CVE-2014-0096
Improper Input Validation in Apache Tomcat
4.3 MediumFix available
java/org/apache/catalina/servlets/DefaultServlet.java in the default servlet in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4 does not properly restrict XSLT stylesheets, which allows remote attackers to bypass security-manager restrictions and read arbitrary files via a crafted web application that provides an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
Exploit likelihood
6.91%Down 0.4 points since Feb 4, 2022
What each source reports
NVD Score used
java/org/apache/catalina/servlets/DefaultServlet.java in the default servlet in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4 does not properly restrict XSLT stylesheets, which allows remote attackers to bypass security-manager restrictions and read arbitrary files via a crafted web application that provides an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
- Record
CVE-2014-0096- CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:P/I:N/A:N - Weakness
- CWE-264
- Updated
- 2026-11-02
CVE List No score
java/org/apache/catalina/servlets/DefaultServlet.java in the default servlet in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4 does not properly restrict XSLT stylesheets, which allows remote attackers to bypass security-manager restrictions and read arbitrary files via a crafted web application that provides an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
- Record
CVE-2014-0096- Updated
- 2026-11-02
EUVDEUVD-2022-5013 No score
java/org/apache/catalina/servlets/DefaultServlet.java in the default servlet in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4 does not properly restrict XSLT stylesheets, which allows remote attackers to bypass security-manager restrictions and read arbitrary files via a crafted web application that provides an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
- Record
EUVD-2022-5013- Updated
- 2026-11-02
GitHub AdvisoriesGHSA-qprx-q2r7-3rx6 No score
Improper Input Validation in Apache Tomcat
java/org/apache/catalina/servlets/DefaultServlet.java in the default servlet in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4 does not properly restrict XSLT stylesheets, which allows remote attackers to bypass security-manager restrictions and read arbitrary files via a crafted web application that provides an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
- Record
GHSA-qprx-q2r7-3rx6- Weakness
- CWE-20
- Updated
- 2026-11-02
OSVGHSA-qprx-q2r7-3rx6 No score
Improper Input Validation in Apache Tomcat
java/org/apache/catalina/servlets/DefaultServlet.java in the default servlet in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4 does not properly restrict XSLT stylesheets, which allows remote attackers to bypass security-manager restrictions and read arbitrary files via a crafted web application that provides an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
- Record
GHSA-qprx-q2r7-3rx6- Weakness
- CWE-20
- Updated
- 2026-11-02
OSVMGASA-2014-0268 No score
Updated tomcat and tomcat6 packages fix security vulnerabilities
Integer overflow in the parseChunkHeader function in java/org/apache/coyote/http11/filters/ChunkedInputFilter.java in Apache Tomcat before 6.0.40 and 7.x before 7.0.53 allows remote attackers to cause a denial of service (resource consumption) via a malformed chunk size in chunked transfer coding of a request during the streaming of data (CVE-2014-0075).
java/org/apache/catalina/servlets/DefaultServlet.java in the default servlet in Apache Tomcat before 6.0.40 and 7.x before 7.0.53 does not properly restrict XSLT stylesheets, which allows remote attackers to bypass security-manager restrictions and read arbitrary files via a crafted web application that provides an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue (CVE-2014-0096).
Integer overflow in java/org/apache/tomcat/util/buf/Ascii.java in Apache Tomcat before 6.0.40 and 7.x before 7.0.53, when operated behind a reverse proxy, allows remote attackers to conduct HTTP request smuggling attacks via a crafted Content-Length HTTP header (CVE-2014-0099).
Apache Tomcat before 6.0.40 and 7.x before 7.0.54 does not properly constrain the class loader that accesses the XML parser used with an XSLT stylesheet, which allows remote attackers to read arbitrary files via a crafted web application that provides an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue, or read files associated with different web applications on a single Tomcat instance via a crafted web application (CVE-2014-0119).
