Every CVE Search/ Get API key

CVE-2017-5664

Improper Handling of Exceptional Conditions in Apache Tomcat

7.5 HighFix available

The error page mechanism of the Java Servlet Specification requires that, when an error occurs and an error page is configured for the error that occurred, the original request and response are forwarded to the error page. This means that the request is presented to the error page with the original HTTP method. If the error page is a static file, expected behaviour is to serve content of the file as if processing a GET request, regardless of the actual HTTP method. The Default Servlet in Apache Tomcat 9.0.0.M1 to 9.0.0.M20, 8.5.0 to 8.5.14, 8.0.0.RC1 to 8.0.43 and 7.0.0 to 7.0.77 did not do this. Depending on the original request this could lead to unexpected and undesirable results for static error pages including, if the DefaultServlet is configured to permit writes, the replacement or removal of the custom error page. Notes for other user provided error pages: (1) Unless explicitly coded otherwise, JSPs ignore the HTTP method. JSPs used as error pages must must ensure that they handle any error dispatch as a GET request, regardless of the actual method. (2) By default, the response generated by a Servlet does depend on the HTTP method. Custom Servlets used as error pages must ensure that they handle any error dispatch as a GET request, regardless of the actual method.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
High
Availability
None

Exploit likelihood

16.6%Down 3.5 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 7.5

The error page mechanism of the Java Servlet Specification requires that, when an error occurs and an error page is configured for the error that occurred, the original request and response are forwarded to the error page. This means that the request is presented to the error page with the original HTTP method. If the error page is a static file, expected behaviour is to serve content of the file as if processing a GET request, regardless of the actual HTTP method. The Default Servlet in Apache Tomcat 9.0.0.M1 to 9.0.0.M20, 8.5.0 to 8.5.14, 8.0.0.RC1 to 8.0.43 and 7.0.0 to 7.0.77 did not do this. Depending on the original request this could lead to unexpected and undesirable results for static error pages including, if the DefaultServlet is configured to permit writes, the replacement or removal of the custom error page. Notes for other user provided error pages: (1) Unless explicitly coded otherwise, JSPs ignore the HTTP method. JSPs used as error pages must must ensure that they handle any error dispatch as a GET request, regardless of the actual method. (2) By default, the response generated by a Servlet does depend on the HTTP method. Custom Servlets used as error pages must ensure that they handle any error dispatch as a GET request, regardless of the actual method.

Record
CVE-2017-5664
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CVSS 2.0
5.0 MediumAV:N/AC:L/Au:N/C:N/I:P/A:N
Weakness
CWE-755
Updated
2026-11-02
CVE List No score

The error page mechanism of the Java Servlet Specification requires that, when an error occurs and an error page is configured for the error that occurred, the original request and response are forwarded to the error page. This means that the request is presented to the error page with the original HTTP method. If the error page is a static file, expected behaviour is to serve content of the file as if processing a GET request, regardless of the actual HTTP method. The Default Servlet in Apache Tomcat 9.0.0.M1 to 9.0.0.M20, 8.5.0 to 8.5.14, 8.0.0.RC1 to 8.0.43 and 7.0.0 to 7.0.77 did not do this. Depending on the original request this could lead to unexpected and undesirable results for static error pages including, if the DefaultServlet is configured to permit writes, the replacement or removal of the custom error page. Notes for other user provided error pages: (1) Unless explicitly coded otherwise, JSPs ignore the HTTP method. JSPs used as error pages must must ensure that they handle any error dispatch as a GET request, regardless of the actual method. (2) By default, the response generated by a Servlet does depend on the HTTP method. Custom Servlets used as error pages must ensure that they handle any error dispatch as a GET request, regardless of the actual method.

Record
CVE-2017-5664
Updated
2026-11-02
EUVDEUVD-2022-4402 No score

The error page mechanism of the Java Servlet Specification requires that, when an error occurs and an error page is configured for the error that occurred, the original request and response are forwarded to the error page. This means that the request is presented to the error page with the original HTTP method. If the error page is a static file, expected behaviour is to serve content of the file as if processing a GET request, regardless of the actual HTTP method. The Default Servlet in Apache Tomcat 9.0.0.M1 to 9.0.0.M20, 8.5.0 to 8.5.14, 8.0.0.RC1 to 8.0.43 and 7.0.0 to 7.0.77 did not do this. Depending on the original request this could lead to unexpected and undesirable results for static error pages including, if the DefaultServlet is configured to permit writes, the replacement or removal of the custom error page. Notes for other user provided error pages: (1) Unless explicitly coded otherwise, JSPs ignore the HTTP method. JSPs used as error pages must must ensure that they handle any error dispatch as a GET request, regardless of the actual method. (2) By default, the response generated by a Servlet does depend on the HTTP method. Custom Servlets used as error pages must ensure that they handle any error dispatch as a GET request, regardless of the actual method.

Record
EUVD-2022-4402
Updated
2026-11-02
GitHub AdvisoriesGHSA-jmvv-524f-hj5j 7.5

Improper Handling of Exceptional Conditions in Apache Tomcat

The error page mechanism of the Java Servlet Specification requires that, when an error occurs and an error page is configured for the error that occurred, the original request and response are forwarded to the error page. This means that the request is presented to the error page with the original HTTP method. If the error page is a static file, expected behaviour is to serve content of the file as if processing a GET request, regardless of the actual HTTP method. The Default Servlet in Apache Tomcat 9.0.0.M1 to 9.0.0.M20, 8.5.0 to 8.5.14, 8.0.0.RC1 to 8.0.43 and 7.0.0 to 7.0.77 did not do this. Depending on the original request this could lead to unexpected and undesirable results for static error pages including, if the DefaultServlet is configured to permit writes, the replacement or removal of the custom error page. Notes for other user provided error pages: (1) Unless explicitly coded otherwise, JSPs ignore the HTTP method. JSPs used as error pages must must ensure that they handle any error dispatch as a GET request, regardless of the actual method. (2) By default, the response generated by a Servlet does depend on the HTTP method. Custom Servlets used as error pages must ensure that they handle any error dispatch as a GET request, regardless of the actual method.

Record
GHSA-jmvv-524f-hj5j
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weakness
CWE-755
Updated
2026-11-02
OSV 7.5

The error page mechanism of the Java Servlet Specification requires that, when an error occurs and an error page is configured for the error that occurred, the original request and response are forwarded to the error page. This means that the request is presented to the error page with the original HTTP method. If the error page is a static file, expected behaviour is to serve content of the file as if processing a GET request, regardless of the actual HTTP method. The Default Servlet in Apache Tomcat 9.0.0.M1 to 9.0.0.M20, 8.5.0 to 8.5.14, 8.0.0.RC1 to 8.0.43 and 7.0.0 to 7.0.77 did not do this. Depending on the original request this could lead to unexpected and undesirable results for static error pages including, if the DefaultServlet is configured to permit writes, the replacement or removal of the custom error page. Notes for other user provided error pages: (1) Unless explicitly coded otherwise, JSPs ignore the HTTP method. JSPs used as error pages must must ensure that they handle any error dispatch as a GET request, regardless of the actual method. (2) By default, the response generated by a Servlet does depend on the HTTP method. Custom Servlets used as error pages must ensure that they handle any error dispatch as a GET request, regardless of the actual method.

Record
CVE-2017-5664
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-02
OSVGHSA-jmvv-524f-hj5j 7.5

Improper Handling of Exceptional Conditions in Apache Tomcat

The error page mechanism of the Java Servlet Specification requires that, when an error occurs and an error page is configured for the error that occurred, the original request and response are forwarded to the error page. This means that the request is presented to the error page with the original HTTP method. If the error page is a static file, expected behaviour is to serve content of the file as if processing a GET request, regardless of the actual HTTP method. The Default Servlet in Apache Tomcat 9.0.0.M1 to 9.0.0.M20, 8.5.0 to 8.5.14, 8.0.0.RC1 to 8.0.43 and 7.0.0 to 7.0.77 did not do this. Depending on the original request this could lead to unexpected and undesirable results for static error pages including, if the DefaultServlet is configured to permit writes, the replacement or removal of the custom error page. Notes for other user provided error pages: (1) Unless explicitly coded otherwise, JSPs ignore the HTTP method. JSPs used as error pages must must ensure that they handle any error dispatch as a GET request, regardless of the actual method. (2) By default, the response generated by a Servlet does depend on the HTTP method. Custom Servlets used as error pages must ensure that they handle any error dispatch as a GET request, regardless of the actual method.

Record
GHSA-jmvv-524f-hj5j
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weakness
CWE-755
Updated
2026-11-02
Show 18 moreShow less
OSVRHSA-2017:1801 9.8

Red Hat Security Advisory: Red Hat JBoss Web Server 3.1.0 Service Pack 1 security update

Record
RHSA-2017:1801
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2017:1809 7.5

Red Hat Security Advisory: tomcat security update

Record
RHSA-2017:1809
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-02
OSVRHSA-2017:2493 7.5

Red Hat Security Advisory: Red Hat JBoss Web Server 2 security update

Record
RHSA-2017:2493
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-02
OSVRHSA-2017:2635 8.1

Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.4.17 update on RHEL 6

Record
RHSA-2017:2635
CVSS 3.0
8.1 HighCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2017:2636 8.1

Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.4.17 update on RHEL 7

Record
RHSA-2017:2636
CVSS 3.0
8.1 HighCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2017:2637 8.1

Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.4.17 update on RHEL 5

Record
RHSA-2017:2637
CVSS 3.0
8.1 HighCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2017:2638 9.8

Red Hat Security Advisory: jboss-ec2-eap security, bug fix, and enhancement update

Record
RHSA-2017:2638
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2017:3080 8.1

Red Hat Security Advisory: tomcat6 security update

Record
RHSA-2017:3080
CVSS 3.0
8.1 HighCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2017-5664 7.5

The error page mechanism of the Java Servlet Specification requires that, when an error occurs and an error page is configured for the error that occurred, the original request and response are forwarded to the error page. This means that the request is presented to the error page with the original HTTP method. If the error page is a static file, expected behaviour is to serve content of the file as if processing a GET request, regardless of the actual HTTP method. The Default Servlet in Apache Tomcat 9.0.0.M1 to 9.0.0.M20, 8.5.0 to 8.5.14, 8.0.0.RC1 to 8.0.43 and 7.0.0 to 7.0.77 did not do this. Depending on the original request this could lead to unexpected and undesirable results for static error pages including, if the DefaultServlet is configured to permit writes, the replacement or removal of the custom error page. Notes for other user provided error pages: (1) Unless explicitly coded otherwise, JSPs ignore the HTTP method. JSPs used as error pages must must ensure that they handle any error dispatch as a GET request, regardless of the actual method. (2) By default, the response generated by a Servlet does depend on the HTTP method. Custom Servlets used as error pages must ensure that they handle any error dispatch as a GET request, regardless of the actual method.

Record
UBUNTU-CVE-2017-5664
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-02
OSVCLSA-2026-1789677164 No score

TuxCare security update for 32 packages (16 CVEs)

TuxCare rebuilt 32 packages to address 16 CVEs. Fixed in 7.0.70-tuxcare.4.

Record
CLSA-2026-1789677164
Updated
2026-11-02
OSVMGASA-2017-0196 No score

Updated tomcat packages fix security vulnerability

Aniket Nandkishor Kulkarni discovered that in tomcat7, static error pages used the original request's HTTP method to serve content, instead of systematically using the GET method. This could under certain conditions result in undesirable results, including the replacement or removal of the custom error page (CVE-2017-5664).

