5018
    - CVE-2016-6794
    - CVE-2016-6796
  * SECURITY UPDATE: Limited resources bypass.
    - debian/patches/CVE-2016-6797.patch: When adding and removing
      ResourceLinks dynamically, ensure that the global resource is only
      visible via the ResourceLinkFactory when it is meant to be.
    - debian/patches/CVE-2016-6797-part2.patch: Fix regression.
    - CVE-2016-6797
  * SECURITY UPDATE: Data injection in HTTP requests.
    - debian/patches/CVE-2016-6816.patch: Add additional checks for valid
      characters to the HTTP request line parsing so invalid request lines
      are rejected sooner.
    - CVE-2016-6816
  * SECURITY UPDATE: Remote code execution.
    - debian/patches/CVE-2016-8735.patch: Explicitly configure allowed
      credential types.
    - CVE-2016-8735

 -- Eduardo Barretto <eduardo.barretto@canonical.com>  Tue, 29 Sep 2020 10:08:34 -0300

tomcat6 (6.0.45+dfsg-1) unstable; urgency=medium

  * Team upload.
  * Imported Upstream version 6.0.45+dfsg.
    - Remove all prebuilt jar files.
  * Declare compliance with Debian Policy 3.9.7.
  * Vcs-fields: Use https.
  * This update fixes the following security vulnerabilities in the source
    package. Since src:tomcat6 only builds libservlet2.5-java and
    documentation, users are not directly affected.
    - CVE-2015-5174: Directory traversal vulnerability in RequestUtil.java.
    - CVE-2015-5345: The Mapper component in Apache Tomcat before 6.0.45
      processes redirects before considering security constraints and Filters.
    - CVE-2016-0706: Apache Tomcat before 6.0.45 does not place
      org.apache.catalina.manager.StatusManagerServlet on the
      org/apache/catalina/core/RestrictedServlets.properties list which allows
      remote authenticated users to bypass intended SecurityManager
      restrictions.
    - CVE-2016-0714: The session-persistence implementation in Apache Tomcat
      before 6.0.45 mishandles session attributes, which allows remote
      authenticated users to bypass intended SecurityManager restrictions.
    - CVE-2016-0763: The setGlobalContext method in
      org/apache/naming/factory/ResourceLinkFactory.java in Apache Tomcat does
      not consider whether ResourceLinkFactory.setGlobalContext callers are
      authorized, which allows remote authenticated users to bypass intended
      SecurityManager restrictions and read or write to arbitrary application
      data, or cause a denial of service (application disruption), via a web
      application that sets a crafted global context.
    - CVE-2015-5351: The Manager and Host Manager applications in
      Apache Tomcat establish sessions and send CSRF tokens for arbitrary new
      requests, which allows remote attackers to bypass a CSRF protection
      mechanism by using a token.

 -- Markus Koschany <apo@debian.org>  Sat, 27 Feb 2016 19:32:00 +0100

tomcat6 (6.0.41-4) unstable; urgency=medium

  * Removed the timstamp from the Javadoc of the Servlet API
    to make the build reproducible

 -- Emmanuel Bourg <ebourg@apache.org>  Wed, 06 May 2015 09:35:37 +0200

tomcat6 (6.0.41-3) unstable; urgency=medium

  * Build only the libservlet2.5-java and libservlet2.5-java-doc packages.
    Tomcat 6 will not be supported in Jessie, but the Servlet API is still
    useful as a build dependency for other packages.
  * Standards-Version updated to 3.9.6 (no changes)

 -- Emmanuel Bourg <ebourg@apache.org>  Wed, 22 Oct 2014 09:48:54 +0200

tomcat6 (6.0.41-2) unstable; urgency=medium

  [ Emmanuel Bourg ]
  * Updated the version required for libtcnative-1 (>= 1.1.30)

  [ tony mancill ]
  * Add patch for logfile compression. (Closes: #682955)
    - Thank you to Thijs Kinkhorst.

 -- tony mancill <tmancill@debian.org>  Sun, 24 Aug 2014 13:52:40 -0700

tomcat6 (6.0.41-1) unstable; urgency=medium

  * New upstream release.
    - Refreshed the patches

 -- Emmanuel Bourg <ebourg@apache.org>  Thu, 22 May 2014 10:03:04 +0200

tomcat6 (6.0.39-1) unstable; urgency=medium

  * Team upload.
  * New upstream release.
    - Refreshed the patches
  * Standards-Version updated to 3.9.5 (no changes)
  * Switch to debhelper level 9
  * Use XZ compression for the upstream tarball
  * Use canonical URL for the Vcs-Git field

 -- Emmanuel Bourg <ebourg@apache.org>  Mon, 17 Feb 2014 00:02:00 +0100

tomcat6 (6.0.37-1) unstable; urgency=low

  * New upstream release.
    - Drop patches for CVE-2012-4534, CVE-2012-4431, CVE-2012-3546,
      CVE-2012-2733, CVE-2012-3439
    - Drop 0011-CVE-02012-0022-regression-fix.patch
    - Drop 0017-eclipse-compiler-update.patch
  * Freshened remaining patches.

 -- tony mancill <tmancill@debian.org>  Sat, 03 Aug 2013 21:50:20 -0700

tomcat6 (6.0.35-7) unstable; urgency=low

  * Team upload.
  * Fixed the watch file
  * Fix FTBFS with ecj 3.8 (closes: #717279, #713796) 
  * Updated the standards version to 3.9.4 - no changes
  * Updated the Vcs-Git field to the canonical url

 -- Stephen Nelson <stephen@eccostudio.com>  Tue, 30 Jul 2013 23:07:18 +0100

# For older changelog entries, run 'apt-get changelog libservlet2.5-java'