- Record
MGASA-2014-0268- Updated
- 2026-11-02
OSVUBUNTU-CVE-2014-0096 No score
java/org/apache/catalina/servlets/DefaultServlet.java in the default servlet in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4 does not properly restrict XSLT stylesheets, which allows remote attackers to bypass security-manager restrictions and read arbitrary files via a crafted web application that provides an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
- Record
UBUNTU-CVE-2014-0096- Updated
- 2026-11-02
OSVUSN-2302-1 No score
tomcat6, tomcat7 vulnerabilities
David Jorm discovered that Tomcat incorrectly handled certain requests submitted using chunked transfer encoding. A remote attacker could use this flaw to cause the Tomcat server to consume resources, resulting in a denial of service. (CVE-2014-0075)
It was discovered that Tomcat did not properly restrict XSLT stylesheets. An attacker could use this issue with a crafted web application to bypass security-manager restrictions and read arbitrary files. (CVE-2014-0096)
It was discovered that Tomcat incorrectly handled certain Content-Length headers. A remote attacker could use this flaw in configurations where Tomcat is behind a reverse proxy to perform HTTP request smuggling attacks. (CVE-2014-0099)
- Record
USN-2302-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.tomcat:tomcatMaven |
before 6.0.40 | 6.0.40 |
org.apache.tomcat:tomcatMaven |
7.0.0 up to 7.0.54 | 7.0.54 |
org.apache.tomcat:tomcatMaven |
8.0.0 up to 8.0.6 | 8.0.6 |
org.apache.tomcat:tomcat-catalinaMaven |
before 6.0.40 | 6.0.40 |
org.apache.tomcat:tomcat-catalinaMaven |
7.0.0 up to 7.0.54 | 7.0.54 |
org.apache.tomcat:tomcat-catalinaMaven |
8.0.0 up to 8.0.6 | 8.0.6 |
tomcat6Debian:7 From an advisory covering 18 CVEs |
before 6.0.45+dfsg-1~deb7u1, plus listed versions 6.0.35-66.0.35-6+deb7u16.0.35-76.0.37-16.0.39-1 Show 8 moreShow less6.0.41-16.0.41-26.0.41-2+squeeze56.0.41-2+squeeze66.0.41-2+squeeze76.0.41-36.0.41-46.0.45-1~deb6u1 |
6.0.45+dfsg-1~deb7u1 |
org.apache.tomcat:tomcatMaven |
7.0.0 up to 7.0.54, plus listed versions 7.0.357.0.377.0.397.0.407.0.41 Show 5 moreShow less7.0.427.0.477.0.507.0.527.0.53 |
7.0.54 |
org.apache.tomcat:tomcatMaven |
8.0.0 up to 8.0.6, plus listed versions 8.0.18.0.38.0.5 |
8.0.6 |
org.apache.tomcat:tomcat-catalinaMaven |
7.0.0 up to 7.0.54, plus listed versions 7.0.117.0.127.0.147.0.167.0.19 Show 28 moreShow less7.0.27.0.207.0.217.0.227.0.237.0.257.0.267.0.277.0.287.0.297.0.307.0.327.0.337.0.347.0.357.0.377.0.397.0.47.0.407.0.417.0.427.0.477.0.57.0.507.0.527.0.537.0.67.0.8 |
7.0.54 |
Show 125 moreShow less
| Package | Affected | Fixed |
|---|---|---|
org.apache.tomcat:tomcat-catalinaMaven |
8.0.0 up to 8.0.6, plus listed versions 8.0.18.0.38.0.5 |
8.0.6 |
tomcat6Mageia:3 From an advisory covering 4 CVEs |
before 6.0.41-1.mga3 | 6.0.41-1.mga3 |
tomcatMageia:3 From an advisory covering 4 CVEs |
before 7.0.54-1.mga3 | 7.0.54-1.mga3 |
tomcatMageia:4 From an advisory covering 4 CVEs |
before 7.0.54-1.mga4 | 7.0.54-1.mga4 |
tomcatRed Hat:enterprise_linux:7::client From an advisory covering 3 CVEs |
before 0:7.0.42-6.el7_0 | 0:7.0.42-6.el7_0 |
