CVE-2010-2227

Publication date 13 July 2010

Last updated 24 July 2024

Ubuntu priority

Apache Tomcat 5.5.0 through 5.5.29, 6.0.0 through 6.0.27, and 7.0.0 beta does not properly handle an invalid Transfer-Encoding header, which allows remote attackers to cause a denial of service (application outage) or obtain sensitive information via a crafted header that interferes with "recycling of a buffer."

Status

Show unmaintained releases

Package	Ubuntu Release	Status
tomcat5	11.10 oneiric	Not in release
	11.04 natty	Not in release
	10.10 maverick	Not in release
	10.04 LTS lucid	Not in release
	9.10 karmic	Not in release
	9.04 jaunty	Not in release
	8.04 LTS hardy	Not in release
	6.06 LTS dapper	Ignored
tomcat5.5	11.10 oneiric	Not in release
	11.04 natty	Not in release
	10.10 maverick	Not in release
	10.04 LTS lucid	Not in release
	9.10 karmic	Not in release
	9.04 jaunty	Ignored
	8.04 LTS hardy	Ignored
	6.06 LTS dapper	Not in release
tomcat6	11.10 oneiric	Fixed 6.0.28-2
	11.04 natty	Fixed 6.0.28-2
	10.10 maverick	Fixed 6.0.28-2
	10.04 LTS lucid	Fixed 6.0.24-2ubuntu1.3
	9.10 karmic	Fixed 6.0.20-2ubuntu2.2
	9.04 jaunty	Fixed 6.0.18-0ubuntu6.3
	8.04 LTS hardy	Not in release
	6.06 LTS dapper	Not in release

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package	Patch details
tomcat5	Upstream: http://svn.apache.org/viewvc?view=revision&revision=959428
tomcat5.5	Upstream: http://svn.apache.org/viewvc?view=revision&revision=959428
tomcat6	Upstream: http://svn.apache.org/viewvc?view=revision&revision=958977

CVE-2010-2227

Status

Patch details

References

Related Ubuntu Security Notices (USN)

Other references