Record
MGASA-2017-0196
Updated
2026-11-02
OSVopenSUSE-SU-2024:11468-1 No score

tomcat-9.0.36-8.4 on GA media

These are all security issues fixed in the tomcat-9.0.36-8.4 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:11468-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:13441-1 No score

tomcat10-10.1.14-1.1 on GA media

These are all security issues fixed in the tomcat10-10.1.14-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:13441-1
Updated
2026-11-02
OSVSUSE-SU-2017:3039-1 No score

Security update for tomcat

This update for tomcat fixes the following issues:

Security issues fixed:

  • CVE-2017-5664: A problem in handling error pages was fixed, to avoid potential file overwrites during error page handling. (bsc#1042910).
  • CVE-2017-7674: A CORS Filter issue could lead to client and server side cache poisoning (bsc#1053352)
  • CVE-2017-12617: A remote code execution possibility via JSP Upload was fixed (bsc#1059554)

Non security bugs fixed:

  • Fix tomcat-digest classpath error (bsc#977410)
  • Fix packaged /etc/alternatives symlinks for api libs that caused rpm -V to report link mismatch (bsc#1019016)
Record
SUSE-SU-2017:3039-1
Updated
2026-11-02
OSVSUSE-SU-2017:3059-1 No score

Security update for tomcat

Apache Tomcat was updated to 7.0.82 adding features, fixing bugs and security issues.

This is another bugfix release, for full details see:

https://tomcat.apache.org/tomcat-7.0-doc/changelog.html

Fixed security issues:

  • CVE-2017-5664: A problem in handling error pages was fixed, to avoid potential file overwrites during error page handling. (bsc#1042910).
  • CVE-2017-7674: A CORS Filter issue could lead to client and server side cache poisoning (bsc#1053352)
  • CVE-2017-12617: A remote code execution possibility via JSP Upload was fixed (bsc#1059554)
  • CVE-2017-12616: An information disclosure when using VirtualDirContext was fixed (bsc#1059551)
  • CVE-2017-12615: A Remote Code Execution via JSP Upload was fixed (bsc#1059554)

Non-security issues fixed:

  • Fix tomcat-digest classpath error (bsc#977410)
Record
SUSE-SU-2017:3059-1
Updated
2026-11-02
OSVSUSE-SU-2017:3279-1 No score

Security update for tomcat

This update for tomcat fixes the following issues:

Security issues fixed:

  • CVE-2017-5664: A problem in handling error pages was fixed, to avoid potential file overwrites during error page handling. (bsc#1042910).
  • CVE-2017-7674: A CORS Filter issue could lead to client and server side cache poisoning (bsc#1053352)
  • CVE-2017-12617: A remote code execution possibility via JSP Upload was fixed (bsc#1059554)

Non security issues fixed:

  • Fix tomcat-digest classpath error (bsc#977410)
  • Read setenv.sh when starting Tomcat with catalina.sh (bsc#1002639)
  • Fix packaged /etc/alternatives symlinks for api libs that caused rpm -V to report link mismatch (bsc#1019016)
Record
SUSE-SU-2017:3279-1
Updated
2026-11-02
OSVSUSE-SU-2018:1847-1 No score

Security update for tomcat6

This update for tomcat6 fixes the following security issues:

  • : The error page mechanism of the Java Servlet Specification requires that, when an error occurs and an error page is configured for the error that occurred, the original request and response are forwarded to the error page. This means that the request is presented to the error page with the original HTTP method. If the error page is a static file, expected behaviour is to serve content of the file as if processing a GET request, regardless of the actual HTTP method. The Default Servlet in Tomcat did not do this. Depending on the original request this could lead to unexpected and undesirable results for static error pages including, if the DefaultServlet is configured to permit writes, the replacement or removal of the custom error page (bsc#1042910).
  • : The URL pattern of '' was not correctly handled when used as part of a security constraint definition. This caused the constraint to be ignored. It was possible for unauthorised users to gain access to web application resources that should have been protected. Only security constraints with a URL pattern of the empty string were affected (bsc#1082480).
Record
SUSE-SU-2018:1847-1
Updated
2026-11-02
OSVUSN-3519-1 No score

tomcat7, tomcat8 vulnerabilities

It was discovered that Tomcat incorrectly handled certain pipelined requests when sendfile was used. A remote attacker could use this issue to obtain wrong responses possibly containing sensitive information. (CVE-2017-5647)

It was discovered that Tomcat incorrectly used the appropriate facade object. A malicious application could possibly use this to bypass Security Manager restrictions. (CVE-2017-5648)

It was discovered that Tomcat incorrectly handled error pages. A remote attacker could possibly use this issue to replace or remove the custom error page. (CVE-2017-5664)

It was discovered that Tomcat incorrectly handled the CORS filter. A remote attacker could possibly use this issue to perform cache poisoning. (CVE-2017-7674)