tomcat-servlet-3.0-apiRed Hat:enterprise_linux:7::client From an advisory covering 3 CVEs |
before 0:7.0.42-6.el7_0 | 0:7.0.42-6.el7_0 |
tomcat-admin-webappsRed Hat:enterprise_linux:7::client From an advisory covering 3 CVEs |
before 0:7.0.42-6.el7_0 | 0:7.0.42-6.el7_0 |
tomcat-docs-webappRed Hat:enterprise_linux:7::client From an advisory covering 3 CVEs |
before 0:7.0.42-6.el7_0 | 0:7.0.42-6.el7_0 |
tomcat-el-2.2-apiRed Hat:enterprise_linux:7::client From an advisory covering 3 CVEs |
before 0:7.0.42-6.el7_0 | 0:7.0.42-6.el7_0 |
tomcat-javadocRed Hat:enterprise_linux:7::client From an advisory covering 3 CVEs |
before 0:7.0.42-6.el7_0 | 0:7.0.42-6.el7_0 |
tomcat-jsp-2.2-apiRed Hat:enterprise_linux:7::client From an advisory covering 3 CVEs |
before 0:7.0.42-6.el7_0 | 0:7.0.42-6.el7_0 |
tomcat-jsvcRed Hat:enterprise_linux:7::client From an advisory covering 3 CVEs |
before 0:7.0.42-6.el7_0 | 0:7.0.42-6.el7_0 |
tomcat-libRed Hat:enterprise_linux:7::client From an advisory covering 3 CVEs |
before 0:7.0.42-6.el7_0 | 0:7.0.42-6.el7_0 |
tomcat-webappsRed Hat:enterprise_linux:7::client From an advisory covering 3 CVEs |
before 0:7.0.42-6.el7_0 | 0:7.0.42-6.el7_0 |
tomcatRed Hat:enterprise_linux:7::computenode From an advisory covering 3 CVEs |
before 0:7.0.42-6.el7_0 | 0:7.0.42-6.el7_0 |
tomcat-servlet-3.0-apiRed Hat:enterprise_linux:7::computenode From an advisory covering 3 CVEs |
before 0:7.0.42-6.el7_0 | 0:7.0.42-6.el7_0 |
tomcat-admin-webappsRed Hat:enterprise_linux:7::computenode From an advisory covering 3 CVEs |
before 0:7.0.42-6.el7_0 | 0:7.0.42-6.el7_0 |
tomcat-docs-webappRed Hat:enterprise_linux:7::computenode From an advisory covering 3 CVEs |
before 0:7.0.42-6.el7_0 | 0:7.0.42-6.el7_0 |
tomcat-el-2.2-apiRed Hat:enterprise_linux:7::computenode From an advisory covering 3 CVEs |
before 0:7.0.42-6.el7_0 | 0:7.0.42-6.el7_0 |
tomcat-javadocRed Hat:enterprise_linux:7::computenode From an advisory covering 3 CVEs |
before 0:7.0.42-6.el7_0 | 0:7.0.42-6.el7_0 |
tomcat-jsp-2.2-apiRed Hat:enterprise_linux:7::computenode From an advisory covering 3 CVEs |
before 0:7.0.42-6.el7_0 | 0:7.0.42-6.el7_0 |
tomcat-jsvcRed Hat:enterprise_linux:7::computenode From an advisory covering 3 CVEs |
before 0:7.0.42-6.el7_0 | 0:7.0.42-6.el7_0 |
tomcat-libRed Hat:enterprise_linux:7::computenode From an advisory covering 3 CVEs |
before 0:7.0.42-6.el7_0 | 0:7.0.42-6.el7_0 |
tomcat-webappsRed Hat:enterprise_linux:7::computenode From an advisory covering 3 CVEs |
before 0:7.0.42-6.el7_0 | 0:7.0.42-6.el7_0 |
tomcatRed Hat:enterprise_linux:7::server From an advisory covering 3 CVEs |
before 0:7.0.42-6.el7_0 | 0:7.0.42-6.el7_0 |
tomcat-admin-webappsRed Hat:enterprise_linux:7::server From an advisory covering 3 CVEs |
before 0:7.0.42-6.el7_0 | 0:7.0.42-6.el7_0 |
tomcat-el-2.2-apiRed Hat:enterprise_linux:7::server From an advisory covering 3 CVEs |
before 0:7.0.42-6.el7_0 | 0:7.0.42-6.el7_0 |
tomcat-jsp-2.2-apiRed Hat:enterprise_linux:7::server From an advisory covering 3 CVEs |
before 0:7.0.42-6.el7_0 | 0:7.0.42-6.el7_0 |
tomcat-libRed Hat:enterprise_linux:7::server From an advisory covering 3 CVEs |
before 0:7.0.42-6.el7_0 | 0:7.0.42-6.el7_0 |
