Skip to content
OpenAdvisories
High RHSA-2016:2807 6 CVEs

Red Hat Security Advisory: Red Hat JBoss Web Server 2.1.2 security update for Tomcat 7

Published Sep 22, 2024 · Updated Oct 8, 2026

Ecosystem: Red Hat

Fixed packages 22

ReleasePackageFixed in
Red Hat · JBoss Web Server 2 jboss_enterprise_web_server:2::el6 tomcat7 0:7.0.54-23_patch_05.ep6.el6
Red Hat · JBoss Web Server 2 jboss_enterprise_web_server:2::el6 tomcat7-admin-webapps 0:7.0.54-23_patch_05.ep6.el6
Red Hat · JBoss Web Server 2 jboss_enterprise_web_server:2::el6 tomcat7-docs-webapp 0:7.0.54-23_patch_05.ep6.el6
Red Hat · JBoss Web Server 2 jboss_enterprise_web_server:2::el6 tomcat7-el-2.2-api 0:7.0.54-23_patch_05.ep6.el6
Red Hat · JBoss Web Server 2 jboss_enterprise_web_server:2::el6 tomcat7-javadoc 0:7.0.54-23_patch_05.ep6.el6
Red Hat · JBoss Web Server 2 jboss_enterprise_web_server:2::el6 tomcat7-jsp-2.2-api 0:7.0.54-23_patch_05.ep6.el6
Red Hat · JBoss Web Server 2 jboss_enterprise_web_server:2::el6 tomcat7-lib 0:7.0.54-23_patch_05.ep6.el6
Red Hat · JBoss Web Server 2 jboss_enterprise_web_server:2::el6 tomcat7-log4j 0:7.0.54-23_patch_05.ep6.el6
Red Hat · JBoss Web Server 2 jboss_enterprise_web_server:2::el6 tomcat7-maven-devel 0:7.0.54-23_patch_05.ep6.el6
Red Hat · JBoss Web Server 2 jboss_enterprise_web_server:2::el6 tomcat7-servlet-3.0-api 0:7.0.54-23_patch_05.ep6.el6
Red Hat · JBoss Web Server 2 jboss_enterprise_web_server:2::el6 tomcat7-webapps 0:7.0.54-23_patch_05.ep6.el6
Red Hat · JBoss Web Server 2 jboss_enterprise_web_server:2::el7 tomcat7 0:7.0.54-23_patch_05.ep6.el7
Red Hat · JBoss Web Server 2 jboss_enterprise_web_server:2::el7 tomcat7-admin-webapps 0:7.0.54-23_patch_05.ep6.el7
Red Hat · JBoss Web Server 2 jboss_enterprise_web_server:2::el7 tomcat7-docs-webapp 0:7.0.54-23_patch_05.ep6.el7
Red Hat · JBoss Web Server 2 jboss_enterprise_web_server:2::el7 tomcat7-el-2.2-api 0:7.0.54-23_patch_05.ep6.el7
Red Hat · JBoss Web Server 2 jboss_enterprise_web_server:2::el7 tomcat7-javadoc 0:7.0.54-23_patch_05.ep6.el7
Red Hat · JBoss Web Server 2 jboss_enterprise_web_server:2::el7 tomcat7-jsp-2.2-api 0:7.0.54-23_patch_05.ep6.el7
Red Hat · JBoss Web Server 2 jboss_enterprise_web_server:2::el7 tomcat7-lib 0:7.0.54-23_patch_05.ep6.el7
Red Hat · JBoss Web Server 2 jboss_enterprise_web_server:2::el7 tomcat7-log4j 0:7.0.54-23_patch_05.ep6.el7
Red Hat · JBoss Web Server 2 jboss_enterprise_web_server:2::el7 tomcat7-maven-devel 0:7.0.54-23_patch_05.ep6.el7
Red Hat · JBoss Web Server 2 jboss_enterprise_web_server:2::el7 tomcat7-servlet-3.0-api 0:7.0.54-23_patch_05.ep6.el7
Red Hat · JBoss Web Server 2 jboss_enterprise_web_server:2::el7 tomcat7-webapps 0:7.0.54-23_patch_05.ep6.el7

