Skip to content
OpenAdvisories
High RHSA-2011:0348 2 CVEs

Red Hat Security Advisory: tomcat6 security update

Published Sep 15, 2024 · Updated Jun 29, 2026

Ecosystem: Red Hat

Fixed packages 20

ReleasePackageFixed in
Red Hat · JBoss Web Server 1 jboss_enterprise_web_server:1::el4 tomcat6 0:6.0.24-11.patch_03.ep5.el4
Red Hat · JBoss Web Server 1 jboss_enterprise_web_server:1::el4 tomcat6-admin-webapps 0:6.0.24-11.patch_03.ep5.el4
Red Hat · JBoss Web Server 1 jboss_enterprise_web_server:1::el4 tomcat6-docs-webapp 0:6.0.24-11.patch_03.ep5.el4
Red Hat · JBoss Web Server 1 jboss_enterprise_web_server:1::el4 tomcat6-el-1.0-api 0:6.0.24-11.patch_03.ep5.el4
Red Hat · JBoss Web Server 1 jboss_enterprise_web_server:1::el4 tomcat6-javadoc 0:6.0.24-11.patch_03.ep5.el4
Red Hat · JBoss Web Server 1 jboss_enterprise_web_server:1::el4 tomcat6-jsp-2.1-api 0:6.0.24-11.patch_03.ep5.el4
Red Hat · JBoss Web Server 1 jboss_enterprise_web_server:1::el4 tomcat6-lib 0:6.0.24-11.patch_03.ep5.el4
Red Hat · JBoss Web Server 1 jboss_enterprise_web_server:1::el4 tomcat6-log4j 0:6.0.24-11.patch_03.ep5.el4
Red Hat · JBoss Web Server 1 jboss_enterprise_web_server:1::el4 tomcat6-servlet-2.5-api 0:6.0.24-11.patch_03.ep5.el4
Red Hat · JBoss Web Server 1 jboss_enterprise_web_server:1::el4 tomcat6-webapps 0:6.0.24-11.patch_03.ep5.el4
Red Hat · JBoss Web Server 1 jboss_enterprise_web_server:1::el5 tomcat6 0:6.0.24-11.patch_03.ep5.el5
Red Hat · JBoss Web Server 1 jboss_enterprise_web_server:1::el5 tomcat6-admin-webapps 0:6.0.24-11.patch_03.ep5.el5
Red Hat · JBoss Web Server 1 jboss_enterprise_web_server:1::el5 tomcat6-docs-webapp 0:6.0.24-11.patch_03.ep5.el5
Red Hat · JBoss Web Server 1 jboss_enterprise_web_server:1::el5 tomcat6-el-1.0-api 0:6.0.24-11.patch_03.ep5.el5
Red Hat · JBoss Web Server 1 jboss_enterprise_web_server:1::el5 tomcat6-javadoc 0:6.0.24-11.patch_03.ep5.el5
Red Hat · JBoss Web Server 1 jboss_enterprise_web_server:1::el5 tomcat6-jsp-2.1-api 0:6.0.24-11.patch_03.ep5.el5
Red Hat · JBoss Web Server 1 jboss_enterprise_web_server:1::el5 tomcat6-lib 0:6.0.24-11.patch_03.ep5.el5
Red Hat · JBoss Web Server 1 jboss_enterprise_web_server:1::el5 tomcat6-log4j 0:6.0.24-11.patch_03.ep5.el5
Red Hat · JBoss Web Server 1 jboss_enterprise_web_server:1::el5 tomcat6-servlet-2.5-api 0:6.0.24-11.patch_03.ep5.el5
Red Hat · JBoss Web Server 1 jboss_enterprise_web_server:1::el5 tomcat6-webapps 0:6.0.24-11.patch_03.ep5.el5

Vulnerabilities 2

  • High 7.5
    CVE-2011-0534

    Apache Tomcat does not enforce the maxHttpHeaderSize limit

    Apache Tomcat 7.0.0 through 7.0.6 and 6.0.0 through 6.0.30 does not enforce the maxHttpHeaderSize limit for requests involving the NIO HTTP connector, which allows remote attackers to cause a denial of service (OutOfMemoryError) via a crafted request.

    org.apache.tomcat:tomcat Maven
  • Medium —
    CVE-2010-4476 Public exploit EPSS 23%

    Apache Tomcat affected by infinite loop in Double.parseDouble method in Java Runtime Environment

    The Double.parseDouble method in Java Runtime Environment (JRE) in Oracle Java SE and Java for Business 6 Update 23 and earlier, 5.0 Update 27 and earlier, and 1.4.2_29 and earlier, as used in OpenJDK, Apache, JBossweb, and other products, allows remote attac…

    org.apache.tomcat:tomcat Maven

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • article
    http://tomcat.apache.org/security-6.html
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=674336
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=675338
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2011/rhsa-2011_0348.json
  • report
    https://access.redhat.com/security/cve/CVE-2010-4476
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2010-4476
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2010-4476
  • report
    https://access.redhat.com/security/cve/CVE-2011-0534
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2011-0534
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2011-0534