Skip to content
OpenAdvisories
High RHSA-2016:2046 5 CVEs

Red Hat Security Advisory: tomcat security update

Published Sep 15, 2024 · Updated Aug 5, 2026

Ecosystem: Red Hat

Fixed packages 40

ReleasePackageFixed in
Red Hat · RHEL 7 enterprise_linux:7::client tomcat 0:7.0.54-8.el7_2
Red Hat · RHEL 7 enterprise_linux:7::client tomcat-admin-webapps 0:7.0.54-8.el7_2
Red Hat · RHEL 7 enterprise_linux:7::client tomcat-docs-webapp 0:7.0.54-8.el7_2
Red Hat · RHEL 7 enterprise_linux:7::client tomcat-el-2.2-api 0:7.0.54-8.el7_2
Red Hat · RHEL 7 enterprise_linux:7::client tomcat-javadoc 0:7.0.54-8.el7_2
Red Hat · RHEL 7 enterprise_linux:7::client tomcat-jsp-2.2-api 0:7.0.54-8.el7_2
Red Hat · RHEL 7 enterprise_linux:7::client tomcat-jsvc 0:7.0.54-8.el7_2
Red Hat · RHEL 7 enterprise_linux:7::client tomcat-lib 0:7.0.54-8.el7_2
Red Hat · RHEL 7 enterprise_linux:7::client tomcat-servlet-3.0-api 0:7.0.54-8.el7_2
Red Hat · RHEL 7 enterprise_linux:7::client tomcat-webapps 0:7.0.54-8.el7_2
Red Hat · RHEL 7 enterprise_linux:7::computenode tomcat 0:7.0.54-8.el7_2
Red Hat · RHEL 7 enterprise_linux:7::computenode tomcat-admin-webapps 0:7.0.54-8.el7_2
Red Hat · RHEL 7 enterprise_linux:7::computenode tomcat-docs-webapp 0:7.0.54-8.el7_2
Red Hat · RHEL 7 enterprise_linux:7::computenode tomcat-el-2.2-api 0:7.0.54-8.el7_2
Red Hat · RHEL 7 enterprise_linux:7::computenode tomcat-javadoc 0:7.0.54-8.el7_2
Red Hat · RHEL 7 enterprise_linux:7::computenode tomcat-jsp-2.2-api 0:7.0.54-8.el7_2
Red Hat · RHEL 7 enterprise_linux:7::computenode tomcat-jsvc 0:7.0.54-8.el7_2
Red Hat · RHEL 7 enterprise_linux:7::computenode tomcat-lib 0:7.0.54-8.el7_2
Red Hat · RHEL 7 enterprise_linux:7::computenode tomcat-servlet-3.0-api 0:7.0.54-8.el7_2
Red Hat · RHEL 7 enterprise_linux:7::computenode tomcat-webapps 0:7.0.54-8.el7_2
Red Hat · RHEL 7 enterprise_linux:7::server tomcat 0:7.0.54-8.el7_2
Red Hat · RHEL 7 enterprise_linux:7::server tomcat-admin-webapps 0:7.0.54-8.el7_2
Red Hat · RHEL 7 enterprise_linux:7::server tomcat-docs-webapp 0:7.0.54-8.el7_2
Red Hat · RHEL 7 enterprise_linux:7::server tomcat-el-2.2-api 0:7.0.54-8.el7_2
Red Hat · RHEL 7 enterprise_linux:7::server tomcat-javadoc 0:7.0.54-8.el7_2
Red Hat · RHEL 7 enterprise_linux:7::server tomcat-jsp-2.2-api 0:7.0.54-8.el7_2
Red Hat · RHEL 7 enterprise_linux:7::server tomcat-jsvc 0:7.0.54-8.el7_2
Red Hat · RHEL 7 enterprise_linux:7::server tomcat-lib 0:7.0.54-8.el7_2
Red Hat · RHEL 7 enterprise_linux:7::server tomcat-servlet-3.0-api 0:7.0.54-8.el7_2
Red Hat · RHEL 7 enterprise_linux:7::server tomcat-webapps 0:7.0.54-8.el7_2
Red Hat · RHEL 7 enterprise_linux:7::workstation tomcat 0:7.0.54-8.el7_2
Red Hat · RHEL 7 enterprise_linux:7::workstation tomcat-admin-webapps 0:7.0.54-8.el7_2
Red Hat · RHEL 7 enterprise_linux:7::workstation tomcat-docs-webapp 0:7.0.54-8.el7_2
Red Hat · RHEL 7 enterprise_linux:7::workstation tomcat-el-2.2-api 0:7.0.54-8.el7_2
Red Hat · RHEL 7 enterprise_linux:7::workstation tomcat-javadoc 0:7.0.54-8.el7_2
Red Hat · RHEL 7 enterprise_linux:7::workstation tomcat-jsp-2.2-api 0:7.0.54-8.el7_2
Red Hat · RHEL 7 enterprise_linux:7::workstation tomcat-jsvc 0:7.0.54-8.el7_2
Red Hat · RHEL 7 enterprise_linux:7::workstation tomcat-lib 0:7.0.54-8.el7_2
Red Hat · RHEL 7 enterprise_linux:7::workstation tomcat-servlet-3.0-api 0:7.0.54-8.el7_2
Red Hat · RHEL 7 enterprise_linux:7::workstation tomcat-webapps 0:7.0.54-8.el7_2

