LWN.net Logo

jetty: multiple vulnerabilities

Package(s):jetty CVE #(s):CVE-2007-5615 CVE-2007-5614 CVE-2007-5613
Created:July 7, 2008 Updated:February 17, 2009
Description:

From the Red Hat bugzilla:

For CVE-2007-5613: "Cross-site scripting (XSS) vulnerability in Dump Servlet in Mortbay Jetty before 6.1.6rc1 allows remote attackers to inject arbitrary web script or HTML via unspecified parameters and cookies."

For CVE-2007-5614: "Mortbay Jetty before 6.1.6rc1 does not properly handle "certain quote sequences" in HTML cookie parameters, which allows remote attackers to hijack browser sessions via unspecified vectors."

For CVE-2007-5615: "CRLF injection vulnerability in Mortbay Jetty before 6.1.6rc0 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors."

Alerts:
SuSE SUSE-SR:2009:004 2009-02-17
Fedora FEDORA-2008-6141 2008-07-06
Fedora FEDORA-2008-6164 2008-07-06

(Log in to post comments)

Copyright © 2012, Eklektix, Inc.
Comments and public postings are copyrighted by their creators.
Linux is a registered trademark of Linus Torvalds