Record
USN-3519-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
org.apache.tomcat:tomcat
Maven
 9.0.0.M1 to 9.0.0.M20
9.0.0.M21
org.apache.tomcat:tomcat
Maven
 8.5.0 to 8.5.14
8.5.15
org.apache.tomcat:tomcat
Maven
 8.0.0 to 8.0.43
8.0.44
org.apache.tomcat:tomcat
Maven
 7.0.0 to 7.0.77
7.0.78
org.apache.tomcat.embed:tomcat-embed-core
TuxCare:Maven
From an advisory covering 16 CVEs
 7.0.70 up to 7.0.70-tuxcare.4, plus listed versions
7.0.70-tuxcare.17.0.70-tuxcare.27.0.70-tuxcare.3
7.0.70-tuxcare.4
org.apache.tomcat.embed:tomcat-embed-el
TuxCare:Maven
From an advisory covering 16 CVEs
 7.0.70 up to 7.0.70-tuxcare.4, plus listed versions
7.0.70-tuxcare.17.0.70-tuxcare.27.0.70-tuxcare.3
7.0.70-tuxcare.4
org.apache.tomcat.embed:tomcat-embed-jasper
TuxCare:Maven
From an advisory covering 16 CVEs
 7.0.70 up to 7.0.70-tuxcare.4, plus listed versions
7.0.70-tuxcare.17.0.70-tuxcare.27.0.70-tuxcare.3
7.0.70-tuxcare.4
org.apache.tomcat.embed:tomcat-embed-logging-juli
TuxCare:Maven
From an advisory covering 16 CVEs
 7.0.70 up to 7.0.70-tuxcare.4, plus listed versions
7.0.70-tuxcare.17.0.70-tuxcare.27.0.70-tuxcare.3
7.0.70-tuxcare.4
org.apache.tomcat.embed:tomcat-embed-logging-log4j
TuxCare:Maven
From an advisory covering 16 CVEs
 7.0.70 up to 7.0.70-tuxcare.4, plus listed versions
7.0.70-tuxcare.17.0.70-tuxcare.27.0.70-tuxcare.3
7.0.70-tuxcare.4
org.apache.tomcat.embed:tomcat-embed-websocket
TuxCare:Maven
From an advisory covering 16 CVEs
 7.0.70 up to 7.0.70-tuxcare.4, plus listed versions
7.0.70-tuxcare.17.0.70-tuxcare.27.0.70-tuxcare.3
7.0.70-tuxcare.4
Show 290 moreShow less
Affected packages
PackageAffectedFixed
org.apache.tomcat.extras:tomcat-extras-juli
TuxCare:Maven
From an advisory covering 16 CVEs
 7.0.70 up to 7.0.70-tuxcare.4, plus listed versions
7.0.70-tuxcare.17.0.70-tuxcare.27.0.70-tuxcare.3
7.0.70-tuxcare.4
org.apache.tomcat.extras:tomcat-extras-juli-adapters
TuxCare:Maven
From an advisory covering 16 CVEs
 7.0.70 up to 7.0.70-tuxcare.4, plus listed versions
7.0.70-tuxcare.17.0.70-tuxcare.27.0.70-tuxcare.3
7.0.70-tuxcare.4
org.apache.tomcat:tomcat
TuxCare:Maven
From an advisory covering 16 CVEs
 7.0.70 up to 7.0.70-tuxcare.4, plus listed versions
7.0.70-tuxcare.17.0.70-tuxcare.27.0.70-tuxcare.3
7.0.70-tuxcare.4
org.apache.tomcat:tomcat-annotations-api
TuxCare:Maven
From an advisory covering 16 CVEs
 7.0.70 up to 7.0.70-tuxcare.4, plus listed versions
7.0.70-tuxcare.17.0.70-tuxcare.27.0.70-tuxcare.3
7.0.70-tuxcare.4
org.apache.tomcat:tomcat-api
TuxCare:Maven
From an advisory covering 16 CVEs
 7.0.70 up to 7.0.70-tuxcare.4, plus listed versions
7.0.70-tuxcare.17.0.70-tuxcare.27.0.70-tuxcare.3
7.0.70-tuxcare.4
org.apache.tomcat:tomcat-catalina
TuxCare:Maven
From an advisory covering 16 CVEs
 7.0.70 up to 7.0.70-tuxcare.4, plus listed versions
7.0.70-tuxcare.17.0.70-tuxcare.27.0.70-tuxcare.3
7.0.70-tuxcare.4
org.apache.tomcat:tomcat-catalina-ant
TuxCare:Maven
From an advisory covering 16 CVEs
 7.0.70 up to 7.0.70-tuxcare.4, plus listed versions
7.0.70-tuxcare.17.0.70-tuxcare.27.0.70-tuxcare.3
7.0.70-tuxcare.4
org.apache.tomcat:tomcat-catalina-ha
TuxCare:Maven
From an advisory covering 16 CVEs
 7.0.70 up to 7.0.70-tuxcare.4, plus listed versions
7.0.70-tuxcare.17.0.70-tuxcare.27.0.70-tuxcare.3
7.0.70-tuxcare.4
org.apache.tomcat:tomcat-catalina-jmx-remote
TuxCare:Maven
From an advisory covering 16 CVEs
 7.0.70 up to 7.0.70-tuxcare.4, plus listed versions
7.0.70-tuxcare.17.0.70-tuxcare.27.0.70-tuxcare.3
7.0.70-tuxcare.4
org.apache.tomcat:tomcat-catalina-ws
TuxCare:Maven
From an advisory covering 16 CVEs
 7.0.70 up to 7.0.70-tuxcare.4, plus listed versions
7.0.70-tuxcare.17.0.70-tuxcare.27.0.70-tuxcare.3
7.0.70-tuxcare.4
org.apache.tomcat:tomcat-coyote
TuxCare:Maven
From an advisory covering 16 CVEs
 7.0.70 up to 7.0.70-tuxcare.4, plus listed versions
7.0.70-tuxcare.17.0.70-tuxcare.27.0.70-tuxcare.3
7.0.70-tuxcare.4
org.apache.tomcat:tomcat-dbcp
TuxCare:Maven
From an advisory covering 16 CVEs
 7.0.70 up to 7.0.70-tuxcare.4, plus listed versions
7.0.70-tuxcare.17.0.70-tuxcare.27.0.70-tuxcare.3
7.0.70-tuxcare.4
org.apache.tomcat:tomcat-el-api
TuxCare:Maven
From an advisory covering 16 CVEs
 7.0.70 up to 7.0.70-tuxcare.4, plus listed versions
7.0.70-tuxcare.17.0.70-tuxcare.27.0.70-tuxcare.3
7.0.70-tuxcare.4
org.apache.tomcat:tomcat-i18n-es
TuxCare:Maven
From an advisory covering 16 CVEs
 7.0.70 up to 7.0.70-tuxcare.4, plus listed versions
7.0.70-tuxcare.17.0.70-tuxcare.27.0.70-tuxcare.3
7.0.70-tuxcare.4
org.apache.tomcat:tomcat-i18n-fr
TuxCare:Maven
From an advisory covering 16 CVEs
 7.0.70 up to 7.0.70-tuxcare.4, plus listed versions
7.0.70-tuxcare.17.0.70-tuxcare.27.0.70-tuxcare.3
7.0.70-tuxcare.4
org.apache.tomcat:tomcat-i18n-ja
TuxCare:Maven
From an advisory covering 16 CVEs
 7.0.70 up to 7.0.70-tuxcare.4, plus listed versions
7.0.70-tuxcare.17.0.70-tuxcare.27.0.70-tuxcare.3
7.0.70-tuxcare.4
org.apache.tomcat:tomcat-jasper
TuxCare:Maven
From an advisory covering 16 CVEs
 7.0.70 up to 7.0.70-tuxcare.4, plus listed versions
7.0.70-tuxcare.17.0.70-tuxcare.27.0.70-tuxcare.3
7.0.70-tuxcare.4
org.apache.tomcat:tomcat-jasper-el
TuxCare:Maven
From an advisory covering 16 CVEs
 7.0.70 up to 7.0.70-tuxcare.4, plus listed versions
7.0.70-tuxcare.17.0.70-tuxcare.27.0.70-tuxcare.3
7.0.70-tuxcare.4
org.apache.tomcat:tomcat-jdbc
TuxCare:Maven
From an advisory covering 16 CVEs
 7.0.70 up to 7.0.70-tuxcare.4, plus listed versions
7.0.70-tuxcare.17.0.70-tuxcare.27.0.70-tuxcare.3
7.0.70-tuxcare.4
org.apache.tomcat:tomcat-jsp-api
TuxCare:Maven
From an advisory covering 16 CVEs
 7.0.70 up to 7.0.70-tuxcare.4, plus listed versions
7.0.70-tuxcare.17.0.70-tuxcare.27.0.70-tuxcare.3
7.0.70-tuxcare.4
org.apache.tomcat:tomcat-juli
TuxCare:Maven
From an advisory covering 16 CVEs
 7.0.70 up to 7.0.70-tuxcare.4, plus listed versions
7.0.70-tuxcare.17.0.70-tuxcare.27.0.70-tuxcare.3
7.0.70-tuxcare.4
org.apache.tomcat:tomcat-servlet-api
TuxCare:Maven
From an advisory covering 16 CVEs
 7.0.70 up to 7.0.70-tuxcare.4, plus listed versions
7.0.70-tuxcare.17.0.70-tuxcare.27.0.70-tuxcare.3
7.0.70-tuxcare.4
org.apache.tomcat:tomcat-tribes
TuxCare:Maven
From an advisory covering 16 CVEs
 7.0.70 up to 7.0.70-tuxcare.4, plus listed versions
7.0.70-tuxcare.17.0.70-tuxcare.27.0.70-tuxcare.3
7.0.70-tuxcare.4
org.apache.tomcat:tomcat-util
TuxCare:Maven
From an advisory covering 16 CVEs
 7.0.70 up to 7.0.70-tuxcare.4, plus listed versions
7.0.70-tuxcare.17.0.70-tuxcare.27.0.70-tuxcare.3
7.0.70-tuxcare.4
org.apache.tomcat:tomcat-websocket-api
TuxCare:Maven
From an advisory covering 16 CVEs
 7.0.70 up to 7.0.70-tuxcare.4, plus listed versions
7.0.70-tuxcare.17.0.70-tuxcare.27.0.70-tuxcare.3
7.0.70-tuxcare.4
org.apache.tomcat:tomcat7-websocket
TuxCare:Maven
From an advisory covering 16 CVEs
 7.0.70 up to 7.0.70-tuxcare.4, plus listed versions
7.0.70-tuxcare.17.0.70-tuxcare.27.0.70-tuxcare.3
7.0.70-tuxcare.4
tomcat7
Debian:7
 before 7.0.28-4+deb7u14, plus listed versions
7.0.28-47.0.28-4+deb7u17.0.28-4+deb7u107.0.28-4+deb7u117.0.28-4+deb7u12
Show 9 moreShow less
7.0.28-4+deb7u137.0.28-4+deb7u27.0.28-4+deb7u37.0.28-4+deb7u47.0.28-4+deb7u57.0.28-4+deb7u67.0.28-4+deb7u77.0.28-4+deb7u87.0.28-4+deb7u9
7.0.28-4+deb7u14
tomcat8
Debian:8
 before 8.0.14-1+deb8u10, plus listed versions
8.0.14-18.0.14-1+deb8u18.0.14-1+deb8u28.0.14-1+deb8u38.0.14-1+deb8u4
Show 5 moreShow less
8.0.14-1+deb8u58.0.14-1+deb8u68.0.14-1+deb8u78.0.14-1+deb8u88.0.14-1+deb8u9
8.0.14-1+deb8u10
tomcat8
Debian:9
 before 8.5.14-1+deb9u1, plus listed versions
8.5.14-1
8.5.14-1+deb9u1
tomcat7
Debian:8
 before 7.0.56-3+deb8u11, plus listed versions
7.0.56-37.0.56-3+deb8u17.0.56-3+deb8u107.0.56-3+deb8u27.0.56-3+deb8u3
Show 6 moreShow less
7.0.56-3+deb8u47.0.56-3+deb8u57.0.56-3+deb8u67.0.56-3+deb8u77.0.56-3+deb8u87.0.56-3+deb8u9
7.0.56-3+deb8u11
org.apache.tomcat:tomcat
Maven
 9.0.0.M1 up to 9.0.0.M21, plus listed versions
9.0.0.M109.0.0.M119.0.0.M139.0.0.M159.0.0.M17
Show 8 moreShow less
9.0.0.M189.0.0.M199.0.0.M209.0.0.M39.0.0.M49.0.0.M69.0.0.M89.0.0.M9
9.0.0.M21
org.apache.tomcat:tomcat
Maven
 8.5.0 up to 8.5.15, plus listed versions
8.5.118.5.128.5.138.5.148.5.2
Show 6 moreShow less
8.5.38.5.48.5.58.5.68.5.88.5.9
8.5.15
org.apache.tomcat:tomcat
Maven
 8.0.0 up to 8.0.44, plus listed versions
8.0.18.0.118.0.128.0.148.0.15
Show 26 moreShow less
