<oval_definitions xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5" xmlns:oval="http://oval.mitre.org/XMLSchema/oval-common-5" xmlns:oval-def="http://oval.mitre.org/XMLSchema/oval-definitions-5" xmlns:unix-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" xmlns:red-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux" xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://oval.mitre.org/XMLSchema/oval-common-5 oval-common-schema.xsd http://oval.mitre.org/XMLSchema/oval-definitions-5 oval-definitions-schema.xsd http://oval.mitre.org/XMLSchema/oval-definitions-5#unix unix-definitions-schema.xsd http://oval.mitre.org/XMLSchema/oval-definitions-5#linux linux-definitions-schema.xsd">
<generator>
<oval:product_name>Oracle Errata System</oval:product_name>
<oval:product_version>Oracle Linux</oval:product_version>
<oval:schema_version>5.11</oval:schema_version>
<oval:timestamp>2024-09-21T19:08:39</oval:timestamp>
</generator>
<definitions>
<definition id="oval:com.oracle.elsa:def:20140429" version="501" class="patch">
<metadata>
<title>
ELSA-2014-0429:  tomcat6 security update (MODERATE)
</title>
<affected family="unix">
<platform>Oracle Linux 6</platform>

</affected>
<reference source="elsa" ref_id="ELSA-2014-0429" ref_url="https://linux.oracle.com/errata/ELSA-2014-0429.html"/>
<reference source="CVE" ref_id="CVE-2013-4286" ref_url="https://linux.oracle.com/cve/CVE-2013-4286.html"/>
<reference source="CVE" ref_id="CVE-2013-4322" ref_url="https://linux.oracle.com/cve/CVE-2013-4322.html"/>
<reference source="CVE" ref_id="CVE-2014-0050" ref_url="https://linux.oracle.com/cve/CVE-2014-0050.html"/>

<description>
[0:6.0.24-64]
- Resolves: CVE-2014-0050

[0:6.0.24-63]
- Resolves: CVE-2013-4322 CVE-2013-4286
</description>
<!--
 ~~~~~~~~~~~~~~~~~~~~   advisory details   ~~~~~~~~~~~~~~~~~~~ 
-->
<advisory>
<severity>MODERATE</severity>
<rights>Copyright 2014 Oracle, Inc.</rights>
<issued date="2014-04-23"/>
<cve cvss2="5.8/AV:N/AC:M/Au:N/C:P/I:P/A:N" href="https://linux.oracle.com/cve/CVE-2013-4286.html" public="20140225">CVE-2013-4286</cve>
<cve cvss2="4.3/AV:N/AC:M/Au:N/C:N/I:N/A:P" href="https://linux.oracle.com/cve/CVE-2013-4322.html" public="20140225">CVE-2013-4322</cve>
<cve cvss2="5/AV:N/AC:L/Au:N/C:N/I:N/A:P" href="https://linux.oracle.com/cve/CVE-2014-0050.html" public="20140206">CVE-2014-0050</cve>

<affected_cpe_list>
<cpe>cpe:/a:oracle:linux:6::latest_archive</cpe>
<cpe>cpe:/a:oracle:linux:6:5:patch</cpe>
</affected_cpe_list>
</advisory>
</metadata>
<criteria operator="AND">
<criterion test_ref="oval:com.oracle.elsa:tst:20140429001" comment="Oracle Linux 6 is installed"/>
<criteria operator="OR">
<criteria operator="AND">
<criterion test_ref="oval:com.oracle.elsa:tst:20140429002" comment="Oracle Linux arch is x86_64"/>
<criteria operator="OR">
<criteria operator="AND">
<criterion test_ref="oval:com.oracle.elsa:tst:20140429003" comment="tomcat6 is earlier than 0:6.0.24-64.el6_5"/>
<criterion test_ref="oval:com.oracle.elsa:tst:20140429004" comment="tomcat6 is signed with the Oracle Linux 6 key"/>
</criteria>
<criteria operator="AND">
<criterion test_ref="oval:com.oracle.elsa:tst:20140429005" comment="tomcat6-admin-webapps is earlier than 0:6.0.24-64.el6_5"/>
<criterion test_ref="oval:com.oracle.elsa:tst:20140429006" comment="tomcat6-admin-webapps is signed with the Oracle Linux 6 key"/>
</criteria>
<criteria operator="AND">
<criterion test_ref="oval:com.oracle.elsa:tst:20140429007" comment="tomcat6-docs-webapp is earlier than 0:6.0.24-64.el6_5"/>
<criterion test_ref="oval:com.oracle.elsa:tst:20140429008" comment="tomcat6-docs-webapp is signed with the Oracle Linux 6 key"/>
</criteria>
<criteria operator="AND">
