Red Hat Security Advisory

RHSA-2007:0876

tomcat security update

Released 2007-10-11 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat Application Server v2 4AS tomcat5-5.5.23-0jpp_4rh.4, tomcat5-admin-webapps-5.5.23-0jpp_4rh.4, tomcat5-common-lib-5.5.23-0jpp_4rh.4 +8
Red Hat Application Server v2 4ES tomcat5-5.5.23-0jpp_4rh.4, tomcat5-admin-webapps-5.5.23-0jpp_4rh.4, tomcat5-common-lib-5.5.23-0jpp_4rh.4 +8
Red Hat Application Server v2 4WS tomcat5-5.5.23-0jpp_4rh.4, tomcat5-admin-webapps-5.5.23-0jpp_4rh.4, tomcat5-common-lib-5.5.23-0jpp_4rh.4 +8

Fixes 6 records

TI-2007-02365 CVE-2007-2449 · GHSA-hc39-rjwp-qffq

Multiple cross-site scripting (XSS) vulnerabilities in certain JSP files in the examples…

MEDIUM 59

Multiple cross-site scripting (XSS) vulnerabilities in certain JSP files in the examples web application in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0 through 4.1.36, 5.0.0 through 5.0.30, 5.5.0 through 5.5.24, and 6.0.0 t…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.77376 Published 2007-06-14 Fixed

TI-2007-03281 CVE-2007-3386 · GHSA-v66v-63h2-8q5q

Cross-site scripting (XSS) vulnerability in the Host Manager Servlet for Apache Tomcat…

MEDIUM 54

Cross-site scripting (XSS) vulnerability in the Host Manager Servlet for Apache Tomcat 6.0.0 to 6.0.13 and 5.5.0 to 5.5.24 allows remote attackers to inject arbitrary HTML and web script via crafted requests, as demonstr…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.58956 Published 2007-08-14 Fixed CWE-79

TI-2007-03277 CVE-2007-3382 · GHSA-qff8-g48j-pwpw

Apache Tomcat 6.0.0 to 6.0.13, 5.5.0 to 5.5.24, 5.0.0 to 5.0.30, 4.1.0 to 4.1.36, and 3.3…

MEDIUM 47

Apache Tomcat 6.0.0 to 6.0.13, 5.5.0 to 5.5.24, 5.0.0 to 5.0.30, 4.1.0 to 4.1.36, and 3.3 to 3.3.2 treats single quotes ("'") as delimiters in cookies, which might cause sensitive information such as session IDs to be le…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.37497 Published 2007-08-14 Fixed CWE-200

TI-2007-03280 CVE-2007-3385 · GHSA-6j8f-66vh-39mj

Apache Tomcat 6.0.0 to 6.0.13, 5.5.0 to 5.5.24, 5.0.0 to 5.0.30, 4.1.0 to 4.1.36, and 3.3…

LOW 37

Apache Tomcat 6.0.0 to 6.0.13, 5.5.0 to 5.5.24, 5.0.0 to 5.0.30, 4.1.0 to 4.1.36, and 3.3 to 3.3.2 does not properly handle the \" character sequence in a cookie value, which might cause sensitive information such as ses…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.16944 Published 2007-08-14 Fixed CWE-200

TI-2007-01301 CVE-2007-1358 · GHSA-xmc9-6p56-3c4v

Cross-site scripting (XSS) vulnerability in certain applications using Apache Tomcat…

LOW 32

Cross-site scripting (XSS) vulnerability in certain applications using Apache Tomcat 4.0.0 through 4.0.6 and 4.1.0 through 4.1.34 allows remote attackers to inject arbitrary web script or HTML via crafted "Accept-Languag…

CVSS 2.0LOW 2.6 Network No auth Interaction — EPSS 0.19889 Published 2007-05-09 Fixed CWE-79

TI-2007-02366 CVE-2007-2450 · GHSA-5c5p-jxvx-x7j2

Multiple cross-site scripting (XSS) vulnerabilities in the (1) Manager and (2) Host…

LOW 23

Multiple cross-site scripting (XSS) vulnerabilities in the (1) Manager and (2) Host Manager web applications in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0 through 4.1.36, 5.0.0 through 5.0.30, 5.5.0 through 5.5.24, and 6.0…

CVSS 2.0LOW 3.5 Network Low privileges Interaction — EPSS 0.03291 Published 2007-06-14 Fixed in 4.1.37, 5.5.25 +1 CWE-79