• info
• discussion
• exploit
• solution
• references

Apache Tomcat 'HttpServletResponse.sendError()' Cross Site Scripting Vulnerability

Solution:
Updates are available. Please see the references for more information.


Mandriva Linux Mandrake 2008.0

• Mandriva tomcat5-5.5.23-9.2.10.2mdv2008.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva tomcat5-admin-webapps-5.5.23-9.2.10.2mdv2008.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva tomcat5-common-lib-5.5.23-9.2.10.2mdv2008.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva tomcat5-jasper-5.5.23-9.2.10.2mdv2008.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva tomcat5-jasper-javadoc-5.5.23-9.2.10.2mdv2008.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva tomcat5-jsp-2.0-api-5.5.23-9.2.10.2mdv2008.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva tomcat5-jsp-2.0-api-javadoc-5.5.23-9.2.10.2mdv2008.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva tomcat5-server-lib-5.5.23-9.2.10.2mdv2008.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva tomcat5-servlet-2.4-api-5.5.23-9.2.10.2mdv2008.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva tomcat5-servlet-2.4-api-javadoc-5.5.23-9.2.10.2mdv2008.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva tomcat5-webapps-5.5.23-9.2.10.2mdv2008.0.i586.rpm
  http://www.mandriva.com/en/download/

VMWare ESX Server 4.0

• VMWare ESX-4.0.0-update01.zip
  https://hostupdate.vmware.com/software/VUM/OFFLINE/release-158-2009111 8-187517/ESX-4.0.0-update01.zip

HP HP-UX B.11.23

• HP HPUXWSATW-B222-1123-32.depot
  PA-32
  http://software.hp.com


• HP HPUXWSATW-B222-1123-64.depot
  IA-64
  http://software.hp.com


• HP HPUXWSATW-B302-32.depot
  IA-64
  http://software.hp.com

HP HP-UX B.11.11

• HP HPUXWSATW-B222-1111.depot
  PA-32
  http://software.hp.com


• HP HPUXWSATW-B302-64.depot
  http://software.hp.com

Apache Software Foundation Tomcat 6.0.10

• Apache Software Foundation apache-tomcat-6.0.18.tar.gz
  http://mirror.atlanticmetro.net/apache/tomcat/tomcat-6/v6.0.18/bin/apa che-tomcat-6.0.18.tar.gz

Apache Software Foundation Tomcat 6.0.15

• Apache Software Foundation apache-tomcat-6.0.18.tar.gz
  http://mirror.atlanticmetro.net/apache/tomcat/tomcat-6/v6.0.18/bin/apa che-tomcat-6.0.18.tar.gz

Apache Software Foundation Tomcat 6.0.16

• Apache Software Foundation apache-tomcat-6.0.18.tar.gz
  http://mirror.atlanticmetro.net/apache/tomcat/tomcat-6/v6.0.18/bin/apa che-tomcat-6.0.18.tar.gz

Apache Software Foundation Tomcat 6.0.5

• Apache Software Foundation apache-tomcat-6.0.18.tar.gz
  http://mirror.atlanticmetro.net/apache/tomcat/tomcat-6/v6.0.18/bin/apa che-tomcat-6.0.18.tar.gz

Apache Software Foundation Tomcat 6.0.7

• Apache Software Foundation apache-tomcat-6.0.18.tar.gz
  http://mirror.atlanticmetro.net/apache/tomcat/tomcat-6/v6.0.18/bin/apa che-tomcat-6.0.18.tar.gz

Apache Software Foundation Tomcat 6.0.8

• Apache Software Foundation apache-tomcat-6.0.18.tar.gz
  http://mirror.atlanticmetro.net/apache/tomcat/tomcat-6/v6.0.18/bin/apa che-tomcat-6.0.18.tar.gz