tomcat-servlet-3.0-apiRed Hat:enterprise_linux:7::server From an advisory covering 3 CVEs |
before 0:7.0.42-6.el7_0 | 0:7.0.42-6.el7_0 |
tomcat-webappsRed Hat:enterprise_linux:7::server From an advisory covering 3 CVEs |
before 0:7.0.42-6.el7_0 | 0:7.0.42-6.el7_0 |
tomcat-docs-webappRed Hat:enterprise_linux:7::server From an advisory covering 3 CVEs |
before 0:7.0.42-6.el7_0 | 0:7.0.42-6.el7_0 |
tomcat-javadocRed Hat:enterprise_linux:7::server From an advisory covering 3 CVEs |
before 0:7.0.42-6.el7_0 | 0:7.0.42-6.el7_0 |
tomcat-jsvcRed Hat:enterprise_linux:7::server From an advisory covering 3 CVEs |
before 0:7.0.42-6.el7_0 | 0:7.0.42-6.el7_0 |
tomcatRed Hat:enterprise_linux:7::workstation From an advisory covering 3 CVEs |
before 0:7.0.42-6.el7_0 | 0:7.0.42-6.el7_0 |
tomcat-admin-webappsRed Hat:enterprise_linux:7::workstation From an advisory covering 3 CVEs |
before 0:7.0.42-6.el7_0 | 0:7.0.42-6.el7_0 |
tomcat-el-2.2-apiRed Hat:enterprise_linux:7::workstation From an advisory covering 3 CVEs |
before 0:7.0.42-6.el7_0 | 0:7.0.42-6.el7_0 |
tomcat-jsp-2.2-apiRed Hat:enterprise_linux:7::workstation From an advisory covering 3 CVEs |
before 0:7.0.42-6.el7_0 | 0:7.0.42-6.el7_0 |
tomcat-libRed Hat:enterprise_linux:7::workstation From an advisory covering 3 CVEs |
before 0:7.0.42-6.el7_0 | 0:7.0.42-6.el7_0 |
tomcat-servlet-3.0-apiRed Hat:enterprise_linux:7::workstation From an advisory covering 3 CVEs |
before 0:7.0.42-6.el7_0 | 0:7.0.42-6.el7_0 |
tomcat-webappsRed Hat:enterprise_linux:7::workstation From an advisory covering 3 CVEs |
before 0:7.0.42-6.el7_0 | 0:7.0.42-6.el7_0 |
tomcat-docs-webappRed Hat:enterprise_linux:7::workstation From an advisory covering 3 CVEs |
before 0:7.0.42-6.el7_0 | 0:7.0.42-6.el7_0 |
tomcat-javadocRed Hat:enterprise_linux:7::workstation From an advisory covering 3 CVEs |
before 0:7.0.42-6.el7_0 | 0:7.0.42-6.el7_0 |
tomcat-jsvcRed Hat:enterprise_linux:7::workstation From an advisory covering 3 CVEs |
before 0:7.0.42-6.el7_0 | 0:7.0.42-6.el7_0 |
tomcat6Red Hat:jboss_enterprise_web_server:2::el5 From an advisory covering 3 CVEs |
before 0:6.0.37-20_patch_04.ep6.el5 | 0:6.0.37-20_patch_04.ep6.el5 |
tomcat6-admin-webappsRed Hat:jboss_enterprise_web_server:2::el5 From an advisory covering 3 CVEs |
before 0:6.0.37-20_patch_04.ep6.el5 | 0:6.0.37-20_patch_04.ep6.el5 |
tomcat6-docs-webappRed Hat:jboss_enterprise_web_server:2::el5 From an advisory covering 3 CVEs |
before 0:6.0.37-20_patch_04.ep6.el5 | 0:6.0.37-20_patch_04.ep6.el5 |
tomcat6-el-2.1-apiRed Hat:jboss_enterprise_web_server:2::el5 From an advisory covering 3 CVEs |
before 0:6.0.37-20_patch_04.ep6.el5 | 0:6.0.37-20_patch_04.ep6.el5 |
tomcat6-javadocRed Hat:jboss_enterprise_web_server:2::el5 From an advisory covering 3 CVEs |
before 0:6.0.37-20_patch_04.ep6.el5 | 0:6.0.37-20_patch_04.ep6.el5 |
tomcat6-jsp-2.1-apiRed Hat:jboss_enterprise_web_server:2::el5 From an advisory covering 3 CVEs |
before 0:6.0.37-20_patch_04.ep6.el5 | 0:6.0.37-20_patch_04.ep6.el5 |
tomcat6-libRed Hat:jboss_enterprise_web_server:2::el5 From an advisory covering 3 CVEs |
before 0:6.0.37-20_patch_04.ep6.el5 | 0:6.0.37-20_patch_04.ep6.el5 |
