Information on source package tomcat7

Available versions

ReleaseVersion
wheezy7.0.28-4+deb7u4
wheezy (security)7.0.28-4+deb7u15
jessie (security)7.0.56-3+deb8u11
stretch7.0.75-1
buster7.0.78-1
sid7.0.78-1

Open issues

BugwheezyjessiestretchbustersidDescription
CVE-2017-7674fixedvulnerable (no DSA, postponed)fixedfixedfixedThe CORS Filter in Apache Tomcat 9.0.0.M1 to 9.0.0.M21, 8.5.0 to ...
CVE-2017-12617vulnerablevulnerablefixedfixedfixedWhen running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to ...
CVE-2017-12616fixedvulnerablefixedfixedfixedWhen using a VirtualDirContext with Apache Tomcat 7.0.0 to 7.0.80 it ...
CVE-2013-4590vulnerable (no DSA)fixedfixedfixedfixedApache Tomcat before 6.0.39, 7.x before 7.0.50, and 8.x before ...

Open unimportant issues

BugwheezyjessiestretchbustersidDescription
CVE-2016-5388vulnerablevulnerablefixedfixedfixedApache Tomcat through 8.5.4, when the CGI Servlet is enabled, follows ...
CVE-2012-5568vulnerablevulnerablevulnerablevulnerablevulnerableApache Tomcat through 7.0.x allows remote attackers to cause a denial ...