8.0.178.0.188.0.208.0.218.0.228.0.238.0.248.0.268.0.278.0.288.0.298.0.38.0.308.0.328.0.338.0.358.0.368.0.378.0.388.0.398.0.418.0.428.0.438.0.58.0.88.0.9
8.0.44
org.apache.tomcat:tomcat
Maven
 7.0.0 up to 7.0.78, plus listed versions
7.0.357.0.377.0.397.0.407.0.41
Show 24 moreShow less
7.0.427.0.477.0.507.0.527.0.537.0.547.0.557.0.567.0.577.0.597.0.617.0.627.0.637.0.647.0.657.0.677.0.687.0.697.0.707.0.727.0.737.0.757.0.767.0.77
7.0.78
tomcat
Mageia:5
 before 7.0.78-1.mga5
7.0.78-1.mga5
log4j-eap6
Red Hat:jboss_enterprise_web_server:3.1::el6
From an advisory covering 9 CVEs
 before 0:1.2.16-12.redhat_3.1.ep6.el6
0:1.2.16-12.redhat_3.1.ep6.el6
tomcat-native
Red Hat:jboss_enterprise_web_server:3.1::el6
From an advisory covering 9 CVEs
 before 0:1.2.8-10.redhat_10.ep7.el6
0:1.2.8-10.redhat_10.ep7.el6
tomcat-native-debuginfo
Red Hat:jboss_enterprise_web_server:3.1::el6
From an advisory covering 9 CVEs
 before 0:1.2.8-10.redhat_10.ep7.el6
0:1.2.8-10.redhat_10.ep7.el6
tomcat7
Red Hat:jboss_enterprise_web_server:3.1::el6
From an advisory covering 9 CVEs
 before 0:7.0.70-22.ep7.el6
0:7.0.70-22.ep7.el6
tomcat7-admin-webapps
Red Hat:jboss_enterprise_web_server:3.1::el6
From an advisory covering 9 CVEs
 before 0:7.0.70-22.ep7.el6
0:7.0.70-22.ep7.el6
tomcat7-docs-webapp
Red Hat:jboss_enterprise_web_server:3.1::el6
From an advisory covering 9 CVEs
 before 0:7.0.70-22.ep7.el6
0:7.0.70-22.ep7.el6
tomcat7-el-2.2-api
Red Hat:jboss_enterprise_web_server:3.1::el6
From an advisory covering 9 CVEs
 before 0:7.0.70-22.ep7.el6
0:7.0.70-22.ep7.el6
tomcat7-javadoc
Red Hat:jboss_enterprise_web_server:3.1::el6
From an advisory covering 9 CVEs
 before 0:7.0.70-22.ep7.el6
0:7.0.70-22.ep7.el6
tomcat7-jsp-2.2-api
Red Hat:jboss_enterprise_web_server:3.1::el6
From an advisory covering 9 CVEs
 before 0:7.0.70-22.ep7.el6
0:7.0.70-22.ep7.el6
tomcat7-jsvc
Red Hat:jboss_enterprise_web_server:3.1::el6
From an advisory covering 9 CVEs
 before 0:7.0.70-22.ep7.el6
0:7.0.70-22.ep7.el6
tomcat7-lib
Red Hat:jboss_enterprise_web_server:3.1::el6
From an advisory covering 9 CVEs
 before 0:7.0.70-22.ep7.el6
0:7.0.70-22.ep7.el6
tomcat7-log4j
Red Hat:jboss_enterprise_web_server:3.1::el6
From an advisory covering 9 CVEs
 before 0:7.0.70-22.ep7.el6
0:7.0.70-22.ep7.el6
tomcat7-selinux
Red Hat:jboss_enterprise_web_server:3.1::el6
From an advisory covering 9 CVEs
 before 0:7.0.70-22.ep7.el6
0:7.0.70-22.ep7.el6
tomcat7-servlet-3.0-api
Red Hat:jboss_enterprise_web_server:3.1::el6
From an advisory covering 9 CVEs
 before 0:7.0.70-22.ep7.el6
0:7.0.70-22.ep7.el6
tomcat7-webapps
Red Hat:jboss_enterprise_web_server:3.1::el6
From an advisory covering 9 CVEs
 before 0:7.0.70-22.ep7.el6
0:7.0.70-22.ep7.el6
tomcat8
Red Hat:jboss_enterprise_web_server:3.1::el6
From an advisory covering 9 CVEs
 before 0:8.0.36-24.ep7.el6
0:8.0.36-24.ep7.el6
tomcat8-admin-webapps
Red Hat:jboss_enterprise_web_server:3.1::el6
From an advisory covering 9 CVEs
 before 0:8.0.36-24.ep7.el6
0:8.0.36-24.ep7.el6
tomcat8-docs-webapp
Red Hat:jboss_enterprise_web_server:3.1::el6
From an advisory covering 9 CVEs
 before 0:8.0.36-24.ep7.el6
0:8.0.36-24.ep7.el6
tomcat8-el-2.2-api
Red Hat:jboss_enterprise_web_server:3.1::el6
From an advisory covering 9 CVEs
 before 0:8.0.36-24.ep7.el6
0:8.0.36-24.ep7.el6
tomcat8-javadoc
Red Hat:jboss_enterprise_web_server:3.1::el6
From an advisory covering 9 CVEs
 before 0:8.0.36-24.ep7.el6
0:8.0.36-24.ep7.el6
tomcat8-jsp-2.3-api
Red Hat:jboss_enterprise_web_server:3.1::el6
From an advisory covering 9 CVEs
 before 0:8.0.36-24.ep7.el6
0:8.0.36-24.ep7.el6
tomcat8-jsvc
Red Hat:jboss_enterprise_web_server:3.1::el6
From an advisory covering 9 CVEs
 before 0:8.0.36-24.ep7.el6
0:8.0.36-24.ep7.el6
tomcat8-lib
Red Hat:jboss_enterprise_web_server:3.1::el6
From an advisory covering 9 CVEs
 before 0:8.0.36-24.ep7.el6
0:8.0.36-24.ep7.el6
tomcat8-log4j
Red Hat:jboss_enterprise_web_server:3.1::el6
From an advisory covering 9 CVEs
 before 0:8.0.36-24.ep7.el6
0:8.0.36-24.ep7.el6
tomcat8-selinux
Red Hat:jboss_enterprise_web_server:3.1::el6
From an advisory covering 9 CVEs
 before 0:8.0.36-24.ep7.el6
0:8.0.36-24.ep7.el6
tomcat8-servlet-3.1-api
Red Hat:jboss_enterprise_web_server:3.1::el6
From an advisory covering 9 CVEs
 before 0:8.0.36-24.ep7.el6
0:8.0.36-24.ep7.el6
tomcat8-webapps
Red Hat:jboss_enterprise_web_server:3.1::el6
From an advisory covering 9 CVEs
 before 0:8.0.36-24.ep7.el6
0:8.0.36-24.ep7.el6
log4j-eap6
Red Hat:jboss_enterprise_web_server:3.1::el7
From an advisory covering 9 CVEs
 before 0:1.2.16-12.redhat_3.1.ep6.el7
0:1.2.16-12.redhat_3.1.ep6.el7
tomcat-native
Red Hat:jboss_enterprise_web_server:3.1::el7
From an advisory covering 9 CVEs
 before 0:1.2.8-10.redhat_10.ep7.el7
0:1.2.8-10.redhat_10.ep7.el7
tomcat-native-debuginfo
Red Hat:jboss_enterprise_web_server:3.1::el7
From an advisory covering 9 CVEs
 before 0:1.2.8-10.redhat_10.ep7.el7
0:1.2.8-10.redhat_10.ep7.el7
tomcat7
Red Hat:jboss_enterprise_web_server:3.1::el7
From an advisory covering 9 CVEs
 before 0:7.0.70-22.ep7.el7
0:7.0.70-22.ep7.el7
tomcat7-admin-webapps
Red Hat:jboss_enterprise_web_server:3.1::el7
From an advisory covering 9 CVEs
 before 0:7.0.70-22.ep7.el7
0:7.0.70-22.ep7.el7
tomcat7-docs-webapp
Red Hat:jboss_enterprise_web_server:3.1::el7
From an advisory covering 9 CVEs
 before 0:7.0.70-22.ep7.el7
0:7.0.70-22.ep7.el7
tomcat7-el-2.2-api
Red Hat:jboss_enterprise_web_server:3.1::el7
From an advisory covering 9 CVEs
 before 0:7.0.70-22.ep7.el7
0:7.0.70-22.ep7.el7
tomcat7-javadoc
Red Hat:jboss_enterprise_web_server:3.1::el7
From an advisory covering 9 CVEs
 before 0:7.0.70-22.ep7.el7
0:7.0.70-22.ep7.el7
tomcat7-jsp-2.2-api
Red Hat:jboss_enterprise_web_server:3.1::el7
From an advisory covering 9 CVEs
 before 0:7.0.70-22.ep7.el7
0:7.0.70-22.ep7.el7
tomcat7-jsvc
Red Hat:jboss_enterprise_web_server:3.1::el7
From an advisory covering 9 CVEs
 before 0:7.0.70-22.ep7.el7
0:7.0.70-22.ep7.el7
tomcat7-lib
Red Hat:jboss_enterprise_web_server:3.1::el7
From an advisory covering 9 CVEs
 before 0:7.0.70-22.ep7.el7
0:7.0.70-22.ep7.el7
tomcat7-log4j
Red Hat:jboss_enterprise_web_server:3.1::el7
From an advisory covering 9 CVEs
 before 0:7.0.70-22.ep7.el7
0:7.0.70-22.ep7.el7
tomcat7-selinux
Red Hat:jboss_enterprise_web_server:3.1::el7
From an advisory covering 9 CVEs
 before 0:7.0.70-22.ep7.el7
0:7.0.70-22.ep7.el7
tomcat7-servlet-3.0-api
Red Hat:jboss_enterprise_web_server:3.1::el7
From an advisory covering 9 CVEs
 before 0:7.0.70-22.ep7.el7
0:7.0.70-22.ep7.el7
tomcat7-webapps
Red Hat:jboss_enterprise_web_server:3.1::el7
From an advisory covering 9 CVEs
 before 0:7.0.70-22.ep7.el7
0:7.0.70-22.ep7.el7
tomcat8
Red Hat:jboss_enterprise_web_server:3.1::el7
From an advisory covering 9 CVEs
 before 0:8.0.36-24.ep7.el7
0:8.0.36-24.ep7.el7
tomcat8-admin-webapps
Red Hat:jboss_enterprise_web_server:3.1::el7
From an advisory covering 9 CVEs
 before 0:8.0.36-24.ep7.el7
0:8.0.36-24.ep7.el7
tomcat8-docs-webapp
Red Hat:jboss_enterprise_web_server:3.1::el7
From an advisory covering 9 CVEs
 before 0:8.0.36-24.ep7.el7
0:8.0.36-24.ep7.el7
tomcat8-el-2.2-api
Red Hat:jboss_enterprise_web_server:3.1::el7
From an advisory covering 9 CVEs
 before 0:8.0.36-24.ep7.el7
0:8.0.36-24.ep7.el7
tomcat8-javadoc
Red Hat:jboss_enterprise_web_server:3.1::el7
From an advisory covering 9 CVEs
 before 0:8.0.36-24.ep7.el7
0:8.0.36-24.ep7.el7
tomcat8-jsp-2.3-api
Red Hat:jboss_enterprise_web_server:3.1::el7
From an advisory covering 9 CVEs
 before 0:8.0.36-24.ep7.el7
0:8.0.36-24.ep7.el7
tomcat8-jsvc
Red Hat:jboss_enterprise_web_server:3.1::el7
From an advisory covering 9 CVEs
 before 0:8.0.36-24.ep7.el7
0:8.0.36-24.ep7.el7
tomcat8-lib
Red Hat:jboss_enterprise_web_server:3.1::el7
From an advisory covering 9 CVEs
 before 0:8.0.36-24.ep7.el7
0:8.0.36-24.ep7.el7
tomcat8-log4j
Red Hat:jboss_enterprise_web_server:3.1::el7
From an advisory covering 9 CVEs
 before 0:8.0.36-24.ep7.el7
0:8.0.36-24.ep7.el7
tomcat8-selinux
Red Hat:jboss_enterprise_web_server:3.1::el7
From an advisory covering 9 CVEs
 before 0:8.0.36-24.ep7.el7
0:8.0.36-24.ep7.el7
tomcat8-servlet-3.1-api
Red Hat:jboss_enterprise_web_server:3.1::el7
From an advisory covering 9 CVEs
 before 0:8.0.36-24.ep7.el7
0:8.0.36-24.ep7.el7
tomcat8-webapps
Red Hat:jboss_enterprise_web_server:3.1::el7
From an advisory covering 9 CVEs
 before 0:8.0.36-24.ep7.el7
0:8.0.36-24.ep7.el7
tomcat
Red Hat:enterprise_linux:7::client
From an advisory covering 2 CVEs
