Description
Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18 permits web applications to replace an XML parser used for other web applications, which allows local users to read or modify the (1) web.xml, (2) context.xml, or (3) tld files of arbitrary web applications via a crafted application that is loaded earlier than the target application.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 5.0 | tomcat5.5 | 5.5.26-5lenny2 | DSA-2207-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | tomcat5 +10 | 5.5.23-0jpp.7.el5_3.2 | RHSA-2009:1164 |
Show 5 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Rhel Developer Suite 3 | tomcat5 +5 | 5.5.23-0jpp_18rh | RHSA-2009:1563 |
| Red Hat Rhel Application Server 2 | tomcat5 +10 | 5.5.23-0jpp_4rh.16 | RHSA-2009:1562 |
| Red Hat Network Satellite 5 | tomcat5 | 5.0.30-0jpp_16rh | RHSA-2009:1617, RHSA-2009:1616 |
| Red Hat Network Satellite 5 | tomcat5-jasper +4 | 5.5.23-0jpp_18rh | RHSA-2009:1616 |
| Red Hat JBoss Web Server 1 | tomcat5 +10 | 5.5.23-0jpp.9.6.ep5.el5 | RHSA-2009:1454 |
| Red Hat JBoss Web Server 1 | tomcat6 +9 | 6.0.18-11.3.ep5.el4 | RHSA-2009:1506 |
| Red Hat JBoss EAP 4 | glassfish-jaxb +1 | 2.1.4-1.11.ep1.el4 | RHSA-2009:1146, RHSA-2009:1145 |
| Red Hat JBoss EAP 4 | hibernate3 +1 | 1:3.2.4-1.SP1_CP08.0jpp.ep1.2.el4 | RHSA-2009:1146, RHSA-2009:1145, RHSA-2009:1144 |
| Red Hat JBoss EAP 4 | hibernate3-annotations +1 | 3.3.1-1.10.GA_CP01.ep1.el4 | RHSA-2009:1146, RHSA-2009:1145, RHSA-2009:1144 |
| Red Hat JBoss EAP 4 | hibernate3-commons-annotations +1 | 3.0.0-1jpp.ep1.5.el4 | RHSA-2009:1146, RHSA-2009:1145, RHSA-2009:1144 |
| Red Hat JBoss EAP 4 | hibernate3-entitymanager +1 | 3.3.2-2.4.ep1.el4 | RHSA-2009:1146, RHSA-2009:1145, RHSA-2009:1144 |
| Red Hat JBoss EAP 4 | hibernate3-validator +1 | 3.0.0-1jpp.ep1.8.el4 | RHSA-2009:1146, RHSA-2009:1145, RHSA-2009:1144 |
| Red Hat JBoss EAP 4 | hsqldb | 1:1.8.0.8-2.patch02.1jpp.ep1.2.el4 | RHSA-2009:1146, RHSA-2009:1144 |
| Red Hat JBoss EAP 4 | jakarta-slide-webdavclient | 2.1-9.2.el4 | RHSA-2009:1146, RHSA-2009:1145, RHSA-2009:1144 |
| Red Hat JBoss EAP 4 | jboss-cache | 1.4.1-6.SP13.1.ep1.el4 | RHSA-2009:1146, RHSA-2009:1145, RHSA-2009:1144 |
| Red Hat JBoss EAP 4 | jboss-messaging | 1.4.0-2.SP3_CP08.1.ep1.el4 | RHSA-2009:1146, RHSA-2009:1145 |
| Red Hat JBoss EAP 4 | jboss-remoting | 2.2.3-2.ep1.el4 | RHSA-2009:1146, RHSA-2009:1145, RHSA-2009:1144 |
| Red Hat JBoss EAP 4 | jboss-seam +1 | 1.2.1-1.ep1.13.el5 | RHSA-2009:1146, RHSA-2009:1145, RHSA-2009:1144 |
| Red Hat JBoss EAP 4 | jbossas +2 | 4.2.0-4.GA_CP07.5.ep1.el4 | RHSA-2009:1146, RHSA-2009:1145, RHSA-2009:1144 |
| Red Hat JBoss EAP 4 | jbossas-4.3.0.GA_CP05-bin | 4.3.0-4.GA_CP05.6.ep1.el4 | RHSA-2009:1146, RHSA-2009:1145 |
| Red Hat JBoss EAP 4 | jbossts | 1:4.2.3-1.SP5_CP05.1jpp.ep1.1.el4 | RHSA-2009:1146, RHSA-2009:1145, RHSA-2009:1144 |
| Red Hat JBoss EAP 4 | jbossweb | 2.0.0-6.CP11.0jpp.ep1.1.el4 | RHSA-2009:1146, RHSA-2009:1145, RHSA-2009:1144 |
| Red Hat JBoss EAP 4 | jbossws +1 | 2.0.1-3.SP2_CP06.3.ep1.el4 | RHSA-2009:1146, RHSA-2009:1145 |
| Red Hat JBoss EAP 4 | jbossws-common | 1.0.0-2.GA_CP04.1.ep1.el4 | RHSA-2009:1146, RHSA-2009:1145 |
| Red Hat JBoss EAP 4 | jbossws-framework | 2.0.1-1.GA_CP04.2.ep1.el4 | RHSA-2009:1146, RHSA-2009:1145 |
| Red Hat JBoss EAP 4 | jbossws-spi | 1.0.0-1.GA_CP02.1.ep1.el4 | RHSA-2009:1146, RHSA-2009:1145 |
| Red Hat JBoss EAP 4 | jgroups | 1:2.4.6-1.ep1.el4 | RHSA-2009:1146, RHSA-2009:1145, RHSA-2009:1144 |
| Red Hat JBoss EAP 4 | rh-eap-docs +1 | 4.2.0-5.GA_CP07.ep1.1.el4 | RHSA-2009:1146, RHSA-2009:1145, RHSA-2009:1144 |
| Red Hat JBoss EAP 4 | xerces-j2 | 2.7.1-9jpp.ep1.2.el4 | RHSA-2009:1146, RHSA-2009:1144 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.apache.tomcat:tomcat | >= 4.1.0, <= 4.1.39 | — | GHSA-hhjg-g8xq-hhr3 |
| Maven | org.apache.tomcat:tomcat | >= 5.5.0, <= 5.5.27 | — | GHSA-hhjg-g8xq-hhr3 |
| Maven | org.apache.tomcat:tomcat | >= 6.0.0, < 6.0.20 | 6.0.20 | GHSA-hhjg-g8xq-hhr3 |
