Skip to content
OpenAdvisories
High USN-4791-1 2 CVEs

tomcat7 vulnerabilities

Published Mar 15, 2021 · Updated Jun 25, 2026

Ecosystem: Ubuntu

Summary

It was discovered that Apache Tomcat 7 did not protect applications from the
presence of untrusted client data in an environment variable. A remote
attacker could possible use this vulnerability to redirect the traffic to an
arbitrary proxy and obtain sensitive information. (CVE-2016-5388)

It was discovered that Apache Tomcat 7 mishandled specially crafted input.
An attacker could use this vulnerability to cause a denial of service.
(CVE-2018-1336)

Fixed packages 1

ReleasePackageFixed in
Ubuntu · Pro 16.04 LTS Pro:16.04:LTS tomcat7 7.0.68-1ubuntu0.4+esm1

Vulnerabilities 2

  • High 8.1
    CVE-2016-5388 EPSS 51%

    Improper Access Control in Apache Tomcat

    Apache Tomcat 7.x through 7.0.70 and 8.x through 8.5.4, when the CGI Servlet is enabled, follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might…

    tomcat8 tomcat7 tomcat6 org.apache.tomcat:tomcat-catalina Ubuntu Maven
  • High 7.5
    CVE-2018-1336 EPSS 20%

    In Apache Tomcat there is an improper handing of overflow in the UTF-8 decoder

    An improper handing of overflow in the UTF-8 decoder with supplementary characters can lead to an infinite loop in the decoder causing a Denial of Service. Versions Affected: Apache Tomcat 9.0.0.M9 to 9.0.7, 8.5.0 to 8.5.30, 8.0.0.RC1 to 8.0.51, and 7.0.28 to…

    Apache Software Foundation Apache Tomcat tomcat8 tomcat7 Ubuntu Maven

References

  • report
    https://ubuntu.com/security/CVE-2016-5388
  • report
    https://ubuntu.com/security/CVE-2018-1336