Skip to content
OpenAdvisories
Unscored RHSA-2014:1038 2 CVEs

Red Hat Security Advisory: tomcat6 security update

Published Sep 15, 2024 · Updated Aug 5, 2026

Ecosystem: Red Hat

Fixed packages 36

ReleasePackageFixed in
Red Hat · RHEL 6 enterprise_linux:6::client tomcat6 0:6.0.24-78.el6_5
Red Hat · RHEL 6 enterprise_linux:6::client tomcat6-admin-webapps 0:6.0.24-78.el6_5
Red Hat · RHEL 6 enterprise_linux:6::client tomcat6-docs-webapp 0:6.0.24-78.el6_5
Red Hat · RHEL 6 enterprise_linux:6::client tomcat6-el-2.1-api 0:6.0.24-78.el6_5
Red Hat · RHEL 6 enterprise_linux:6::client tomcat6-javadoc 0:6.0.24-78.el6_5
Red Hat · RHEL 6 enterprise_linux:6::client tomcat6-jsp-2.1-api 0:6.0.24-78.el6_5
Red Hat · RHEL 6 enterprise_linux:6::client tomcat6-lib 0:6.0.24-78.el6_5
Red Hat · RHEL 6 enterprise_linux:6::client tomcat6-servlet-2.5-api 0:6.0.24-78.el6_5
Red Hat · RHEL 6 enterprise_linux:6::client tomcat6-webapps 0:6.0.24-78.el6_5
Red Hat · RHEL 6 enterprise_linux:6::computenode tomcat6 0:6.0.24-78.el6_5
Red Hat · RHEL 6 enterprise_linux:6::computenode tomcat6-admin-webapps 0:6.0.24-78.el6_5
Red Hat · RHEL 6 enterprise_linux:6::computenode tomcat6-docs-webapp 0:6.0.24-78.el6_5
Red Hat · RHEL 6 enterprise_linux:6::computenode tomcat6-el-2.1-api 0:6.0.24-78.el6_5
Red Hat · RHEL 6 enterprise_linux:6::computenode tomcat6-javadoc 0:6.0.24-78.el6_5
Red Hat · RHEL 6 enterprise_linux:6::computenode tomcat6-jsp-2.1-api 0:6.0.24-78.el6_5
Red Hat · RHEL 6 enterprise_linux:6::computenode tomcat6-lib 0:6.0.24-78.el6_5
Red Hat · RHEL 6 enterprise_linux:6::computenode tomcat6-servlet-2.5-api 0:6.0.24-78.el6_5
Red Hat · RHEL 6 enterprise_linux:6::computenode tomcat6-webapps 0:6.0.24-78.el6_5
Red Hat · RHEL 6 enterprise_linux:6::server tomcat6 0:6.0.24-78.el6_5
Red Hat · RHEL 6 enterprise_linux:6::server tomcat6-admin-webapps 0:6.0.24-78.el6_5
Red Hat · RHEL 6 enterprise_linux:6::server tomcat6-docs-webapp 0:6.0.24-78.el6_5
Red Hat · RHEL 6 enterprise_linux:6::server tomcat6-el-2.1-api 0:6.0.24-78.el6_5
Red Hat · RHEL 6 enterprise_linux:6::server tomcat6-javadoc 0:6.0.24-78.el6_5
Red Hat · RHEL 6 enterprise_linux:6::server tomcat6-jsp-2.1-api 0:6.0.24-78.el6_5
Red Hat · RHEL 6 enterprise_linux:6::server tomcat6-lib 0:6.0.24-78.el6_5
Red Hat · RHEL 6 enterprise_linux:6::server tomcat6-servlet-2.5-api 0:6.0.24-78.el6_5
Red Hat · RHEL 6 enterprise_linux:6::server tomcat6-webapps 0:6.0.24-78.el6_5
Red Hat · RHEL 6 enterprise_linux:6::workstation tomcat6 0:6.0.24-78.el6_5
Red Hat · RHEL 6 enterprise_linux:6::workstation tomcat6-admin-webapps 0:6.0.24-78.el6_5
Red Hat · RHEL 6 enterprise_linux:6::workstation tomcat6-docs-webapp 0:6.0.24-78.el6_5
Red Hat · RHEL 6 enterprise_linux:6::workstation tomcat6-el-2.1-api 0:6.0.24-78.el6_5
Red Hat · RHEL 6 enterprise_linux:6::workstation tomcat6-javadoc 0:6.0.24-78.el6_5
Red Hat · RHEL 6 enterprise_linux:6::workstation tomcat6-jsp-2.1-api 0:6.0.24-78.el6_5
Red Hat · RHEL 6 enterprise_linux:6::workstation tomcat6-lib 0:6.0.24-78.el6_5
Red Hat · RHEL 6 enterprise_linux:6::workstation tomcat6-servlet-2.5-api 0:6.0.24-78.el6_5
Red Hat · RHEL 6 enterprise_linux:6::workstation tomcat6-webapps 0:6.0.24-78.el6_5

Vulnerabilities 2

  • Medium —
    CVE-2013-4590

    Exposure of Sensitive Information to an Unauthorized Actor in Apache Tomcat

    Apache Tomcat before 6.0.39, 7.x before 7.0.50, and 8.x before 8.0.0-RC10 allows attackers to obtain "Tomcat internals" information by leveraging the presence of an untrusted web application with a context.xml, web.xml, *.jspx, *.tagx, or *.tld XML document c…

    org.apache.tomcat:tomcat Maven
  • Medium —
    CVE-2014-0119

    Missing XML Validation in Apache Tomcat

    Apache Tomcat before 6.0.40, 7.x before 7.0.54, and 8.x before 8.0.6 does not properly constrain the class loader that accesses the XML parser used with an XSLT stylesheet, which allows remote attackers to (1) read arbitrary files via a crafted web applicatio…

    org.apache.tomcat:tomcat tomcat7 tomcat6 org.apache.tomcat:tomcat-catalina Ubuntu Maven

References

  • article
    https://access.redhat.com/security/updates/classification/#low
  • article
    https://tomcat.apache.org/security-6.html
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1069911
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1102038
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_1038.json
  • report
    https://access.redhat.com/security/cve/CVE-2013-4590
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2013-4590
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2013-4590
  • report
    https://access.redhat.com/security/cve/CVE-2014-0119
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2014-0119
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2014-0119