Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:ebuild/www-servers/tomcat@7.0.23
purl pkg:ebuild/www-servers/tomcat@7.0.23
Vulnerabilities affecting this package (0)
Vulnerability Summary Fixed by
This package is not known to be affected by vulnerabilities.
Vulnerabilities fixed by this package (32)
Vulnerability Summary Aliases
VCID-1qt3-ctae-sfgw Directory traversal vulnerability in Apache Tomcat 5.5.0 through 5.5.28 and 6.0.0 through 6.0.20 allows remote attackers to create or overwrite arbitrary files via a .. (dot dot) in an entry in a WAR file, as demonstrated by a ../../bin/catalina.bat entry. CVE-2009-2693
GHSA-ggx9-4728-588r
VCID-1v6c-f56v-hqh1 The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.12 does not check qop values, which might allow remote attackers to bypass intended integrity-protection requirements via a qop=auth value, a different vulnerability than CVE-2011-1184. CVE-2011-5062
GHSA-4f7h-9j2x-cmr4
VCID-241m-q6vd-kudk Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.19, when sendfile is enabled for the HTTP APR or HTTP NIO connector, does not validate certain request attributes, which allows local users to bypass intended file access restrictions or cause a denial of service (infinite loop or JVM crash) by leveraging an untrusted web application. CVE-2011-2526
GHSA-9ggm-7897-x4mg
VCID-4rcx-xfn5-7kdb Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18, when FORM authentication is used, allows remote attackers to enumerate valid usernames via requests to /j_security_check with malformed URL encoding of passwords, related to improper error checking in the (1) MemoryRealm, (2) DataSourceRealm, and (3) JDBCRealm authentication realms, as demonstrated by a % (percent) value for the j_password parameter. CVE-2009-0580
GHSA-w227-xcfx-3pj8
VCID-5eqm-218u-p7gq The HTTP BIO connector in Apache Tomcat 7.0.x before 7.0.12 does not properly handle HTTP pipelining, which allows remote attackers to read responses intended for other clients in opportunistic circumstances by examining the application data in HTTP packets, related to "a mix-up of responses for requests from different users." CVE-2011-1475
GHSA-h6c8-rg87-f3pc
VCID-618c-ar98-qfcr native/unix/native/jsvc-unix.c in jsvc in the Daemon component 1.0.3 through 1.0.6 in Apache Commons, as used in Apache Tomcat 5.5.32 through 5.5.33, 6.0.30 through 6.0.32, and 7.0.x before 7.0.20 on Linux, does not drop capabilities, which allows remote attackers to bypass read permissions for files via a request to an application. CVE-2011-2729
VCID-7ej8-5f77-cybb Apache Tomcat 7.0.0 through 7.0.6 and 6.0.0 through 6.0.30 does not enforce the maxHttpHeaderSize limit for requests involving the NIO HTTP connector, which allows remote attackers to cause a denial of service (OutOfMemoryError) via a crafted request. CVE-2011-0534
GHSA-43v2-6grp-9pp9
VCID-7kjm-p97s-zuh8 Apache Tomcat 5.5.0 through 5.5.29 and 6.0.0 through 6.0.26 might allow remote attackers to discover the server's hostname or IP address by sending a request for a resource that requires (1) BASIC or (2) DIGEST authentication, and then reading the realm field in the WWW-Authenticate header in the reply. CVE-2010-1157
GHSA-w6q7-ww2x-7gm3
VCID-886n-1vzv-syc6 Multiple cross-site scripting (XSS) vulnerabilities in the Manager application in Apache Tomcat 6.0.12 through 6.0.29 and 7.0.0 through 7.0.4 allow remote attackers to inject arbitrary web script or HTML via the (1) orderBy or (2) sort parameter to sessionsList.jsp, or unspecified input to (3) sessionDetail.jsp or (4) java/org/apache/catalina/manager/JspHelper.java, related to use of untrusted web applications. CVE-2010-4172
GHSA-c78g-qwpw-2jgv
VCID-8ebv-6941-jqdy The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.12 does not check realm values, which might allow remote attackers to bypass intended access restrictions by leveraging the availability of a protection space with weaker authentication or authorization requirements, a different vulnerability than CVE-2011-1184. CVE-2011-5063
