Product: Solaris 9 Operating System Solaris 10 Operating System OpenSolaris
There are three security vulnerabilities in the Tomcat JSP/Servlet container that affect Tomcat 5.5 bundled in Solaris 9 and Solaris 10.
The first two security vulnerabilities are Cross Site Scripting (XSS) issues. One in the HttpServletResponse.sendError method (CVE-2008-1232) and the other in the Tomcat Virtual Host Manager (CVE-2008-1947). These may allow a local or remote unprivileged user to inject arbitrary web script or HTML, which in turn may allow the unprivileged user to bypass access control and gain access to unauthorized data.
The third security vulnerability is a Directory Traversal vulnerability in the RequestDispatcher class (CVE-2008-2370) that may allow a local or remote unprivileged user to bypass access control and gain access to unauthorized data.
Additional information regarding these issues is available at:
First released: 25-Feb-2009