Red Hat Security AdvisoryRHSA-2007:0327
tomcat security update
Released 2007-05-14 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux (v. 5 server) jakarta-commons-modeler-1.1-8jpp.1.0.2.el5, jakarta-commons-modeler-1.1-8jpp.1.0.2.el5.i386, jakarta-commons-modeler-1.1-8jpp.1.0.2.el5.ia64 +47
- Red Hat Enterprise Linux Desktop (v. 5 client) tomcat5-5.5.23-0jpp.1.0.3.el5, tomcat5-jsp-2.0-api-5.5.23-0jpp.1.0.3.el5, tomcat5-jsp-2.0-api-5.5.23-0jpp.1.0.3.el5.i386 +2
- Red Hat Enterprise Linux Desktop Workstation (v. 5 client) jakarta-commons-modeler-1.1-8jpp.1.0.2.el5, jakarta-commons-modeler-1.1-8jpp.1.0.2.el5.i386, jakarta-commons-modeler-javadoc-1.1-8jpp.1.0.2.el5 +19
Fixes 4 records
Priority HIGH 66
Directory traversal vulnerability in Apache HTTP Server and Tomcat 5.x before 5.5.22 and 6.x before 6.0.10, when using certain proxy modules (mod_proxy, mod_rewrite, mod_jk), allows remote attackers to read arbitrary fil…
CVSS 2.0MEDIUM 5.0· Network · No auth · Interaction — · EPSS 0.91158 · Published 2007-03-16 · Fixed in 5.5.22, 6.0.10 CWE-22
Priority MEDIUM 42
Jakarta Tomcat 5.0.19 (Coyote/1.1) and Tomcat 4.1.24 (Coyote/1.0) allows remote attackers to poison the web cache, bypass web application firewall protection, and conduct XSS attacks via an HTTP request with both a "Tran…
CVSS 2.0MEDIUM 4.3· Network · No auth · Interaction — · EPSS 0.26114 · Published 2005-06-30 · Fixed
Priority LOW 32
Cross-site scripting (XSS) vulnerability in certain applications using Apache Tomcat 4.0.0 through 4.0.6 and 4.1.0 through 4.1.34 allows remote attackers to inject arbitrary web script or HTML via crafted "Accept-Languag…
CVSS 2.0LOW 2.6· Network · No auth · Interaction — · EPSS 0.19889 · Published 2007-05-09 · Fixed CWE-79
Priority LOW 28
Cross-site scripting (XSS) vulnerability in implicit-objects.jsp in Apache Tomcat 5.0.0 through 5.0.30 and 5.5.0 through 5.5.17 allows remote attackers to inject arbitrary web script or HTML via certain header values.
CVSS 2.0MEDIUM 4.3· Network · No auth · Interaction — · EPSS 0.05476 · Published 2007-05-09 · Fixed in 5.5.18 CWE-79
THREATIST.IORead the docs