Skip to content
OpenAdvisories
High DSA-2160-1 3 CVEs

tomcat6 - several

Published Feb 13, 2011 · Updated Mar 9, 2026

Ecosystem: Debian

Fixed packages 1

ReleasePackageFixed in
Debian · 6.0 tomcat6 6.0.28-9+squeeze1

Vulnerabilities 3

  • High 7.5
    CVE-2011-0534

    Apache Tomcat does not enforce the maxHttpHeaderSize limit

    Apache Tomcat 7.0.0 through 7.0.6 and 6.0.0 through 6.0.30 does not enforce the maxHttpHeaderSize limit for requests involving the NIO HTTP connector, which allows remote attackers to cause a denial of service (OutOfMemoryError) via a crafted request.

    org.apache.tomcat:tomcat Maven
  • Low —
    CVE-2010-3718

    Improper Limitation of a Pathname to a Restricted Directory in Apache Tomcat

    Apache Tomcat 7.0.0 through 7.0.3, 6.0.x, and 5.5.x, when running within a SecurityManager, does not make the ServletContext attribute read-only, which allows local web applications to read or write files outside of the intended working directory, as demonstr…

    org.apache.tomcat:tomcat Maven
  • Medium —
    CVE-2011-0013 EPSS 10%

    Improper Neutralization of Input During Web Page Generation in Apache Tomcat

    Multiple cross-site scripting (XSS) vulnerabilities in the HTML Manager Interface in Apache Tomcat 5.5 before 5.5.32, 6.0 before 6.0.30, and 7.0 before 7.0.6 allow remote attackers to inject arbitrary web script or HTML, as demonstrated via the display-name t…

    org.apache.tomcat:tomcat Maven