Index: tomcat6-6.0.41/apache-tomcat-6.0.41-src/java/javax/el/BeanELResolver.java
===================================================================
--- tomcat6-6.0.41.orig/apache-tomcat-6.0.41-src/java/javax/el/BeanELResolver.java
+++ tomcat6-6.0.41/apache-tomcat-6.0.41-src/java/javax/el/BeanELResolver.java
@@ -188,25 +188,49 @@ public class BeanELResolver extends ELRe
 		return null;
 	}
 
-	protected final static class BeanProperties {
-		private final Map<String, BeanProperty> properties;
+    protected final static class BeanProperties {
+        private final Map<String, BeanProperty> properties;
 
-		private final Class<?> type;
+        private final Class<?> type;
 
-		public BeanProperties(Class<?> type) throws ELException {
-			this.type = type;
-			this.properties = new HashMap<String, BeanProperty>();
-			try {
-				BeanInfo info = Introspector.getBeanInfo(this.type);
-				PropertyDescriptor[] pds = info.getPropertyDescriptors();
-				for (int i = 0; i < pds.length; i++) {
-					this.properties.put(pds[i].getName(), new BeanProperty(
-							type, pds[i]));
-				}
-			} catch (IntrospectionException ie) {
-				throw new ELException(ie);
-			}
-		}
+        public BeanProperties(Class<?> type) throws ELException {
+            this.type = type;
+            this.properties = new HashMap<String, BeanProperty>();
+            try {
+                BeanInfo info = Introspector.getBeanInfo(this.type);
+                PropertyDescriptor[] pds = info.getPropertyDescriptors();
+                for (PropertyDescriptor pd: pds) {
+                    this.properties.put(pd.getName(), new BeanProperty(type, pd));
+                }
+                if (System.getSecurityManager() != null) {
+                    // When running with SecurityManager, some classes may be
+                    // not accessible, but have accessible interfaces.
+                    populateFromInterfaces(type);
+                }
+            } catch (IntrospectionException ie) {
+                throw new ELException(ie);
+            }
+        }
+
+        private void populateFromInterfaces(Class<?> aClass) throws IntrospectionException {
+            Class<?> interfaces[] = aClass.getInterfaces();
+            if (interfaces.length > 0) {
+                for (Class<?> ifs : interfaces) {
+                    BeanInfo info = Introspector.getBeanInfo(ifs);
+                    PropertyDescriptor[] pds = info.getPropertyDescriptors();
+                    for (PropertyDescriptor pd : pds) {
+                        if (!this.properties.containsKey(pd.getName())) {
+                            this.properties.put(pd.getName(), new BeanProperty(
+                                    this.type, pd));
+                        }
+                    }
+                }
+            }
+            Class<?> superclass = aClass.getSuperclass();
+            if (superclass != null) {
+                populateFromInterfaces(superclass);
+            }
+        }
 
 		private BeanProperty get(ELContext ctx, String name) {
 			BeanProperty property = this.properties.get(name);
Index: tomcat6-6.0.41/apache-tomcat-6.0.41-src/java/org/apache/jasper/runtime/PageContextImpl.java
===================================================================
--- tomcat6-6.0.41.orig/apache-tomcat-6.0.41-src/java/org/apache/jasper/runtime/PageContextImpl.java
+++ tomcat6-6.0.41/apache-tomcat-6.0.41-src/java/org/apache/jasper/runtime/PageContextImpl.java
@@ -5,9 +5,9 @@
  * The ASF licenses this file to You under the Apache License, Version 2.0
  * (the "License"); you may not use this file except in compliance with
  * the License.  You may obtain a copy of the License at
- * 
+ *
  *      http://www.apache.org/licenses/LICENSE-2.0
- * 
+ *
  * Unless required by applicable law or agreed to in writing, software
  * distributed under the License is distributed on an "AS IS" BASIS,
  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
@@ -59,7 +59,7 @@ import org.apache.jasper.util.Enumerator
 /**
  * Implementation of the PageContext class from the JSP spec. Also doubles as a
  * VariableResolver for the EL.
- * 
+ *
  * @author Anil K. Vijendran
  * @author Larry Cable
  * @author Hans Bergsten
@@ -70,7 +70,7 @@ import org.apache.jasper.util.Enumerator
  */
 public class PageContextImpl extends PageContext {
 
