Red Hat Security Advisory

RHSA-2014:0827

tomcat security update

Released 2014-07-02 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat Enterprise Linux Client (v. 7) tomcat-7.0.42-6.el7_0, tomcat-servlet-3.0-api-7.0.42-6.el7_0
Red Hat Enterprise Linux Client Optional (v. 7) tomcat-7.0.42-6.el7_0, tomcat-admin-webapps-7.0.42-6.el7_0, tomcat-docs-webapp-7.0.42-6.el7_0 +6
Red Hat Enterprise Linux ComputeNode (v. 7) tomcat-7.0.42-6.el7_0, tomcat-servlet-3.0-api-7.0.42-6.el7_0
Red Hat Enterprise Linux ComputeNode Optional (v. 7) tomcat-7.0.42-6.el7_0, tomcat-admin-webapps-7.0.42-6.el7_0, tomcat-docs-webapp-7.0.42-6.el7_0 +6
Red Hat Enterprise Linux Server (v. 7) tomcat-7.0.42-6.el7_0, tomcat-admin-webapps-7.0.42-6.el7_0, tomcat-el-2.2-api-7.0.42-6.el7_0 +4
Red Hat Enterprise Linux Server Optional (v. 7) tomcat-7.0.42-6.el7_0, tomcat-admin-webapps-7.0.42-6.el7_0, tomcat-docs-webapp-7.0.42-6.el7_0 +6
Red Hat Enterprise Linux Workstation (v. 7) tomcat-7.0.42-6.el7_0, tomcat-admin-webapps-7.0.42-6.el7_0, tomcat-el-2.2-api-7.0.42-6.el7_0 +4
Red Hat Enterprise Linux Workstation Optional (v. 7) tomcat-docs-webapp-7.0.42-6.el7_0, tomcat-javadoc-7.0.42-6.el7_0, tomcat-jsvc-7.0.42-6.el7_0

Fixes 3 records

TI-2014-00070 CVE-2014-0075 · GHSA-475f-74wp-pqv5

Integer overflow in the parseChunkHeader function in…

MEDIUM 46

Integer overflow in the parseChunkHeader function in java/org/apache/coyote/http11/filters/ChunkedInputFilter.java in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4 allows remote attackers to cause…

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.17577 Published 2014-05-31 Partial fix · 6.0.40, 7.0.53 +1 CWE-189

TI-2014-00094 CVE-2014-0099 · GHSA-xh5x-j8jf-pcpx

Integer overflow in java/org/apache/tomcat/util/buf/Ascii.java in Apache Tomcat before…

LOW 37

Integer overflow in java/org/apache/tomcat/util/buf/Ascii.java in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4, when operated behind a reverse proxy, allows remote attackers to conduct HTTP reques…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.08838 Published 2014-05-31 Partial fix · 6.0.40, 7.0.54 +1 CWE-189

TI-2014-00091 CVE-2014-0096 · GHSA-qprx-q2r7-3rx6

java/org/apache/catalina/servlets/DefaultServlet.java in the default servlet in Apache…

LOW 36

java/org/apache/catalina/servlets/DefaultServlet.java in the default servlet in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4 does not properly restrict XSLT stylesheets, which allows remote attack…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.06905 Published 2014-05-31 Partial fix · 6.0.40, 7.0.54 +1 CWE-264