tomcat6-log4jRed Hat:jboss_enterprise_web_server:2::el5 From an advisory covering 3 CVEs |
before 0:6.0.37-20_patch_04.ep6.el5 | 0:6.0.37-20_patch_04.ep6.el5 |
tomcat6-servlet-2.5-apiRed Hat:jboss_enterprise_web_server:2::el5 From an advisory covering 3 CVEs |
before 0:6.0.37-20_patch_04.ep6.el5 | 0:6.0.37-20_patch_04.ep6.el5 |
tomcat6-webappsRed Hat:jboss_enterprise_web_server:2::el5 From an advisory covering 3 CVEs |
before 0:6.0.37-20_patch_04.ep6.el5 | 0:6.0.37-20_patch_04.ep6.el5 |
tomcat6Red Hat:jboss_enterprise_web_server:2::el6 From an advisory covering 3 CVEs |
before 0:6.0.37-29_patch_05.ep6.el6 | 0:6.0.37-29_patch_05.ep6.el6 |
tomcat6-admin-webappsRed Hat:jboss_enterprise_web_server:2::el6 From an advisory covering 3 CVEs |
before 0:6.0.37-29_patch_05.ep6.el6 | 0:6.0.37-29_patch_05.ep6.el6 |
tomcat6-docs-webappRed Hat:jboss_enterprise_web_server:2::el6 From an advisory covering 3 CVEs |
before 0:6.0.37-29_patch_05.ep6.el6 | 0:6.0.37-29_patch_05.ep6.el6 |
tomcat6-el-2.1-apiRed Hat:jboss_enterprise_web_server:2::el6 From an advisory covering 3 CVEs |
before 0:6.0.37-29_patch_05.ep6.el6 | 0:6.0.37-29_patch_05.ep6.el6 |
tomcat6-javadocRed Hat:jboss_enterprise_web_server:2::el6 From an advisory covering 3 CVEs |
before 0:6.0.37-29_patch_05.ep6.el6 | 0:6.0.37-29_patch_05.ep6.el6 |
tomcat6-jsp-2.1-apiRed Hat:jboss_enterprise_web_server:2::el6 From an advisory covering 3 CVEs |
before 0:6.0.37-29_patch_05.ep6.el6 | 0:6.0.37-29_patch_05.ep6.el6 |
tomcat6-libRed Hat:jboss_enterprise_web_server:2::el6 From an advisory covering 3 CVEs |
before 0:6.0.37-29_patch_05.ep6.el6 | 0:6.0.37-29_patch_05.ep6.el6 |
tomcat6-log4jRed Hat:jboss_enterprise_web_server:2::el6 From an advisory covering 3 CVEs |
before 0:6.0.37-29_patch_05.ep6.el6 | 0:6.0.37-29_patch_05.ep6.el6 |
tomcat6-servlet-2.5-apiRed Hat:jboss_enterprise_web_server:2::el6 From an advisory covering 3 CVEs |
before 0:6.0.37-29_patch_05.ep6.el6 | 0:6.0.37-29_patch_05.ep6.el6 |
tomcat6-webappsRed Hat:jboss_enterprise_web_server:2::el6 From an advisory covering 3 CVEs |
before 0:6.0.37-29_patch_05.ep6.el6 | 0:6.0.37-29_patch_05.ep6.el6 |
tomcat7Red Hat:jboss_enterprise_web_server:2::el5 From an advisory covering 3 CVEs |
before 0:7.0.40-14_patch_03.ep6.el5 | 0:7.0.40-14_patch_03.ep6.el5 |
tomcat7-admin-webappsRed Hat:jboss_enterprise_web_server:2::el5 From an advisory covering 3 CVEs |
before 0:7.0.40-14_patch_03.ep6.el5 | 0:7.0.40-14_patch_03.ep6.el5 |
tomcat7-docs-webappRed Hat:jboss_enterprise_web_server:2::el5 From an advisory covering 3 CVEs |
before 0:7.0.40-14_patch_03.ep6.el5 | 0:7.0.40-14_patch_03.ep6.el5 |
tomcat7-el-2.2-apiRed Hat:jboss_enterprise_web_server:2::el5 From an advisory covering 3 CVEs |
before 0:7.0.40-14_patch_03.ep6.el5 | 0:7.0.40-14_patch_03.ep6.el5 |
tomcat7-javadocRed Hat:jboss_enterprise_web_server:2::el5 From an advisory covering 3 CVEs |
before 0:7.0.40-14_patch_03.ep6.el5 | 0:7.0.40-14_patch_03.ep6.el5 |
tomcat7-jsp-2.2-apiRed Hat:jboss_enterprise_web_server:2::el5 From an advisory covering 3 CVEs |
before 0:7.0.40-14_patch_03.ep6.el5 | 0:7.0.40-14_patch_03.ep6.el5 |
tomcat7-libRed Hat:jboss_enterprise_web_server:2::el5 From an advisory covering 3 CVEs |
