Skip to content
OpenAdvisories
Medium RHBA-2016:0090 1 CVE

Red Hat Bug Fix Advisory: Red Hat JBoss Web Server 2.1.0 tomcat7 update

Published Sep 13, 2024 · Updated Aug 5, 2026

Ecosystem: Red Hat

Fixed packages 33

ReleasePackageFixed in
Red Hat · JBoss Web Server 2 jboss_enterprise_web_server:2::el5 tomcat7 0:7.0.54-21_patch_05.ep6.el5
Red Hat · JBoss Web Server 2 jboss_enterprise_web_server:2::el5 tomcat7-admin-webapps 0:7.0.54-21_patch_05.ep6.el5
Red Hat · JBoss Web Server 2 jboss_enterprise_web_server:2::el5 tomcat7-docs-webapp 0:7.0.54-21_patch_05.ep6.el5
Red Hat · JBoss Web Server 2 jboss_enterprise_web_server:2::el5 tomcat7-el-2.2-api 0:7.0.54-21_patch_05.ep6.el5
Red Hat · JBoss Web Server 2 jboss_enterprise_web_server:2::el5 tomcat7-javadoc 0:7.0.54-21_patch_05.ep6.el5
Red Hat · JBoss Web Server 2 jboss_enterprise_web_server:2::el5 tomcat7-jsp-2.2-api 0:7.0.54-21_patch_05.ep6.el5
Red Hat · JBoss Web Server 2 jboss_enterprise_web_server:2::el5 tomcat7-lib 0:7.0.54-21_patch_05.ep6.el5
Red Hat · JBoss Web Server 2 jboss_enterprise_web_server:2::el5 tomcat7-log4j 0:7.0.54-21_patch_05.ep6.el5
Red Hat · JBoss Web Server 2 jboss_enterprise_web_server:2::el5 tomcat7-maven-devel 0:7.0.54-21_patch_05.ep6.el5
Red Hat · JBoss Web Server 2 jboss_enterprise_web_server:2::el5 tomcat7-servlet-3.0-api 0:7.0.54-21_patch_05.ep6.el5
Red Hat · JBoss Web Server 2 jboss_enterprise_web_server:2::el5 tomcat7-webapps 0:7.0.54-21_patch_05.ep6.el5
Red Hat · JBoss Web Server 2 jboss_enterprise_web_server:2::el6 tomcat7 0:7.0.54-21_patch_05.ep6.el6
Red Hat · JBoss Web Server 2 jboss_enterprise_web_server:2::el6 tomcat7-admin-webapps 0:7.0.54-21_patch_05.ep6.el6
Red Hat · JBoss Web Server 2 jboss_enterprise_web_server:2::el6 tomcat7-docs-webapp 0:7.0.54-21_patch_05.ep6.el6
Red Hat · JBoss Web Server 2 jboss_enterprise_web_server:2::el6 tomcat7-el-2.2-api 0:7.0.54-21_patch_05.ep6.el6
Red Hat · JBoss Web Server 2 jboss_enterprise_web_server:2::el6 tomcat7-javadoc 0:7.0.54-21_patch_05.ep6.el6
Red Hat · JBoss Web Server 2 jboss_enterprise_web_server:2::el6 tomcat7-jsp-2.2-api 0:7.0.54-21_patch_05.ep6.el6
Red Hat · JBoss Web Server 2 jboss_enterprise_web_server:2::el6 tomcat7-lib 0:7.0.54-21_patch_05.ep6.el6
Red Hat · JBoss Web Server 2 jboss_enterprise_web_server:2::el6 tomcat7-log4j 0:7.0.54-21_patch_05.ep6.el6
Red Hat · JBoss Web Server 2 jboss_enterprise_web_server:2::el6 tomcat7-maven-devel 0:7.0.54-21_patch_05.ep6.el6
Red Hat · JBoss Web Server 2 jboss_enterprise_web_server:2::el6 tomcat7-servlet-3.0-api 0:7.0.54-21_patch_05.ep6.el6
Red Hat · JBoss Web Server 2 jboss_enterprise_web_server:2::el6 tomcat7-webapps 0:7.0.54-21_patch_05.ep6.el6
Red Hat · JBoss Web Server 2 jboss_enterprise_web_server:2::el7 tomcat7 0:7.0.54-21_patch_05.ep6.el7
Red Hat · JBoss Web Server 2 jboss_enterprise_web_server:2::el7 tomcat7-admin-webapps 0:7.0.54-21_patch_05.ep6.el7
Red Hat · JBoss Web Server 2 jboss_enterprise_web_server:2::el7 tomcat7-docs-webapp 0:7.0.54-21_patch_05.ep6.el7
Red Hat · JBoss Web Server 2 jboss_enterprise_web_server:2::el7 tomcat7-el-2.2-api 0:7.0.54-21_patch_05.ep6.el7
Red Hat · JBoss Web Server 2 jboss_enterprise_web_server:2::el7 tomcat7-javadoc 0:7.0.54-21_patch_05.ep6.el7
Red Hat · JBoss Web Server 2 jboss_enterprise_web_server:2::el7 tomcat7-jsp-2.2-api 0:7.0.54-21_patch_05.ep6.el7
Red Hat · JBoss Web Server 2 jboss_enterprise_web_server:2::el7 tomcat7-lib 0:7.0.54-21_patch_05.ep6.el7
Red Hat · JBoss Web Server 2 jboss_enterprise_web_server:2::el7 tomcat7-log4j 0:7.0.54-21_patch_05.ep6.el7
Red Hat · JBoss Web Server 2 jboss_enterprise_web_server:2::el7 tomcat7-maven-devel 0:7.0.54-21_patch_05.ep6.el7
Red Hat · JBoss Web Server 2 jboss_enterprise_web_server:2::el7 tomcat7-servlet-3.0-api 0:7.0.54-21_patch_05.ep6.el7
Red Hat · JBoss Web Server 2 jboss_enterprise_web_server:2::el7 tomcat7-webapps 0:7.0.54-21_patch_05.ep6.el7

Vulnerabilities 1

  • Medium 4.3
    CVE-2015-5174 EPSS 13%

    Improper Limitation of a Pathname to a Restricted Directory in Apache Tomcat

    Directory traversal vulnerability in RequestUtil.java in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.65, and 8.x before 8.0.27 allows remote authenticated users to bypass intended SecurityManager restrictions and list a parent directory via a /.. (slash d…

    org.apache.tomcat:tomcat tomcat7 tomcat6 Ubuntu Maven

References

  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1297687
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhba-2016_0090.json
  • report
    https://access.redhat.com/security/cve/CVE-2015-5174
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1265698
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2015-5174
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2015-5174
  • article
    http://seclists.org/bugtraq/2016/Feb/149