Vulnerabilities 6

  • High 8.8
    CVE-2015-5351

    Apache Tomcat allows remote attackers to bypass a CSRF protection mechanism by using a token

    The (1) Manager and (2) Host Manager applications in Apache Tomcat 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 establish sessions and send CSRF tokens for arbitrary new requests, which allows remote attackers to bypass a CSRF protection mech…

    org.apache.tomcat:tomcat tomcat7 tomcat6 Ubuntu Maven
  • High 8.8
    CVE-2016-0714 Public exploit EPSS 13%

    Improper Access Control in Apache Tomcat

    The session-persistence implementation in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 mishandles session attributes, which allows remote authenticated users to bypass intended SecurityManager restrictions and…

    org.apache.tomcat:tomcat tomcat7 tomcat6 Ubuntu Maven
  • High 8.1
    CVE-2015-5346 EPSS 11%

    Improper Neutralization of Input During Web Page Generation in Apache Tomcat

    Session fixation vulnerability in Apache Tomcat 7.x before 7.0.66, 8.x before 8.0.30, and 9.x before 9.0.0.M2, when different session settings are used for deployments of multiple versions of the same web application, might allow remote attackers to hijack we…

    org.apache.tomcat:tomcat tomcat7 Ubuntu Maven
  • High 7.5
    CVE-2016-3092 EPSS 37%

    High severity vulnerability that affects commons-fileupload:commons-fileupload

    The MultipartStream class in Apache Commons Fileupload before 1.3.2, as used in Apache Tomcat 7.x before 7.0.70, 8.x before 8.0.36, 8.5.x before 8.5.3, and 9.x before 9.0.0.M7 and other products, allows remote attackers to cause a denial of service (CPU consu…

    tomcat8 tomcat7 tomcat6 commons-fileupload:commons-fileupload Debian Ubuntu Maven
  • Medium 6.3
    CVE-2016-0763 EPSS 11%

    Improper Verification of Source of a Communication Channel in Apache Tomcat

    The setGlobalContext method in org/apache/naming/factory/ResourceLinkFactory.java in Apache Tomcat 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M3 does not consider whether ResourceLinkFactory.setGlobalContext callers are authorized, which allow…

    org.apache.tomcat:tomcat tomcat7 tomcat6 Ubuntu Maven
  • Medium 4.3
    CVE-2016-0706

    Exposure of Sensitive Information to an Unauthorized Actor in Apache Tomcat

    Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 does not place org.apache.catalina.manager.StatusManagerServlet on the org/apache/catalina/core/RestrictedServlets.properties list, which allows remote authenticate…

    org.apache.tomcat:tomcat tomcat7 tomcat6 Ubuntu Maven

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1311076
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1311082
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1311085
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1311087
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1311093
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1349468
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_2807.json
  • report
    https://access.redhat.com/security/cve/CVE-2015-5346
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2015-5346
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2015-5346
  • article
    http://seclists.org/bugtraq/2016/Feb/143
  • report
    https://access.redhat.com/security/cve/CVE-2015-5351
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2015-5351
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2015-5351
  • article
    http://seclists.org/bugtraq/2016/Feb/148
  • report
    https://access.redhat.com/security/cve/CVE-2016-0706
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2016-0706
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2016-0706
  • article
    http://seclists.org/bugtraq/2016/Feb/144
  • report
    https://access.redhat.com/security/cve/CVE-2016-0714
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2016-0714
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2016-0714
  • article
    http://seclists.org/bugtraq/2016/Feb/145
  • report
    https://access.redhat.com/security/cve/CVE-2016-0763
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2016-0763
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2016-0763
  • article
    http://seclists.org/bugtraq/2016/Feb/147
  • report
    https://access.redhat.com/security/cve/CVE-2016-3092
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2016-3092
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2016-3092
  • article
    http://tomcat.apache.org/security-7.html
  • article
    http://tomcat.apache.org/security-8.html