Published: 10/08/2017 Updated: 15/04/2019

CVSS v2 Base Score: 5 | Impact Score: 2.9 | Exploitability Score: 10

CVSS v3 Base Score: 7.5 | Impact Score: 3.6 | Exploitability Score: 3.9

VMScore: 446

Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N

A bug in the error handling of the send file code for the NIO HTTP connector in Apache Tomcat 9.0.0.M1 to 9.0.0.M13, 8.5.0 to 8.5.8, 8.0.0.RC1 to 8.0.39, 7.0.0 to 7.0.73 and 6.0.16 to 6.0.48 resulted in the current Processor object being added to the Processor cache multiple times. This in turn meant that the same Processor could be used for concurrent requests. Sharing a Processor can result in information leakage between requests including, not not limited to, session ID and the response body. The bug was first noticed in 8.5.x onwards where it appears the refactoring of the Connector code for 8.5.x onwards made it more likely that the bug was observed. Initially it was thought that the 8.5.x refactoring introduced the bug but further investigation has shown that the bug is present in all currently supported Tomcat versions.

Vulnerable Product	Search on Vulmon	Subscribe to Product
apache tomcat 7.0.33
apache tomcat 7.0.34
apache tomcat 7.0.22
apache tomcat 7.0.23
apache tomcat 7.0.30
apache tomcat 7.0.11
apache tomcat 7.0.18
apache tomcat 7.0.19
apache tomcat 7.0.7
apache tomcat 7.0.8
apache tomcat 7.0.45
apache tomcat 7.0.46
apache tomcat 7.0.54
apache tomcat 7.0.55
apache tomcat 7.0.63
apache tomcat 7.0.64
apache tomcat 7.0.71
apache tomcat 7.0.72
apache tomcat 8.0.1
apache tomcat 8.0.2
apache tomcat 8.0.3
apache tomcat 8.0.10
apache tomcat 8.0.11
apache tomcat 8.0.18
apache tomcat 8.0.19
apache tomcat 8.0.27
apache tomcat 8.0.28
apache tomcat 8.0.35
apache tomcat 8.0.36
apache tomcat 8.5.3
apache tomcat 8.5.4
apache tomcat 9.0.0
apache tomcat 7.0.35
apache tomcat 7.0.36
apache tomcat 7.0.24
apache tomcat 7.0.25
apache tomcat 7.0.12
apache tomcat 7.0.13
apache tomcat 7.0.20
apache tomcat 7.0.1
apache tomcat 7.0.9
apache tomcat 7.0.0
apache tomcat 7.0.47
apache tomcat 7.0.48
apache tomcat 7.0.56
apache tomcat 7.0.57
apache tomcat 7.0.58
apache tomcat 7.0.65
apache tomcat 7.0.66
apache tomcat 7.0.73
apache tomcat 8.0
apache tomcat 8.0.4
apache tomcat 8.0.5
apache tomcat 8.0.12
apache tomcat 8.0.13
apache tomcat 8.0.20
apache tomcat 8.0.21
apache tomcat 8.0.29
apache tomcat 8.0.30
apache tomcat 8.0.37
apache tomcat 8.0.38
apache tomcat 8.5.5
apache tomcat 8.5.6
apache tomcat 7.0.31
apache tomcat 7.0.32
apache tomcat 7.0.40
apache tomcat 7.0.21
apache tomcat 7.0.28
apache tomcat 7.0.29
apache tomcat 7.0.16
apache tomcat 7.0.17
apache tomcat 7.0.5
apache tomcat 7.0.6
apache tomcat 7.0.43
apache tomcat 7.0.44
apache tomcat 7.0.52
apache tomcat 7.0.53
apache tomcat 7.0.61
apache tomcat 7.0.62
apache tomcat 7.0.69
apache tomcat 7.0.70
apache tomcat 8.0.0
apache tomcat 8.0.8
apache tomcat 8.0.9
apache tomcat 8.0.16
apache tomcat 8.0.17
apache tomcat 8.0.24
apache tomcat 8.0.25
apache tomcat 8.0.26
apache tomcat 8.0.33
apache tomcat 8.0.34
apache tomcat 8.5.1
apache tomcat 8.5.2
apache tomcat 7.0.37
apache tomcat 7.0.38
apache tomcat 7.0.39
apache tomcat 7.0.26
apache tomcat 7.0.27
apache tomcat 7.0.14
apache tomcat 7.0.15
apache tomcat 7.0.2
apache tomcat 7.0.3
apache tomcat 7.0.4
apache tomcat 7.0.41
apache tomcat 7.0.42
apache tomcat 7.0.49
apache tomcat 7.0.50
apache tomcat 7.0.59
apache tomcat 7.0.60
apache tomcat 7.0.67
apache tomcat 7.0.68
apache tomcat 8.0.6
apache tomcat 8.0.7
apache tomcat 8.0.14
apache tomcat 8.0.15
apache tomcat 8.0.22
apache tomcat 8.0.23
apache tomcat 8.0.31
apache tomcat 8.0.32
apache tomcat 8.0.39
apache tomcat 8.5.0
apache tomcat 8.5.7
apache tomcat 8.5.8

Synopsis Moderate: tomcat6 security update Type/Severity Security Advisory: Moderate Topic An update for tomcat6 is now available for Red Hat Enterprise Linux 6Red Hat Product Security has rated this update as having a security impact of Moderate A Common Vulnerability Scoring System (CVSS) base score, wh ...