<criterion test_ref="oval:com.oracle.elsa:tst:20140429009" comment="tomcat6-el-2.1-api is earlier than 0:6.0.24-64.el6_5"/>
<criterion test_ref="oval:com.oracle.elsa:tst:20140429010" comment="tomcat6-el-2.1-api is signed with the Oracle Linux 6 key"/>
</criteria>
<criteria operator="AND">
<criterion test_ref="oval:com.oracle.elsa:tst:20140429011" comment="tomcat6-javadoc is earlier than 0:6.0.24-64.el6_5"/>
<criterion test_ref="oval:com.oracle.elsa:tst:20140429012" comment="tomcat6-javadoc is signed with the Oracle Linux 6 key"/>
</criteria>
<criteria operator="AND">
<criterion test_ref="oval:com.oracle.elsa:tst:20140429013" comment="tomcat6-jsp-2.1-api is earlier than 0:6.0.24-64.el6_5"/>
<criterion test_ref="oval:com.oracle.elsa:tst:20140429014" comment="tomcat6-jsp-2.1-api is signed with the Oracle Linux 6 key"/>
</criteria>
<criteria operator="AND">
<criterion test_ref="oval:com.oracle.elsa:tst:20140429015" comment="tomcat6-lib is earlier than 0:6.0.24-64.el6_5"/>
<criterion test_ref="oval:com.oracle.elsa:tst:20140429016" comment="tomcat6-lib is signed with the Oracle Linux 6 key"/>
</criteria>
<criteria operator="AND">
<criterion test_ref="oval:com.oracle.elsa:tst:20140429017" comment="tomcat6-servlet-2.5-api is earlier than 0:6.0.24-64.el6_5"/>
<criterion test_ref="oval:com.oracle.elsa:tst:20140429018" comment="tomcat6-servlet-2.5-api is signed with the Oracle Linux 6 key"/>
</criteria>
<criteria operator="AND">
<criterion test_ref="oval:com.oracle.elsa:tst:20140429019" comment="tomcat6-webapps is earlier than 0:6.0.24-64.el6_5"/>
<criterion test_ref="oval:com.oracle.elsa:tst:20140429020" comment="tomcat6-webapps is signed with the Oracle Linux 6 key"/>
</criteria>
</criteria>
</criteria>
<criteria operator="AND">
<criterion test_ref="oval:com.oracle.elsa:tst:20140429021" comment="Oracle Linux arch is i686"/>
<criteria operator="OR">
<criteria operator="AND">
<criterion test_ref="oval:com.oracle.elsa:tst:20140429003" comment="tomcat6 is earlier than 0:6.0.24-64.el6_5"/>
<criterion test_ref="oval:com.oracle.elsa:tst:20140429004" comment="tomcat6 is signed with the Oracle Linux 6 key"/>
</criteria>
<criteria operator="AND">
<criterion test_ref="oval:com.oracle.elsa:tst:20140429005" comment="tomcat6-admin-webapps is earlier than 0:6.0.24-64.el6_5"/>
<criterion test_ref="oval:com.oracle.elsa:tst:20140429006" comment="tomcat6-admin-webapps is signed with the Oracle Linux 6 key"/>
</criteria>
<criteria operator="AND">
<criterion test_ref="oval:com.oracle.elsa:tst:20140429007" comment="tomcat6-docs-webapp is earlier than 0:6.0.24-64.el6_5"/>
<criterion test_ref="oval:com.oracle.elsa:tst:20140429008" comment="tomcat6-docs-webapp is signed with the Oracle Linux 6 key"/>
</criteria>
<criteria operator="AND">
<criterion test_ref="oval:com.oracle.elsa:tst:20140429009" comment="tomcat6-el-2.1-api is earlier than 0:6.0.24-64.el6_5"/>
<criterion test_ref="oval:com.oracle.elsa:tst:20140429010" comment="tomcat6-el-2.1-api is signed with the Oracle Linux 6 key"/>
</criteria>
<criteria operator="AND">
<criterion test_ref="oval:com.oracle.elsa:tst:20140429011" comment="tomcat6-javadoc is earlier than 0:6.0.24-64.el6_5"/>
<criterion test_ref="oval:com.oracle.elsa:tst:20140429012" comment="tomcat6-javadoc is signed with the Oracle Linux 6 key"/>
</criteria>
<criteria operator="AND">
<criterion test_ref="oval:com.oracle.elsa:tst:20140429013" comment="tomcat6-jsp-2.1-api is earlier than 0:6.0.24-64.el6_5"/>
<criterion test_ref="oval:com.oracle.elsa:tst:20140429014" comment="tomcat6-jsp-2.1-api is signed with the Oracle Linux 6 key"/>
</criteria>
<criteria operator="AND">
<criterion test_ref="oval:com.oracle.elsa:tst:20140429015" comment="tomcat6-lib is earlier than 0:6.0.24-64.el6_5"/>
