7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
5 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:L/Au:N/C:P/I:N/A:N
0.006 Low
EPSS
Percentile
79.1%
Package : tomcat7
Version : 7.0.28-4+deb7u9
CVE ID : CVE-2016-8745
Debian Bug : 849949
A bug in the error handling of the send file code for the NIO HTTP
connector resulted in the current Processor object being added to the
Processor cache multiple times. This in turn meant that the same
Processor could be used for concurrent requests. Sharing a Processor
can result in information leakage between requests including, not
limited to, session ID and the response body.
In addition this update also addresses a regression when running
Tomcat 7 with SecurityManager enabled due to an incomplete fix for
CVE-2016-6816.
For Debian 7 "Wheezy", these problems have been fixed in version
7.0.28-4+deb7u9.
We recommend that you upgrade your tomcat7 packages.
Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
OS | Version | Architecture | Package | Version | Filename |
---|---|---|---|---|---|
Debian | 8 | all | tomcat8 | < 8.0.14-1+deb8u6 | tomcat8_8.0.14-1+deb8u6_all.deb |
Debian | 8 | all | libservlet3.1-java | < 8.0.14-1+deb8u6 | libservlet3.1-java_8.0.14-1+deb8u6_all.deb |
Debian | 8 | all | libservlet3.0-java | < 7.0.56-3+deb8u7 | libservlet3.0-java_7.0.56-3+deb8u7_all.deb |
Debian | 8 | all | libtomcat7-java | < 7.0.56-3+deb8u7 | libtomcat7-java_7.0.56-3+deb8u7_all.deb |
Debian | 8 | all | tomcat7 | < 7.0.56-3+deb8u7 | tomcat7_7.0.56-3+deb8u7_all.deb |
Debian | 8 | all | libservlet3.1-java-doc | < 8.0.14-1+deb8u6 | libservlet3.1-java-doc_8.0.14-1+deb8u6_all.deb |
Debian | 7 | all | libservlet3.0-java-doc | < 7.0.28-4+deb7u9 | libservlet3.0-java-doc_7.0.28-4+deb7u9_all.deb |
Debian | 8 | all | tomcat8-admin | < 8.0.14-1+deb8u6 | tomcat8-admin_8.0.14-1+deb8u6_all.deb |
Debian | 8 | all | tomcat7-admin | < 7.0.56-3+deb8u7 | tomcat7-admin_7.0.56-3+deb8u7_all.deb |
Debian | 7 | all | tomcat7-docs | < 7.0.28-4+deb7u9 | tomcat7-docs_7.0.28-4+deb7u9_all.deb |
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
5 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:L/Au:N/C:P/I:N/A:N
0.006 Low
EPSS
Percentile
79.1%