 before 0:7.0.69-12.el7_3
0:7.0.69-12.el7_3
tomcat-servlet-3.0-api
Red Hat:enterprise_linux:7::client
From an advisory covering 2 CVEs
 before 0:7.0.69-12.el7_3
0:7.0.69-12.el7_3
tomcat-admin-webapps
Red Hat:enterprise_linux:7::client
From an advisory covering 2 CVEs
 before 0:7.0.69-12.el7_3
0:7.0.69-12.el7_3
tomcat-docs-webapp
Red Hat:enterprise_linux:7::client
From an advisory covering 2 CVEs
 before 0:7.0.69-12.el7_3
0:7.0.69-12.el7_3
tomcat-el-2.2-api
Red Hat:enterprise_linux:7::client
From an advisory covering 2 CVEs
 before 0:7.0.69-12.el7_3
0:7.0.69-12.el7_3
tomcat-javadoc
Red Hat:enterprise_linux:7::client
From an advisory covering 2 CVEs
 before 0:7.0.69-12.el7_3
0:7.0.69-12.el7_3
tomcat-jsp-2.2-api
Red Hat:enterprise_linux:7::client
From an advisory covering 2 CVEs
 before 0:7.0.69-12.el7_3
0:7.0.69-12.el7_3
tomcat-jsvc
Red Hat:enterprise_linux:7::client
From an advisory covering 2 CVEs
 before 0:7.0.69-12.el7_3
0:7.0.69-12.el7_3
tomcat-lib
Red Hat:enterprise_linux:7::client
From an advisory covering 2 CVEs
 before 0:7.0.69-12.el7_3
0:7.0.69-12.el7_3
tomcat-webapps
Red Hat:enterprise_linux:7::client
From an advisory covering 2 CVEs
 before 0:7.0.69-12.el7_3
0:7.0.69-12.el7_3
tomcat
Red Hat:enterprise_linux:7::computenode
From an advisory covering 2 CVEs
 before 0:7.0.69-12.el7_3
0:7.0.69-12.el7_3
tomcat-servlet-3.0-api
Red Hat:enterprise_linux:7::computenode
From an advisory covering 2 CVEs
 before 0:7.0.69-12.el7_3
0:7.0.69-12.el7_3
tomcat-admin-webapps
Red Hat:enterprise_linux:7::computenode
From an advisory covering 2 CVEs
 before 0:7.0.69-12.el7_3
0:7.0.69-12.el7_3
tomcat-docs-webapp
Red Hat:enterprise_linux:7::computenode
From an advisory covering 2 CVEs
 before 0:7.0.69-12.el7_3
0:7.0.69-12.el7_3
tomcat-el-2.2-api
Red Hat:enterprise_linux:7::computenode
From an advisory covering 2 CVEs
 before 0:7.0.69-12.el7_3
0:7.0.69-12.el7_3
tomcat-javadoc
Red Hat:enterprise_linux:7::computenode
From an advisory covering 2 CVEs
 before 0:7.0.69-12.el7_3
0:7.0.69-12.el7_3
tomcat-jsp-2.2-api
Red Hat:enterprise_linux:7::computenode
From an advisory covering 2 CVEs
 before 0:7.0.69-12.el7_3
0:7.0.69-12.el7_3
tomcat-jsvc
Red Hat:enterprise_linux:7::computenode
From an advisory covering 2 CVEs
 before 0:7.0.69-12.el7_3
0:7.0.69-12.el7_3
tomcat-lib
Red Hat:enterprise_linux:7::computenode
From an advisory covering 2 CVEs
 before 0:7.0.69-12.el7_3
0:7.0.69-12.el7_3
tomcat-webapps
Red Hat:enterprise_linux:7::computenode
From an advisory covering 2 CVEs
 before 0:7.0.69-12.el7_3
0:7.0.69-12.el7_3
tomcat
Red Hat:enterprise_linux:7::server
From an advisory covering 2 CVEs
 before 0:7.0.69-12.el7_3
0:7.0.69-12.el7_3
tomcat-admin-webapps
Red Hat:enterprise_linux:7::server
From an advisory covering 2 CVEs
 before 0:7.0.69-12.el7_3
0:7.0.69-12.el7_3
tomcat-el-2.2-api
Red Hat:enterprise_linux:7::server
From an advisory covering 2 CVEs
 before 0:7.0.69-12.el7_3
0:7.0.69-12.el7_3
tomcat-jsp-2.2-api
Red Hat:enterprise_linux:7::server
From an advisory covering 2 CVEs
 before 0:7.0.69-12.el7_3
0:7.0.69-12.el7_3
tomcat-lib
Red Hat:enterprise_linux:7::server
From an advisory covering 2 CVEs
 before 0:7.0.69-12.el7_3
0:7.0.69-12.el7_3
tomcat-servlet-3.0-api
Red Hat:enterprise_linux:7::server
From an advisory covering 2 CVEs
 before 0:7.0.69-12.el7_3
0:7.0.69-12.el7_3
tomcat-webapps
Red Hat:enterprise_linux:7::server
From an advisory covering 2 CVEs
 before 0:7.0.69-12.el7_3
0:7.0.69-12.el7_3
tomcat-docs-webapp
Red Hat:enterprise_linux:7::server
From an advisory covering 2 CVEs
 before 0:7.0.69-12.el7_3
0:7.0.69-12.el7_3
tomcat-javadoc
Red Hat:enterprise_linux:7::server
From an advisory covering 2 CVEs
 before 0:7.0.69-12.el7_3
0:7.0.69-12.el7_3
tomcat-jsvc
Red Hat:enterprise_linux:7::server
From an advisory covering 2 CVEs
 before 0:7.0.69-12.el7_3
0:7.0.69-12.el7_3
tomcat
Red Hat:enterprise_linux:7::workstation
From an advisory covering 2 CVEs
 before 0:7.0.69-12.el7_3
0:7.0.69-12.el7_3
tomcat-admin-webapps
Red Hat:enterprise_linux:7::workstation
From an advisory covering 2 CVEs
 before 0:7.0.69-12.el7_3
0:7.0.69-12.el7_3
tomcat-el-2.2-api
Red Hat:enterprise_linux:7::workstation
From an advisory covering 2 CVEs
 before 0:7.0.69-12.el7_3
0:7.0.69-12.el7_3
tomcat-jsp-2.2-api
Red Hat:enterprise_linux:7::workstation
From an advisory covering 2 CVEs
 before 0:7.0.69-12.el7_3
0:7.0.69-12.el7_3
tomcat-lib
Red Hat:enterprise_linux:7::workstation
From an advisory covering 2 CVEs
 before 0:7.0.69-12.el7_3
0:7.0.69-12.el7_3
tomcat-servlet-3.0-api
Red Hat:enterprise_linux:7::workstation
From an advisory covering 2 CVEs
 before 0:7.0.69-12.el7_3
0:7.0.69-12.el7_3
tomcat-webapps
Red Hat:enterprise_linux:7::workstation
From an advisory covering 2 CVEs
 before 0:7.0.69-12.el7_3
0:7.0.69-12.el7_3
tomcat-docs-webapp
Red Hat:enterprise_linux:7::workstation
From an advisory covering 2 CVEs
 before 0:7.0.69-12.el7_3
0:7.0.69-12.el7_3
tomcat-javadoc
Red Hat:enterprise_linux:7::workstation
From an advisory covering 2 CVEs
 before 0:7.0.69-12.el7_3
0:7.0.69-12.el7_3
tomcat-jsvc
Red Hat:enterprise_linux:7::workstation
From an advisory covering 2 CVEs
 before 0:7.0.69-12.el7_3
0:7.0.69-12.el7_3
jbcs-httpd24-openssl
Red Hat:jboss_enterprise_web_server:2::el6
From an advisory covering 4 CVEs
 before 1:1.0.2h-13.jbcs.el6
1:1.0.2h-13.jbcs.el6
jbcs-httpd24-openssl-debuginfo
Red Hat:jboss_enterprise_web_server:2::el6
From an advisory covering 4 CVEs
 before 1:1.0.2h-13.jbcs.el6
1:1.0.2h-13.jbcs.el6
jbcs-httpd24-openssl-devel
Red Hat:jboss_enterprise_web_server:2::el6
From an advisory covering 4 CVEs
 before 1:1.0.2h-13.jbcs.el6
1:1.0.2h-13.jbcs.el6
jbcs-httpd24-openssl-libs
Red Hat:jboss_enterprise_web_server:2::el6
From an advisory covering 4 CVEs
 before 1:1.0.2h-13.jbcs.el6
1:1.0.2h-13.jbcs.el6
jbcs-httpd24-openssl-perl
Red Hat:jboss_enterprise_web_server:2::el6
From an advisory covering 4 CVEs
 before 1:1.0.2h-13.jbcs.el6
1:1.0.2h-13.jbcs.el6
jbcs-httpd24-openssl-static
Red Hat:jboss_enterprise_web_server:2::el6
From an advisory covering 4 CVEs
 before 1:1.0.2h-13.jbcs.el6
1:1.0.2h-13.jbcs.el6
tomcat6
Red Hat:jboss_enterprise_web_server:2::el6
From an advisory covering 4 CVEs
 before 0:6.0.41-17_patch_04.ep6.el6
0:6.0.41-17_patch_04.ep6.el6
tomcat6-admin-webapps
Red Hat:jboss_enterprise_web_server:2::el6
From an advisory covering 4 CVEs
 before 0:6.0.41-17_patch_04.ep6.el6
0:6.0.41-17_patch_04.ep6.el6
tomcat6-docs-webapp
Red Hat:jboss_enterprise_web_server:2::el6
From an advisory covering 4 CVEs
 before 0:6.0.41-17_patch_04.ep6.el6
0:6.0.41-17_patch_04.ep6.el6
tomcat6-el-2.1-api
Red Hat:jboss_enterprise_web_server:2::el6
From an advisory covering 4 CVEs
 before 0:6.0.41-17_patch_04.ep6.el6
0:6.0.41-17_patch_04.ep6.el6
tomcat6-javadoc
Red Hat:jboss_enterprise_web_server:2::el6
From an advisory covering 4 CVEs
 before 0:6.0.41-17_patch_04.ep6.el6
0:6.0.41-17_patch_04.ep6.el6
tomcat6-jsp-2.1-api
Red Hat:jboss_enterprise_web_server:2::el6
From an advisory covering 4 CVEs
 before 0:6.0.41-17_patch_04.ep6.el6
0:6.0.41-17_patch_04.ep6.el6
tomcat6-lib
Red Hat:jboss_enterprise_web_server:2::el6
From an advisory covering 4 CVEs
 before 0:6.0.41-17_patch_04.ep6.el6
0:6.0.41-17_patch_04.ep6.el6
tomcat6-log4j
Red Hat:jboss_enterprise_web_server:2::el6
From an advisory covering 4 CVEs
 before 0:6.0.41-17_patch_04.ep6.el6
0:6.0.41-17_patch_04.ep6.el6
tomcat6-maven-devel
Red Hat:jboss_enterprise_web_server:2::el6
From an advisory covering 4 CVEs
 before 0:6.0.41-17_patch_04.ep6.el6
0:6.0.41-17_patch_04.ep6.el6
tomcat6-servlet-2.5-api
Red Hat:jboss_enterprise_web_server:2::el6
From an advisory covering 4 CVEs
 before 0:6.0.41-17_patch_04.ep6.el6
0:6.0.41-17_patch_04.ep6.el6
tomcat6-webapps
Red Hat:jboss_enterprise_web_server:2::el6
From an advisory covering 4 CVEs
 before 0:6.0.41-17_patch_04.ep6.el6
0:6.0.41-17_patch_04.ep6.el6
tomcat7
Red Hat:jboss_enterprise_web_server:2::el6
From an advisory covering 4 CVEs
 before 0:7.0.54-25_patch_05.ep6.el6
0:7.0.54-25_patch_05.ep6.el6
tomcat7-admin-webapps
Red Hat:jboss_enterprise_web_server:2::el6
From an advisory covering 4 CVEs
 before 0:7.0.54-25_patch_05.ep6.el6
0:7.0.54-25_patch_05.ep6.el6
tomcat7-docs-webapp
Red Hat:jboss_enterprise_web_server:2::el6
From an advisory covering 4 CVEs
 before 0:7.0.54-25_patch_05.ep6.el6
0:7.0.54-25_patch_05.ep6.el6
tomcat7-el-2.2-api
Red Hat:jboss_enterprise_web_server:2::el6