Advisories 12
- RHSA-2009:1164 Red Hat Security Advisory: tomcat security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-2207-1 tomcat5.5 - several Debian Security (DSA / DLA) · Mar 9, 2026
- RHSA-2009:1617 Red Hat Security Advisory: tomcat security update for Red Hat Network Satellite Server Red Hat Security Advisories (RHSA) · Nov 22, 2025
- RHSA-2009:1616 Red Hat Security Advisory: tomcat security update for Red Hat Network Satellite Server Red Hat Security Advisories (RHSA) · Nov 22, 2025
- RHSA-2009:1563 Red Hat Security Advisory: tomcat security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
- RHSA-2009:1562 Red Hat Security Advisory: tomcat security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
- RHSA-2009:1506 Red Hat Security Advisory: tomcat6 security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
- RHSA-2009:1454 Red Hat Security Advisory: tomcat5 security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
- RHSA-2009:1146 Red Hat Security Advisory: JBoss Enterprise Application Platform 4.3.0.CP05 update Red Hat Security Advisories (RHSA) · Nov 22, 2025
- RHSA-2009:1145 Red Hat Security Advisory: JBoss Enterprise Application Platform 4.3.0.CP05 update Red Hat Security Advisories (RHSA) · Nov 22, 2025
- RHSA-2009:1144 Red Hat Security Advisory: JBoss Enterprise Application Platform 4.2.0.CP07 update Red Hat Security Advisories (RHSA) · Nov 22, 2025
- RHSA-2009:1143 Red Hat Security Advisory: JBoss Enterprise Application Platform 4.2.0.CP07 update Red Hat Security Advisories (RHSA) · Nov 22, 2025
References
- http://tomcat.apache.org/security-4.html
- HPSBMA02535 vendor-advisory
- http://svn.apache.org/viewvc?rev=652592&view=rev
- MDVSA-2009:138 vendor-advisory
- FEDORA-2009-11356 vendor-advisory
- DSA-2207 vendor-advisory
- HPSBUX02860 vendor-advisory
- 37460 third-party-advisory
- http://svn.apache.org/viewvc?rev=781542&view=rev
- oval:org.mitre.oval:def:18913 vdb-entry signature
- ADV-2010-3056 vdb-entry
- 20090604 [SECURITY] CVE-2009-0783 Apache Tomcat Information disclosure mailing-list
- http://www.vmware.com/security/advisories/VMSA-2009-0016.html
- 35788 third-party-advisory
- http://svn.apache.org/viewvc?rev=781708&view=rev
- APPLE-SA-2010-03-29-1 vendor-advisory
- http://svn.apache.org/viewvc?rev=739522&view=rev
- ADV-2009-1856 vdb-entry
- MDVSA-2010:176 vendor-advisory
- 20091120 VMSA-2009-0016 VMware vCenter and ESX update release and vMA patch release address multiple security issue in third party components mailing-list
- http://svn.apache.org/viewvc?rev=681156&view=rev
- 42368 third-party-advisory
- http://tomcat.apache.org/security-6.html
- http://support.apple.com/kb/HT4077
- https://issues.apache.org/bugzilla/show_bug.cgi?id=45933
- FEDORA-2009-11374 vendor-advisory
- oval:org.mitre.oval:def:6450 vdb-entry signature
- 35685 third-party-advisory
- 1022336 vdb-entry
- tomcat-xml-information-disclosure(51195) vdb-entry
- FEDORA-2009-11352 vendor-advisory
- http://tomcat.apache.org/security-5.html
- SUSE-SR:2009:012 vendor-advisory
- HPSBUX02579 vendor-advisory
- MDVSA-2009:136 vendor-advisory
- 263529 vendor-advisory
- https://issues.apache.org/bugzilla/show_bug.cgi?id=29936
- 35416 vdb-entry
- oval:org.mitre.oval:def:10716 vdb-entry signature
- ADV-2009-3316 vdb-entry
- [tomcat-dev] 20190319 svn commit: r1855831 [21/30] - in /tomcat/site/trunk: ./ docs/ xdocs/ mailing-list
- [tomcat-dev] 20190319 svn commit: r1855831 [22/30] - in /tomcat/site/trunk: ./ docs/ xdocs/ mailing-list
- [tomcat-dev] 20190325 svn commit: r1856174 [19/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/ mailing-list
- [tomcat-dev] 20190325 svn commit: r1856174 [20/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/ mailing-list
- [tomcat-dev] 20200203 svn commit: r1873527 [22/30] - /tomcat/site/trunk/docs/ mailing-list
- [tomcat-dev] 20200213 svn commit: r1873980 [24/34] - /tomcat/site/trunk/docs/ mailing-list
- [tomcat-dev] 20200213 svn commit: r1873980 [25/34] - /tomcat/site/trunk/docs/ mailing-list