before 0:7.0.40-14_patch_03.ep6.el5 | 0:7.0.40-14_patch_03.ep6.el5 |
tomcat7-log4jRed Hat:jboss_enterprise_web_server:2::el5 From an advisory covering 3 CVEs |
before 0:7.0.40-14_patch_03.ep6.el5 | 0:7.0.40-14_patch_03.ep6.el5 |
tomcat7-servlet-3.0-apiRed Hat:jboss_enterprise_web_server:2::el5 From an advisory covering 3 CVEs |
before 0:7.0.40-14_patch_03.ep6.el5 | 0:7.0.40-14_patch_03.ep6.el5 |
tomcat7-webappsRed Hat:jboss_enterprise_web_server:2::el5 From an advisory covering 3 CVEs |
before 0:7.0.40-14_patch_03.ep6.el5 | 0:7.0.40-14_patch_03.ep6.el5 |
tomcat7Red Hat:jboss_enterprise_web_server:2::el6 From an advisory covering 3 CVEs |
before 0:7.0.40-11_patch_03.ep6.el6 | 0:7.0.40-11_patch_03.ep6.el6 |
tomcat7-admin-webappsRed Hat:jboss_enterprise_web_server:2::el6 From an advisory covering 3 CVEs |
before 0:7.0.40-11_patch_03.ep6.el6 | 0:7.0.40-11_patch_03.ep6.el6 |
tomcat7-docs-webappRed Hat:jboss_enterprise_web_server:2::el6 From an advisory covering 3 CVEs |
before 0:7.0.40-11_patch_03.ep6.el6 | 0:7.0.40-11_patch_03.ep6.el6 |
tomcat7-el-2.2-apiRed Hat:jboss_enterprise_web_server:2::el6 From an advisory covering 3 CVEs |
before 0:7.0.40-11_patch_03.ep6.el6 | 0:7.0.40-11_patch_03.ep6.el6 |
tomcat7-javadocRed Hat:jboss_enterprise_web_server:2::el6 From an advisory covering 3 CVEs |
before 0:7.0.40-11_patch_03.ep6.el6 | 0:7.0.40-11_patch_03.ep6.el6 |
tomcat7-jsp-2.2-apiRed Hat:jboss_enterprise_web_server:2::el6 From an advisory covering 3 CVEs |
before 0:7.0.40-11_patch_03.ep6.el6 | 0:7.0.40-11_patch_03.ep6.el6 |
tomcat7-libRed Hat:jboss_enterprise_web_server:2::el6 From an advisory covering 3 CVEs |
before 0:7.0.40-11_patch_03.ep6.el6 | 0:7.0.40-11_patch_03.ep6.el6 |
tomcat7-log4jRed Hat:jboss_enterprise_web_server:2::el6 From an advisory covering 3 CVEs |
before 0:7.0.40-11_patch_03.ep6.el6 | 0:7.0.40-11_patch_03.ep6.el6 |
tomcat7-servlet-3.0-apiRed Hat:jboss_enterprise_web_server:2::el6 From an advisory covering 3 CVEs |
before 0:7.0.40-11_patch_03.ep6.el6 | 0:7.0.40-11_patch_03.ep6.el6 |
tomcat7-webappsRed Hat:jboss_enterprise_web_server:2::el6 From an advisory covering 3 CVEs |
before 0:7.0.40-11_patch_03.ep6.el6 | 0:7.0.40-11_patch_03.ep6.el6 |
jbosswebRed Hat:jboss_enterprise_application_platform:6::el5 From an advisory covering 4 CVEs |
before 0:7.3.2-4.Final_redhat_3.1.ep6.el5 | 0:7.3.2-4.Final_redhat_3.1.ep6.el5 |
jbosswebRed Hat:jboss_enterprise_application_platform:6::el6 From an advisory covering 4 CVEs |
before 0:7.3.2-4.Final_redhat_3.1.ep6.el6 | 0:7.3.2-4.Final_redhat_3.1.ep6.el6 |
tomcat6Red Hat:enterprise_linux:6::client From an advisory covering 3 CVEs |
before 0:6.0.24-72.el6_5 | 0:6.0.24-72.el6_5 |
tomcat6-admin-webappsRed Hat:enterprise_linux:6::client From an advisory covering 3 CVEs |
before 0:6.0.24-72.el6_5 | 0:6.0.24-72.el6_5 |
tomcat6-docs-webappRed Hat:enterprise_linux:6::client From an advisory covering 3 CVEs |
before 0:6.0.24-72.el6_5 | 0:6.0.24-72.el6_5 |
tomcat6-el-2.1-apiRed Hat:enterprise_linux:6::client From an advisory covering 3 CVEs |
before 0:6.0.24-72.el6_5 | 0:6.0.24-72.el6_5 |
tomcat6-javadocRed Hat:enterprise_linux:6::client From an advisory covering 3 CVEs |
