Information on source package tomcat7

Available versions

ReleaseVersion
wheezy7.0.28-4+deb7u4
wheezy (security)7.0.28-4+deb7u10
jessie7.0.56-3+deb8u7
jessie (security)7.0.56-3+deb8u8
stretch7.0.75-1
sid7.0.75-1

Open issues

BugwheezyjessiestretchsidDescription
CVE-2013-4590vulnerable (no DSA)fixedfixedfixedApache Tomcat before 6.0.39, 7.x before 7.0.50, and 8.x before ...

Open unimportant issues

BugwheezyjessiestretchsidDescription
CVE-2016-5388vulnerablevulnerablefixedfixedApache Tomcat through 8.5.4, when the CGI Servlet is enabled, follows ...
CVE-2012-5568vulnerablevulnerablevulnerablevulnerableApache Tomcat through 7.0.x allows remote attackers to cause a denial ...

Resolved issues

BugDescription
TEMP-0840685-CEF76BTOCTOU race condition in initscript on chown'ing JVM_TMP temporary directory
CVE-2017-6056It was discovered that a programming error in the processing of HTTPS ...
CVE-2016-9775tomcat8: privilege escalation during package removal
CVE-2016-9774tomcat8: privilege escalation during package upgrade
CVE-2016-8745
CVE-2016-8735remote code execution
CVE-2016-6817denial of service
CVE-2016-6816information disclosure
CVE-2016-6797Apache Tomcat Unrestricted Access to Global Resources
CVE-2016-6796Apache Tomcat Security Manager Bypass
CVE-2016-6794Apache Tomcat System Property Disclosure
CVE-2016-6325The Tomcat package on Red Hat Enterprise Linux (RHEL) 5 through 7, ...
CVE-2016-5425The Tomcat package on Red Hat Enterprise Linux (RHEL) 7, Fedora, ...
CVE-2016-5018Apache Tomcat Security Manager Bypass
CVE-2016-3092The MultipartStream class in Apache Commons Fileupload before 1.3.2, ...
CVE-2016-1240The Tomcat init script in the tomcat7 package before 7.0.56-3+deb8u4 ...
CVE-2016-0763The setGlobalContext method in ...
CVE-2016-0762Apache Tomcat Realm Timing Attack
CVE-2016-0714The session-persistence implementation in Apache Tomcat 6.x before ...
CVE-2016-0706Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.31, ...
CVE-2015-5351The (1) Manager and (2) Host Manager applications in Apache Tomcat 7.x ...
CVE-2015-5346Session fixation vulnerability in Apache Tomcat 7.x before 7.0.66, 8.x ...
CVE-2015-5345The Mapper component in Apache Tomcat 6.x before 6.0.45, 7.x before ...
CVE-2015-5174Directory traversal vulnerability in RequestUtil.java in Apache Tomcat ...
CVE-2014-7810The Expression Language (EL) implementation in Apache Tomcat 6.x ...
CVE-2014-0230Apache Tomcat 6.x before 6.0.44, 7.x before 7.0.55, and 8.x before ...
CVE-2014-0227java/org/apache/coyote/http11/filters/ChunkedInputFilter.java in ...
CVE-2014-0186A certain tomcat7 package for Apache Tomcat 7 in Red Hat Enterprise ...
CVE-2014-0119Apache Tomcat before 6.0.40, 7.x before 7.0.54, and 8.x before 8.0.6 ...
CVE-2014-0099Integer overflow in java/org/apache/tomcat/util/buf/Ascii.java in ...
CVE-2014-0096java/org/apache/catalina/servlets/DefaultServlet.java in the default ...
CVE-2014-0075Integer overflow in the parseChunkHeader function in ...
CVE-2014-0050MultipartStream.java in Apache Commons FileUpload before 1.3.1, as ...
CVE-2013-4444Unrestricted file upload vulnerability in Apache Tomcat 7.x before ...
CVE-2013-4322Apache Tomcat before 6.0.39, 7.x before 7.0.50, and 8.x before ...
CVE-2013-4286Apache Tomcat before 6.0.39, 7.x before 7.0.47, and 8.x before ...
CVE-2013-2071java/org/apache/catalina/core/AsyncContextImpl.java in Apache Tomcat ...
CVE-2013-2067java/org/apache/catalina/authenticator/FormAuthenticator.java in the ...
CVE-2013-2051The Tomcat 6 DIGEST authentication functionality as used in Red Hat ...
CVE-2013-1976The (1) tomcat5, (2) tomcat6, and (3) tomcat7 init scripts, as used in ...
CVE-2012-5887The HTTP Digest Access Authentication implementation in Apache Tomcat ...
CVE-2012-5886The HTTP Digest Access Authentication implementation in Apache Tomcat ...
CVE-2012-5885The replay-countermeasure functionality in the HTTP Digest Access ...
CVE-2012-4534org/apache/tomcat/util/net/NioEndpoint.java in Apache Tomcat 6.x ...
CVE-2012-4431org/apache/catalina/filters/CsrfPreventionFilter.java in Apache Tomcat ...
CVE-2012-3546org/apache/catalina/realm/RealmBase.java in Apache Tomcat 6.x before ...
CVE-2012-3544Apache Tomcat 6.x before 6.0.37 and 7.x before 7.0.30 does not ...
CVE-2012-2733java/org/apache/coyote/http11/InternalNioInputBuffer.java in the HTTP ...
CVE-2012-0022Apache Tomcat 5.5.x before 5.5.35, 6.x before 6.0.34, and 7.x before ...
CVE-2011-5064DigestAuthenticator.java in the HTTP Digest Access Authentication ...
CVE-2011-5063The HTTP Digest Access Authentication implementation in Apache Tomcat ...
CVE-2011-5062The HTTP Digest Access Authentication implementation in Apache Tomcat ...
CVE-2011-4858Apache Tomcat before 5.5.35, 6.x before 6.0.35, and 7.x before 7.0.23 ...
CVE-2011-3376org/apache/catalina/core/DefaultInstanceManager.java in Apache Tomcat ...
CVE-2011-3375Apache Tomcat 6.0.30 through 6.0.33 and 7.x before 7.0.22 does not ...
CVE-2011-3190Certain AJP protocol connector implementations in Apache Tomcat 7.0.0 ...
CVE-2011-2526Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before ...
CVE-2011-2481Apache Tomcat 7.0.x before 7.0.17 permits web applications to replace ...
CVE-2011-2204Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before ...
CVE-2011-1184The HTTP Digest Access Authentication implementation in Apache Tomcat ...

Security announcements

DSA / DLADescription
DLA-823-1tomcat7 - security update
DSA-3787-1tomcat7 - security update
DLA-779-1tomcat7 - security update
DSA-3754-1tomcat7 - security update
DSA-3738-1tomcat7 - security update
DLA-753-1tomcat7 - security update
DLA-729-1tomcat7 - security update
DSA-3721-1tomcat7 - security update
DSA-3669-1tomcat7 - security update
DLA-623-1tomcat7 - security update
DSA-3614-1tomcat7 - security update
DLA-529-1tomcat7 - security update
DSA-3552-1tomcat7 - security update
DSA-3552-1tomcat7 - security update
DSA-3447-1tomcat7 - security update
DSA-3447-1tomcat7 - security update
DSA-2897-1tomcat7 - security update

Search for package or bug name: Reporting problems