The following problems were fixed in Apache Tomcat version 6.0.36:
Important: Denial of service CVE-2012-2733
The checks that limited the permitted size of request headers were implemented too late in the request parsing process for the HTTP NIO connector. This enabled a malicious user to trigger an OutOfMemoryError by sending a single request with very large headers. This was fixed in revision 1356208.
DIGEST authentication weakness CVE-2012-3439
Three weaknesses in Tomcat's implementation of DIGEST authentication were identified and resolved:
Tomcat tracked client rather than server nonces and nonce count.
When a session ID was present, authentication was bypassed.
The user name and password were not checked before when indicating that a nonce was stale.
These issues reduced the security of DIGEST authentication making replay attacks possible in some circumstances.
Important: Bypass of security constraints CVE-2012-3546
When using FORM authentication it was possible to bypass the security constraint checks in the FORM authenticator by appending /j_security_check to the end of the URL if some other component (such as the Single-Sign-On valve) had called request.setUserPrincipal() before the call to FormAuthenticator#authenticate(). This was fixed in revision 1381035.
Important: Bypass of CSRF prevention filter CVE-2012-4431
The CSRF prevention filter could be bypassed if a request was made to a protected resource without a session identifier present in the request. This was fixed in revision 1394456.
Important: Denial of service CVE-2012-4534
When using the NIO connector with sendfile and HTTPS enabled, if a client breaks the connection while reading the response an infinite loop is entered leading to a denial of service. This was originally reported as bug 52858. This was fixed in revision 1372035.
Affected Apache Tomcat versions (6.0.0 - 6.0.36).
- Important: Denial of service CVE-2012-2733
- Upgrade to the latest version of Apache Tomcat.
- WordPress Plugin Add Link to Facebook Cross-Site Scripting (2.2.7)
- WordPress Plugin Lazy SEO Arbitrary File Upload (1.3.2)
- WordPress Plugin Local Weather Cross-Site Scripting (1.0)
- WordPress 4.5.x Multiple Vulnerabilities (4.5 - 4.5.13)
- WordPress Plugin JW Player for Flash & HTML5 Video Cross-Site Request Forgery (2.1.11)