Description: Fixes CVE-2016-0763: The setGlobalContext method in ResourceLinkFactory
 in Apache Tomcat does not consider whether ResourceLinkFactory.setGlobalContext
 callers are authorized, which allows remote authenticated users to bypass intended
 SecurityManager restrictions and read or write to arbitrary application data,
 or cause a denial of service (application disruption), via a web application
 that sets a crafted global context.
Author: Markus Koschany <apo@debian.org>
Origin: backport, https://svn.apache.org/r1725929
--- a/java/org/apache/naming/factory/ResourceLinkFactory.java
+++ b/java/org/apache/naming/factory/ResourceLinkFactory.java
@@ -60,6 +60,11 @@
      * @param newGlobalContext new global context value
      */
     public static void setGlobalContext(Context newGlobalContext) {
+        SecurityManager sm = System.getSecurityManager();
+        if (sm != null) {
+            sm.checkPermission(new RuntimePermission(
+                   ResourceLinkFactory.class.getName() + ".setGlobalContext"));
+        }
         globalContext = newGlobalContext;
     }
 
--- a/webapps/docs/changelog.xml
+++ b/webapps/docs/changelog.xml
@@ -360,6 +360,10 @@
         Add the <code>StatusManagerServlet</code> to the list of Servlets that
         can only be loaded by privileged applications. (markt)
       </fix>
+      <fix>
+        Protect initialization of <code>ResourceLinkFactory</code> when
+        running with a SecurityManager. (kkolinko)
+      </fix>
     </changelog>
   </subsection>
   <subsection name="WebSocket">
