tomcat7 - security update

Fixed packages 1

Vulnerabilities 6

• High 7.5
  CVE-2014-0050 Public exploit EPSS 83%

  Commons FileUpload Denial of service vulnerability

  MultipartStream.java in Apache Commons FileUpload before 1.3.1, as used in Apache Tomcat, JBoss Web, and other products, allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a crafted Content-Type header that bypasses a…

  org.apache.tomcat:tomcat commons-fileupload:commons-fileupload libcommons-fileupload-java Debian Maven
  Mar 28, 2014
• Medium —
  CVE-2012-3544 EPSS 11%

  Apache Tomcat Vulnerable to Denial of Service (DoS) via Improper Handling of chunk extensions

  Apache Tomcat 6.x before 6.0.37 and 7.x before 7.0.30 does not properly handle chunk extensions in chunked transfer coding, which allows remote attackers to cause a denial of service by streaming data.

  org.apache.tomcat:tomcat Maven
  Jun 1, 2013
• Medium —
  CVE-2013-2067 EPSS 10%

  Improper Authentication in Apache Tomcat

  java/org/apache/catalina/authenticator/FormAuthenticator.java in the form authentication feature in Apache Tomcat 6.0.21 through 6.0.36 and 7.x before 7.0.33 does not properly handle the relationships between authentication requirements and sessions, which al…

  org.apache.tomcat:tomcat Maven
  Jun 1, 2013
• Low —
  CVE-2013-2071

  Exposure of Sensitive Information to an Unauthorized Actor in Apache Tomcat

  java/org/apache/catalina/core/AsyncContextImpl.java in Apache Tomcat 7.x before 7.0.40 does not properly handle the throwing of a RuntimeException in an AsyncListener in an application, which allows context-dependent attackers to obtain sensitive request info…

  org.apache.tomcat:tomcat Maven
  Jun 1, 2013
• Medium —
  CVE-2013-4286 EPSS 16%

  Apache Tomcat is vulnerable to HTTP request-smuggling

  Apache Tomcat before 6.0.39, 7.x before 7.0.47, and 8.x before 8.0.0-RC3, when an HTTP connector or AJP connector is used, does not properly handle certain inconsistent HTTP request headers, which allows remote attackers to trigger incorrect identification of…

  org.apache.tomcat:tomcat Maven
  Feb 26, 2014
• Medium —
  CVE-2013-4322 Public exploit

  Apache Tomcat Denial of Service vulnerability

  Apache Tomcat before 6.0.39, 7.x before 7.0.50, and 8.x before 8.0.0-RC10 processes chunked transfer coding without properly handling (1) a large total amount of chunked data or (2) whitespace characters in an HTTP header value within a trailer field, which a…

  org.apache.tomcat:tomcat Maven
  Feb 26, 2014