CVE-2016-5648

The Acer Portal Android app (versions 3.9.3.2003–3.9.3.2006) is affected by CVE-2016-5648 due to improper SSL certificate validation, allowing remote MITM attacks and potential credential exposure when connecting to Acer Cloud. Impact is a credential/theory exposure via unauthenticated, network-b...

SUSE-SU-2017:1382-1 Security update for tomcat

This update for tomcat fixes the following issues: - CVE-2017-5647 Pipelined requests could lead to information disclosure bsc1033448 - CVE-2017-5648 Untrusted application could retain listener leading to information disclosure bsc1033447 - CVE-2016-8745 shared Processor on Connector code could...

openSUSE Security Update : tomcat (openSUSE-2017-586)

This update for tomcat fixes the following issues : - CVE-2017-5647 Pipelined requests could lead to information disclosure bsc1033448 - CVE-2017-5648 Untrusted application could retain listener leading to information disclosure bsc1033447 - CVE-2016-8745 shared Processor on Connector code could...

SUSE-SU-2017:1229-1 Security update for tomcat

This update for tomcat fixes the following issues: - CVE-2017-5647 Pipelined requests could lead to information disclosure bsc1033448 - CVE-2017-5648 Untrusted application could retain listener leading to information disclosure bsc1033447 - CVE-2016-8745 shared Processor on Connector code could...

Debian DSA-3842-1 : tomcat7 - security update

Two vulnerabilities were discovered in tomcat7, a servlet and JSP engine. - CVE-2017-5647 Pipelined requests were processed incorrectly, which could result in some responses appearing to be sent for the wrong request. - CVE-2017-5648 Some application listeners calls were issued against the wrong...

Debian DSA-3843-1 : tomcat8 - security update

Two vulnerabilities were discovered in tomcat8, a servlet and JSP engine. - CVE-2017-5647 Pipelined requests were processed incorrectly, which could result in some responses appearing to be sent for the wrong request. - CVE-2017-5648 Some application listeners calls were issued against the wrong...

[SECURITY] [DSA 3843-1] tomcat8 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3843-1 [email protected] https://www.debian.org/security/ Sebastien Delafond May 03, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3843-1] tomcat8 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3843-1 [email protected] https://www.debian.org/security/ Sebastien Delafond May 03, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3842-1] tomcat7 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3842-1 [email protected] https://www.debian.org/security/ Sebastien Delafond May 03, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3842-1] tomcat7 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3842-1 [email protected] https://www.debian.org/security/ Sebastien Delafond May 03, 2017 https://www.debian.org/security/faq -...

Fedora Update for tomcat FEDORA-2017-d5aa7c77d6

The remote host is missing an update for the SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] [DLA 924-1] tomcat7 security update

Package : tomcat7 Version : 7.0.28-4+deb7u12 CVE ID : CVE-2017-5647 CVE-2017-5648 Debian Bug : 860068 Two security vulnerabilities have been discovered in the Tomcat servlet and JSP engine. CVE-2017-5647 A bug in the handling of the pipelined requests when send file was used resulted in the...

Fedora 24 : 1:tomcat (2017-d5aa7c77d6)

This updates includes a rebase from tomcat 8.0.42 up to 8.0.43 which resolves multiple CVEs : - rhbz1441242 CVE-2017-5647 CVE-2017-5648 CVE-2017-5650 CVE-2017-5651 tomcat: various flaws Note that Tenable Network Security has extracted the preceding description block directly from the Fedora updat...

MGASA-2017-0117 Updated tomcat packages fix security vulnerability

A bug in the handling of the pipelined requests when send file was used resulted in the pipelined request being lost when send file processing of the previous request completed. This could result in responses appearing to be sent for the wrong request. For example, a user agent that sent requests...

Updated tomcat packages fix security vulnerability

A bug in the handling of the pipelined requests when send file was used resulted in the pipelined request being lost when send file processing of the previous request completed. This could result in responses appearing to be sent for the wrong request. For example, a user agent that sent requests...

Apache Tomcat 'SecurityManager' Information Disclosure Vulnerability (Apr 2017) - Windows

Apache Tomcat is prone to an information disclosure vulnerability. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:apache:tomcat"...

Amazon Linux AMI : tomcat7 / tomcat8 (ALAS-2017-822)

Incorrect handling of pipelined requests when send file was used A bug in the handling of the pipelined requests in Apache Tomcat 9.0.0.M1 to 9.0.0.M18, 8.5.0 to 8.5.12, 8.0.0.RC1 to 8.0.42, 7.0.0 to 7.0.76, and 6.0.0 to 6.0.52, when send file was used, results in the pipelined request being lost...

Important: tomcat7, tomcat8

Issue Overview: Incorrect handling of pipelined requests when send file was used A bug in the handling of the pipelined requests in Apache Tomcat 9.0.0.M1 to 9.0.0.M18, 8.5.0 to 8.5.12, 8.0.0.RC1 to 8.0.42, 7.0.0 to 7.0.76, and 6.0.0 to 6.0.52, when send file was used, results in the pipelined...

CVE-2017-5648

CVE-2017-5648 is described across connected advisories as a vulnerability in Apache Tomcat where calls to application listeners did not use the appropriate facade object. Under a SecurityManager, an untrusted application could retain a reference to the request or response and access/modify inform...

CVE-2017-5648

While investigating bug 60718, it was noticed that some calls to application listeners in Apache Tomcat 9.0.0.M1 to 9.0.0.M17, 8.5.0 to 8.5.11, 8.0.0.RC1 to 8.0.41, and 7.0.0 to 7.0.75 did not use the appropriate facade object. When running an untrusted application under a SecurityManager, it was...