Skip to content
OpenAdvisories
Unscored RHSA-2013:0266 6 CVEs

Red Hat Security Advisory: tomcat6 security update

Published Sep 15, 2024 · Updated Aug 5, 2026

Ecosystem: Red Hat

Fixed packages 20

ReleasePackageFixed in
Red Hat · JBoss Web Server 2 jboss_enterprise_web_server:2::el5 tomcat6 0:6.0.35-6_patch_06.ep6.el5
Red Hat · JBoss Web Server 2 jboss_enterprise_web_server:2::el5 tomcat6-admin-webapps 0:6.0.35-6_patch_06.ep6.el5
Red Hat · JBoss Web Server 2 jboss_enterprise_web_server:2::el5 tomcat6-docs-webapp 0:6.0.35-6_patch_06.ep6.el5
Red Hat · JBoss Web Server 2 jboss_enterprise_web_server:2::el5 tomcat6-el-1.0-api 0:6.0.35-6_patch_06.ep6.el5
Red Hat · JBoss Web Server 2 jboss_enterprise_web_server:2::el5 tomcat6-javadoc 0:6.0.35-6_patch_06.ep6.el5
Red Hat · JBoss Web Server 2 jboss_enterprise_web_server:2::el5 tomcat6-jsp-2.1-api 0:6.0.35-6_patch_06.ep6.el5
Red Hat · JBoss Web Server 2 jboss_enterprise_web_server:2::el5 tomcat6-lib 0:6.0.35-6_patch_06.ep6.el5
Red Hat · JBoss Web Server 2 jboss_enterprise_web_server:2::el5 tomcat6-log4j 0:6.0.35-6_patch_06.ep6.el5
Red Hat · JBoss Web Server 2 jboss_enterprise_web_server:2::el5 tomcat6-servlet-2.5-api 0:6.0.35-6_patch_06.ep6.el5
Red Hat · JBoss Web Server 2 jboss_enterprise_web_server:2::el5 tomcat6-webapps 0:6.0.35-6_patch_06.ep6.el5
Red Hat · JBoss Web Server 2 jboss_enterprise_web_server:2::el6 tomcat6 0:6.0.35-29_patch_06.ep6.el6
Red Hat · JBoss Web Server 2 jboss_enterprise_web_server:2::el6 tomcat6-admin-webapps 0:6.0.35-29_patch_06.ep6.el6
Red Hat · JBoss Web Server 2 jboss_enterprise_web_server:2::el6 tomcat6-docs-webapp 0:6.0.35-29_patch_06.ep6.el6
Red Hat · JBoss Web Server 2 jboss_enterprise_web_server:2::el6 tomcat6-el-1.0-api 0:6.0.35-29_patch_06.ep6.el6
Red Hat · JBoss Web Server 2 jboss_enterprise_web_server:2::el6 tomcat6-javadoc 0:6.0.35-29_patch_06.ep6.el6
Red Hat · JBoss Web Server 2 jboss_enterprise_web_server:2::el6 tomcat6-jsp-2.1-api 0:6.0.35-29_patch_06.ep6.el6
Red Hat · JBoss Web Server 2 jboss_enterprise_web_server:2::el6 tomcat6-lib 0:6.0.35-29_patch_06.ep6.el6
Red Hat · JBoss Web Server 2 jboss_enterprise_web_server:2::el6 tomcat6-log4j 0:6.0.35-29_patch_06.ep6.el6
Red Hat · JBoss Web Server 2 jboss_enterprise_web_server:2::el6 tomcat6-servlet-2.5-api 0:6.0.35-29_patch_06.ep6.el6
Red Hat · JBoss Web Server 2 jboss_enterprise_web_server:2::el6 tomcat6-webapps 0:6.0.35-29_patch_06.ep6.el6

Vulnerabilities 6

  • Unscored —
    CVE-2012-2733

    java/org/apache/coyote/http11/InternalNioInputBuffer.java in the HTTP NIO connector in Apache Tomcat 6.x before 6.0.36 …

  • Medium —
    CVE-2012-4431 Public exploit

    Cross-Site Request Forgery in Apache Tomcat

    org/apache/catalina/filters/CsrfPreventionFilter.java in Apache Tomcat 6.x before 6.0.36 and 7.x before 7.0.32 allows remote attackers to bypass the cross-site request forgery (CSRF) protection mechanism via a request that lacks a session identifier.

    org.apache.tomcat:tomcat Maven
  • Unscored —
    CVE-2012-4534

    org/apache/tomcat/util/net/NioEndpoint.java in Apache Tomcat 6.x before 6.0.36 and 7.x before 7.0.28, when the NIO conn…

  • Medium —
    CVE-2012-5885

    Improper Access Control in Apache Tomcat

    The replay-countermeasure functionality in the HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, and 7.x before 7.0.30 tracks cnonce (aka client nonce) values instead of nonce (aka server nonce) and nc (…

    org.apache.tomcat:tomcat Maven
  • Medium —
    CVE-2012-5886

    Improper Authentication in Apache Tomcat

    The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, and 7.x before 7.0.30 caches information about the authenticated user within the session state, which makes it easier for remote attackers to bypass …

    org.apache.tomcat:tomcat-catalina Maven
  • Medium —
    CVE-2012-5887 EPSS 12%

    Improper Authentication in Apache Tomcat

    The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, and 7.x before 7.0.30 does not properly check for stale nonce values in conjunction with enforcement of proper credentials, which makes it easier for…

    org.apache.tomcat:tomcat Maven

References

  • article
    https://access.redhat.com/security/updates/classification/#moderate
  • article
    http://tomcat.apache.org/security-6.html
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=873664
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=873695
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=883636
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=883637
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2013/rhsa-2013_0266.json
  • report
    https://access.redhat.com/security/cve/CVE-2012-2733
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2012-2733
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2012-2733
  • report
    https://access.redhat.com/security/cve/CVE-2012-4431
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2012-4431
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2012-4431
  • article
    http://tomcat.apache.org/security-6.html#Fixed_in_Apache_Tomcat_6.0.36
  • article
    http://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.32
  • report
    https://access.redhat.com/security/cve/CVE-2012-4534
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2012-4534
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2012-4534
  • report
    https://access.redhat.com/security/cve/CVE-2012-5885
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2012-5885
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2012-5885
  • report
    https://access.redhat.com/security/cve/CVE-2012-5886
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2012-5886
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2012-5886
  • report
    https://access.redhat.com/security/cve/CVE-2012-5887
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2012-5887
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2012-5887