<criterion test_ref="oval:com.oracle.elsa:tst:20140429016" comment="tomcat6-lib is signed with the Oracle Linux 6 key"/>
</criteria>
<criteria operator="AND">
<criterion test_ref="oval:com.oracle.elsa:tst:20140429017" comment="tomcat6-servlet-2.5-api is earlier than 0:6.0.24-64.el6_5"/>
<criterion test_ref="oval:com.oracle.elsa:tst:20140429018" comment="tomcat6-servlet-2.5-api is signed with the Oracle Linux 6 key"/>
</criteria>
<criteria operator="AND">
<criterion test_ref="oval:com.oracle.elsa:tst:20140429019" comment="tomcat6-webapps is earlier than 0:6.0.24-64.el6_5"/>
<criterion test_ref="oval:com.oracle.elsa:tst:20140429020" comment="tomcat6-webapps is signed with the Oracle Linux 6 key"/>
</criteria>
</criteria>
</criteria>
</criteria>
</criteria>

</definition>
</definitions>
<!--
 ~~~~~~~~~~~~~~~~~~~~~   rpminfo tests   ~~~~~~~~~~~~~~~~~~~~~ 
-->
<tests>
<rpminfo_test id="oval:com.oracle.elsa:tst:20140429001"  version="501" comment="Oracle Linux 6 is installed" check="at least one" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux">
<object object_ref="oval:com.oracle.elsa:obj:20140429001" />
<state state_ref="oval:com.oracle.elsa:ste:20140429002" />
</rpminfo_test>
<rpminfo_test id="oval:com.oracle.elsa:tst:20140429002"  version="501" comment="Oracle Linux arch is x86_64" check="at least one" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux">
<object object_ref="oval:com.oracle.elsa:obj:20140429001" />
<state state_ref="oval:com.oracle.elsa:ste:20140429003" />
</rpminfo_test>
<rpminfo_test id="oval:com.oracle.elsa:tst:20140429003"  version="501" comment="tomcat6 is earlier than 0:6.0.24-64.el6_5" check="at least one" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux">
<object object_ref="oval:com.oracle.elsa:obj:20140429002" />
<state state_ref="oval:com.oracle.elsa:ste:20140429004" />
</rpminfo_test>
<rpminfo_test id="oval:com.oracle.elsa:tst:20140429004"  version="501" comment="tomcat6 is signed with the Oracle Linux 6 key" check="at least one" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux">
<object object_ref="oval:com.oracle.elsa:obj:20140429002" />
<state state_ref="oval:com.oracle.elsa:ste:20140429001" />
</rpminfo_test>
<rpminfo_test id="oval:com.oracle.elsa:tst:20140429005"  version="501" comment="tomcat6-admin-webapps is earlier than 0:6.0.24-64.el6_5" check="at least one" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux">
<object object_ref="oval:com.oracle.elsa:obj:20140429003" />
<state state_ref="oval:com.oracle.elsa:ste:20140429004" />
</rpminfo_test>
<rpminfo_test id="oval:com.oracle.elsa:tst:20140429006"  version="501" comment="tomcat6-admin-webapps is signed with the Oracle Linux 6 key" check="at least one" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux">
<object object_ref="oval:com.oracle.elsa:obj:20140429003" />
<state state_ref="oval:com.oracle.elsa:ste:20140429001" />
</rpminfo_test>
<rpminfo_test id="oval:com.oracle.elsa:tst:20140429007"  version="501" comment="tomcat6-docs-webapp is earlier than 0:6.0.24-64.el6_5" check="at least one" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux">
<object object_ref="oval:com.oracle.elsa:obj:20140429004" />
<state state_ref="oval:com.oracle.elsa:ste:20140429004" />
</rpminfo_test>
<rpminfo_test id="oval:com.oracle.elsa:tst:20140429008"  version="501" comment="tomcat6-docs-webapp is signed with the Oracle Linux 6 key" check="at least one" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux">
<object object_ref="oval:com.oracle.elsa:obj:20140429004" />
<state state_ref="oval:com.oracle.elsa:ste:20140429001" />
</rpminfo_test>
