Skip to content
OpenAdvisories
High ELSA-2016-2046 5 CVEs

Important: tomcat security update (Oracle Linux 7)

Published Oct 10, 2016 · Updated Oct 10, 2016

Ecosystem: Oracle Linux

Summary

[0:7.0.54-8]
- Resolves: rhbz#1368121

[0:7.0.54-7]
- Resolves: rhbz#1362212 Tomcat: CGI sets environmental variable based on user supplied Proxy request header
- Resolves: rhbz#1368121

[0:7.0.54-5]
- Resolves: rhbz#1362567

[0:7.0.54-4]
- Resolves: CVE-2015-5346

[0:7.0.54-3]
- Resolves: CVE-2014-7810

Fixed packages 10

ReleasePackageFixed in
Oracle Linux · 7 tomcat 0:7.0.54-8.el7_2
Oracle Linux · 7 tomcat-admin-webapps 0:7.0.54-8.el7_2
Oracle Linux · 7 tomcat-docs-webapp 0:7.0.54-8.el7_2
Oracle Linux · 7 tomcat-el-2.2-api 0:7.0.54-8.el7_2
Oracle Linux · 7 tomcat-javadoc 0:7.0.54-8.el7_2
Oracle Linux · 7 tomcat-jsp-2.2-api 0:7.0.54-8.el7_2
Oracle Linux · 7 tomcat-jsvc 0:7.0.54-8.el7_2
Oracle Linux · 7 tomcat-lib 0:7.0.54-8.el7_2
Oracle Linux · 7 tomcat-servlet-3.0-api 0:7.0.54-8.el7_2
Oracle Linux · 7 tomcat-webapps 0:7.0.54-8.el7_2

Vulnerabilities 5

  • High 8.1
    CVE-2015-5346 EPSS 11%

    Improper Neutralization of Input During Web Page Generation in Apache Tomcat

    Session fixation vulnerability in Apache Tomcat 7.x before 7.0.66, 8.x before 8.0.30, and 9.x before 9.0.0.M2, when different session settings are used for deployments of multiple versions of the same web application, might allow remote attackers to hijack we…

    org.apache.tomcat:tomcat tomcat7 Ubuntu Maven
  • High 8.1
    CVE-2016-5388 EPSS 51%

    Improper Access Control in Apache Tomcat

    Apache Tomcat 7.x through 7.0.70 and 8.x through 8.5.4, when the CGI Servlet is enabled, follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might…

    tomcat8 tomcat7 tomcat6 org.apache.tomcat:tomcat-catalina Ubuntu Maven
  • Medium —
    CVE-2014-7810 EPSS 13%

    Improper Access Control in Apache Tomcat

    The Expression Language (EL) implementation in Apache Tomcat 6.x before 6.0.44, 7.x before 7.0.58, and 8.x before 8.0.16 does not properly consider the possibility of an accessible interface implemented by an inaccessible class, which allows attackers to bypa…

    org.apache.tomcat:tomcat tomcat7 tomcat6 Ubuntu Maven
  • Unscored —
    CVE-2016-5425 Public exploit

    The Tomcat package on Red Hat Enterprise Linux (RHEL) 7, Fedora, CentOS, Oracle Linux, and possibly other Linux distrib…

  • Unscored —
    CVE-2016-6325

    The Tomcat package on Red Hat Enterprise Linux (RHEL) 5 through 7, JBoss Web Server 3.0, and JBoss EWS 2 uses weak perm…