[jboss-jira] [JBoss JIRA] Created: (JBWEB-159) CVE-2009-0783

Fri Jan 15 14:36:47 EST 2010

CVE-2009-0783
-------------

                 Key: JBWEB-159
                 URL: https://jira.jboss.org/jira/browse/JBWEB-159
             Project: JBoss Web
          Issue Type: Bug
      Security Level: Public (Everyone can see)
    Affects Versions: JBossWeb-2.1.3.GA
            Reporter: Mike Millson
            Assignee: Mike Millson
             Fix For: JBossWeb-2.1.6.GA

Allows a web application to replace the XML parser used by Tomcat to process web.xml, context.xml and tld files. In limited circumstances these bugs may allow a rogue web application to view and/or alter the web.xml, context.xml and tld files of other web applications deployed on the Tomcat instance[1].

[1]http://tomcat.apache.org/security-6.html

-- 
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators: https://jira.jboss.org/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira