[jboss-jira] [JBoss JIRA] Commented: (JBWEB-159) CVE-2009-0783

CVE-2009-0783 ------------- Key: JBWEB-159 URL: https://jira.jboss.org/jira/browse/JBWEB-159 Project: JBoss Web Issue Type: Bug Security Level: Public(Everyone can see) Affects Versions: JBossWeb-2.1.3.GA Reporter: Mike Millson Assignee: Mike Millson Fix For: JBossWeb-2.1.6.GA Allows a web application to replace the XML parser used by Tomcat to process web.xml, context.xml and tld files. In limited circumstances these bugs may allow a rogue web application to view and/or alter the web.xml, context.xml and tld files of other web applications deployed on the Tomcat instance[1]. [1]http://tomcat.apache.org/security-6.html