<rpminfo_test id="oval:com.oracle.elsa:tst:20140429009"  version="501" comment="tomcat6-el-2.1-api is earlier than 0:6.0.24-64.el6_5" check="at least one" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux">
<object object_ref="oval:com.oracle.elsa:obj:20140429005" />
<state state_ref="oval:com.oracle.elsa:ste:20140429004" />
</rpminfo_test>
<rpminfo_test id="oval:com.oracle.elsa:tst:20140429010"  version="501" comment="tomcat6-el-2.1-api is signed with the Oracle Linux 6 key" check="at least one" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux">
<object object_ref="oval:com.oracle.elsa:obj:20140429005" />
<state state_ref="oval:com.oracle.elsa:ste:20140429001" />
</rpminfo_test>
<rpminfo_test id="oval:com.oracle.elsa:tst:20140429011"  version="501" comment="tomcat6-javadoc is earlier than 0:6.0.24-64.el6_5" check="at least one" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux">
<object object_ref="oval:com.oracle.elsa:obj:20140429006" />
<state state_ref="oval:com.oracle.elsa:ste:20140429004" />
</rpminfo_test>
<rpminfo_test id="oval:com.oracle.elsa:tst:20140429012"  version="501" comment="tomcat6-javadoc is signed with the Oracle Linux 6 key" check="at least one" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux">
<object object_ref="oval:com.oracle.elsa:obj:20140429006" />
<state state_ref="oval:com.oracle.elsa:ste:20140429001" />
</rpminfo_test>
<rpminfo_test id="oval:com.oracle.elsa:tst:20140429013"  version="501" comment="tomcat6-jsp-2.1-api is earlier than 0:6.0.24-64.el6_5" check="at least one" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux">
<object object_ref="oval:com.oracle.elsa:obj:20140429007" />
<state state_ref="oval:com.oracle.elsa:ste:20140429004" />
</rpminfo_test>
<rpminfo_test id="oval:com.oracle.elsa:tst:20140429014"  version="501" comment="tomcat6-jsp-2.1-api is signed with the Oracle Linux 6 key" check="at least one" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux">
<object object_ref="oval:com.oracle.elsa:obj:20140429007" />
<state state_ref="oval:com.oracle.elsa:ste:20140429001" />
</rpminfo_test>
<rpminfo_test id="oval:com.oracle.elsa:tst:20140429015"  version="501" comment="tomcat6-lib is earlier than 0:6.0.24-64.el6_5" check="at least one" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux">
<object object_ref="oval:com.oracle.elsa:obj:20140429008" />
<state state_ref="oval:com.oracle.elsa:ste:20140429004" />
</rpminfo_test>
<rpminfo_test id="oval:com.oracle.elsa:tst:20140429016"  version="501" comment="tomcat6-lib is signed with the Oracle Linux 6 key" check="at least one" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux">
<object object_ref="oval:com.oracle.elsa:obj:20140429008" />
<state state_ref="oval:com.oracle.elsa:ste:20140429001" />
</rpminfo_test>
<rpminfo_test id="oval:com.oracle.elsa:tst:20140429017"  version="501" comment="tomcat6-servlet-2.5-api is earlier than 0:6.0.24-64.el6_5" check="at least one" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux">
<object object_ref="oval:com.oracle.elsa:obj:20140429009" />
<state state_ref="oval:com.oracle.elsa:ste:20140429004" />
</rpminfo_test>
<rpminfo_test id="oval:com.oracle.elsa:tst:20140429018"  version="501" comment="tomcat6-servlet-2.5-api is signed with the Oracle Linux 6 key" check="at least one" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux">
<object object_ref="oval:com.oracle.elsa:obj:20140429009" />
<state state_ref="oval:com.oracle.elsa:ste:20140429001" />
</rpminfo_test>
<rpminfo_test id="oval:com.oracle.elsa:tst:20140429019"  version="501" comment="tomcat6-webapps is earlier than 0:6.0.24-64.el6_5" check="at least one" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux">
<object object_ref="oval:com.oracle.elsa:obj:20140429010" />
