| Name | TEMP-0840685-CEF76B |
| Description | TOCTOU race condition in initscript on chown'ing JVM_TMP temporary directory |
| Source | Automatically generated temporary name. Not for external reference. |
| Debian Bugs | 840685, 841655 |
Vulnerable and fixed packages
The table below lists information on source packages.
| Source Package | Release | Version | Status |
|---|
| tomcat6 (PTS) | jessie, jessie (lts) | 6.0.45+dfsg-1~deb8u1 | fixed |
| tomcat7 (PTS) | jessie, jessie (lts) | 7.0.56-3+really7.0.109-1+deb8u6 | fixed |
| stretch | 7.0.75-1 | fixed |
| tomcat8 (PTS) | jessie, jessie (lts) | 8.0.14-1+deb8u28 | fixed |
| stretch (security) | 8.5.54-0+deb9u8 | fixed |
| stretch (lts), stretch | 8.5.54-0+deb9u15 | fixed |
The information below is based on the following data on fixed versions.
Notes
Workaround entry for DSA-3720-1 since no CVE assinged
Workaround entry for DSA-3721-1 since no CVE assinged
Since 7.0.72-3, src:tomcat7 only builds the Servlet API
Since 6.0.41-3, src:tomcat6 only builds a servlet and docs in Jessie