before 0:6.0.24-72.el6_5 | 0:6.0.24-72.el6_5 |
tomcat6-jsp-2.1-apiRed Hat:enterprise_linux:6::client From an advisory covering 3 CVEs |
before 0:6.0.24-72.el6_5 | 0:6.0.24-72.el6_5 |
tomcat6-libRed Hat:enterprise_linux:6::client From an advisory covering 3 CVEs |
before 0:6.0.24-72.el6_5 | 0:6.0.24-72.el6_5 |
tomcat6-servlet-2.5-apiRed Hat:enterprise_linux:6::client From an advisory covering 3 CVEs |
before 0:6.0.24-72.el6_5 | 0:6.0.24-72.el6_5 |
tomcat6-webappsRed Hat:enterprise_linux:6::client From an advisory covering 3 CVEs |
before 0:6.0.24-72.el6_5 | 0:6.0.24-72.el6_5 |
tomcat6Red Hat:enterprise_linux:6::computenode From an advisory covering 3 CVEs |
before 0:6.0.24-72.el6_5 | 0:6.0.24-72.el6_5 |
tomcat6-admin-webappsRed Hat:enterprise_linux:6::computenode From an advisory covering 3 CVEs |
before 0:6.0.24-72.el6_5 | 0:6.0.24-72.el6_5 |
tomcat6-docs-webappRed Hat:enterprise_linux:6::computenode From an advisory covering 3 CVEs |
before 0:6.0.24-72.el6_5 | 0:6.0.24-72.el6_5 |
tomcat6-el-2.1-apiRed Hat:enterprise_linux:6::computenode From an advisory covering 3 CVEs |
before 0:6.0.24-72.el6_5 | 0:6.0.24-72.el6_5 |
tomcat6-javadocRed Hat:enterprise_linux:6::computenode From an advisory covering 3 CVEs |
before 0:6.0.24-72.el6_5 | 0:6.0.24-72.el6_5 |
tomcat6-jsp-2.1-apiRed Hat:enterprise_linux:6::computenode From an advisory covering 3 CVEs |
before 0:6.0.24-72.el6_5 | 0:6.0.24-72.el6_5 |
tomcat6-libRed Hat:enterprise_linux:6::computenode From an advisory covering 3 CVEs |
before 0:6.0.24-72.el6_5 | 0:6.0.24-72.el6_5 |
tomcat6-servlet-2.5-apiRed Hat:enterprise_linux:6::computenode From an advisory covering 3 CVEs |
before 0:6.0.24-72.el6_5 | 0:6.0.24-72.el6_5 |
tomcat6-webappsRed Hat:enterprise_linux:6::computenode From an advisory covering 3 CVEs |
before 0:6.0.24-72.el6_5 | 0:6.0.24-72.el6_5 |
tomcat6Red Hat:enterprise_linux:6::server From an advisory covering 3 CVEs |
before 0:6.0.24-72.el6_5 | 0:6.0.24-72.el6_5 |
tomcat6-el-2.1-apiRed Hat:enterprise_linux:6::server From an advisory covering 3 CVEs |
before 0:6.0.24-72.el6_5 | 0:6.0.24-72.el6_5 |
tomcat6-jsp-2.1-apiRed Hat:enterprise_linux:6::server From an advisory covering 3 CVEs |
before 0:6.0.24-72.el6_5 | 0:6.0.24-72.el6_5 |
tomcat6-libRed Hat:enterprise_linux:6::server From an advisory covering 3 CVEs |
before 0:6.0.24-72.el6_5 | 0:6.0.24-72.el6_5 |
tomcat6-servlet-2.5-apiRed Hat:enterprise_linux:6::server From an advisory covering 3 CVEs |
before 0:6.0.24-72.el6_5 | 0:6.0.24-72.el6_5 |
tomcat6-admin-webappsRed Hat:enterprise_linux:6::server From an advisory covering 3 CVEs |
before 0:6.0.24-72.el6_5 | 0:6.0.24-72.el6_5 |
tomcat6-docs-webappRed Hat:enterprise_linux:6::server From an advisory covering 3 CVEs |
before 0:6.0.24-72.el6_5 | 0:6.0.24-72.el6_5 |
tomcat6-javadocRed Hat:enterprise_linux:6::server From an advisory covering 3 CVEs |
before 0:6.0.24-72.el6_5 | 0:6.0.24-72.el6_5 |
tomcat6-webappsRed Hat:enterprise_linux:6::server From an advisory covering 3 CVEs |
before 0:6.0.24-72.el6_5 | 0:6.0.24-72.el6_5 |
tomcat6Red Hat:enterprise_linux:6::workstation From an advisory covering 3 CVEs |
