Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:ebuild/www-servers/tomcat@7.0.56
purl pkg:ebuild/www-servers/tomcat@7.0.56
Vulnerabilities affecting this package (0)
Vulnerability Summary Fixed by
This package is not known to be affected by vulnerabilities.
Vulnerabilities fixed by this package (19)
Vulnerability Summary Aliases
VCID-12du-1vyt-bkgx Improper Authentication in Apache Tomcat The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, and 7.x before 7.0.30 does not properly check for stale nonce values in conjunction with enforcement of proper credentials, which makes it easier for remote attackers to bypass intended access restrictions by sniffing the network for valid requests. CVE-2012-5887
GHSA-28cq-6rmx-pjq4
VCID-a9bd-d31y-k7g6 org/apache/catalina/connector/CoyoteAdapter.java in Apache Tomcat 6.0.33 through 6.0.37 does not consider the disableURLRewriting setting when handling a session ID in a URL, which allows remote attackers to conduct session fixation attacks via a crafted URL. CVE-2014-0033
GHSA-6gjj-c5mj-4cvp
VCID-afm2-uj45-xkgx java/org/apache/catalina/core/AsyncContextImpl.java in Apache Tomcat 7.x before 7.0.40 does not properly handle the throwing of a RuntimeException in an AsyncListener in an application, which allows context-dependent attackers to obtain sensitive request information intended for other applications in opportunistic circumstances via an application that records the requests that it processes. CVE-2013-2071
GHSA-3p5r-7cw3-2m67
VCID-fpuc-fe6m-47c6 org/apache/catalina/realm/RealmBase.java in Apache Tomcat 6.x before 6.0.36 and 7.x before 7.0.30, when FORM authentication is used, allows remote attackers to bypass security-constraint checks by leveraging a previous setUserPrincipal call and then placing /j_security_check at the end of a URI. CVE-2012-3546
GHSA-jgm2-m5cg-f66g
VCID-g7eg-s99s-xqe7 Improper Authentication in Apache Tomcat The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, and 7.x before 7.0.30 caches information about the authenticated user within the session state, which makes it easier for remote attackers to bypass authentication via vectors related to the session ID. CVE-2012-5886
GHSA-9xrj-439h-62hg
VCID-gv12-4ruf-kfhq MultipartStream.java in Apache Commons FileUpload before 1.3.1, as used in Apache Tomcat, JBoss Web, and other products, allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a crafted Content-Type header that bypasses a loop's intended exit conditions. CVE-2014-0050
GHSA-xx68-jfcg-xmmf
VCID-h9ds-trhx-m7aj Apache Tomcat before 6.0.39, 7.x before 7.0.47, and 8.x before 8.0.0-RC3, when an HTTP connector or AJP connector is used, does not properly handle certain inconsistent HTTP request headers, which allows remote attackers to trigger incorrect identification of a request's length and conduct request-smuggling attacks via (1) multiple Content-Length headers or (2) a Content-Length header and a "Transfer-Encoding: chunked" header. NOTE: this vulnerability exists because of an incomplete fix for CVE-2005-2090. CVE-2013-4286
GHSA-j448-j653-r3vj
VCID-jf7u-dvpd-b7f4 Apache Tomcat before 6.0.40, 7.x before 7.0.54, and 8.x before 8.0.6 does not properly constrain the class loader that accesses the XML parser used with an XSLT stylesheet, which allows remote attackers to (1) read arbitrary files via a crafted web application that provides an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue, or (2) read files associated with different web applications on a single Tomcat instance via a crafted web application. CVE-2014-0119
GHSA-prc3-7f44-w48j
VCID-kgd1-bzst-muh7 java/org/apache/catalina/servlets/DefaultServlet.java in the default servlet in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4 does not properly restrict XSLT stylesheets, which allows remote attackers to bypass security-manager restrictions and read arbitrary files via a crafted web application that provides an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue. CVE-2014-0096
GHSA-qprx-q2r7-3rx6
VCID-kzzv-rhya-j7dd Integer overflow in the parseChunkHeader function in java/org/apache/coyote/http11/filters/ChunkedInputFilter.java in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4 allows remote attackers to cause a denial of service (resource consumption) via a malformed chunk size in chunked transfer coding of a request during the streaming of data. CVE-2014-0075
GHSA-475f-74wp-pqv5
VCID-mwk8-b5c9-kbb9 org/apache/tomcat/util/net/NioEndpoint.java in Apache Tomcat 6.x before 6.0.36 and 7.x before 7.0.28, when the NIO connector is used in conjunction with sendfile and HTTPS, allows remote attackers to cause a denial of service (infinite loop) by terminating the connection during the reading of a response. CVE-2012-4534
VCID-p4dn-y54m-8fd1 Apache Tomcat 6.x before 6.0.37 and 7.x before 7.0.30 does not properly handle chunk extensions in chunked transfer coding, which allows remote attackers to cause a denial of service by streaming data. CVE-2012-3544
GHSA-qfxv-3ppc-7qg5
