tomcat8 (8.5.14-1+deb9u2) stretch-security; urgency=high

  * Team upload.
  * Fix CVE-2017-7674:
    The CORS Filter did not add an HTTP Vary header indicating that the
    response varies depending on Origin. This permitted client and server side
    cache poisoning in some circumstances.
  * Fix CVE-2017-7675:
    The HTTP/2 implementation bypassed a number of security checks that
    prevented directory traversal attacks. It was therefore possible to bypass
    security constraints using a specially crafted URL.

Fixed CVE-2017-5664: Static error pages can be overwritten if the DefaultServlet is configured to permit writes (Closes: #864447)

Upstream version 8.5.14

Upstream version 8.5.13

Upstream version 8.5.12

Thanks: Salvatore Bonaccorso for the report.
Closes: #860068

Add CVE patches to series file.

Upstream version 8.5.11

Upstream version 8.5.10

Restored the classloading from the common, server and shared directories under CATALINA_BASE (Closes: #847137)

Upstream version 8.5.9