Red Hat Security Advisory: Red Hat JBoss Web Server security and enhancement update

CVE-2016-0762 — tomcat: timing attack in Realm implementation CVE-2016-1240 — tomcat: unsafe chown of catalina.log in tomcat init script allows privilege escalation CVE-2016-3092 — tomcat: Usage of vulnerable FileUpload package can result in denial of service CVE-2016-5018 — tomcat: security manager bypass via IntrospectHelper utility function CVE-2016-6325 — tomcat: tomcat writable config files allow privilege escalation CVE-2016-6794 — tomcat: system property disclosure CVE-2016-6796 — tomcat: security manager bypass via JSP Servlet config parameters CVE-2016-6797 — tomcat: unrestricted access to global resources CVE-2016-6816 — tomcat: HTTP Request smuggling vulnerability due to permitting invalid character in HTTP requests CVE-2016-8735 — tomcat: Remote code execution vulnerability in JmxRemoteLifecycleListener CVE-2016-8745 — tomcat: information disclosure due to incorrect Processor sharing