From an advisory covering 4 CVEs
 before 0:7.0.54-25_patch_05.ep6.el6
0:7.0.54-25_patch_05.ep6.el6
tomcat7-javadoc
Red Hat:jboss_enterprise_web_server:2::el6
From an advisory covering 4 CVEs
 before 0:7.0.54-25_patch_05.ep6.el6
0:7.0.54-25_patch_05.ep6.el6
tomcat7-jsp-2.2-api
Red Hat:jboss_enterprise_web_server:2::el6
From an advisory covering 4 CVEs
 before 0:7.0.54-25_patch_05.ep6.el6
0:7.0.54-25_patch_05.ep6.el6
tomcat7-lib
Red Hat:jboss_enterprise_web_server:2::el6
From an advisory covering 4 CVEs
 before 0:7.0.54-25_patch_05.ep6.el6
0:7.0.54-25_patch_05.ep6.el6
tomcat7-log4j
Red Hat:jboss_enterprise_web_server:2::el6
From an advisory covering 4 CVEs
 before 0:7.0.54-25_patch_05.ep6.el6
0:7.0.54-25_patch_05.ep6.el6
tomcat7-maven-devel
Red Hat:jboss_enterprise_web_server:2::el6
From an advisory covering 4 CVEs
 before 0:7.0.54-25_patch_05.ep6.el6
0:7.0.54-25_patch_05.ep6.el6
tomcat7-servlet-3.0-api
Red Hat:jboss_enterprise_web_server:2::el6
From an advisory covering 4 CVEs
 before 0:7.0.54-25_patch_05.ep6.el6
0:7.0.54-25_patch_05.ep6.el6
tomcat7-webapps
Red Hat:jboss_enterprise_web_server:2::el6
From an advisory covering 4 CVEs
 before 0:7.0.54-25_patch_05.ep6.el6
0:7.0.54-25_patch_05.ep6.el6
jbcs-httpd24-openssl
Red Hat:jboss_enterprise_web_server:2::el7
From an advisory covering 4 CVEs
 before 1:1.0.2h-13.jbcs.el7
1:1.0.2h-13.jbcs.el7
jbcs-httpd24-openssl-debuginfo
Red Hat:jboss_enterprise_web_server:2::el7
From an advisory covering 4 CVEs
 before 1:1.0.2h-13.jbcs.el7
1:1.0.2h-13.jbcs.el7
jbcs-httpd24-openssl-devel
Red Hat:jboss_enterprise_web_server:2::el7
From an advisory covering 4 CVEs
 before 1:1.0.2h-13.jbcs.el7
1:1.0.2h-13.jbcs.el7
jbcs-httpd24-openssl-libs
Red Hat:jboss_enterprise_web_server:2::el7
From an advisory covering 4 CVEs
 before 1:1.0.2h-13.jbcs.el7
1:1.0.2h-13.jbcs.el7
jbcs-httpd24-openssl-perl
Red Hat:jboss_enterprise_web_server:2::el7
From an advisory covering 4 CVEs
 before 1:1.0.2h-13.jbcs.el7
1:1.0.2h-13.jbcs.el7
jbcs-httpd24-openssl-static
Red Hat:jboss_enterprise_web_server:2::el7
From an advisory covering 4 CVEs
 before 1:1.0.2h-13.jbcs.el7
1:1.0.2h-13.jbcs.el7
tomcat6
Red Hat:jboss_enterprise_web_server:2::el7
From an advisory covering 4 CVEs
 before 0:6.0.41-17_patch_04.ep6.el7
0:6.0.41-17_patch_04.ep6.el7
tomcat6-admin-webapps
Red Hat:jboss_enterprise_web_server:2::el7
From an advisory covering 4 CVEs
 before 0:6.0.41-17_patch_04.ep6.el7
0:6.0.41-17_patch_04.ep6.el7
tomcat6-docs-webapp
Red Hat:jboss_enterprise_web_server:2::el7
From an advisory covering 4 CVEs
 before 0:6.0.41-17_patch_04.ep6.el7
0:6.0.41-17_patch_04.ep6.el7
tomcat6-el-2.1-api
Red Hat:jboss_enterprise_web_server:2::el7
From an advisory covering 4 CVEs
 before 0:6.0.41-17_patch_04.ep6.el7
0:6.0.41-17_patch_04.ep6.el7
tomcat6-javadoc
Red Hat:jboss_enterprise_web_server:2::el7
From an advisory covering 4 CVEs
 before 0:6.0.41-17_patch_04.ep6.el7
0:6.0.41-17_patch_04.ep6.el7
tomcat6-jsp-2.1-api
Red Hat:jboss_enterprise_web_server:2::el7
From an advisory covering 4 CVEs
 before 0:6.0.41-17_patch_04.ep6.el7
0:6.0.41-17_patch_04.ep6.el7
tomcat6-lib
Red Hat:jboss_enterprise_web_server:2::el7
From an advisory covering 4 CVEs
 before 0:6.0.41-17_patch_04.ep6.el7
0:6.0.41-17_patch_04.ep6.el7
tomcat6-log4j
Red Hat:jboss_enterprise_web_server:2::el7
From an advisory covering 4 CVEs
 before 0:6.0.41-17_patch_04.ep6.el7
0:6.0.41-17_patch_04.ep6.el7
tomcat6-maven-devel
Red Hat:jboss_enterprise_web_server:2::el7
From an advisory covering 4 CVEs
 before 0:6.0.41-17_patch_04.ep6.el7
0:6.0.41-17_patch_04.ep6.el7
tomcat6-servlet-2.5-api
Red Hat:jboss_enterprise_web_server:2::el7
From an advisory covering 4 CVEs
 before 0:6.0.41-17_patch_04.ep6.el7
0:6.0.41-17_patch_04.ep6.el7
tomcat6-webapps
Red Hat:jboss_enterprise_web_server:2::el7
From an advisory covering 4 CVEs
 before 0:6.0.41-17_patch_04.ep6.el7
0:6.0.41-17_patch_04.ep6.el7
tomcat7
Red Hat:jboss_enterprise_web_server:2::el7
From an advisory covering 4 CVEs
 before 0:7.0.54-25_patch_05.ep6.el7
0:7.0.54-25_patch_05.ep6.el7
tomcat7-admin-webapps
Red Hat:jboss_enterprise_web_server:2::el7
From an advisory covering 4 CVEs
 before 0:7.0.54-25_patch_05.ep6.el7
0:7.0.54-25_patch_05.ep6.el7
tomcat7-docs-webapp
Red Hat:jboss_enterprise_web_server:2::el7
From an advisory covering 4 CVEs
 before 0:7.0.54-25_patch_05.ep6.el7
0:7.0.54-25_patch_05.ep6.el7
tomcat7-el-2.2-api
Red Hat:jboss_enterprise_web_server:2::el7
From an advisory covering 4 CVEs
 before 0:7.0.54-25_patch_05.ep6.el7
0:7.0.54-25_patch_05.ep6.el7
tomcat7-javadoc
Red Hat:jboss_enterprise_web_server:2::el7
From an advisory covering 4 CVEs
 before 0:7.0.54-25_patch_05.ep6.el7
0:7.0.54-25_patch_05.ep6.el7
tomcat7-jsp-2.2-api
Red Hat:jboss_enterprise_web_server:2::el7
From an advisory covering 4 CVEs
 before 0:7.0.54-25_patch_05.ep6.el7
0:7.0.54-25_patch_05.ep6.el7
tomcat7-lib
Red Hat:jboss_enterprise_web_server:2::el7
From an advisory covering 4 CVEs
 before 0:7.0.54-25_patch_05.ep6.el7
0:7.0.54-25_patch_05.ep6.el7
tomcat7-log4j
Red Hat:jboss_enterprise_web_server:2::el7
From an advisory covering 4 CVEs
 before 0:7.0.54-25_patch_05.ep6.el7
0:7.0.54-25_patch_05.ep6.el7
tomcat7-maven-devel
Red Hat:jboss_enterprise_web_server:2::el7
From an advisory covering 4 CVEs
 before 0:7.0.54-25_patch_05.ep6.el7
0:7.0.54-25_patch_05.ep6.el7
tomcat7-servlet-3.0-api
Red Hat:jboss_enterprise_web_server:2::el7
From an advisory covering 4 CVEs
 before 0:7.0.54-25_patch_05.ep6.el7
0:7.0.54-25_patch_05.ep6.el7
tomcat7-webapps
Red Hat:jboss_enterprise_web_server:2::el7
From an advisory covering 4 CVEs
 before 0:7.0.54-25_patch_05.ep6.el7
0:7.0.54-25_patch_05.ep6.el7
apache-cxf
Red Hat:jboss_enterprise_application_platform:6::el6
From an advisory covering 3 CVEs
 before 0:2.7.18-7.SP6_redhat_1.1.ep6.el6
0:2.7.18-7.SP6_redhat_1.1.ep6.el6
codehaus-jackson
Red Hat:jboss_enterprise_application_platform:6::el6
From an advisory covering 3 CVEs
 before 0:1.9.9-11.redhat_5.1.ep6.el6
0:1.9.9-11.redhat_5.1.ep6.el6
codehaus-jackson-core-asl
Red Hat:jboss_enterprise_application_platform:6::el6
From an advisory covering 3 CVEs
 before 0:1.9.9-11.redhat_5.1.ep6.el6
0:1.9.9-11.redhat_5.1.ep6.el6
codehaus-jackson-jaxrs
Red Hat:jboss_enterprise_application_platform:6::el6
From an advisory covering 3 CVEs
 before 0:1.9.9-11.redhat_5.1.ep6.el6
0:1.9.9-11.redhat_5.1.ep6.el6
codehaus-jackson-mapper-asl
Red Hat:jboss_enterprise_application_platform:6::el6
From an advisory covering 3 CVEs
 before 0:1.9.9-11.redhat_5.1.ep6.el6
0:1.9.9-11.redhat_5.1.ep6.el6
codehaus-jackson-xc
Red Hat:jboss_enterprise_application_platform:6::el6
From an advisory covering 3 CVEs
 before 0:1.9.9-11.redhat_5.1.ep6.el6
0:1.9.9-11.redhat_5.1.ep6.el6
hibernate4-core-eap6
Red Hat:jboss_enterprise_application_platform:6::el6
From an advisory covering 3 CVEs
 before 0:4.2.27-1.Final_redhat_1.1.ep6.el6
0:4.2.27-1.Final_redhat_1.1.ep6.el6
hibernate4-eap6
Red Hat:jboss_enterprise_application_platform:6::el6
From an advisory covering 3 CVEs
 before 0:4.2.27-1.Final_redhat_1.1.ep6.el6
0:4.2.27-1.Final_redhat_1.1.ep6.el6
hibernate4-entitymanager-eap6
Red Hat:jboss_enterprise_application_platform:6::el6
From an advisory covering 3 CVEs
 before 0:4.2.27-1.Final_redhat_1.1.ep6.el6
0:4.2.27-1.Final_redhat_1.1.ep6.el6
hibernate4-envers-eap6
Red Hat:jboss_enterprise_application_platform:6::el6
From an advisory covering 3 CVEs
 before 0:4.2.27-1.Final_redhat_1.1.ep6.el6
0:4.2.27-1.Final_redhat_1.1.ep6.el6
hibernate4-infinispan-eap6
Red Hat:jboss_enterprise_application_platform:6::el6
From an advisory covering 3 CVEs
 before 0:4.2.27-1.Final_redhat_1.1.ep6.el6
0:4.2.27-1.Final_redhat_1.1.ep6.el6
hornetq
Red Hat:jboss_enterprise_application_platform:6::el6
From an advisory covering 3 CVEs
 before 0:2.3.25-22.SP20_redhat_1.1.ep6.el6
0:2.3.25-22.SP20_redhat_1.1.ep6.el6
infinispan
Red Hat:jboss_enterprise_application_platform:6::el6
From an advisory covering 3 CVEs
 before 0:5.2.22-1.Final_redhat_1.1.ep6.el6
0:5.2.22-1.Final_redhat_1.1.ep6.el6
infinispan-cachestore-jdbc
Red Hat:jboss_enterprise_application_platform:6::el6
From an advisory covering 3 CVEs
 before 0:5.2.22-1.Final_redhat_1.1.ep6.el6
0:5.2.22-1.Final_redhat_1.1.ep6.el6
infinispan-cachestore-remote
Red Hat:jboss_enterprise_application_platform:6::el6
From an advisory covering 3 CVEs
 before 0:5.2.22-1.Final_redhat_1.1.ep6.el6