<state state_ref="oval:com.oracle.elsa:ste:20140429004" />
</rpminfo_test>
<rpminfo_test id="oval:com.oracle.elsa:tst:20140429020"  version="501" comment="tomcat6-webapps is signed with the Oracle Linux 6 key" check="at least one" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux">
<object object_ref="oval:com.oracle.elsa:obj:20140429010" />
<state state_ref="oval:com.oracle.elsa:ste:20140429001" />
</rpminfo_test>
<rpminfo_test id="oval:com.oracle.elsa:tst:20140429021"  version="501" comment="Oracle Linux arch is i686" check="at least one" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux">
<object object_ref="oval:com.oracle.elsa:obj:20140429001" />
<state state_ref="oval:com.oracle.elsa:ste:20140429005" />
</rpminfo_test>

</tests>
<!--
 ~~~~~~~~~~~~~~~~~~~~   rpminfo objects   ~~~~~~~~~~~~~~~~~~~~ 
-->
<objects>
<rpminfo_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux" id="oval:com.oracle.elsa:obj:20140429006" version="501">
<name>tomcat6-javadoc</name>
</rpminfo_object>
<rpminfo_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux" id="oval:com.oracle.elsa:obj:20140429010" version="501">
<name>tomcat6-webapps</name>
</rpminfo_object>
<rpminfo_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux" id="oval:com.oracle.elsa:obj:20140429005" version="501">
<name>tomcat6-el-2.1-api</name>
</rpminfo_object>
<rpminfo_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux" id="oval:com.oracle.elsa:obj:20140429007" version="501">
<name>tomcat6-jsp-2.1-api</name>
</rpminfo_object>
<rpminfo_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux" id="oval:com.oracle.elsa:obj:20140429001" version="501">
<name>oraclelinux-release</name>
</rpminfo_object>
<rpminfo_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux" id="oval:com.oracle.elsa:obj:20140429002" version="501">
<name>tomcat6</name>
</rpminfo_object>
<rpminfo_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux" id="oval:com.oracle.elsa:obj:20140429004" version="501">
<name>tomcat6-docs-webapp</name>
</rpminfo_object>
<rpminfo_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux" id="oval:com.oracle.elsa:obj:20140429008" version="501">
<name>tomcat6-lib</name>
</rpminfo_object>
<rpminfo_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux" id="oval:com.oracle.elsa:obj:20140429003" version="501">
<name>tomcat6-admin-webapps</name>
</rpminfo_object>
<rpminfo_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux" id="oval:com.oracle.elsa:obj:20140429009" version="501">
<name>tomcat6-servlet-2.5-api</name>
</rpminfo_object>

</objects>
<states>
<!--
 ~~~~~~~~~~~~~~~~~~~~   rpminfo states   ~~~~~~~~~~~~~~~~~~~~~ 
-->
<rpminfo_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux" id="oval:com.oracle.elsa:ste:20140429001" version="501">
<signature_keyid operation="equals">72f97b74ec551f03</signature_keyid>
</rpminfo_state>
<rpminfo_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux" id="oval:com.oracle.elsa:ste:20140429002" version="501">
<version operation="pattern match">^6</version>
</rpminfo_state>
<rpminfo_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux" id="oval:com.oracle.elsa:ste:20140429003" version="501">
<arch operation="pattern match">x86_64</arch>
</rpminfo_state>
<rpminfo_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux" id="oval:com.oracle.elsa:ste:20140429004" version="501">
<evr datatype="evr_string" operation="less than">0:6.0.24-64.el6_5</evr>
</rpminfo_state>
<rpminfo_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux" id="oval:com.oracle.elsa:ste:20140429005" version="501">
<arch operation="pattern match">i686</arch>
</rpminfo_state>

</states>
</oval_definitions>