before 0:6.0.24-72.el6_5 | 0:6.0.24-72.el6_5 |
tomcat6-el-2.1-apiRed Hat:enterprise_linux:6::workstation From an advisory covering 3 CVEs |
before 0:6.0.24-72.el6_5 | 0:6.0.24-72.el6_5 |
tomcat6-jsp-2.1-apiRed Hat:enterprise_linux:6::workstation From an advisory covering 3 CVEs |
before 0:6.0.24-72.el6_5 | 0:6.0.24-72.el6_5 |
tomcat6-libRed Hat:enterprise_linux:6::workstation From an advisory covering 3 CVEs |
before 0:6.0.24-72.el6_5 | 0:6.0.24-72.el6_5 |
tomcat6-servlet-2.5-apiRed Hat:enterprise_linux:6::workstation From an advisory covering 3 CVEs |
before 0:6.0.24-72.el6_5 | 0:6.0.24-72.el6_5 |
tomcat6-admin-webappsRed Hat:enterprise_linux:6::workstation From an advisory covering 3 CVEs |
before 0:6.0.24-72.el6_5 | 0:6.0.24-72.el6_5 |
tomcat6-docs-webappRed Hat:enterprise_linux:6::workstation From an advisory covering 3 CVEs |
before 0:6.0.24-72.el6_5 | 0:6.0.24-72.el6_5 |
tomcat6-javadocRed Hat:enterprise_linux:6::workstation From an advisory covering 3 CVEs |
before 0:6.0.24-72.el6_5 | 0:6.0.24-72.el6_5 |
tomcat6-webappsRed Hat:enterprise_linux:6::workstation From an advisory covering 3 CVEs |
before 0:6.0.24-72.el6_5 | 0:6.0.24-72.el6_5 |
tomcat6Ubuntu:14.04:LTS |
before 6.0.39-1ubuntu0.1, plus listed versions 6.0.37-16.0.39-1 |
6.0.39-1ubuntu0.1 |
tomcat7Ubuntu:14.04:LTS |
before 7.0.52-1ubuntu0.1, plus listed versions 7.0.42-17.0.47-17.0.50-17.0.52-1 |
7.0.52-1ubuntu0.1 |
tomcat7Ubuntu:14.04:LTS From an advisory covering 3 CVEs |
before 7.0.52-1ubuntu0.1, plus listed versions 7.0.42-17.0.47-17.0.50-17.0.52-1 |
7.0.52-1ubuntu0.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2014-0096 is a medium vulnerability (CVSS 4.3) in Apache Tomcat, published May 31, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 6.91%, the 94th percentile. Fixed in org.apache.tomcat:tomcat 6.0.40.
References
advisories.mageia.org/MGASA-2014-0268.html
novell.com/support/kb/doc.php?id=7010166
securityfocus.com/bid/67667
secunia.com/advisories/59121
rhn.redhat.com/errata/RHSA-2015-0765.html
Show 89 moreShow less
vmware.com/security/advisories/VMSA-2014-0012.html
www-01.ibm.com/support/docview.wss?uid=swg21681528
mandriva.com/security/advisories?name=MDVSA-2015:052
linux.oracle.com/errata/ELSA-2014-0865.html
svn.apache.org/viewvc?view=revision&revision=1578637
securitytracker.com/id/1030301
debian.org/security/2016/dsa-3530
marc.info?l=bugtraq&m=141017844705317&w=2
tomcat.apache.org/security-7.html
oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html
lists.fedoraproject.org/pipermail/package-announce/2015-February/150282.html
seclists.org/fulldisclosure/2014/May/135
h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04851013
lists.apache.org/thread.html/b8a1bf18155b552dcf9a928ba808cbadad84c236d85eab3033662cfb%40%3Cdev.tomcat.apache.org%3E
nvd.nist.gov/vuln/detail/CVE-2014-0096
github.com/apache/tomcat/commit/3c53c4da7bcf300f519eaed5ad1751d24dd59f6b
bugs.mageia.org/show_bug.cgi?id=13442
access.redhat.com/errata/RHSA-2014:0827
bugzilla.redhat.com/show_bug.cgi?id=1072776
security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_0827.json
cve.org/CVERecord?id=CVE-2014-0075
ubuntu.com/security/CVE-2014-0096