-    private static final JspFactory jspf = JspFactory.getDefaultFactory(); 
+    private static final JspFactory jspf = JspFactory.getDefaultFactory();
 
     private BodyContentImpl[] outs;
 
@@ -96,12 +96,12 @@ public class PageContextImpl extends Pag
     private transient ServletResponse response;
 
     private transient HttpSession session;
-    
+
     private transient ELContextImpl elContext;
 
     private boolean isIncluded;
-    
-    
+
+
     // initial output stream
     private transient JspWriter out;
 
@@ -137,7 +137,7 @@ public class PageContextImpl extends Pag
         this.errorPageURL = errorPageURL;
         this.request = request;
         this.response = response;
-        
+
         // initialize application context
         this.applicationContext = JspApplicationContextImpl.getInstance(context);
 
@@ -589,7 +589,7 @@ public class PageContextImpl extends Pag
      * Returns the exception associated with this page context, if any. <p/>
      * Added wrapping for Throwables to avoid ClassCastException: see Bugzilla
      * 31171 for details.
-     * 
+     *
      * @return The Exception associated with this page context, if any.
      */
     public Exception getException() {
@@ -875,7 +875,7 @@ public class PageContextImpl extends Pag
      * go away once the EL interpreter moves out of JSTL and into its own
      * project. For now, this is necessary because the standard machinery is too
      * slow.
-     * 
+     *
      * @param expression
      *            The expression to be evaluated
      * @param expectedType
@@ -887,39 +887,14 @@ public class PageContextImpl extends Pag
      * @return The result of the evaluation
      */
     public static Object proprietaryEvaluate(final String expression,
-            final Class expectedType, final PageContext pageContext,
+            final Class<?> expectedType, final PageContext pageContext,
             final ProtectedFunctionMapper functionMap, final boolean escape)
             throws ELException {
-        Object retValue;
         final ExpressionFactory exprFactory = jspf.getJspApplicationContext(pageContext.getServletContext()).getExpressionFactory();
-        if (SecurityUtil.isPackageProtectionEnabled()) {
-            try {
-                retValue = AccessController
-                        .doPrivileged(new PrivilegedExceptionAction() {
-
-                            public Object run() throws Exception {
-                                ELContextImpl ctx = (ELContextImpl) pageContext.getELContext();
-                                ctx.setFunctionMapper(new FunctionMapperImpl(functionMap));
-                                ValueExpression ve = exprFactory.createValueExpression(ctx, expression, expectedType);
-                                return ve.getValue(ctx);
-                            }
-                        });
-            } catch (PrivilegedActionException ex) {
-                Exception realEx = ex.getException();
-                if (realEx instanceof ELException) {
-                    throw (ELException) realEx;
-                } else {
-                    throw new ELException(realEx);
-                }
-            }
-        } else {
-            ELContextImpl ctx = (ELContextImpl) pageContext.getELContext();
-            ctx.setFunctionMapper(new FunctionMapperImpl(functionMap));
-            ValueExpression ve = exprFactory.createValueExpression(ctx, expression, expectedType);
-            retValue = ve.getValue(ctx);
-        }
-
-        return retValue;
+        ELContextImpl ctx = (ELContextImpl) pageContext.getELContext();
+        ctx.setFunctionMapper(new FunctionMapperImpl(functionMap));
+        ValueExpression ve = exprFactory.createValueExpression(ctx, expression, expectedType);
+        return ve.getValue(ctx);
     }
 
     public ELContext getELContext() {
Index: tomcat6-6.0.41/apache-tomcat-6.0.41-src/java/org/apache/jasper/security/SecurityClassLoad.java
===================================================================
--- tomcat6-6.0.41.orig/apache-tomcat-6.0.41-src/java/org/apache/jasper/security/SecurityClassLoad.java
+++ tomcat6-6.0.41/apache-tomcat-6.0.41-src/java/org/apache/jasper/security/SecurityClassLoad.java
@@ -93,8 +93,6 @@ public final class SecurityClassLoad {
                 "runtime.PageContextImpl$11");      
             loader.loadClass( basePackage +
                 "runtime.PageContextImpl$12");      
-            loader.loadClass( basePackage +
-                "runtime.PageContextImpl$13");      
 
             loader.loadClass( basePackage +
                 "runtime.JspContextWrapper");   