GHSA-hffm-fqv4-w27r
VCID-95fn-d2ad-qyg6 Apache Tomcat 7.x before 7.0.10 does not follow ServletSecurity annotations, which allows remote attackers to bypass intended access restrictions via HTTP requests to a web application. CVE-2011-1088
GHSA-mg4v-rf8p-ghqq
VCID-bung-pa58-ayfv Cross-site scripting (XSS) vulnerability in jsp/cal/cal2.jsp in the calendar application in the examples web application in Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18 allows remote attackers to inject arbitrary web script or HTML via the time parameter, related to "invalid HTML." CVE-2009-0781
GHSA-j788-fx57-99wp
VCID-d9ys-kxh6-nkgr The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.12 does not have the expected countermeasures against replay attacks, which makes it easier for remote attackers to bypass intended access restrictions by sniffing the network for valid requests, related to lack of checking of nonce (aka server nonce) and nc (aka nonce-count or client nonce count) values. CVE-2011-1184
GHSA-q9xf-jwr4-v445
VCID-dcrp-rae1-zfcm Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18, when the Java AJP connector and mod_jk load balancing are used, allows remote attackers to cause a denial of service (application outage) via a crafted request with invalid headers, related to temporary blocking of connectors that have encountered errors, as demonstrated by an error involving a malformed HTTP Host header. CVE-2009-0033
GHSA-5cw4-ggx9-36vg
VCID-dhun-hj5q-dfch Multiple cross-site scripting (XSS) vulnerabilities in the HTML Manager Interface in Apache Tomcat 5.5 before 5.5.32, 6.0 before 6.0.30, and 7.0 before 7.0.6 allow remote attackers to inject arbitrary web script or HTML, as demonstrated via the display-name tag. CVE-2011-0013
GHSA-3p86-xgrq-m6p6
VCID-egye-da2v-4ybh Use of Hard-coded Cryptographic Key in Apache Tomcat DigestAuthenticator.java in the HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.12 uses Catalina as the hard-coded server secret (aka private key), which makes it easier for remote attackers to bypass cryptographic protection mechanisms by leveraging knowledge of this string, a different vulnerability than CVE-2011-1184. CVE-2011-5064
GHSA-6cr4-7c7p-p3xv
VCID-f2zy-gq57-ufat Apache Tomcat 5.5.0 through 5.5.29, 6.0.0 through 6.0.27, and 7.0.0 beta does not properly handle an invalid Transfer-Encoding header, which allows remote attackers to cause a denial of service (application outage) or obtain sensitive information via a crafted header that interferes with "recycling of a buffer." CVE-2010-2227
GHSA-cxg2-49rq-8gcr
VCID-fd9j-6vta-ubbp Apache Tomcat 7.x before 7.0.11, when web.xml has no security constraints, does not follow ServletSecurity annotations, which allows remote attackers to bypass intended access restrictions via HTTP requests to a web application. NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-1088. CVE-2011-1419
GHSA-vch7-92vf-jm44
VCID-g998-xymt-fudu The autodeployment process in Apache Tomcat 5.5.0 through 5.5.28 and 6.0.0 through 6.0.20, when autoDeploy is enabled, deploys appBase files that remain from a failed undeploy, which might allow remote attackers to bypass intended authentication requirements via HTTP requests. CVE-2009-2901
GHSA-hjfh-7c4v-7q8h
VCID-hhk9-cr54-8fgc Apache Tomcat 5.5.x before 5.5.35, 6.x before 6.0.34, and 7.x before 7.0.23 uses an inefficient approach for handling parameters, which allows remote attackers to cause a denial of service (CPU consumption) via a request that contains many parameters and parameter values, a different vulnerability than CVE-2011-4858. CVE-2012-0022
GHSA-8h2q-qm9x-55jc
VCID-hxj6-mupf-abbc Apache Tomcat 6.0.30 through 6.0.33 and 7.x before 7.0.22 does not properly perform certain caching and recycling operations involving request objects, which allows remote attackers to obtain unintended read access to IP address and HTTP header information in opportunistic circumstances by reading TCP data. CVE-2011-3375
GHSA-rp8h-vr48-4j8p
