Skip to content
OpenAdvisories
Critical DSA-3842-1 2 CVEs

tomcat7 - security update

Published May 3, 2017 · Updated Mar 9, 2026

Ecosystem: Debian

Fixed packages 1

ReleasePackageFixed in
Debian · 8 tomcat7 7.0.56-3+deb8u10

Vulnerabilities 2

  • Critical 9.1
    CVE-2017-5648 EPSS 13%

    Exposure of Resource to Wrong Sphere in Apache Tomcat

    While investigating bug 60718, it was noticed that some calls to application listeners in Apache Tomcat 9.0.0.M1 to 9.0.0.M17, 8.5.0 to 8.5.11, 8.0.0.RC1 to 8.0.41, and 7.0.0 to 7.0.75 did not use the appropriate facade object. When running an untrusted appli…

    Apache Software Foundation Apache Tomcat tomcat8 tomcat7 Ubuntu Maven
  • High 7.5
    CVE-2017-5647 EPSS 17%

    Exposure of Sensitive Information to an Unauthorized Actor in Apache Tomcat

    A bug in the handling of the pipelined requests in Apache Tomcat 9.0.0.M1 to 9.0.0.M18, 8.5.0 to 8.5.12, 8.0.0.RC1 to 8.0.42, 7.0.0 to 7.0.76, and 6.0.0 to 6.0.52, when send file was used, results in the pipelined request being lost when send file processing …

    Apache Software Foundation Apache Tomcat org.apache.tomcat:tomcat tomcat8 Ubuntu Maven