Vulnerabilities 5

  • High 8.1
    CVE-2015-5346 EPSS 11%

    Improper Neutralization of Input During Web Page Generation in Apache Tomcat

    Session fixation vulnerability in Apache Tomcat 7.x before 7.0.66, 8.x before 8.0.30, and 9.x before 9.0.0.M2, when different session settings are used for deployments of multiple versions of the same web application, might allow remote attackers to hijack we…

    org.apache.tomcat:tomcat tomcat7 Ubuntu Maven
  • High 8.1
    CVE-2016-5388 EPSS 51%

    Improper Access Control in Apache Tomcat

    Apache Tomcat 7.x through 7.0.70 and 8.x through 8.5.4, when the CGI Servlet is enabled, follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might…

    tomcat8 tomcat7 tomcat6 org.apache.tomcat:tomcat-catalina Ubuntu Maven
  • Medium —
    CVE-2014-7810 EPSS 13%

    Improper Access Control in Apache Tomcat

    The Expression Language (EL) implementation in Apache Tomcat 6.x before 6.0.44, 7.x before 7.0.58, and 8.x before 8.0.16 does not properly consider the possibility of an accessible interface implemented by an inaccessible class, which allows attackers to bypa…

    org.apache.tomcat:tomcat tomcat7 tomcat6 Ubuntu Maven
  • Unscored —
    CVE-2016-5425 Public exploit

    The Tomcat package on Red Hat Enterprise Linux (RHEL) 7, Fedora, CentOS, Oracle Linux, and possibly other Linux distrib…

  • Unscored —
    CVE-2016-6325

    The Tomcat package on Red Hat Enterprise Linux (RHEL) 5 through 7, JBoss Web Server 3.0, and JBoss EWS 2 uses weak perm…

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • article
    https://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.59
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1222573
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1311085
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1353809
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1362545
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1367447
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_2046.json
  • report
    https://access.redhat.com/security/cve/CVE-2014-7810
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2014-7810
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2014-7810
  • article
    http://tomcat.apache.org/security-6.html#Fixed_in_Apache_Tomcat_6.0.44
  • article
    http://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.59
  • article
    http://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.0.17
  • report
    https://access.redhat.com/security/cve/CVE-2015-5346
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2015-5346
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2015-5346
  • article
    http://seclists.org/bugtraq/2016/Feb/143
  • report
    https://access.redhat.com/security/cve/CVE-2016-5388
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2016-5388
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2016-5388
  • report
    https://access.redhat.com/security/cve/CVE-2016-5425
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2016-5425
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2016-5425
  • article
    http://legalhackers.com/advisories/Tomcat-RedHat-based-Root-Privilege-Escalation-Exploit.txt
  • report
    https://access.redhat.com/security/cve/CVE-2016-6325
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2016-6325
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2016-6325