0:5.2.22-1.Final_redhat_1.1.ep6.el6
infinispan-client-hotrod
Red Hat:jboss_enterprise_application_platform:6::el6
From an advisory covering 3 CVEs
 before 0:5.2.22-1.Final_redhat_1.1.ep6.el6
0:5.2.22-1.Final_redhat_1.1.ep6.el6
infinispan-core
Red Hat:jboss_enterprise_application_platform:6::el6
From an advisory covering 3 CVEs
 before 0:5.2.22-1.Final_redhat_1.1.ep6.el6
0:5.2.22-1.Final_redhat_1.1.ep6.el6
jboss-as-appclient
Red Hat:jboss_enterprise_application_platform:6::el6
From an advisory covering 3 CVEs
 before 0:7.5.17-2.Final_redhat_4.1.ep6.el6
0:7.5.17-2.Final_redhat_4.1.ep6.el6
jboss-as-cli
Red Hat:jboss_enterprise_application_platform:6::el6
From an advisory covering 3 CVEs
 before 0:7.5.17-2.Final_redhat_4.1.ep6.el6
0:7.5.17-2.Final_redhat_4.1.ep6.el6
jboss-as-client-all
Red Hat:jboss_enterprise_application_platform:6::el6
From an advisory covering 3 CVEs
 before 0:7.5.17-2.Final_redhat_4.1.ep6.el6
0:7.5.17-2.Final_redhat_4.1.ep6.el6
jboss-as-clustering
Red Hat:jboss_enterprise_application_platform:6::el6
From an advisory covering 3 CVEs
 before 0:7.5.17-2.Final_redhat_4.1.ep6.el6
0:7.5.17-2.Final_redhat_4.1.ep6.el6
jboss-as-cmp
Red Hat:jboss_enterprise_application_platform:6::el6
From an advisory covering 3 CVEs
 before 0:7.5.17-2.Final_redhat_4.1.ep6.el6
0:7.5.17-2.Final_redhat_4.1.ep6.el6
jboss-as-configadmin
Red Hat:jboss_enterprise_application_platform:6::el6
From an advisory covering 3 CVEs
 before 0:7.5.17-2.Final_redhat_4.1.ep6.el6
0:7.5.17-2.Final_redhat_4.1.ep6.el6
jboss-as-connector
Red Hat:jboss_enterprise_application_platform:6::el6
From an advisory covering 3 CVEs
 before 0:7.5.17-2.Final_redhat_4.1.ep6.el6
0:7.5.17-2.Final_redhat_4.1.ep6.el6
jboss-as-controller
Red Hat:jboss_enterprise_application_platform:6::el6
From an advisory covering 3 CVEs
 before 0:7.5.17-2.Final_redhat_4.1.ep6.el6
0:7.5.17-2.Final_redhat_4.1.ep6.el6
jboss-as-controller-client
Red Hat:jboss_enterprise_application_platform:6::el6
From an advisory covering 3 CVEs
 before 0:7.5.17-2.Final_redhat_4.1.ep6.el6
0:7.5.17-2.Final_redhat_4.1.ep6.el6
jboss-as-core-security
Red Hat:jboss_enterprise_application_platform:6::el6
From an advisory covering 3 CVEs
 before 0:7.5.17-2.Final_redhat_4.1.ep6.el6
0:7.5.17-2.Final_redhat_4.1.ep6.el6
jboss-as-deployment-repository
Red Hat:jboss_enterprise_application_platform:6::el6
From an advisory covering 3 CVEs
 before 0:7.5.17-2.Final_redhat_4.1.ep6.el6
0:7.5.17-2.Final_redhat_4.1.ep6.el6
jboss-as-deployment-scanner
Red Hat:jboss_enterprise_application_platform:6::el6
From an advisory covering 3 CVEs
 before 0:7.5.17-2.Final_redhat_4.1.ep6.el6
0:7.5.17-2.Final_redhat_4.1.ep6.el6
jboss-as-domain-http
Red Hat:jboss_enterprise_application_platform:6::el6
From an advisory covering 3 CVEs
 before 0:7.5.17-2.Final_redhat_4.1.ep6.el6
0:7.5.17-2.Final_redhat_4.1.ep6.el6
jboss-as-domain-management
Red Hat:jboss_enterprise_application_platform:6::el6
From an advisory covering 3 CVEs
 before 0:7.5.17-2.Final_redhat_4.1.ep6.el6
0:7.5.17-2.Final_redhat_4.1.ep6.el6
jboss-as-ee
Red Hat:jboss_enterprise_application_platform:6::el6
From an advisory covering 3 CVEs
 before 0:7.5.17-2.Final_redhat_4.1.ep6.el6
0:7.5.17-2.Final_redhat_4.1.ep6.el6
jboss-as-ee-deployment
Red Hat:jboss_enterprise_application_platform:6::el6
From an advisory covering 3 CVEs
 before 0:7.5.17-2.Final_redhat_4.1.ep6.el6
0:7.5.17-2.Final_redhat_4.1.ep6.el6
jboss-as-ejb3
Red Hat:jboss_enterprise_application_platform:6::el6
From an advisory covering 3 CVEs
 before 0:7.5.17-2.Final_redhat_4.1.ep6.el6
0:7.5.17-2.Final_redhat_4.1.ep6.el6
jboss-as-embedded
Red Hat:jboss_enterprise_application_platform:6::el6
From an advisory covering 3 CVEs
 before 0:7.5.17-2.Final_redhat_4.1.ep6.el6
0:7.5.17-2.Final_redhat_4.1.ep6.el6
jboss-as-host-controller
Red Hat:jboss_enterprise_application_platform:6::el6
From an advisory covering 3 CVEs
 before 0:7.5.17-2.Final_redhat_4.1.ep6.el6
0:7.5.17-2.Final_redhat_4.1.ep6.el6
jboss-as-jacorb
Red Hat:jboss_enterprise_application_platform:6::el6
From an advisory covering 3 CVEs
 before 0:7.5.17-2.Final_redhat_4.1.ep6.el6
0:7.5.17-2.Final_redhat_4.1.ep6.el6
jboss-as-jaxr
Red Hat:jboss_enterprise_application_platform:6::el6
From an advisory covering 3 CVEs
 before 0:7.5.17-2.Final_redhat_4.1.ep6.el6
0:7.5.17-2.Final_redhat_4.1.ep6.el6
jboss-as-jaxrs
Red Hat:jboss_enterprise_application_platform:6::el6
From an advisory covering 3 CVEs
 before 0:7.5.17-2.Final_redhat_4.1.ep6.el6
0:7.5.17-2.Final_redhat_4.1.ep6.el6
jboss-as-jdr
Red Hat:jboss_enterprise_application_platform:6::el6
From an advisory covering 3 CVEs
 before 0:7.5.17-2.Final_redhat_4.1.ep6.el6
0:7.5.17-2.Final_redhat_4.1.ep6.el6
jboss-as-jmx
Red Hat:jboss_enterprise_application_platform:6::el6
From an advisory covering 3 CVEs
 before 0:7.5.17-2.Final_redhat_4.1.ep6.el6
0:7.5.17-2.Final_redhat_4.1.ep6.el6
jboss-as-jpa
Red Hat:jboss_enterprise_application_platform:6::el6
From an advisory covering 3 CVEs
 before 0:7.5.17-2.Final_redhat_4.1.ep6.el6
0:7.5.17-2.Final_redhat_4.1.ep6.el6
jboss-as-jsf
Red Hat:jboss_enterprise_application_platform:6::el6
From an advisory covering 3 CVEs
 before 0:7.5.17-2.Final_redhat_4.1.ep6.el6
0:7.5.17-2.Final_redhat_4.1.ep6.el6
jboss-as-jsr77
Red Hat:jboss_enterprise_application_platform:6::el6
From an advisory covering 3 CVEs
 before 0:7.5.17-2.Final_redhat_4.1.ep6.el6
0:7.5.17-2.Final_redhat_4.1.ep6.el6
jboss-as-logging
Red Hat:jboss_enterprise_application_platform:6::el6
From an advisory covering 3 CVEs
 before 0:7.5.17-2.Final_redhat_4.1.ep6.el6
0:7.5.17-2.Final_redhat_4.1.ep6.el6
jboss-as-mail
Red Hat:jboss_enterprise_application_platform:6::el6
From an advisory covering 3 CVEs
 before 0:7.5.17-2.Final_redhat_4.1.ep6.el6
0:7.5.17-2.Final_redhat_4.1.ep6.el6
jboss-as-management-client-content
Red Hat:jboss_enterprise_application_platform:6::el6
From an advisory covering 3 CVEs
 before 0:7.5.17-2.Final_redhat_4.1.ep6.el6
0:7.5.17-2.Final_redhat_4.1.ep6.el6
jboss-as-messaging
Red Hat:jboss_enterprise_application_platform:6::el6
From an advisory covering 3 CVEs
 before 0:7.5.17-2.Final_redhat_4.1.ep6.el6
0:7.5.17-2.Final_redhat_4.1.ep6.el6
jboss-as-modcluster
Red Hat:jboss_enterprise_application_platform:6::el6
From an advisory covering 3 CVEs
 before 0:7.5.17-2.Final_redhat_4.1.ep6.el6
0:7.5.17-2.Final_redhat_4.1.ep6.el6
jboss-as-naming
Red Hat:jboss_enterprise_application_platform:6::el6
From an advisory covering 3 CVEs
 before 0:7.5.17-2.Final_redhat_4.1.ep6.el6
0:7.5.17-2.Final_redhat_4.1.ep6.el6
jboss-as-network
Red Hat:jboss_enterprise_application_platform:6::el6
From an advisory covering 3 CVEs
 before 0:7.5.17-2.Final_redhat_4.1.ep6.el6
0:7.5.17-2.Final_redhat_4.1.ep6.el6
jboss-as-osgi
Red Hat:jboss_enterprise_application_platform:6::el6
From an advisory covering 3 CVEs
 before 0:7.5.17-2.Final_redhat_4.1.ep6.el6
0:7.5.17-2.Final_redhat_4.1.ep6.el6
jboss-as-osgi-configadmin
Red Hat:jboss_enterprise_application_platform:6::el6
From an advisory covering 3 CVEs
 before 0:7.5.17-2.Final_redhat_4.1.ep6.el6
0:7.5.17-2.Final_redhat_4.1.ep6.el6
jboss-as-osgi-service
Red Hat:jboss_enterprise_application_platform:6::el6
From an advisory covering 3 CVEs
 before 0:7.5.17-2.Final_redhat_4.1.ep6.el6
0:7.5.17-2.Final_redhat_4.1.ep6.el6
jboss-as-picketlink
Red Hat:jboss_enterprise_application_platform:6::el6
From an advisory covering 3 CVEs
 before 0:7.5.17-2.Final_redhat_4.1.ep6.el6
0:7.5.17-2.Final_redhat_4.1.ep6.el6
jboss-as-platform-mbean
Red Hat:jboss_enterprise_application_platform:6::el6
From an advisory covering 3 CVEs
 before 0:7.5.17-2.Final_redhat_4.1.ep6.el6
0:7.5.17-2.Final_redhat_4.1.ep6.el6
jboss-as-pojo
Red Hat:jboss_enterprise_application_platform:6::el6
From an advisory covering 3 CVEs
 before 0:7.5.17-2.Final_redhat_4.1.ep6.el6
0:7.5.17-2.Final_redhat_4.1.ep6.el6
jboss-as-process-controller
Red Hat:jboss_enterprise_application_platform:6::el6
From an advisory covering 3 CVEs
 before 0:7.5.17-2.Final_redhat_4.1.ep6.el6
0:7.5.17-2.Final_redhat_4.1.ep6.el6
jboss-as-protocol
Red Hat:jboss_enterprise_application_platform:6::el6
From an advisory covering 3 CVEs
 before 0:7.5.17-2.Final_redhat_4.1.ep6.el6
0:7.5.17-2.Final_redhat_4.1.ep6.el6
jboss-as-remoting
Red Hat:jboss_enterprise_application_platform:6::el6
From an advisory covering 3 CVEs
 before 0:7.5.17-2.Final_redhat_4.1.ep6.el6