Synopsis Moderate: tomcat security update Type/Severity Security Advisory: Moderate Topic An update for tomcat is now available for Red Hat Enterprise Linux 7Red Hat Product Security has rated this update as having a security impact of Moderate A Common Vulnerability Scoring System (CVSS) base score, whic ...

It was discovered that incorrect error handling in the NIO HTTP connector of the Tomcat servlet and JSP engine could result in information disclosure For the stable distribution (jessie), this problem has been fixed in version 7056-3+deb8u7 We recommend that you upgrade your tomcat7 packages ...

It was discovered that incorrect error handling in the NIO HTTP connector of the Tomcat servlet and JSP engine could result in information disclosure For the stable distribution (jessie), this problem has been fixed in version 8014-1+deb8u6 For the testing distribution (stretch), this problem has been fixed in version 859-1 For the unstable ...

A bug in the error handling of the send file code for the NIO HTTP connector resulted in the current Processor object being added to the Processor cache multiple times This in turn meant that the same Processor could be used for concurrent requests Sharing a Processor can result in information leakage between requests including, not not limited t ...

Synopsis Important: Red Hat JBoss Web Server security and enhancement update Type/Severity Security Advisory: Important Topic An update is now available for Red Hat JBoss Web ServerRed Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Scoring System ...

It was discovered that the code that parsed the HTTP request line permittedinvalid characters This could be exploited, in conjunction with a proxy thatalso permitted the invalid characters but with a different interpretation, toinject data into the HTTP response By manipulating the HTTP response theattacker could poison a web-cache, perform an XS ...

A bug was discovered in the error handling of the send file code for the NIO HTTP connector This led to the current Processor object being added to the Processor cache multiple times allowing information leakage between requests including, and not limited to, session ID and the response body ...

USN-3177-1 introduced a regression in Tomcat ...

Several security issues were fixed in Tomcat ...

Oracle Solaris Third Party Bulletin - January 2017 Description The Oracle Solaris Third Party Bulletin announces patches for one or more security vulnerabilities fixed in third party software that is included in Oracle Solaris distributions Starting January 20, 2015, Third Party Bulletins are released on the same day when Oracle Critical Patch Up ...

Oracle Linux Bulletin - January 2017 Description The Oracle Linux Bulletin lists all CVEs that had been resolved and announced in Oracle Linux Security Advisories (ELSA) in the last one month prior to the release of the bulletin Oracle Linux Bulletins are published on the same day as Oracle Critical ...

Oracle Solaris Third Party Bulletin - April 2017 Description The Oracle Solaris Third Party Bulletin announces patches for one or more security vulnerabilities fixed in third party software that is included in Oracle Solaris distributions Starting January 20, 2015, Third Party Bulletins are released on the same day when Oracle Critical Patch Upda ...

Oracle Critical Patch Update Advisory - April 2018 Description A Critical Patch Update is a collection of patches for multiple security vulnerabilities Critical Patch Update patches are usually cumulative, but each advisory describes only the security fixes added since the previous ...

Oracle Linux Bulletin - April 2017 Description The Oracle Linux Bulletin lists all CVEs that had been resolved and announced in Oracle Linux Security Advisories (ELSA) in the last one month prior to the release of the bulletin Oracle Linux Bulletins are published on the same day as Oracle Critical Patch Updates are release ...

Oracle Critical Patch Update Advisory - October 2017 Description A Critical Patch Update (CPU) is a collection of patches for multiple security vulnerabilities Critical Patch Update patches are usually cumulative, but each advisory describes only the security fixes added since the ...

Cyber Securiy MOOC Unsecure project

LINK: githubcom/ilmari666/cybsec Based on the Springboot-template as per course material that can be installed and run with suitably configured Netbeans and Maven Five flaws as per wwwowasporg/images/7/72/OWASP_Top_10-2017_%28en%29pdfpdf This document can be read at githubcom/ilmari666/cybsec/blob/master/READMEmd FLAW 1: A2:2017 Broken Authentica

veracode-container-security-finding-parser Map Vulnerabilities into Different Layers of the Container Image Usage usage: mainpy [-h] [-i INSPECT_FILE] [-s SCAN_FILE] [-d] Example python mainpy Output: Scanned Image: juliantotzek/verademo1-tomcat:latest, Base Image OS Family: centos , Base Image OS Name: 761810 Base Image (based on the first Layer in veracode inspect comman

VNC server library gets security fix

The Register • Richard Chirgwin • 09 Jan 2017

Debian plugs overflow vuln

An important fix for libvncserver has landed in Debian and on the library's GitHub page.
Late in 2016, a bug emerged in the VNC libraries that left clients vulnerable to malicious servers.
As the Debian advisory states, the fix addresses two bugs: CVE-2016-9941 and CVE-2016-9942. The libraries incorrectly handled incoming packets, leading to heap-based buffer overflows.
Clients could be attacked either for denial-of-service, or potentially for remote code execution.
The f...

Get Started

CVE-2016-8745

Vulnerability Summary

Most Upvoted Vulmon Research Post

Vulnerability Trend

Vendor Advisories

Github Repositories

Recent Articles

References

Vulmon Search

About

Products

Connect