SOL65230547 - Apache Tomcat vulnerabilities CVE-2016-5018, CVE-2016-6794, and CVE-2016-6796

Vulnerability Recommended Actions If you are running a version listed in the Versions known to be vulnerable column, you can eliminate this vulnerability by upgrading to a version listed in the Versions known to be not vulnerable column. If the table lists only an older version than what you are...

SOL36784855 - Apache Tomcat vulnerability CVE-2016-0762

Vulnerability Recommended Actions If you are running a version listed in the Versions known to be vulnerable column, you can eliminate this vulnerability by upgrading to a version listed in the Versions known to be not vulnerable column. If the table lists only an older version than what you are...

Fixed in Apache Tomcat 8.0.39

Important: Remote Code Execution CVE-2016-8735 The JmxRemoteLifecycleListener was not updated to take account of Oracle's fix for CVE-2016-3427. Therefore, Tomcat installations using this listener remained vulnerable to a similar remote code execution vulnerability. This issue has been rated as...

SOL36302720 - Apache Tomcat vulnerability CVE-2016-6797

Vulnerability Recommended Actions If you are running a version listed in the Versions known to be vulnerable column, you can eliminate this vulnerability by upgrading to a version listed in the Versions known to be not vulnerable column. If the table lists only an older version than what you are...

Fixed in Apache Tomcat 7.0.73

Important: Remote Code Execution CVE-2016-8735 The JmxRemoteLifecycleListener was not updated to take account of Oracle's fix for CVE-2016-3427. Therefore, Tomcat installations using this listener remained vulnerable to a similar remote code execution vulnerability. This issue has been rated as...

PT-2016-7120 · Apache · Apache Tomcat

Name of the Vulnerable Software and Affected Versions: Apache Tomcat versions 8.5.0 through 8.5.6 Apache Tomcat versions 9.0.0.M1 through 9.0.0.M11 Description: The HTTP/2 header parser in Apache Tomcat entered an infinite loop if a header was received that was larger than the available buffer...

PT-2016-3139 · Apache +3 · Apache Tomcat +3

Name of the Vulnerable Software and Affected Versions: Apache Tomcat versions 6.0.0 through 6.0.47 Apache Tomcat versions 7.0.0 through 7.0.72 Apache Tomcat versions 8.0.0 through 8.0.38 Apache Tomcat versions 8.5.0 through 8.5.6 Apache Tomcat versions 9.0.0.M1 through 9.0.0.M11 Description: The...

Fixed in Apache Tomcat 8.5.8

Note: The issues below were fixed in Apache Tomcat 8.5.7 but the release vote for the 8.5.7 release candidate did not pass. Therefore, although users must download 8.5.8 to obtain a version that includes fixes for these issues, version 8.5.7 is not included in the list of affected versions...

PT-2016-7119 · Apache +5 · Apache Tomcat +5

Name of the Vulnerable Software and Affected Versions: Apache Tomcat versions 9.0.0.M1 through 9.0.0.M11 Apache Tomcat versions 8.5.0 through 8.5.6 Apache Tomcat versions 8.0.0.RC1 through 8.0.38 Apache Tomcat versions 7.0.0 through 7.0.72 Apache Tomcat versions 6.0.0 through 6.0.47 Description:...

Apache Tomcat 8.5.x < 8.5.5 / 9.0.0.x < 9.0.0.M10 Multiple Vulnerabilities

Binary data 9721.pasl...

Apache Tomcat 8.5.0 < 8.5.5 multiple vulnerabilities

The version of Tomcat installed on the remote host is prior to 8.5.5. It is, therefore, affected by multiple vulnerabilities as referenced in the fixedinapachetomcat8.5.5and8.0.37security-8 advisory. - The ResourceLinkFactory implementation in Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4,...

Apache Tomcat Version 9.x Detection

Binary data 9715.prm...

Apache Tomcat 6.0.x < 6.0.47 / 7.0.x < 7.0.72 / 8.0.x < 8.0.37 Multiple Vulnerabilities

Binary data 9723.pasl...

Moderate: Red Hat Security Advisory: tomcat security, bug fix, and enhancement update

An update for tomcat is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the...

Apache Tomcat security restrictions bypass Vulnerability(CVE-2 0 1 6-6 7 9 7)-vulnerability warning-the black bar safety net

Apache Tomcat security restrictions bypass VulnerabilityCVE-2 0 1 6-6 7 9 7 Release date: 2016-10-27 Update date: 2016-10-28 Affected system: Apache Group Tomcat 7.0.0－7.0.70 Description: BUGTRAQ ID: 9 3 9 4 0 CVECAN ID: CVE-2 0 1 6-6 7 9 7 Apache Tomcat is a popular open source JSP application...

Apache Tomcat Security Manager Security Restriction Bypass Vulnerability (CNVD-2016-10423)

Apache Tomcat is a popular open source JSP application server program. Apache Tomcat 7.0.0-7.0.70 suffers from a security restriction bypass vulnerability in its implementation. An attacker can exploit this vulnerability to bypass certain security restrictions and perform unauthorized operations...

Apache Tomcat Information Disclosure Vulnerability (CNVD-2016-10420)

Apache Tomcat is a popular open source JSP application server program. Apache Tomcat suffers from an information disclosure vulnerability in its implementation. An attacker can exploit this vulnerability to obtain sensitive information...

Apache Tomcat Security Restriction Bypass Vulnerability

Apache Tomcat is a popular open source JSP application server program. Apache Tomcat suffers from a security restriction bypass vulnerability in its implementation. An attacker can exploit this vulnerability to bypass certain security restrictions and perform unauthorized operations...

CVE-2016-5018

In Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 a malicious web application was able to bypass a configured SecurityManager via a Tomcat utility method that was accessible to web applications...

CVE-2016-6794

When a SecurityManager is configured, a web application's ability to read system properties should be controlled by the SecurityManager. In Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70, 6.0.0 to 6.0.45 the system property replacement feature for...