Critical Photon OS Security Update - PHSA-2022-0361

Updates of 'linux-aws', 'linux-secure', 'linux', 'apache-tomcat', 'linux-rt', 'linux-esx', 'go', 'strongswan', 'mariadb' packages of Photon OS have been released...

Infinite Loop in Apache Tomcat

The payload length in a WebSocket frame was not correctly validated in Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M1 to 9.0.36, 8.5.0 to 8.5.56 and 7.0.27 to 7.0.104. Invalid payload lengths could trigger an infinite loop. Multiple requests with invalid payload lengths could lead to a denial of...

GHSA-VF77-8H7G-GGHP Improper Restriction of Operations within the Bounds of a Memory Buffer in Apache Tomcat

An h2c direct connection to Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M5 to 9.0.36 and 8.5.1 to 8.5.56 did not release the HTTP/1.1 processor after the upgrade to HTTP/2. If a sufficient number of such requests were made, an OutOfMemoryException could occur leading to a denial of service...

Improper Restriction of Operations within the Bounds of a Memory Buffer in Apache Tomcat

An h2c direct connection to Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M5 to 9.0.36 and 8.5.1 to 8.5.56 did not release the HTTP/1.1 processor after the upgrade to HTTP/2. If a sufficient number of such requests were made, an OutOfMemoryException could occur leading to a denial of service...

Security Bulletin: IBM UrbanCode Build is affected by CVE-2021-30639

Summary IBM UrbanCode Build is affected by CVE-2021-30639 Vulnerability Details CVEID:CVE-2021-30639 DESCRIPTION: Apache Tomcat is vulnerable to a denial of service, caused by improper error handling during non-blocking I/O. By sending a specially-crafted request, a remote attacker could exploit...

Important Photon OS Security Update - PHSA-2022-0440

Updates of 'go', 'linux-aws', 'linux', 'polkit', 'linux-esx', 'apache-tomcat', 'linux-secure' packages of Photon OS have been released...

Apache Tomcat 10.1.0-M1 < 10.1.0-M10 Local Privilege Escalation

The version of Apache Tomcat installed on the remote host is 8.5.55 to 8.5.73, 9.0.35 to 9.0.56, 10.0.0-M5 to 10.0.14 or 10.1.0-M1 to 10.1.0-M8. It is, therefore, affected by a local privilege escalation vulnerability due to a time of check, time of use vulnerability. Note that the scanner has no...

Apache Tomcat 8.5.55 < 8.5.75 Local Privilege Escalation

The version of Apache Tomcat installed on the remote host is 8.5.55 to 8.5.73, 9.0.35 to 9.0.56, 10.0.0-M5 to 10.0.14 or 10.1.0-M1 to 10.1.0-M8. It is, therefore, affected by a local privilege escalation vulnerability due to a time of check, time of use vulnerability. Note that the scanner has no...

Apache Tomcat 10.0.0-M5 < 10.0.16 Local Privilege Escalation

The version of Apache Tomcat installed on the remote host is 8.5.55 to 8.5.73, 9.0.35 to 9.0.56, 10.0.0-M5 to 10.0.14 or 10.1.0-M1 to 10.1.0-M8. It is, therefore, affected by a local privilege escalation vulnerability due to a time of check, time of use vulnerability. Note that the scanner has no...

Apache Tomcat 9.0.35 < 9.0.58 Local Privilege Escalation

The version of Apache Tomcat installed on the remote host is 8.5.55 to 8.5.73, 9.0.35 to 9.0.56, 10.0.0-M5 to 10.0.14 or 10.1.0-M1 to 10.1.0-M8. It is, therefore, affected by a local privilege escalation vulnerability due to a time of check, time of use vulnerability. Note that the scanner has no...

Security Bulletin: Vulnerabilities in IBM WebSphere Application Server Liberty affect IBM Spectrum Protect Snapshot for VMware (CVE-2014-7810, CVE-2018-8039)

Summary IBM WebSphere Application Server Liberty is affected by Apache Tomcat and CXF vulnerabilities that affect IBM Spectrum Protect Snapshot formerly Tivoli Storage FlashCopy Manager for VMware. Vulnerability Details CVEID: CVE-2014-7810 DESCRIPTION: Apache Tomcat could allow a remote attacker...

Race condition in Apache Tomcat

The fix for bug CVE-2020-9484 introduced a time of check time of use vulnerability into Apache Tomcat 10.1.0-M1 to 10.1.0-M8, 10.0.0-M5 to 10.0.14, 9.0.35 to 9.0.56 and 8.5.55 to 8.5.73 that allowed a local attacker to perform actions with the privileges of the user that the Tomcat process is...

GHSA-9F3J-PM6F-9FM5 Race condition in Apache Tomcat

The fix for bug CVE-2020-9484 introduced a time of check time of use vulnerability into Apache Tomcat 10.1.0-M1 to 10.1.0-M8, 10.0.0-M5 to 10.0.14, 9.0.35 to 9.0.56 and 8.5.55 to 8.5.73 that allowed a local attacker to perform actions with the privileges of the user that the Tomcat process is...

Mageia: Security Advisory (MGASA-2014-0149)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Mageia: Security Advisory (MGASA-2016-0312)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Mageia: Security Advisory (MGASA-2018-0150)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Apache Tomcat permission permission and access control issues vulnerability

Apache Tomcat is a lightweight web application server from the Apache Foundation in the United States. The program implements support for Servlet and JavaServer Page JSP. Apache Tomcat is vulnerable to privilege permission and access control issues, and an attacker can bypass Apache Tomcat's...

Mageia: Security Advisory (MGASA-2020-0138)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Mageia: Security Advisory (MGASA-2013-0191)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Mageia: Security Advisory (MGASA-2014-0148)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...