Published: 10/08/2017 Updated: 08/12/2023

CVSS v2 Base Score: 5 | Impact Score: 2.9 | Exploitability Score: 10

CVSS v3 Base Score: 7.5 | Impact Score: 3.6 | Exploitability Score: 3.9

VMScore: 446

Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N

A bug in the error handling of the send file code for the NIO HTTP connector in Apache Tomcat 9.0.0.M1 to 9.0.0.M13, 8.5.0 to 8.5.8, 8.0.0.RC1 to 8.0.39, 7.0.0 to 7.0.73 and 6.0.16 to 6.0.48 resulted in the current Processor object being added to the Processor cache multiple times. This in turn meant that the same Processor could be used for concurrent requests. Sharing a Processor can result in information leakage between requests including, not not limited to, session ID and the response body. The bug was first noticed in 8.5.x onwards where it appears the refactoring of the Connector code for 8.5.x onwards made it more likely that the bug was observed. Initially it was thought that the 8.5.x refactoring introduced the bug but further investigation has shown that the bug is present in all currently supported Tomcat versions.

Vulnerable Product	Search on Vulmon	Subscribe to Product
apache tomcat 8.0.4
apache tomcat 8.0.10
apache tomcat 7.0.49
apache tomcat 8.0.30
apache tomcat 7.0.12
apache tomcat 7.0.62
apache tomcat 8.0.17
apache tomcat 7.0.53
apache tomcat 7.0.20
apache tomcat 8.0.7
apache tomcat 7.0.34
apache tomcat 8.0.26
apache tomcat 7.0.58
apache tomcat 8.5.2
apache tomcat 7.0.8
apache tomcat 7.0.55
apache tomcat 8.5.4
apache tomcat 7.0.1
apache tomcat 7.0.2
apache tomcat 7.0.5
apache tomcat 8.0.2
apache tomcat 7.0.63
apache tomcat 8.0.20
apache tomcat 7.0.22
apache tomcat 8.0.31
apache tomcat 8.5.0
apache tomcat 7.0.39
apache tomcat 7.0.26
apache tomcat 7.0.46
apache tomcat 7.0.72
apache tomcat 8.0.5
apache tomcat 7.0.71
apache tomcat 7.0.28
apache tomcat 8.0.1
apache tomcat 8.0.0
apache tomcat 7.0.59
apache tomcat 7.0.65
apache tomcat 8.0.19
apache tomcat 7.0.0
apache tomcat 7.0.50
apache tomcat 7.0.6
apache tomcat 8.0
apache tomcat 8.0.39
apache tomcat 7.0.18
apache tomcat 8.0.12
apache tomcat 7.0.14
apache tomcat 8.0.27
apache tomcat 8.0.15
apache tomcat 7.0.48
apache tomcat 7.0.11
apache tomcat 7.0.67
apache tomcat 7.0.23
apache tomcat 7.0.66
apache tomcat 8.0.22
apache tomcat 7.0.44
apache tomcat 7.0.69
apache tomcat 8.0.29
apache tomcat 7.0.7
apache tomcat 7.0.52
apache tomcat 7.0.42
apache tomcat 7.0.60
apache tomcat 7.0.37
apache tomcat 7.0.29
apache tomcat 7.0.45
apache tomcat 8.0.11
apache tomcat 8.0.24
apache tomcat 8.0.36
apache tomcat 7.0.68
apache tomcat 8.5.5
apache tomcat 8.0.23
apache tomcat 8.5.3
apache tomcat 8.0.33
apache tomcat 7.0.13
apache tomcat 7.0.47
apache tomcat 8.5.6
apache tomcat 8.0.6
apache tomcat 8.0.21
apache tomcat 8.0.32
apache tomcat 7.0.41
apache tomcat 7.0.31
apache tomcat 7.0.30
apache tomcat 7.0.15
apache tomcat 7.0.19
apache tomcat 7.0.16
apache tomcat 8.0.25
apache tomcat 7.0.36
apache tomcat 8.0.18
apache tomcat 7.0.25
apache tomcat 7.0.54
apache tomcat 8.0.35
apache tomcat 7.0.35
apache tomcat 7.0.61
apache tomcat 8.0.3
apache tomcat 8.0.38
apache tomcat 7.0.57
apache tomcat 7.0.43
apache tomcat 8.0.13
apache tomcat 8.0.14
apache tomcat 8.0.9
apache tomcat 7.0.32
apache tomcat 7.0.38
apache tomcat 7.0.21
apache tomcat 7.0.27
apache tomcat 8.5.7
apache tomcat 8.5.8
apache tomcat 7.0.24
apache tomcat 7.0.17
apache tomcat 7.0.40
apache tomcat 8.0.16
apache tomcat 7.0.9
apache tomcat 7.0.4
apache tomcat 8.0.8
apache tomcat 7.0.3
apache tomcat 7.0.56
apache tomcat 8.0.34
apache tomcat 8.0.28
apache tomcat 7.0.64
apache tomcat 8.0.37
apache tomcat 7.0.70
apache tomcat 8.5.1
apache tomcat 7.0.33
apache tomcat 7.0.73
apache tomcat 9.0.0

