• info
• discussion
• exploit
• solution
• references

Apache Tomcat XML Parser Information Disclosure Vulnerability

Solution:
Updates are available. Please see the references for more information.


Mandriva Linux Mandrake 2008.0

• Mandriva tomcat5-5.5.23-9.2.10.3mdv2008.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva tomcat5-admin-webapps-5.5.23-9.2.10.3mdv2008.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva tomcat5-common-lib-5.5.23-9.2.10.3mdv2008.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva tomcat5-jasper-5.5.23-9.2.10.3mdv2008.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva tomcat5-jasper-javadoc-5.5.23-9.2.10.3mdv2008.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva tomcat5-jsp-2.0-api-5.5.23-9.2.10.3mdv2008.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva tomcat5-jsp-2.0-api-javadoc-5.5.23-9.2.10.3mdv2008.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva tomcat5-server-lib-5.5.23-9.2.10.3mdv2008.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva tomcat5-servlet-2.4-api-5.5.23-9.2.10.3mdv2008.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva tomcat5-servlet-2.4-api-javadoc-5.5.23-9.2.10.3mdv2008.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva tomcat5-webapps-5.5.23-9.2.10.3mdv2008.0.i586.rpm
  http://www.mandriva.com/en/download/

Mandriva Linux Mandrake 2009.0 x86_64

• Mandriva tomcat5-5.5.27-0.3.0.1mdv2009.0.noarch.rpm
  http://www.mandriva.com/en/download/


• Mandriva tomcat5-admin-webapps-5.5.27-0.3.0.1mdv2009.0.noarch.rpm
  http://www.mandriva.com/en/download/


• Mandriva tomcat5-common-lib-5.5.27-0.3.0.1mdv2009.0.noarch.rpm
  http://www.mandriva.com/en/download/


• Mandriva tomcat5-jasper-5.5.27-0.3.0.1mdv2009.0.noarch.rpm
  http://www.mandriva.com/en/download/


• Mandriva tomcat5-jasper-eclipse-5.5.27-0.3.0.1mdv2009.0.noarch.rpm
  http://www.mandriva.com/en/download/


• Mandriva tomcat5-jasper-javadoc-5.5.27-0.3.0.1mdv2009.0.noarch.rpm
  http://www.mandriva.com/en/download/


• Mandriva tomcat5-jsp-2.0-api-5.5.27-0.3.0.1mdv2009.0.noarch.rpm
  http://www.mandriva.com/en/download/


• Mandriva tomcat5-jsp-2.0-api-javadoc-5.5.27-0.3.0.1mdv2009.0.noarch.rpm
  http://www.mandriva.com/en/download/


• Mandriva tomcat5-server-lib-5.5.27-0.3.0.1mdv2009.0.noarch.rpm
  http://www.mandriva.com/en/download/


• Mandriva tomcat5-servlet-2.4-api-5.5.27-0.3.0.1mdv2009.0.noarch.rpm
  http://www.mandriva.com/en/download/


• Mandriva tomcat5-servlet-2.4-api-javadoc-5.5.27-0.3.0.1mdv2009.0.noarch.rpm
  http://www.mandriva.com/en/download/


• Mandriva tomcat5-webapps-5.5.27-0.3.0.1mdv2009.0.noarch.rpm
  http://www.mandriva.com/en/download/

VMWare ESX Server 4.0

• VMWare ESX-4.0.0-update01.zip
  https://hostupdate.vmware.com/software/VUM/OFFLINE/release-158-2009111 8-187517/ESX-4.0.0-update01.zip

Mandriva Linux Mandrake 2009.1 x86_64

• Mandriva tomcat5-5.5.27-0.3.0.1mdv2009.1.noarch.rpm
  http://www.mandriva.com/en/download/


• Mandriva tomcat5-admin-webapps-5.5.27-0.3.0.1mdv2009.1.noarch.rpm
  http://www.mandriva.com/en/download/


• Mandriva tomcat5-common-lib-5.5.27-0.3.0.1mdv2009.1.noarch.rpm
  http://www.mandriva.com/en/download/


• Mandriva tomcat5-jasper-5.5.27-0.3.0.1mdv2009.1.noarch.rpm
  http://www.mandriva.com/en/download/


• Mandriva tomcat5-jasper-eclipse-5.5.27-0.3.0.1mdv2009.1.noarch.rpm
  http://www.mandriva.com/en/download/


• Mandriva tomcat5-jasper-javadoc-5.5.27-0.3.0.1mdv2009.1.noarch.rpm
  http://www.mandriva.com/en/download/


• Mandriva tomcat5-jsp-2.0-api-5.5.27-0.3.0.1mdv2009.1.noarch.rpm
  http://www.mandriva.com/en/download/


• Mandriva tomcat5-jsp-2.0-api-javadoc-5.5.27-0.3.0.1mdv2009.1.noarch.rpm
  http://www.mandriva.com/en/download/


• Mandriva tomcat5-server-lib-5.5.27-0.3.0.1mdv2009.1.noarch.rpm
  http://www.mandriva.com/en/download/