Resolved issues

BugDescription
TEMP-0840685-CEF76BTOCTOU race condition in initscript on chown'ing JVM_TMP temporary directory
CVE-2017-7675The HTTP/2 implementation in Apache Tomcat 9.0.0.M1 to 9.0.0.M21 and ...
CVE-2017-6056It was discovered that a programming error in the processing of HTTPS ...
CVE-2017-5664The error page mechanism of the Java Servlet Specification requires ...
CVE-2017-5648While investigating bug 60718, it was noticed that some calls to ...
CVE-2017-5647A bug in the handling of the pipelined requests in Apache Tomcat ...
CVE-2017-12615When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP PUTs ...
CVE-2016-9775The postrm script in the tomcat6 package before 6.0.45+dfsg-1~deb7u3 ...
CVE-2016-9774The postinst script in the tomcat6 package before 6.0.45+dfsg-1~deb7u4 ...
CVE-2016-8745A bug in the error handling of the send file code for the NIO HTTP ...
CVE-2016-8735Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x ...
CVE-2016-6817The HTTP/2 header parser in Apache Tomcat 9.0.0.M1 to 9.0.0.M11 and ...
CVE-2016-6816The code in Apache Tomcat 9.0.0.M1 to 9.0.0.M11, 8.5.0 to 8.5.6, ...
CVE-2016-6797The ResourceLinkFactory implementation in Apache Tomcat 9.0.0.M1 to ...
CVE-2016-6796A malicious web application running on Apache Tomcat 9.0.0.M1 to ...
CVE-2016-6794When a SecurityManager is configured, a web application's ability to ...
CVE-2016-6325The Tomcat package on Red Hat Enterprise Linux (RHEL) 5 through 7, ...
CVE-2016-5425The Tomcat package on Red Hat Enterprise Linux (RHEL) 7, Fedora, ...
CVE-2016-5018In Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to ...
CVE-2016-3092The MultipartStream class in Apache Commons Fileupload before 1.3.2, ...
CVE-2016-1240The Tomcat init script in the tomcat7 package before 7.0.56-3+deb8u4 ...
CVE-2016-0763The setGlobalContext method in ...
CVE-2016-0762The Realm implementations in Apache Tomcat versions 9.0.0.M1 to ...
CVE-2016-0714The session-persistence implementation in Apache Tomcat 6.x before ...
CVE-2016-0706Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.31, ...
CVE-2015-5351The (1) Manager and (2) Host Manager applications in Apache Tomcat 7.x ...
CVE-2015-5346Session fixation vulnerability in Apache Tomcat 7.x before 7.0.66, 8.x ...
CVE-2015-5345The Mapper component in Apache Tomcat 6.x before 6.0.45, 7.x before ...
CVE-2015-5174Directory traversal vulnerability in RequestUtil.java in Apache Tomcat ...
CVE-2014-7810The Expression Language (EL) implementation in Apache Tomcat 6.x ...
CVE-2014-0230Apache Tomcat 6.x before 6.0.44, 7.x before 7.0.55, and 8.x before ...
CVE-2014-0227java/org/apache/coyote/http11/filters/ChunkedInputFilter.java in ...
CVE-2014-0186A certain tomcat7 package for Apache Tomcat 7 in Red Hat Enterprise ...
CVE-2014-0119Apache Tomcat before 6.0.40, 7.x before 7.0.54, and 8.x before 8.0.6 ...
CVE-2014-0099Integer overflow in java/org/apache/tomcat/util/buf/Ascii.java in ...
CVE-2014-0096java/org/apache/catalina/servlets/DefaultServlet.java in the default ...
CVE-2014-0075Integer overflow in the parseChunkHeader function in ...
CVE-2014-0050MultipartStream.java in Apache Commons FileUpload before 1.3.1, as ...
CVE-2013-4444Unrestricted file upload vulnerability in Apache Tomcat 7.x before ...
CVE-2013-4322Apache Tomcat before 6.0.39, 7.x before 7.0.50, and 8.x before ...
CVE-2013-4286Apache Tomcat before 6.0.39, 7.x before 7.0.47, and 8.x before ...
CVE-2013-2071java/org/apache/catalina/core/AsyncContextImpl.java in Apache Tomcat ...
CVE-2013-2067java/org/apache/catalina/authenticator/FormAuthenticator.java in the ...
CVE-2013-2051The Tomcat 6 DIGEST authentication functionality as used in Red Hat ...
CVE-2013-1976The (1) tomcat5, (2) tomcat6, and (3) tomcat7 init scripts, as used in ...
CVE-2012-5887The HTTP Digest Access Authentication implementation in Apache Tomcat ...
CVE-2012-5886The HTTP Digest Access Authentication implementation in Apache Tomcat ...
CVE-2012-5885The replay-countermeasure functionality in the HTTP Digest Access ...
CVE-2012-4534org/apache/tomcat/util/net/NioEndpoint.java in Apache Tomcat 6.x ...
CVE-2012-4431org/apache/catalina/filters/CsrfPreventionFilter.java in Apache Tomcat ...
CVE-2012-3546org/apache/catalina/realm/RealmBase.java in Apache Tomcat 6.x before ...
CVE-2012-3544Apache Tomcat 6.x before 6.0.37 and 7.x before 7.0.30 does not ...
CVE-2012-2733java/org/apache/coyote/http11/InternalNioInputBuffer.java in the HTTP ...
CVE-2012-0022Apache Tomcat 5.5.x before 5.5.35, 6.x before 6.0.34, and 7.x before ...
CVE-2011-5064DigestAuthenticator.java in the HTTP Digest Access Authentication ...
CVE-2011-5063The HTTP Digest Access Authentication implementation in Apache Tomcat ...
CVE-2011-5062The HTTP Digest Access Authentication implementation in Apache Tomcat ...
CVE-2011-4858Apache Tomcat before 5.5.35, 6.x before 6.0.35, and 7.x before 7.0.23 ...
CVE-2011-3376org/apache/catalina/core/DefaultInstanceManager.java in Apache Tomcat ...
CVE-2011-3375Apache Tomcat 6.0.30 through 6.0.33 and 7.x before 7.0.22 does not ...
CVE-2011-3190Certain AJP protocol connector implementations in Apache Tomcat 7.0.0 ...
CVE-2011-2526Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before ...
CVE-2011-2481Apache Tomcat 7.0.x before 7.0.17 permits web applications to replace ...
CVE-2011-2204Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before ...
CVE-2011-1184The HTTP Digest Access Authentication implementation in Apache Tomcat ...

Security announcements

DSA / DLADescription
DLA-1108-1tomcat7 - security update
DSA-3892-1tomcat7 - security update
DLA-996-1tomcat7 - security update
DLA-924-2tomcat7 - regression update
DSA-3842-1tomcat7 - security update
DLA-924-1tomcat7 - security update
DSA-3787-2tomcat7 - regression update
DLA-823-2tomcat7 - regression update
DLA-823-1tomcat7 - security update
DSA-3787-1tomcat7 - security update
DLA-779-1tomcat7 - security update
DSA-3754-1tomcat7 - security update
DSA-3738-1tomcat7 - security update
DLA-753-1tomcat7 - security update
DLA-729-1tomcat7 - security update
DSA-3721-1tomcat7 - security update
DSA-3669-1tomcat7 - security update
DLA-623-1tomcat7 - security update
DSA-3614-1tomcat7 - security update
DLA-529-1tomcat7 - security update
DSA-3552-1tomcat7 - security update
DSA-3552-1tomcat7 - security update
DSA-3447-1tomcat7 - security update
DSA-3447-1tomcat7 - security update
DSA-2897-1tomcat7 - security update

Search for package or bug name: Reporting problems