0:7.5.17-2.Final_redhat_4.1.ep6.el6
jboss-as-sar
Red Hat:jboss_enterprise_application_platform:6::el6
From an advisory covering 3 CVEs
 before 0:7.5.17-2.Final_redhat_4.1.ep6.el6
0:7.5.17-2.Final_redhat_4.1.ep6.el6
jboss-as-security
Red Hat:jboss_enterprise_application_platform:6::el6
From an advisory covering 3 CVEs
 before 0:7.5.17-2.Final_redhat_4.1.ep6.el6
0:7.5.17-2.Final_redhat_4.1.ep6.el6
jboss-as-server
Red Hat:jboss_enterprise_application_platform:6::el6
From an advisory covering 3 CVEs
 before 0:7.5.17-2.Final_redhat_4.1.ep6.el6
0:7.5.17-2.Final_redhat_4.1.ep6.el6
jboss-as-system-jmx
Red Hat:jboss_enterprise_application_platform:6::el6
From an advisory covering 3 CVEs
 before 0:7.5.17-2.Final_redhat_4.1.ep6.el6
0:7.5.17-2.Final_redhat_4.1.ep6.el6
jboss-as-threads
Red Hat:jboss_enterprise_application_platform:6::el6
From an advisory covering 3 CVEs
 before 0:7.5.17-2.Final_redhat_4.1.ep6.el6
0:7.5.17-2.Final_redhat_4.1.ep6.el6
jboss-as-transactions
Red Hat:jboss_enterprise_application_platform:6::el6
From an advisory covering 3 CVEs
 before 0:7.5.17-2.Final_redhat_4.1.ep6.el6
0:7.5.17-2.Final_redhat_4.1.ep6.el6
jboss-as-version
Red Hat:jboss_enterprise_application_platform:6::el6
From an advisory covering 3 CVEs
 before 0:7.5.17-2.Final_redhat_4.1.ep6.el6
0:7.5.17-2.Final_redhat_4.1.ep6.el6
jboss-as-web
Red Hat:jboss_enterprise_application_platform:6::el6
From an advisory covering 3 CVEs
 before 0:7.5.17-2.Final_redhat_4.1.ep6.el6
0:7.5.17-2.Final_redhat_4.1.ep6.el6
jboss-as-webservices
Red Hat:jboss_enterprise_application_platform:6::el6
From an advisory covering 3 CVEs
 before 0:7.5.17-2.Final_redhat_4.1.ep6.el6
0:7.5.17-2.Final_redhat_4.1.ep6.el6
jboss-as-weld
Red Hat:jboss_enterprise_application_platform:6::el6
From an advisory covering 3 CVEs
 before 0:7.5.17-2.Final_redhat_4.1.ep6.el6
0:7.5.17-2.Final_redhat_4.1.ep6.el6
jboss-as-xts
Red Hat:jboss_enterprise_application_platform:6::el6
From an advisory covering 3 CVEs
 before 0:7.5.17-2.Final_redhat_4.1.ep6.el6
0:7.5.17-2.Final_redhat_4.1.ep6.el6
jboss-marshalling
Red Hat:jboss_enterprise_application_platform:6::el6
From an advisory covering 3 CVEs
 before 0:1.4.10-3.SP3_redhat_1.1.ep6.el6
0:1.4.10-3.SP3_redhat_1.1.ep6.el6
jboss-metadata
Red Hat:jboss_enterprise_application_platform:6::el6
From an advisory covering 3 CVEs
 before 0:7.2.3-1.Final_redhat_1.1.ep6.el6
0:7.2.3-1.Final_redhat_1.1.ep6.el6
jboss-metadata-appclient
Red Hat:jboss_enterprise_application_platform:6::el6
From an advisory covering 3 CVEs
 before 0:7.2.3-1.Final_redhat_1.1.ep6.el6
0:7.2.3-1.Final_redhat_1.1.ep6.el6
jboss-metadata-common
Red Hat:jboss_enterprise_application_platform:6::el6
From an advisory covering 3 CVEs
 before 0:7.2.3-1.Final_redhat_1.1.ep6.el6
0:7.2.3-1.Final_redhat_1.1.ep6.el6
jboss-metadata-ear
Red Hat:jboss_enterprise_application_platform:6::el6
From an advisory covering 3 CVEs
 before 0:7.2.3-1.Final_redhat_1.1.ep6.el6
0:7.2.3-1.Final_redhat_1.1.ep6.el6
jboss-metadata-ejb
Red Hat:jboss_enterprise_application_platform:6::el6
From an advisory covering 3 CVEs
 before 0:7.2.3-1.Final_redhat_1.1.ep6.el6
0:7.2.3-1.Final_redhat_1.1.ep6.el6
jboss-metadata-web
Red Hat:jboss_enterprise_application_platform:6::el6
From an advisory covering 3 CVEs
 before 0:7.2.3-1.Final_redhat_1.1.ep6.el6
0:7.2.3-1.Final_redhat_1.1.ep6.el6
jboss-modules
Red Hat:jboss_enterprise_application_platform:6::el6
From an advisory covering 3 CVEs
 before 0:1.3.10-1.Final_redhat_1.1.ep6.el6
0:1.3.10-1.Final_redhat_1.1.ep6.el6
jboss-remoting3
Red Hat:jboss_enterprise_application_platform:6::el6
From an advisory covering 3 CVEs
 before 0:3.3.10-1.Final_redhat_1.1.ep6.el6
0:3.3.10-1.Final_redhat_1.1.ep6.el6
jboss-vfs2
Red Hat:jboss_enterprise_application_platform:6::el6
From an advisory covering 3 CVEs
 before 0:3.2.12-1.Final_redhat_1.1.ep6.el6
0:3.2.12-1.Final_redhat_1.1.ep6.el6
jbossas-appclient
Red Hat:jboss_enterprise_application_platform:6::el6
From an advisory covering 3 CVEs
 before 0:7.5.17-2.Final_redhat_4.1.ep6.el6
0:7.5.17-2.Final_redhat_4.1.ep6.el6
jbossas-bundles
Red Hat:jboss_enterprise_application_platform:6::el6
From an advisory covering 3 CVEs
 before 0:7.5.17-2.Final_redhat_4.1.ep6.el6
0:7.5.17-2.Final_redhat_4.1.ep6.el6
jbossas-core
Red Hat:jboss_enterprise_application_platform:6::el6
From an advisory covering 3 CVEs
 before 0:7.5.17-2.Final_redhat_4.1.ep6.el6
0:7.5.17-2.Final_redhat_4.1.ep6.el6
jbossas-domain
Red Hat:jboss_enterprise_application_platform:6::el6
From an advisory covering 3 CVEs
 before 0:7.5.17-2.Final_redhat_4.1.ep6.el6
0:7.5.17-2.Final_redhat_4.1.ep6.el6
jbossas-javadocs
Red Hat:jboss_enterprise_application_platform:6::el6
From an advisory covering 3 CVEs
 before 0:7.5.17-4.Final_redhat_4.1.ep6.el6
0:7.5.17-4.Final_redhat_4.1.ep6.el6
tomcat
SUSE:Linux Enterprise Server for Raspberry Pi 12 SP2
From an advisory covering 3 CVEs
 before 8.0.43-29.5.1
8.0.43-29.5.1
tomcat
SUSE:Linux Enterprise Server 12 SP2
From an advisory covering 3 CVEs
 before 8.0.43-29.5.1
8.0.43-29.5.1
tomcat
SUSE:Linux Enterprise Server for SAP Applications 12 SP2
From an advisory covering 3 CVEs
 before 8.0.43-29.5.1
8.0.43-29.5.1
tomcat
SUSE:Linux Enterprise Server 12 SP3
From an advisory covering 3 CVEs
 before 8.0.43-29.5.1
8.0.43-29.5.1
tomcat
SUSE:Linux Enterprise Server for SAP Applications 12 SP3
From an advisory covering 3 CVEs
 before 8.0.43-29.5.1
8.0.43-29.5.1
tomcat
SUSE:Linux Enterprise Server 12-LTSS
From an advisory covering 5 CVEs
 before 7.0.82-7.16.1
7.0.82-7.16.1
tomcat
SUSE:OpenStack Cloud 6
From an advisory covering 3 CVEs
 before 8.0.43-10.24.1
8.0.43-10.24.1
tomcat
SUSE:Linux Enterprise Server for SAP Applications 12 SP1
From an advisory covering 3 CVEs
 before 8.0.43-10.24.1
8.0.43-10.24.1
tomcat
SUSE:Linux Enterprise Server 12 SP1-LTSS
From an advisory covering 3 CVEs
 before 8.0.43-10.24.1
8.0.43-10.24.1
tomcat6
SUSE:Linux Enterprise Server 11 SP4
From an advisory covering 2 CVEs
 before 6.0.53-0.57.7.1
6.0.53-0.57.7.1
tomcat6
SUSE:Linux Enterprise Server for SAP Applications 11 SP4
From an advisory covering 2 CVEs
 before 6.0.53-0.57.7.1
6.0.53-0.57.7.1
tomcat7
Ubuntu:14.04:LTS
 before 7.0.52-1ubuntu0.13, plus listed versions
7.0.42-17.0.47-17.0.50-17.0.52-17.0.52-1ubuntu0.1
Show 7 moreShow less
7.0.52-1ubuntu0.37.0.52-1ubuntu0.67.0.52-1ubuntu0.77.0.52-1ubuntu0.87.0.52-1ubuntu0.97.0.52-1ubuntu0.107.0.52-1ubuntu0.11
7.0.52-1ubuntu0.13
tomcat6
Ubuntu:Pro:14.04:LTS
 All versions, plus listed versions
6.0.37-16.0.39-16.0.39-1ubuntu0.16.0.39-1ubuntu0.1+esm16.0.39-1ubuntu0.1+esm26.0.39-1ubuntu0.1+esm3
 None known
tomcat8
Ubuntu:16.04:LTS
 before 8.0.32-1ubuntu1.5, plus listed versions
8.0.26-18.0.28-18.0.30-18.0.32-18.0.32-1ubuntu1
Show 4 moreShow less
8.0.32-1ubuntu1.18.0.32-1ubuntu1.28.0.32-1ubuntu1.38.0.32-1ubuntu1.4
8.0.32-1ubuntu1.5
tomcat7
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
7.0.64-17.0.68-17.0.68-1ubuntu0.17.0.68-1ubuntu0.37.0.68-1ubuntu0.4
Show 4 moreShow less
7.0.68-1ubuntu0.4+esm17.0.68-1ubuntu0.4+esm27.0.68-1ubuntu0.4+esm37.0.68-1ubuntu0.4+esm4
 None known
tomcat7
Ubuntu:14.04:LTS
From an advisory covering 4 CVEs
 before 7.0.52-1ubuntu0.13, plus listed versions
7.0.42-17.0.47-17.0.50-17.0.52-17.0.52-1ubuntu0.1
Show 7 moreShow less
7.0.52-1ubuntu0.37.0.52-1ubuntu0.67.0.52-1ubuntu0.77.0.52-1ubuntu0.87.0.52-1ubuntu0.97.0.52-1ubuntu0.107.0.52-1ubuntu0.11
7.0.52-1ubuntu0.13
tomcat8
Ubuntu:16.04:LTS
From an advisory covering 4 CVEs
 before 8.0.32-1ubuntu1.5, plus listed versions
8.0.26-18.0.28-18.0.30-18.0.32-18.0.32-1ubuntu1
Show 4 moreShow less
8.0.32-1ubuntu1.18.0.32-1ubuntu1.28.0.32-1ubuntu1.38.0.32-1ubuntu1.4
8.0.32-1ubuntu1.5
tomcat
openSUSE:Tumbleweed
From an advisory covering 25 CVEs
 before 9.0.36-8.4
9.0.36-8.4
tomcat10
openSUSE:Tumbleweed
From an advisory covering 49 CVEs
 before 10.1.14-1.1
10.1.14-1.1

History

History
RecordedChangedSources
affected, facts
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2017-5664 is a high vulnerability (CVSS 7.5) in Apache Tomcat, published June 6, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 16.6%, the 97th percentile. Fixed in org.apache.tomcat:tomcat 9.0.0.M21.

References

Show 194 moreShow less
This page doesn't list everything

Left out here: 237 package rows and 12 references. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open