• Mandriva tomcat5-servlet-2.4-api-5.5.27-0.3.0.1mdv2009.1.noarch.rpm
  http://www.mandriva.com/en/download/


• Mandriva tomcat5-servlet-2.4-api-javadoc-5.5.27-0.3.0.1mdv2009.1.noarch.rpm
  http://www.mandriva.com/en/download/


• Mandriva tomcat5-webapps-5.5.27-0.3.0.1mdv2009.1.noarch.rpm
  http://www.mandriva.com/en/download/

Apache Software Foundation Tomcat 5.5.10

• Apache Software Foundation Revision 652592
  http://svn.apache.org/viewvc?rev=652592&view=rev


• Apache Software Foundation Revision 681156
  http://svn.apache.org/viewvc?rev=781542&view=rev


• Apache Software Foundation Revision 781708
  http://svn.apache.org/viewvc?rev=781708&view=rev

Apache Software Foundation Tomcat 5.5.11

• Apache Software Foundation Revision 652592
  http://svn.apache.org/viewvc?rev=652592&view=rev


• Apache Software Foundation Revision 681156
  http://svn.apache.org/viewvc?rev=781542&view=rev


• Apache Software Foundation Revision 781708
  http://svn.apache.org/viewvc?rev=781708&view=rev

Apache Software Foundation Tomcat 5.5.16

• Apache Software Foundation Revision 652592
  http://svn.apache.org/viewvc?rev=652592&view=rev


• Apache Software Foundation Revision 681156
  http://svn.apache.org/viewvc?rev=781542&view=rev


• Apache Software Foundation Revision 781708
  http://svn.apache.org/viewvc?rev=781708&view=rev

Apache Software Foundation Tomcat 5.5.19

• Apache Software Foundation Revision 652592
  http://svn.apache.org/viewvc?rev=652592&view=rev


• Apache Software Foundation Revision 681156
  http://svn.apache.org/viewvc?rev=781542&view=rev


• Apache Software Foundation Revision 781708
  http://svn.apache.org/viewvc?rev=781708&view=rev

Apache Software Foundation Tomcat 5.5.2

• Apache Software Foundation Revision 652592
  http://svn.apache.org/viewvc?rev=652592&view=rev


• Apache Software Foundation Revision 681156
  http://svn.apache.org/viewvc?rev=781542&view=rev


• Apache Software Foundation Revision 781708
  http://svn.apache.org/viewvc?rev=781708&view=rev

Apache Software Foundation Tomcat 5.5.21

• Apache Software Foundation Revision 652592
  http://svn.apache.org/viewvc?rev=652592&view=rev


• Apache Software Foundation Revision 681156
  http://svn.apache.org/viewvc?rev=781542&view=rev


• Apache Software Foundation Revision 781708
  http://svn.apache.org/viewvc?rev=781708&view=rev

Apache Software Foundation Tomcat 5.5.22

• Apache Software Foundation Revision 652592
  http://svn.apache.org/viewvc?rev=652592&view=rev


• Apache Software Foundation Revision 681156
  http://svn.apache.org/viewvc?rev=781542&view=rev


• Apache Software Foundation Revision 781708
  http://svn.apache.org/viewvc?rev=781708&view=rev

Apache Software Foundation Tomcat 5.5.26

• Apache Software Foundation Revision 652592
  http://svn.apache.org/viewvc?rev=652592&view=rev


• Apache Software Foundation Revision 681156
  http://svn.apache.org/viewvc?rev=781542&view=rev


• Apache Software Foundation Revision 781708
  http://svn.apache.org/viewvc?rev=781708&view=rev

Apache Software Foundation Tomcat 6.0

• Apache Software Foundation Revision 652592
  http://svn.apache.org/viewvc?rev=652592&view=rev


• Apache Software Foundation Revision 739522
  http://svn.apache.org/viewvc?rev=739522&view=rev

Apache Software Foundation Tomcat 6.0.15

• Apache Software Foundation Revision 652592
  http://svn.apache.org/viewvc?rev=652592&view=rev


• Apache Software Foundation Revision 739522
  http://svn.apache.org/viewvc?rev=739522&view=rev

Apache Software Foundation Tomcat 6.0.16

• Apache Software Foundation Revision 652592
  http://svn.apache.org/viewvc?rev=652592&view=rev


• Apache Software Foundation Revision 739522
  http://svn.apache.org/viewvc?rev=739522&view=rev

Apache Software Foundation Tomcat 6.0.5

• Apache Software Foundation Revision 652592
  http://svn.apache.org/viewvc?rev=652592&view=rev


• Apache Software Foundation Revision 739522
  http://svn.apache.org/viewvc?rev=739522&view=rev

Apache Software Foundation Tomcat 6.0.7

• Apache Software Foundation Revision 652592
  http://svn.apache.org/viewvc?rev=652592&view=rev


• Apache Software Foundation Revision 739522
  http://svn.apache.org/viewvc?rev=739522&view=rev