Synopsis Moderate: tomcat security update Type/Severity Security Advisory: Moderate Topic An update for tomcat is now available for Red Hat Enterprise Linux 7Red Hat Product Security has rated this update as having a security impact of Moderate A Common Vulnerability Scoring System (CVSS) base score, whic ...

Synopsis Moderate: tomcat6 security update Type/Severity Security Advisory: Moderate Topic An update for tomcat6 is now available for Red Hat Enterprise Linux 6Red Hat Product Security has rated this update as having a security impact of Moderate A Common Vulnerability Scoring System (CVSS) base score, wh ...

Synopsis Important: Red Hat JBoss Web Server security and enhancement update Type/Severity Security Advisory: Important Topic An update is now available for Red Hat JBoss Web ServerRed Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Scoring System ...

USN-3177-1 introduced a regression in Tomcat ...

Several security issues were fixed in Tomcat ...

It was discovered that incorrect error handling in the NIO HTTP connector of the Tomcat servlet and JSP engine could result in information disclosure For the stable distribution (jessie), this problem has been fixed in version 8014-1+deb8u6 For the testing distribution (stretch), this problem has been fixed in version 859-1 For the unstable ...

It was discovered that incorrect error handling in the NIO HTTP connector of the Tomcat servlet and JSP engine could result in information disclosure For the stable distribution (jessie), this problem has been fixed in version 7056-3+deb8u7 We recommend that you upgrade your tomcat7 packages ...

A bug in the error handling of the send file code for the NIO HTTP connector resulted in the current Processor object being added to the Processor cache multiple times This in turn meant that the same Processor could be used for concurrent requests Sharing a Processor can result in information leakage between requests including, not not limited t ...

It was discovered that the code that parsed the HTTP request line permittedinvalid characters This could be exploited, in conjunction with a proxy thatalso permitted the invalid characters but with a different interpretation, toinject data into the HTTP response By manipulating the HTTP response theattacker could poison a web-cache, perform an XS ...

A bug was discovered in the error handling of the send file code for the NIO HTTP connector This led to the current Processor object being added to the Processor cache multiple times allowing information leakage between requests including, and not limited to, session ID and the response body ...

VNC server library gets security fix

The Register • Richard Chirgwin • 09 Jan 2017

Debian plugs overflow vuln

An important fix for libvncserver has landed in Debian and on the library's GitHub page. Late in 2016, a bug emerged in the VNC libraries that left clients vulnerable to malicious servers. As the Debian advisory states, the fix addresses two bugs: CVE-2016-9941 and CVE-2016-9942. The libraries incorrectly handled incoming packets, leading to heap-based buffer overflows. Clients could be attacked either for denial-of-service, or potentially for remote code execution. The folks at libvncserver pus...

Get Started

CVE-2016-8745

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

Recent Articles

References

Vulmon Search

About

Products

Connect