Advisories » MGASA-2016-0244

Updated struts packages fix security vulnerabilities

Publication date: 08 Jul 2016
Modification date: 08 Jul 2016
Type: security
Affected Mageia releases : 5
CVE: CVE-2016-1181 , CVE-2016-1182

Description

Updated struts packages fix security vulnerabilities:

A vulnerability in Apache Struts 1 ActionForm allowing unintended remote
operations against components on server memory, such as Servlets and
ClassLoader, was found (CVE-2016-1181).

It was reported that The Apache Struts 1 Validator contains a vulnerability
where input validation configurations (validation rules, error messages, etc.)
may be modified. This occurs when ValidatorForm and ValidatorActionForm
(including its subclasses) are in the session scope (CVE-2016-1182).
                

References

• https://bugs.mageia.org/show_bug.cgi?id=18763
• https://jvn.jp/en/jp/JVN65044642/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/UQI2PYM3R4FWEOVHIFT7KUPTILG2DFMZ/
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1181
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1182

SRPMS

5/core

• struts-1.3.10-8.2.mga5