VCID-r5rc-rdd9-bfbk Improper Access Control in Apache Tomcat The replay-countermeasure functionality in the HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, and 7.x before 7.0.30 tracks cnonce (aka client nonce) values instead of nonce (aka server nonce) and nc (aka nonce-count) values, which makes it easier for remote attackers to bypass intended access restrictions by sniffing the network for valid requests, a different vulnerability than CVE-2011-1184. CVE-2012-5885
GHSA-99rf-92v6-cwx4
VCID-ryha-ndms-afbn java/org/apache/catalina/authenticator/FormAuthenticator.java in the form authentication feature in Apache Tomcat 6.0.21 through 6.0.36 and 7.x before 7.0.33 does not properly handle the relationships between authentication requirements and sessions, which allows remote attackers to inject a request into a session by sending this request during completion of the login form, a variant of a session fixation attack. CVE-2013-2067
GHSA-6m48-jxwx-76q7
VCID-ta1m-dh8x-nubc org/apache/catalina/filters/CsrfPreventionFilter.java in Apache Tomcat 6.x before 6.0.36 and 7.x before 7.0.32 allows remote attackers to bypass the cross-site request forgery (CSRF) protection mechanism via a request that lacks a session identifier. CVE-2012-4431
GHSA-76vr-72mv-mf3q
VCID-tcbc-3kgt-muam Apache Tomcat before 6.0.39, 7.x before 7.0.50, and 8.x before 8.0.0-RC10 processes chunked transfer coding without properly handling (1) a large total amount of chunked data or (2) whitespace characters in an HTTP header value within a trailer field, which allows remote attackers to cause a denial of service by streaming data. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-3544. CVE-2013-4322
GHSA-wq2p-q66w-q8gp
VCID-vd1s-m27a-8ucc java/org/apache/coyote/http11/InternalNioInputBuffer.java in the HTTP NIO connector in Apache Tomcat 6.x before 6.0.36 and 7.x before 7.0.28 does not properly restrict the request-header size, which allows remote attackers to cause a denial of service (memory consumption) via a large amount of header data. CVE-2012-2733
VCID-w82a-7kk2-p3f1 Apache Tomcat before 6.0.39, 7.x before 7.0.50, and 8.x before 8.0.0-RC10 allows attackers to obtain "Tomcat internals" information by leveraging the presence of an untrusted web application with a context.xml, web.xml, *.jspx, *.tagx, or *.tld XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue. CVE-2013-4590
GHSA-87w9-x2c3-hrjj
VCID-ygvw-69am-s7ae Integer overflow in java/org/apache/tomcat/util/buf/Ascii.java in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4, when operated behind a reverse proxy, allows remote attackers to conduct HTTP request smuggling attacks via a crafted Content-Length HTTP header. CVE-2014-0099
GHSA-xh5x-j8jf-pcpx

Date Actor Action Vulnerability Source VulnerableCode Version
2026-04-01T13:11:54.495035+00:00 Gentoo Importer Fixing VCID-jf7u-dvpd-b7f4 https://security.gentoo.org/glsa/201412-29 38.0.0
2026-04-01T13:11:54.485575+00:00 Gentoo Importer Fixing VCID-ygvw-69am-s7ae https://security.gentoo.org/glsa/201412-29 38.0.0
2026-04-01T13:11:54.477360+00:00 Gentoo Importer Fixing VCID-kgd1-bzst-muh7 https://security.gentoo.org/glsa/201412-29 38.0.0
2026-04-01T13:11:54.467043+00:00 Gentoo Importer Fixing VCID-kzzv-rhya-j7dd https://security.gentoo.org/glsa/201412-29 38.0.0
2026-04-01T13:11:54.457705+00:00 Gentoo Importer Fixing VCID-gv12-4ruf-kfhq https://security.gentoo.org/glsa/201412-29 38.0.0
2026-04-01T13:11:54.444407+00:00 Gentoo Importer Fixing VCID-a9bd-d31y-k7g6 https://security.gentoo.org/glsa/201412-29 38.0.0
2026-04-01T13:11:54.435408+00:00 Gentoo Importer Fixing VCID-w82a-7kk2-p3f1 https://security.gentoo.org/glsa/201412-29 38.0.0
2026-04-01T13:11:54.425746+00:00 Gentoo Importer Fixing VCID-tcbc-3kgt-muam https://security.gentoo.org/glsa/201412-29 38.0.0
2026-04-01T13:11:54.416598+00:00 Gentoo Importer Fixing VCID-h9ds-trhx-m7aj https://security.gentoo.org/glsa/201412-29 38.0.0
2026-04-01T13:11:54.403609+00:00 Gentoo Importer Fixing VCID-afm2-uj45-xkgx https://security.gentoo.org/glsa/201412-29 38.0.0
2026-04-01T13:11:54.389857+00:00 Gentoo Importer Fixing VCID-ryha-ndms-afbn https://security.gentoo.org/glsa/201412-29 38.0.0
2026-04-01T13:11:54.381191+00:00 Gentoo Importer Fixing VCID-12du-1vyt-bkgx https://security.gentoo.org/glsa/201412-29 38.0.0
2026-04-01T13:11:54.372668+00:00 Gentoo Importer Fixing VCID-g7eg-s99s-xqe7 https://security.gentoo.org/glsa/201412-29 38.0.0
2026-04-01T13:11:54.361116+00:00 Gentoo Importer Fixing VCID-r5rc-rdd9-bfbk https://security.gentoo.org/glsa/201412-29 38.0.0
2026-04-01T13:11:54.350026+00:00 Gentoo Importer Fixing VCID-mwk8-b5c9-kbb9 https://security.gentoo.org/glsa/201412-29 38.0.0
2026-04-01T13:11:54.338942+00:00 Gentoo Importer Fixing VCID-ta1m-dh8x-nubc https://security.gentoo.org/glsa/201412-29 38.0.0
2026-04-01T13:11:54.326813+00:00 Gentoo Importer Fixing VCID-fpuc-fe6m-47c6 https://security.gentoo.org/glsa/201412-29 38.0.0
2026-04-01T13:11:54.316231+00:00 Gentoo Importer Fixing VCID-p4dn-y54m-8fd1 https://security.gentoo.org/glsa/201412-29 38.0.0
2026-04-01T13:11:54.307791+00:00 Gentoo Importer Fixing VCID-vd1s-m27a-8ucc https://security.gentoo.org/glsa/201412-29 38.0.0