Skip to content
OpenAdvisories
Medium ELSA-2017-0935 2 CVEs

Moderate: tomcat security update (Oracle Linux 7)

Published Apr 12, 2017 · Updated Apr 12, 2017

Ecosystem: Oracle Linux

Summary

[0:7.0.69-11]
- Resolves: rhbz#1413591 CVE-2016-8745 tomcat: information disclosure due to incorrect Processor sharing
- Resolves: rhbz#1402662 CVE-2016-6816 tomcat: HTTP Request smuggling vulnerability due to permitting invalid character in HTTP requests

Fixed packages 10

ReleasePackageFixed in
Oracle Linux · 7 tomcat 0:7.0.69-11.el7_3
Oracle Linux · 7 tomcat-admin-webapps 0:7.0.69-11.el7_3
Oracle Linux · 7 tomcat-docs-webapp 0:7.0.69-11.el7_3
Oracle Linux · 7 tomcat-el-2.2-api 0:7.0.69-11.el7_3
Oracle Linux · 7 tomcat-javadoc 0:7.0.69-11.el7_3
Oracle Linux · 7 tomcat-jsp-2.2-api 0:7.0.69-11.el7_3
Oracle Linux · 7 tomcat-jsvc 0:7.0.69-11.el7_3
Oracle Linux · 7 tomcat-lib 0:7.0.69-11.el7_3
Oracle Linux · 7 tomcat-servlet-3.0-api 0:7.0.69-11.el7_3
Oracle Linux · 7 tomcat-webapps 0:7.0.69-11.el7_3

Vulnerabilities 2

  • High 7.5
    CVE-2016-8745 EPSS 16%

    Concurrent Execution using Shared Resource with Improper Synchronization in Apache Tomcat

    A bug in the error handling of the send file code for the NIO HTTP connector in Apache Tomcat 9.0.0.M1 to 9.0.0.M13, 8.5.0 to 8.5.8, 8.0.0.RC1 to 8.0.39, 7.0.0 to 7.0.73 and 6.0.16 to 6.0.48 resulted in the current Processor object being added to the Processo…

    Apache Software Foundation Apache Tomcat tomcat8 tomcat7 Ubuntu Maven
  • High 7.1
    CVE-2016-6816 Public exploit EPSS 40%

    Improper Input Validation in Apache Tomcat

    The code in Apache Tomcat 9.0.0.M1 to 9.0.0.M11, 8.5.0 to 8.5.6, 8.0.0.RC1 to 8.0.38, 7.0.0 to 7.0.72, and 6.0.0 to 6.0.47 that parsed the HTTP request line permitted invalid characters. This could be exploited, in conjunction with a proxy that also permitted…

    Apache Software Foundation Apache Tomcat tomcat8 tomcat7 Ubuntu Maven