VCID-jtg7-217a-qqhk Apache Tomcat has cookies without HTTPOnly flag in Set-Cookie header The default configuration of Apache Tomcat 6.x does not include the HTTPOnly flag in a Set-Cookie header, which makes it easier for remote attackers to hijack a session via script access to a cookie. CVE-2010-4312
GHSA-pvjh-7h8q-q56r
VCID-mctd-9zgv-5qgp Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.17, when the MemoryUserDatabase is used, creates log entries containing passwords upon encountering errors in JMX user creation, which allows local users to obtain sensitive information by reading a log file. CVE-2011-2204
GHSA-c57p-3v2g-w9rg
VCID-mnf8-t3ew-4fgb Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, 6.0.0 through 6.0.18, and possibly earlier versions normalizes the target pathname before filtering the query string when using the RequestDispatcher method, which allows remote attackers to bypass intended access restrictions and conduct directory traversal attacks via .. (dot dot) sequences and the WEB-INF directory in a Request. CVE-2008-5515
GHSA-9737-qmgc-hfr9
VCID-quwu-ep21-cyew Certain AJP protocol connector implementations in Apache Tomcat 7.0.0 through 7.0.20, 6.0.0 through 6.0.33, 5.5.0 through 5.5.33, and possibly other versions allow remote attackers to spoof AJP requests, bypass authentication, and obtain sensitive information by causing the connector to interpret a request body as a new request. CVE-2011-3190
GHSA-c38m-v4m2-524v
VCID-r84b-7ay9-ekcm Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18 permits web applications to replace an XML parser used for other web applications, which allows local users to read or modify the (1) web.xml, (2) context.xml, or (3) tld files of arbitrary web applications via a crafted application that is loaded earlier than the target application. CVE-2009-0783
GHSA-hhjg-g8xq-hhr3
VCID-rhg2-n93w-tqeu Apache Tomcat 7.0.11, when web.xml has no login configuration, does not follow security constraints, which allows remote attackers to bypass intended access restrictions via HTTP requests to a meta-data complete web application. NOTE: this vulnerability exists because of an incorrect fix for CVE-2011-1088 and CVE-2011-1419. CVE-2011-1183
GHSA-p26v-97vp-jcx6
VCID-sp3x-x26s-hue6 Apache Tomcat 7.0.12 and 7.0.13 processes the first request to a servlet without following security constraints that have been configured through annotations, which allows remote attackers to bypass intended access restrictions via HTTP requests. NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-1088, CVE-2011-1183, and CVE-2011-1419. CVE-2011-1582
GHSA-3xpj-jgv5-q4vv
VCID-tfn5-6ckq-wyce Apache Tomcat 7.0.0 through 7.0.3, 6.0.x, and 5.5.x, when running within a SecurityManager, does not make the ServletContext attribute read-only, which allows local web applications to read or write files outside of the intended working directory, as demonstrated using a directory traversal attack. CVE-2010-3718
GHSA-fj6c-prgj-gr3r
VCID-wsn2-pd9b-b3g8 Directory traversal vulnerability in Apache Tomcat 5.5.0 through 5.5.28 and 6.0.0 through 6.0.20 allows remote attackers to delete work-directory files via directory traversal sequences in a WAR filename, as demonstrated by the ...war filename. CVE-2009-2902
GHSA-8wch-9gcg-v2pr
VCID-xqrn-wuv5-x7de Apache Tomcat 7.0.x before 7.0.17 permits web applications to replace an XML parser used for other web applications, which allows local users to read or modify the (1) web.xml, (2) context.xml, or (3) tld files of arbitrary web applications via a crafted application that is loaded earlier than the target application. NOTE: this vulnerability exists because of a CVE-2009-0783 regression. CVE-2011-2481
GHSA-r7c8-hghc-2mp8
VCID-zbbr-wded-9ffj Improper Input Validation in Apache Tomcat Apache Tomcat before 5.5.35, 6.x before 6.0.35, and 7.x before 7.0.23 computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters. CVE-2011-4858
GHSA-wr3m-gw98-mc3j

Date Actor Action Vulnerability Source VulnerableCode Version
