The following two updates has been released for Debian GNU/Linux 7 LTS:
DLA 1108-1: tomcat7 security update
DLA 1109-1: libraw security update
DLA 1108-1: tomcat7 security update
DLA 1109-1: libraw security update
DLA 1108-1: tomcat7 security update
Package : tomcat7
Version : 7.0.28-4+deb7u15
CVE ID : CVE-2017-12616
The Tomcat security team discovered that when using a
VirtualDirContext it was possible to bypass security constraints
and/or view the source code of JSPs for resources served by the
VirtualDirContext using a specially crafted request.
For Debian 7 "Wheezy", these problems have been fixed in version
7.0.28-4+deb7u15.
We recommend that you upgrade your tomcat7 packages.
Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
DLA 1109-1: libraw security update
Package : libraw
Version : 0.14.6-2+deb7u3
CVE ID : CVE-2017-14608
CVE-2017-14608
An out of bounds read flaw related to kodak_65000_load_raw has been
reported in dcraw/dcraw.c and internal/dcraw_common.cpp. An attacker
could possibly exploit this flaw to disclose potentially sensitive
memory or cause an application crash.
For Debian 7 "Wheezy", these problems have been fixed in version
0.14.6-2+deb7u3.
We recommend that you upgrade your libraw packages.
Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS