6.8 - DSA-3552

Executive Summary

This Alert is flagged as TOP 25 Common Weakness Enumeration from CWE/SANS. For more information, you can read this.

Summary
Title	tomcat7 security update

Informations
Name	DSA-3552	First vendor Publication	2016-04-17
Vendor	Debian	Last vendor Modification	2016-04-17
Severity (Vendor)	N/A	Revision	1

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score	NA
Base Score	NA	Environmental Score	NA
impact SubScore	NA	Temporal Score	NA
Exploitabality Sub Score	NA

Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:M/Au:N/C:P/I:P/A:P)
Cvss Base Score	6.8	Attack Range	Network
Cvss Impact Score	6.4	Attack Complexity	Medium
Cvss Expoit Score	8.6	Authentication	None Required
Calculate full CVSS 2.0 Vectors scores

Detail

Multiple security vulnerabilities have been discovered in the Tomcat servlet and JSP engine, which may result in information disclosure, the bypass of CSRF protections and bypass of the SecurityManager.

For the oldstable distribution (wheezy), these problems have been fixed in version 7.0.28-4+deb7u4. This update also fixes CVE-2014-0119 and CVE-2014-0096.

For the stable distribution (jessie), these problems have been fixed in version 7.0.56-3+deb8u2.

For the testing distribution (stretch), these problems have been fixed in version 7.0.68-1.

For the unstable distribution (sid), these problems have been fixed in version 7.0.68-1.

We recommend that you upgrade your tomcat7 packages.

Original Source

Url : http://www.debian.org/security/2016/dsa-3552

CWE : Common Weakness Enumeration

%	Id	Name
50 %	CWE-264	Permissions, Privileges, and Access Controls
25 %	CWE-22	Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE/SANS Top 25)
12 %	CWE-352	Cross-Site Request Forgery (CSRF) (CWE/SANS Top 25)
12 %	CWE-200	Information Exposure

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:24046

Oval ID:	oval:org.mitre.oval:def:24046
Title:	DEPRECATED: ELSA-2014:0246: gnutls security update (Important)
Description:	The GnuTLS library provides support for cryptographic algorithms and for protocols such as Transport Layer Security (TLS). It was discovered that GnuTLS did not correctly handle certain errors that could occur during the verification of an X.509 certificate, causing it to incorrectly report a successful verification. An attacker could use this flaw to create a specially crafted certificate that could be accepted by GnuTLS as valid for a site chosen by the attacker. (CVE-2014-0092) The CVE-2014-0092 issue was discovered by Nikos Mavrogiannopoulos of the Red Hat Security Technologies Team. Users of GnuTLS are advised to upgrade to these updated packages, which correct this issue. For the update to take effect, all applications linked to the GnuTLS library must be restarted.
Family:	unix	Class:	patch
Reference(s):	ELSA-2014:0246-01 CVE-2014-0096	Version:	6
Platform(s):	Oracle Linux 6	Product(s):	gnutls
Definition Synopsis:
Oracle Linux 6.x rpm test gnutls-guile is earlier than 0:2.8.5-13.el6_5 AND gnutls-utils is earlier than 0:2.8.5-13.el6_5 AND gnutls-devel is earlier than 0:2.8.5-13.el6_5 AND gnutls is earlier than 0:2.8.5-13.el6_5

Definition Id: oval:org.mitre.oval:def:26183

Oval ID:	oval:org.mitre.oval:def:26183
Title:	RHSA-2014:1034: tomcat security update (Low)
Description:	Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies. It was found that, in certain circumstances, it was possible for a malicious web application to replace the XML parsers used by Apache Tomcat to process XSLTs for the default servlet, JSP documents, tag library descriptors (TLDs), and tag plug-in configuration files. The injected XML parser(s) could then bypass the limits imposed on XML external entities and/or gain access to the XML files processed for other web applications deployed on the same Apache Tomcat instance. (CVE-2014-0119) All Tomcat users are advised to upgrade to these updated packages, which contain a backported patch to correct this issue. Tomcat must be restarted for this update to take effect.
Family:	unix	Class:	patch
Reference(s):	RHSA-2014:1034-00 CESA-2014:1034 CVE-2014-0119	Version:	3
Platform(s):	Red Hat Enterprise Linux 7 CentOS Linux 7	Product(s):	tomcat
Definition Synopsis:
Redhat 7 or Centos 7 release The operating system installed on the system is Red Hat Enterprise Linux 7 AND The operating system installed on the system is CentOS Linux 7.x Packages section tomcat is earlier than 0:7.0.42-8.el7_0 AND tomcat-admin-webapps is earlier than 0:7.0.42-8.el7_0 AND tomcat-docs-webapp is earlier than 0:7.0.42-8.el7_0 AND tomcat-el-2.2-api is earlier than 0:7.0.42-8.el7_0 AND tomcat-javadoc is earlier than 0:7.0.42-8.el7_0 AND tomcat-jsp-2.2-api is earlier than 0:7.0.42-8.el7_0 AND tomcat-jsvc is earlier than 0:7.0.42-8.el7_0 AND tomcat-lib is earlier than 0:7.0.42-8.el7_0 AND tomcat-servlet-3.0-api is earlier than 0:7.0.42-8.el7_0 AND tomcat-webapps is earlier than 0:7.0.42-8.el7_0

Definition Id: oval:org.mitre.oval:def:26374

Oval ID:	oval:org.mitre.oval:def:26374
Title:	RHSA-2014:1038: tomcat6 security update (Low)
Description:	Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies. It was found that several application-provided XML files, such as web.xml, content.xml, .tld, .tagx, and *.jspx, resolved external entities, permitting XML External Entity (XXE) attacks. An attacker able to deploy malicious applications to Tomcat could use this flaw to circumvent security restrictions set by the JSM, and gain access to sensitive information on the system. Note that this flaw only affected deployments in which Tomcat is running applications from untrusted sources, such as in a shared hosting environment. (CVE-2013-4590) It was found that, in certain circumstances, it was possible for a malicious web application to replace the XML parsers used by Apache Tomcat to process XSLTs for the default servlet, JSP documents, tag library descriptors (TLDs), and tag plug-in configuration files. The injected XML parser(s) could then bypass the limits imposed on XML external entities and/or gain access to the XML files processed for other web applications deployed on the same Apache Tomcat instance. (CVE-2014-0119) All Tomcat users are advised to upgrade to these updated packages, which contain backported patches to correct these issues. Tomcat must be restarted for this update to take effect.
Family:	unix	Class:	patch
Reference(s):	RHSA-2014:1038-00 CESA-2014:1038 CVE-2013-4590 CVE-2014-0119	Version:	3
Platform(s):	Red Hat Enterprise Linux 6 CentOS Linux 6	Product(s):	tomcat6
Definition Synopsis:
Redhat 6 or Centos 6 release The operating system installed on the system is Red Hat Enterprise Linux 6 AND The operating system installed on the system is CentOS Linux 6.x Packages section tomcat6 is earlier than 0:6.0.24-78.el6_5 AND tomcat6-admin-webapps is earlier than 0:6.0.24-78.el6_5 AND tomcat6-docs-webapp is earlier than 0:6.0.24-78.el6_5 AND tomcat6-el-2.1-api is earlier than 0:6.0.24-78.el6_5 AND tomcat6-javadoc is earlier than 0:6.0.24-78.el6_5 AND tomcat6-jsp-2.1-api is earlier than 0:6.0.24-78.el6_5 AND tomcat6-lib is earlier than 0:6.0.24-78.el6_5 AND tomcat6-servlet-2.5-api is earlier than 0:6.0.24-78.el6_5 AND tomcat6-webapps is earlier than 0:6.0.24-78.el6_5

Definition Id: oval:org.mitre.oval:def:27179

Oval ID:	oval:org.mitre.oval:def:27179
Title:	ELSA-2014-1034 -- tomcat security update (low)
Description:	[0:7.0.42-8] - Resolves: CVE-2013-4590 - Resolves: CVE-2014-0119
Family:	unix	Class:	patch
Reference(s):	ELSA-2014-1034 CVE-2014-0119	Version:	3
Platform(s):	Oracle Linux 7	Product(s):	tomcat
Definition Synopsis:
Oracle Linux 7.x Packages match section tomcat is earlier than 0:7.0.42-8.el7_0 AND tomcat-admin-webapps is earlier than 0:7.0.42-8.el7_0 AND tomcat-docs-webapp is earlier than 0:7.0.42-8.el7_0 AND tomcat-el-2.2-api is earlier than 0:7.0.42-8.el7_0 AND tomcat-javadoc is earlier than 0:7.0.42-8.el7_0 AND tomcat-jsp-2.2-api is earlier than 0:7.0.42-8.el7_0 AND tomcat-jsvc is earlier than 0:7.0.42-8.el7_0 AND tomcat-lib is earlier than 0:7.0.42-8.el7_0 AND tomcat-servlet-3.0-api is earlier than 0:7.0.42-8.el7_0 AND tomcat-webapps is earlier than 0:7.0.42-8.el7_0

CPE : Common Platform Enumeration

Type	Description	Count
Application	Apache Tomcat cpe:2.3:a:apache:tomcat:9.0.0:milestone1:::::: cpe:2.3:a:apache:tomcat:8.0.5:::::::* cpe:2.3:a:apache:tomcat:8.0.30:::::::* cpe:2.3:a:apache:tomcat:8.0.3:::::::* cpe:2.3:a:apache:tomcat:8.0.29:::::::* cpe:2.3:a:apache:tomcat:8.0.28:::::::* cpe:2.3:a:apache:tomcat:8.0.27:::::::* cpe:2.3:a:apache:tomcat:8.0.26:::::::* cpe:2.3:a:apache:tomcat:8.0.24:::::::* cpe:2.3:a:apache:tomcat:8.0.23:::::::* cpe:2.3:a:apache:tomcat:8.0.22:::::::* cpe:2.3:a:apache:tomcat:8.0.21:::::::* cpe:2.3:a:apache:tomcat:8.0.20:::::::* cpe:2.3:a:apache:tomcat:8.0.18:::::::* cpe:2.3:a:apache:tomcat:8.0.17:::::::* cpe:2.3:a:apache:tomcat:8.0.15:::::::* cpe:2.3:a:apache:tomcat:8.0.14:::::::* cpe:2.3:a:apache:tomcat:8.0.12:::::::* cpe:2.3:a:apache:tomcat:8.0.11:::::::* cpe:2.3:a:apache:tomcat:8.0.1:::::::* cpe:2.3:a:apache:tomcat:8.0.0:rc1:::::: cpe:2.3:a:apache:tomcat:8.0.0:rc5:::::: cpe:2.3:a:apache:tomcat:8.0.0:rc3:::::: cpe:2.3:a:apache:tomcat:8.0.0:rc10:::::: cpe:2.3:a:apache:tomcat:8.0.0:rc2:::::: cpe:2.3:a:apache:tomcat:7.0.9:::::::* cpe:2.3:a:apache:tomcat:7.0.8:::::::* cpe:2.3:a:apache:tomcat:7.0.7:::::::* cpe:2.3:a:apache:tomcat:7.0.67:::::::* cpe:2.3:a:apache:tomcat:7.0.65:::::::* cpe:2.3:a:apache:tomcat:7.0.64:::::::* cpe:2.3:a:apache:tomcat:7.0.63:::::::* cpe:2.3:a:apache:tomcat:7.0.62:::::::* cpe:2.3:a:apache:tomcat:7.0.61:::::::* cpe:2.3:a:apache:tomcat:7.0.6:::::::* cpe:2.3:a:apache:tomcat:7.0.59:::::::* cpe:2.3:a:apache:tomcat:7.0.57:::::::* cpe:2.3:a:apache:tomcat:7.0.56:::::::* cpe:2.3:a:apache:tomcat:7.0.55:::::::* cpe:2.3:a:apache:tomcat:7.0.54:::::::* cpe:2.3:a:apache:tomcat:7.0.53:::::::* cpe:2.3:a:apache:tomcat:7.0.52:::::::* cpe:2.3:a:apache:tomcat:7.0.50:::::::* cpe:2.3:a:apache:tomcat:7.0.5:beta:::::: cpe:2.3:a:apache:tomcat:7.0.5:::::::* cpe:2.3:a:apache:tomcat:7.0.49:::::::* cpe:2.3:a:apache:tomcat:7.0.48:::::::* cpe:2.3:a:apache:tomcat:7.0.47:::::::* cpe:2.3:a:apache:tomcat:7.0.46:::::::* cpe:2.3:a:apache:tomcat:7.0.45:::::::* cpe:2.3:a:apache:tomcat:7.0.44:::::::* cpe:2.3:a:apache:tomcat:7.0.43:::::::* cpe:2.3:a:apache:tomcat:7.0.42:::::::* cpe:2.3:a:apache:tomcat:7.0.41:::::::* cpe:2.3:a:apache:tomcat:7.0.40:::::::* cpe:2.3:a:apache:tomcat:7.0.4:beta:::::: cpe:2.3:a:apache:tomcat:7.0.4:::::::* cpe:2.3:a:apache:tomcat:7.0.39:::::::* cpe:2.3:a:apache:tomcat:7.0.38:::::::* cpe:2.3:a:apache:tomcat:7.0.37:::::::* cpe:2.3:a:apache:tomcat:7.0.36:::::::* cpe:2.3:a:apache:tomcat:7.0.35:::::::* cpe:2.3:a:apache:tomcat:7.0.34:::::::* cpe:2.3:a:apache:tomcat:7.0.33:::::::* cpe:2.3:a:apache:tomcat:7.0.32:::::::* cpe:2.3:a:apache:tomcat:7.0.31:::::::* cpe:2.3:a:apache:tomcat:7.0.30:::::::* cpe:2.3:a:apache:tomcat:7.0.3:::::::* cpe:2.3:a:apache:tomcat:7.0.29:::::::* cpe:2.3:a:apache:tomcat:7.0.28:::::::* cpe:2.3:a:apache:tomcat:7.0.27:::::::* cpe:2.3:a:apache:tomcat:7.0.26:::::::* cpe:2.3:a:apache:tomcat:7.0.25:::::::* cpe:2.3:a:apache:tomcat:7.0.24:::::::* cpe:2.3:a:apache:tomcat:7.0.23:::::::* cpe:2.3:a:apache:tomcat:7.0.22:::::::* cpe:2.3:a:apache:tomcat:7.0.21:::::::* cpe:2.3:a:apache:tomcat:7.0.20:::::::* cpe:2.3:a:apache:tomcat:7.0.2:beta:::::: cpe:2.3:a:apache:tomcat:7.0.2:::::::* cpe:2.3:a:apache:tomcat:7.0.19:::::::* cpe:2.3:a:apache:tomcat:7.0.18:::::::* cpe:2.3:a:apache:tomcat:7.0.17:::::::* cpe:2.3:a:apache:tomcat:7.0.16:::::::* cpe:2.3:a:apache:tomcat:7.0.15:::::::* cpe:2.3:a:apache:tomcat:7.0.14:::::::* cpe:2.3:a:apache:tomcat:7.0.13:::::::* cpe:2.3:a:apache:tomcat:7.0.12:::::::* cpe:2.3:a:apache:tomcat:7.0.11:::::::* cpe:2.3:a:apache:tomcat:7.0.10:::::::* cpe:2.3:a:apache:tomcat:7.0.1:::::::* cpe:2.3:a:apache:tomcat:7.0.0:beta:::::: cpe:2.3:a:apache:tomcat:7.0.0:::::::* cpe:2.3:a:apache:tomcat:6.0.9:::::::* cpe:2.3:a:apache:tomcat:6.0.9:beta:::::: cpe:2.3:a:apache:tomcat:6.0.8:::::::* cpe:2.3:a:apache:tomcat:6.0.8:alpha:::::: cpe:2.3:a:apache:tomcat:6.0.7:::::::* cpe:2.3:a:apache:tomcat:6.0.7:alpha:::::: cpe:2.3:a:apache:tomcat:6.0.7:beta:::::: cpe:2.3:a:apache:tomcat:6.0.6:::::::* cpe:2.3:a:apache:tomcat:6.0.6:alpha:::::: cpe:2.3:a:apache:tomcat:6.0.5:::::::* cpe:2.3:a:apache:tomcat:6.0.44:::::::* cpe:2.3:a:apache:tomcat:6.0.43:::::::* cpe:2.3:a:apache:tomcat:6.0.41:::::::* cpe:2.3:a:apache:tomcat:6.0.4:::::::* cpe:2.3:a:apache:tomcat:6.0.4:alpha:::::: cpe:2.3:a:apache:tomcat:6.0.39:::::::* cpe:2.3:a:apache:tomcat:6.0.38:::::::* cpe:2.3:a:apache:tomcat:6.0.37:::::::* cpe:2.3:a:apache:tomcat:6.0.36:::::::* cpe:2.3:a:apache:tomcat:6.0.35:::::::* cpe:2.3:a:apache:tomcat:6.0.34:::::::* cpe:2.3:a:apache:tomcat:6.0.33:::::::* cpe:2.3:a:apache:tomcat:6.0.32:::::::* cpe:2.3:a:apache:tomcat:6.0.31:::::::* cpe:2.3:a:apache:tomcat:6.0.30:::::::* cpe:2.3:a:apache:tomcat:6.0.3:::::::* cpe:2.3:a:apache:tomcat:6.0.29:::::::* cpe:2.3:a:apache:tomcat:6.0.28:::::::* cpe:2.3:a:apache:tomcat:6.0.27:::::::* cpe:2.3:a:apache:tomcat:6.0.26:::::::* cpe:2.3:a:apache:tomcat:6.0.25:::::::* cpe:2.3:a:apache:tomcat:6.0.24:::::::* cpe:2.3:a:apache:tomcat:6.0.23:::::::* cpe:2.3:a:apache:tomcat:6.0.22:::::::* cpe:2.3:a:apache:tomcat:6.0.21:::::::* cpe:2.3:a:apache:tomcat:6.0.20:::::::* cpe:2.3:a:apache:tomcat:6.0.2:::::::* cpe:2.3:a:apache:tomcat:6.0.2:alpha:::::: cpe:2.3:a:apache:tomcat:6.0.2:beta:::::: cpe:2.3:a:apache:tomcat:6.0.19:::::::* cpe:2.3:a:apache:tomcat:6.0.18:::::::* cpe:2.3:a:apache:tomcat:6.0.17:::::::* cpe:2.3:a:apache:tomcat:6.0.16:::::::* cpe:2.3:a:apache:tomcat:6.0.15:::::::* cpe:2.3:a:apache:tomcat:6.0.14:::::::* cpe:2.3:a:apache:tomcat:6.0.13:::::::* cpe:2.3:a:apache:tomcat:6.0.12:::::::* cpe:2.3:a:apache:tomcat:6.0.11:::::::* cpe:2.3:a:apache:tomcat:6.0.10:::::::* cpe:2.3:a:apache:tomcat:6.0.1:::::::* cpe:2.3:a:apache:tomcat:6.0.1:alpha:::::: cpe:2.3:a:apache:tomcat:6.0.0:::::::* cpe:2.3:a:apache:tomcat:6.0.0:alpha:::::: cpe:2.3:a:apache:tomcat:6.0:::::::* cpe:2.3:a:apache:tomcat:6:::::::* cpe:2.3:a:apache:tomcat:5.5.9:::::::* cpe:2.3:a:apache:tomcat:5.5.8:::::::* cpe:2.3:a:apache:tomcat:5.5.7:::::::* cpe:2.3:a:apache:tomcat:5.5.6:::::::* cpe:2.3:a:apache:tomcat:5.5.5:::::::* cpe:2.3:a:apache:tomcat:5.5.4:::::::* cpe:2.3:a:apache:tomcat:5.5.35:::::::* cpe:2.3:a:apache:tomcat:5.5.34:::::::* cpe:2.3:a:apache:tomcat:5.5.33:::::::* cpe:2.3:a:apache:tomcat:5.5.32:::::::* cpe:2.3:a:apache:tomcat:5.5.31:::::::* cpe:2.3:a:apache:tomcat:5.5.30:::::::* cpe:2.3:a:apache:tomcat:5.5.3:::::::* cpe:2.3:a:apache:tomcat:5.5.29:::::::* cpe:2.3:a:apache:tomcat:5.5.28:::::::* cpe:2.3:a:apache:tomcat:5.5.27:::::::* cpe:2.3:a:apache:tomcat:5.5.26:::::::* cpe:2.3:a:apache:tomcat:5.5.25:::::::* cpe:2.3:a:apache:tomcat:5.5.24:::::::* cpe:2.3:a:apache:tomcat:5.5.23:::::::* cpe:2.3:a:apache:tomcat:5.5.22:::::::* cpe:2.3:a:apache:tomcat:5.5.21:::::::* cpe:2.3:a:apache:tomcat:5.5.20:::::::* cpe:2.3:a:apache:tomcat:5.5.2:::::::* cpe:2.3:a:apache:tomcat:5.5.19:::::::* cpe:2.3:a:apache:tomcat:5.5.18:::::::* cpe:2.3:a:apache:tomcat:5.5.17:::::::* cpe:2.3:a:apache:tomcat:5.5.16:::::::* cpe:2.3:a:apache:tomcat:5.5.15:::::::* cpe:2.3:a:apache:tomcat:5.5.14:::::::* cpe:2.3:a:apache:tomcat:5.5.13:::::::* cpe:2.3:a:apache:tomcat:5.5.12:::::::* cpe:2.3:a:apache:tomcat:5.5.11:::::::* cpe:2.3:a:apache:tomcat:5.5.10:::::::* cpe:2.3:a:apache:tomcat:5.5.1:::::::* cpe:2.3:a:apache:tomcat:5.5.0:::::::* cpe:2.3:a:apache:tomcat:5.0.9:::::::* cpe:2.3:a:apache:tomcat:5.0.8:::::::* cpe:2.3:a:apache:tomcat:5.0.7:::::::* cpe:2.3:a:apache:tomcat:5.0.6:::::::* cpe:2.3:a:apache:tomcat:5.0.5:::::::* cpe:2.3:a:apache:tomcat:5.0.4:::::::* cpe:2.3:a:apache:tomcat:5.0.30:::::::* cpe:2.3:a:apache:tomcat:5.0.3:::::::* cpe:2.3:a:apache:tomcat:5.0.29:::::::* cpe:2.3:a:apache:tomcat:5.0.28:::::::* cpe:2.3:a:apache:tomcat:5.0.27:::::::* cpe:2.3:a:apache:tomcat:5.0.26:::::::* cpe:2.3:a:apache:tomcat:5.0.25:::::::* cpe:2.3:a:apache:tomcat:5.0.24:::::::* cpe:2.3:a:apache:tomcat:5.0.23:::::::* cpe:2.3:a:apache:tomcat:5.0.22:::::::* cpe:2.3:a:apache:tomcat:5.0.21:::::::* cpe:2.3:a:apache:tomcat:5.0.2:::::::* cpe:2.3:a:apache:tomcat:5.0.19:::::::* cpe:2.3:a:apache:tomcat:5.0.18:::::::* cpe:2.3:a:apache:tomcat:5.0.17:::::::* cpe:2.3:a:apache:tomcat:5.0.16:::::::* cpe:2.3:a:apache:tomcat:5.0.15:::::::* cpe:2.3:a:apache:tomcat:5.0.14:::::::* cpe:2.3:a:apache:tomcat:5.0.13:::::::* cpe:2.3:a:apache:tomcat:5.0.12:::::::* cpe:2.3:a:apache:tomcat:5.0.11:::::::* cpe:2.3:a:apache:tomcat:5.0.10:::::::* cpe:2.3:a:apache:tomcat:5.0.1:::::::* cpe:2.3:a:apache:tomcat:5.0.0:::::::* cpe:2.3:a:apache:tomcat:5:::::::* cpe:2.3:a:apache:tomcat:4.1.9:beta:::::: cpe:2.3:a:apache:tomcat:4.1.9:::::::* cpe:2.3:a:apache:tomcat:4.1.8:::::::* cpe:2.3:a:apache:tomcat:4.1.7:::::::* cpe:2.3:a:apache:tomcat:4.1.6:::::::* cpe:2.3:a:apache:tomcat:4.1.5:::::::* cpe:2.3:a:apache:tomcat:4.1.40:::::::* cpe:2.3:a:apache:tomcat:4.1.4:::::::* cpe:2.3:a:apache:tomcat:4.1.39:::::::* cpe:2.3:a:apache:tomcat:4.1.38:::::::* cpe:2.3:a:apache:tomcat:4.1.37:::::::* cpe:2.3:a:apache:tomcat:4.1.36:::::::* cpe:2.3:a:apache:tomcat:4.1.35:::::::* cpe:2.3:a:apache:tomcat:4.1.34:::::::* cpe:2.3:a:apache:tomcat:4.1.33:::::::* cpe:2.3:a:apache:tomcat:4.1.32:::::::* cpe:2.3:a:apache:tomcat:4.1.31:::::::* cpe:2.3:a:apache:tomcat:4.1.30:::::::* cpe:2.3:a:apache:tomcat:4.1.3:::::::* cpe:2.3:a:apache:tomcat:4.1.3:beta:::::: cpe:2.3:a:apache:tomcat:4.1.29:::::::* cpe:2.3:a:apache:tomcat:4.1.29:alpha:::::: cpe:2.3:a:apache:tomcat:4.1.28:::::::* cpe:2.3:a:apache:tomcat:4.1.28:alpha:::::: cpe:2.3:a:apache:tomcat:4.1.27:::::::* cpe:2.3:a:apache:tomcat:4.1.26:::::::* cpe:2.3:a:apache:tomcat:4.1.25:::::::* cpe:2.3:a:apache:tomcat:4.1.24:::::::* cpe:2.3:a:apache:tomcat:4.1.23:::::::* cpe:2.3:a:apache:tomcat:4.1.22:::::::* cpe:2.3:a:apache:tomcat:4.1.21:::::::* cpe:2.3:a:apache:tomcat:4.1.20:::::::* cpe:2.3:a:apache:tomcat:4.1.2:::::::* cpe:2.3:a:apache:tomcat:4.1.19:::::::* cpe:2.3:a:apache:tomcat:4.1.18:::::::* cpe:2.3:a:apache:tomcat:4.1.17:::::::* cpe:2.3:a:apache:tomcat:4.1.16:::::::* cpe:2.3:a:apache:tomcat:4.1.15:::::::* cpe:2.3:a:apache:tomcat:4.1.14:::::::* cpe:2.3:a:apache:tomcat:4.1.13:::::::* cpe:2.3:a:apache:tomcat:4.1.12:::::::* cpe:2.3:a:apache:tomcat:4.1.11:::::::* cpe:2.3:a:apache:tomcat:4.1.10:::::::* cpe:2.3:a:apache:tomcat:4.1.1:::::::* cpe:2.3:a:apache:tomcat:4.1.0:::::::* cpe:2.3:a:apache:tomcat:4.0.6:::::::* cpe:2.3:a:apache:tomcat:4.0.5:::::::* cpe:2.3:a:apache:tomcat:4.0.4:::::::* cpe:2.3:a:apache:tomcat:4.0.3:::::::* cpe:2.3:a:apache:tomcat:4.0.2:::::::* cpe:2.3:a:apache:tomcat:4.0.1:::::::* cpe:2.3:a:apache:tomcat:4.0.0:::::::* cpe:2.3:a:apache:tomcat:4:::::::* cpe:2.3:a:apache:tomcat:3.3.2:::::::* cpe:2.3:a:apache:tomcat:3.3.1a:::::::* cpe:2.3:a:apache:tomcat:3.3.1:::::::* cpe:2.3:a:apache:tomcat:3.3:::::::* cpe:2.3:a:apache:tomcat:3.2.4:::::::* cpe:2.3:a:apache:tomcat:3.2.3:::::::* cpe:2.3:a:apache:tomcat:3.2.2:::::::* cpe:2.3:a:apache:tomcat:3.2.2:beta2:::::: cpe:2.3:a:apache:tomcat:3.2.1:::::::* cpe:2.3:a:apache:tomcat:3.2:::::::* cpe:2.3:a:apache:tomcat:3.1.1:::::::* cpe:2.3:a:apache:tomcat:3.1:::::::* cpe:2.3:a:apache:tomcat:3.0:::::::* cpe:2.3:a:apache:tomcat:1.1.3:::::::* cpe:2.3:a:apache:tomcat:::::::: cpe:2.3:a:apache:tomcat:-:::::::*	284
Os	Canonical Ubuntu Linux cpe:2.3:o:canonical:ubuntu_linux:16.04::::lts::: cpe:2.3:o:canonical:ubuntu_linux:15.10:::::::* cpe:2.3:o:canonical:ubuntu_linux:14.04::::lts::: cpe:2.3:o:canonical:ubuntu_linux:12.04::::lts:::	4
Os	Debian Debian Linux cpe:2.3:o:debian:debian_linux:8.0:::::::* cpe:2.3:o:debian:debian_linux:7.0:::::::*	2

Information Assurance Vulnerability Management (IAVM)

Date	Description
2015-06-25	IAVM : 2015-B-0083 - Multiple Vulnerabilities in IBM Storwize V7000 Unified Severity : Category I - VMSKEY : V0060983
2014-05-29	IAVM : 2014-B-0063 - Multiple Vulnerabilities in Apache Tomcat Severity : Category I - VMSKEY : V0051613

Nessus® Vulnerability Scanner

Date	Description
2018-03-21	Name : The remote device is affected by multiple vulnerabilities. File : juniper_space_jsa_10838.nasl - Type : ACT_GATHER_INFO
2018-03-06	Name : The remote device is missing a vendor-supplied security patch. File : f5_bigip_SOL58084500.nasl - Type : ACT_GATHER_INFO
2018-03-06	Name : The remote device is missing a vendor-supplied security patch. File : f5_bigip_SOL34341852.nasl - Type : ACT_GATHER_INFO
2018-03-06	Name : The remote device is missing a vendor-supplied security patch. File : f5_bigip_SOL18174924.nasl - Type : ACT_GATHER_INFO
2017-05-18	Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-201705-09.nasl - Type : ACT_GATHER_INFO
2017-05-01	Name : The remote EulerOS host is missing multiple security updates. File : EulerOS_SA-2016-1054.nasl - Type : ACT_GATHER_INFO
2017-05-01	Name : The remote EulerOS host is missing multiple security updates. File : EulerOS_SA-2016-1049.nasl - Type : ACT_GATHER_INFO
2017-02-28	Name : The remote device is missing a vendor-supplied security patch. File : f5_bigip_SOL30971148.nasl - Type : ACT_GATHER_INFO
2017-01-25	Name : A web application running on the remote host is affected by multiple vulnerab... File : mysql_enterprise_monitor_3_2_2_1075.nasl - Type : ACT_GATHER_INFO
2017-01-25	Name : A web application running on the remote host is affected by multiple vulnerab... File : mysql_enterprise_monitor_3_1_5_7958.nasl - Type : ACT_GATHER_INFO
2016-12-20	Name : The remote Debian host is missing a security update. File : debian_DLA-753.nasl - Type : ACT_GATHER_INFO
2016-12-15	Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20161103_tomcat_on_SL7_x.nasl - Type : ACT_GATHER_INFO
2016-11-28	Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2016-2599.nasl - Type : ACT_GATHER_INFO
2016-11-21	Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2016-2807.nasl - Type : ACT_GATHER_INFO
2016-11-11	Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2016-2599.nasl - Type : ACT_GATHER_INFO
2016-11-04	Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2016-2599.nasl - Type : ACT_GATHER_INFO
2016-10-12	Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20161010_tomcat_on_SL7_x.nasl - Type : ACT_GATHER_INFO
2016-10-12	Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20161010_tomcat6_on_SL6_x.nasl - Type : ACT_GATHER_INFO
2016-10-12	Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2016-2046.nasl - Type : ACT_GATHER_INFO
2016-10-12	Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2016-2045.nasl - Type : ACT_GATHER_INFO
2016-10-11	Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2016-2045.nasl - Type : ACT_GATHER_INFO
2016-10-11	Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2016-2045.nasl - Type : ACT_GATHER_INFO
2016-10-11	Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2016-2046.nasl - Type : ACT_GATHER_INFO
2016-10-11	Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2016-2046.nasl - Type : ACT_GATHER_INFO
2016-07-20	Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2016-1433.nasl - Type : ACT_GATHER_INFO
2016-07-19	Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2016-1432.nasl - Type : ACT_GATHER_INFO
2016-07-06	Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-3024-1.nasl - Type : ACT_GATHER_INFO
2016-07-01	Name : The remote Debian host is missing a security-related update. File : debian_DSA-3609.nasl - Type : ACT_GATHER_INFO
2016-05-19	Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2016-1088.nasl - Type : ACT_GATHER_INFO
2016-05-19	Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2016-1087.nasl - Type : ACT_GATHER_INFO
2016-04-18	Name : The remote Debian host is missing a security-related update. File : debian_DSA-3552.nasl - Type : ACT_GATHER_INFO
2016-04-05	Name : The remote Apache Tomcat server is affected by an information disclosure vuln... File : tomcat_xsrf_token_disclosure.nasl - Type : ACT_GATHER_INFO
2016-04-01	Name : The remote Amazon Linux AMI host is missing a security update. File : ala_ALAS-2016-681.nasl - Type : ACT_GATHER_INFO
2016-04-01	Name : The remote Amazon Linux AMI host is missing a security update. File : ala_ALAS-2016-679.nasl - Type : ACT_GATHER_INFO
2016-04-01	Name : The remote Amazon Linux AMI host is missing a security update. File : ala_ALAS-2016-680.nasl - Type : ACT_GATHER_INFO
2016-03-28	Name : The remote Fedora host is missing a security update. File : fedora_2016-e6651efbaf.nasl - Type : ACT_GATHER_INFO
2016-03-28	Name : The remote Debian host is missing a security-related update. File : debian_DSA-3530.nasl - Type : ACT_GATHER_INFO
2016-03-24	Name : The remote openSUSE host is missing a security update. File : openSUSE-2016-384.nasl - Type : ACT_GATHER_INFO
2016-03-11	Name : The remote Amazon Linux AMI host is missing a security update. File : ala_ALAS-2016-658.nasl - Type : ACT_GATHER_INFO
2016-03-11	Name : The remote Amazon Linux AMI host is missing a security update. File : ala_ALAS-2016-657.nasl - Type : ACT_GATHER_INFO
2016-02-29	Name : The remote FreeBSD host is missing one or more security-related updates. File : freebsd_pkg_7bbc3016de6311e58fa814dae9d210b8.nasl - Type : ACT_GATHER_INFO
2016-02-29	Name : The remote FreeBSD host is missing one or more security-related updates. File : freebsd_pkg_1f1124fede5c11e58fa814dae9d210b8.nasl - Type : ACT_GATHER_INFO
2016-02-29	Name : The remote Debian host is missing a security update. File : debian_DLA-435.nasl - Type : ACT_GATHER_INFO
2016-02-24	Name : The remote Apache Tomcat server is affected by multiple vulnerabilities. File : tomcat_8_0_32.nasl - Type : ACT_GATHER_INFO
2016-02-24	Name : The remote Apache Tomcat server is affected by multiple vulnerabilities. File : tomcat_7_0_68.nasl - Type : ACT_GATHER_INFO
2016-02-24	Name : The remote Apache Tomcat server is affected by multiple vulnerabilities. File : tomcat_6_0_45.nasl - Type : ACT_GATHER_INFO
2015-12-17	Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2015-2660.nasl - Type : ACT_GATHER_INFO
2015-12-17	Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2015-2659.nasl - Type : ACT_GATHER_INFO
2015-06-26	Name : The remote Ubuntu host is missing a security-related patch. File : ubuntu_USN-2654-1.nasl - Type : ACT_GATHER_INFO
2015-06-26	Name : The remote IBM Storwize device is affected by multiple vulnerabilities. File : ibm_storwize_1_5_0_2.nasl - Type : ACT_GATHER_INFO
2015-05-18	Name : The remote Amazon Linux AMI host is missing a security update. File : ala_ALAS-2015-527.nasl - Type : ACT_GATHER_INFO
2015-05-18	Name : The remote Amazon Linux AMI host is missing a security update. File : ala_ALAS-2015-526.nasl - Type : ACT_GATHER_INFO
2015-03-30	Name : The remote Mandriva Linux host is missing one or more security updates. File : mandriva_MDVSA-2015-084.nasl - Type : ACT_GATHER_INFO
2015-03-19	Name : The remote Mandriva Linux host is missing one or more security updates. File : mandriva_MDVSA-2015-052.nasl - Type : ACT_GATHER_INFO
2015-03-19	Name : The remote Mandriva Linux host is missing one or more security updates. File : mandriva_MDVSA-2015-053.nasl - Type : ACT_GATHER_INFO
2015-02-24	Name : The remote Fedora host is missing a security update. File : fedora_2015-2109.nasl - Type : ACT_GATHER_INFO
2015-01-19	Name : The remote Solaris system is missing a security patch for third-party software. File : solaris11_tomcat_20140715.nasl - Type : ACT_GATHER_INFO
2014-12-15	Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-201412-29.nasl - Type : ACT_GATHER_INFO
2014-12-03	Name : The remote device is missing a vendor-supplied security patch. File : f5_bigip_SOL15428.nasl - Type : ACT_GATHER_INFO
2014-10-30	Name : The remote host is affected by multiple vulnerabilities. File : oracle_edq_oct_2014_cpu.nasl - Type : ACT_GATHER_INFO
2014-10-10	Name : The remote device is missing a vendor-supplied security patch. File : f5_bigip_SOL15429.nasl - Type : ACT_GATHER_INFO
2014-08-23	Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2014-1088.nasl - Type : ACT_GATHER_INFO
2014-08-23	Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2014-1087.nasl - Type : ACT_GATHER_INFO
2014-08-14	Name : The remote SuSE 11 host is missing one or more security updates. File : suse_11_tomcat6-201407-140706.nasl - Type : ACT_GATHER_INFO
2014-08-12	Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20140811_tomcat6_on_SL6_x.nasl - Type : ACT_GATHER_INFO
2014-08-12	Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2014-1038.nasl - Type : ACT_GATHER_INFO
2014-08-12	Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2014-1038.nasl - Type : ACT_GATHER_INFO
2014-08-12	Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2014-1038.nasl - Type : ACT_GATHER_INFO
2014-08-08	Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2014-1034.nasl - Type : ACT_GATHER_INFO
2014-08-08	Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2014-1034.nasl - Type : ACT_GATHER_INFO
2014-08-08	Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2014-1034.nasl - Type : ACT_GATHER_INFO
2014-07-31	Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-2302-1.nasl - Type : ACT_GATHER_INFO
2014-07-30	Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2014-0827.nasl - Type : ACT_GATHER_INFO
2014-07-24	Name : The remote FreeBSD host is missing one or more security-related updates. File : freebsd_pkg_81fc1076128611e4bebd000c2980a9f3.nasl - Type : ACT_GATHER_INFO
2014-07-24	Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2014-0827.nasl - Type : ACT_GATHER_INFO
2014-07-10	Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20140709_tomcat6_on_SL6_x.nasl - Type : ACT_GATHER_INFO
2014-07-10	Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2014-0865.nasl - Type : ACT_GATHER_INFO
2014-07-10	Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2014-0865.nasl - Type : ACT_GATHER_INFO
2014-07-10	Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2014-0865.nasl - Type : ACT_GATHER_INFO
2014-07-08	Name : The remote Red Hat host is missing a security update. File : redhat-RHSA-2014-0843.nasl - Type : ACT_GATHER_INFO
2014-07-08	Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2014-0835.nasl - Type : ACT_GATHER_INFO
2014-07-08	Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2014-0834.nasl - Type : ACT_GATHER_INFO
2014-05-30	Name : The remote Apache Tomcat server is affected by multiple vulnerabilities. File : tomcat_7_0_53.nasl - Type : ACT_GATHER_INFO
2014-05-30	Name : The remote Apache Tomcat server is affected by an information disclosure vuln... File : tomcat_7_0_54.nasl - Type : ACT_GATHER_INFO
2014-05-30	Name : The remote Apache Tomcat server is affected by multiple vulnerabilities. File : tomcat_8_0_5.nasl - Type : ACT_GATHER_INFO
2014-05-30	Name : The remote Apache Tomcat server is affected by an information disclosure vuln... File : tomcat_8_0_8.nasl - Type : ACT_GATHER_INFO
2014-05-30	Name : The remote Apache Tomcat server is affected by multiple vulnerabilities. File : tomcat_6_0_41.nasl - Type : ACT_GATHER_INFO

Alert History

If you want to see full details history, please login or register.

Date	Informations
2016-04-19 13:30:03	Multiple Updates
2016-04-17 21:25:15	First insertion

Global Informations

Type	Count
CWE ID(s)	8
Oval ID(s)	4
CPE ID(s)	290
IAVM(s)	2
Nessus® Exploit(s)	87

	Related
8.8	CVE-2016-0714
8.8	CVE-2015-5351
8.1	CVE-2015-5346
6.3	CVE-2016-0763
5.3	CVE-2015-5345
4.3	CVE-2016-0706
4.3	CVE-2015-5174
4.3	CVE-2014-0119
4.3	CVE-2014-0096
Info : listing not affected by your CVSS Env Score

Same Subject	Severity
Login to view 9 more Alert(s)