2026-04-01T12:58:36.260968+00:00 Gentoo Importer Fixing VCID-hhk9-cr54-8fgc https://security.gentoo.org/glsa/201206-24 38.0.0
2026-04-01T12:58:36.251278+00:00 Gentoo Importer Fixing VCID-egye-da2v-4ybh https://security.gentoo.org/glsa/201206-24 38.0.0
2026-04-01T12:58:36.242292+00:00 Gentoo Importer Fixing VCID-8ebv-6941-jqdy https://security.gentoo.org/glsa/201206-24 38.0.0
2026-04-01T12:58:36.232590+00:00 Gentoo Importer Fixing VCID-1v6c-f56v-hqh1 https://security.gentoo.org/glsa/201206-24 38.0.0
2026-04-01T12:58:36.223280+00:00 Gentoo Importer Fixing VCID-zbbr-wded-9ffj https://security.gentoo.org/glsa/201206-24 38.0.0
2026-04-01T12:58:36.214421+00:00 Gentoo Importer Fixing VCID-hxj6-mupf-abbc https://security.gentoo.org/glsa/201206-24 38.0.0
2026-04-01T12:58:36.205053+00:00 Gentoo Importer Fixing VCID-quwu-ep21-cyew https://security.gentoo.org/glsa/201206-24 38.0.0
2026-04-01T12:58:36.195762+00:00 Gentoo Importer Fixing VCID-618c-ar98-qfcr https://security.gentoo.org/glsa/201206-24 38.0.0
2026-04-01T12:58:36.186138+00:00 Gentoo Importer Fixing VCID-241m-q6vd-kudk https://security.gentoo.org/glsa/201206-24 38.0.0
2026-04-01T12:58:36.176654+00:00 Gentoo Importer Fixing VCID-xqrn-wuv5-x7de https://security.gentoo.org/glsa/201206-24 38.0.0
2026-04-01T12:58:36.167689+00:00 Gentoo Importer Fixing VCID-mctd-9zgv-5qgp https://security.gentoo.org/glsa/201206-24 38.0.0
2026-04-01T12:58:36.158249+00:00 Gentoo Importer Fixing VCID-sp3x-x26s-hue6 https://security.gentoo.org/glsa/201206-24 38.0.0
2026-04-01T12:58:36.148881+00:00 Gentoo Importer Fixing VCID-5eqm-218u-p7gq https://security.gentoo.org/glsa/201206-24 38.0.0
2026-04-01T12:58:36.139375+00:00 Gentoo Importer Fixing VCID-fd9j-6vta-ubbp https://security.gentoo.org/glsa/201206-24 38.0.0
2026-04-01T12:58:36.130047+00:00 Gentoo Importer Fixing VCID-d9ys-kxh6-nkgr https://security.gentoo.org/glsa/201206-24 38.0.0
2026-04-01T12:58:36.120707+00:00 Gentoo Importer Fixing VCID-rhg2-n93w-tqeu https://security.gentoo.org/glsa/201206-24 38.0.0
2026-04-01T12:58:36.109377+00:00 Gentoo Importer Fixing VCID-95fn-d2ad-qyg6 https://security.gentoo.org/glsa/201206-24 38.0.0
2026-04-01T12:58:36.099902+00:00 Gentoo Importer Fixing VCID-7ej8-5f77-cybb https://security.gentoo.org/glsa/201206-24 38.0.0
2026-04-01T12:58:36.088672+00:00 Gentoo Importer Fixing VCID-dhun-hj5q-dfch https://security.gentoo.org/glsa/201206-24 38.0.0
2026-04-01T12:58:36.079266+00:00 Gentoo Importer Fixing VCID-jtg7-217a-qqhk https://security.gentoo.org/glsa/201206-24 38.0.0
2026-04-01T12:58:36.069828+00:00 Gentoo Importer Fixing VCID-886n-1vzv-syc6 https://security.gentoo.org/glsa/201206-24 38.0.0
2026-04-01T12:58:36.060420+00:00 Gentoo Importer Fixing VCID-tfn5-6ckq-wyce https://security.gentoo.org/glsa/201206-24 38.0.0
2026-04-01T12:58:36.051366+00:00 Gentoo Importer Fixing VCID-f2zy-gq57-ufat https://security.gentoo.org/glsa/201206-24 38.0.0
2026-04-01T12:58:36.041989+00:00 Gentoo Importer Fixing VCID-7kjm-p97s-zuh8 https://security.gentoo.org/glsa/201206-24 38.0.0
2026-04-01T12:58:36.032903+00:00 Gentoo Importer Fixing VCID-wsn2-pd9b-b3g8 https://security.gentoo.org/glsa/201206-24 38.0.0
2026-04-01T12:58:36.023806+00:00 Gentoo Importer Fixing VCID-g998-xymt-fudu https://security.gentoo.org/glsa/201206-24 38.0.0
2026-04-01T12:58:36.014548+00:00 Gentoo Importer Fixing VCID-1qt3-ctae-sfgw https://security.gentoo.org/glsa/201206-24 38.0.0
2026-04-01T12:58:36.006292+00:00 Gentoo Importer Fixing VCID-r84b-7ay9-ekcm https://security.gentoo.org/glsa/201206-24 38.0.0
2026-04-01T12:58:35.997916+00:00 Gentoo Importer Fixing VCID-bung-pa58-ayfv https://security.gentoo.org/glsa/201206-24 38.0.0
2026-04-01T12:58:35.988646+00:00 Gentoo Importer Fixing VCID-4rcx-xfn5-7kdb https://security.gentoo.org/glsa/201206-24 38.0.0
2026-04-01T12:58:35.980175+00:00 Gentoo Importer Fixing VCID-dcrp-rae1-zfcm https://security.gentoo.org/glsa/201206-24 38.0.0
2026-04-01T12:58:35.971631+00:00 Gentoo Importer Fixing VCID-mnf8-t3ew-4fgb https://security.gentoo.org/glsa/201206-24 38.0.0