{"id":"CVE-2014-0119","aliases":["DSA-3530-1","EUVD-2022-4817","GHSA-prc3-7f44-w48j","MGASA-2014-0268","RHSA-2014:0843","RHSA-2014:1034","RHSA-2014:1038","RHSA-2014:1087","RHSA-2014:1088","UBUNTU-CVE-2014-0119","USN-2654-1"],"status":"published","title":"Missing XML Validation in Apache Tomcat","description":"Apache Tomcat before 6.0.40, 7.x before 7.0.54, and 8.x before 8.0.6 does not properly constrain the class loader that accesses the XML parser used with an XSLT stylesheet, which allows remote attackers to (1) read arbitrary files via a crafted web application that provides an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue, or (2) read files associated with different web applications on a single Tomcat instance via a crafted web application.","severity":{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.07616,"percentile":0.9459,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-112","CWE-264"],"published":"2014-05-31T00:00:00Z","modified":"2026-10-14T17:17:31Z","fixes":[{"ecosystem":"Maven","package":"org.apache.tomcat:tomcat","fixed_in":["6.0.40","7.0.54","8.0.6"],"sources":["ghsa","osv"]},{"ecosystem":"Maven","package":"org.apache.tomcat:tomcat-catalina","fixed_in":["6.0.40","7.0.54","8.0.6"],"sources":["ghsa","osv"]},{"ecosystem":"Maven","package":"org.apache.tomcat:tomcat-jasper","fixed_in":["6.0.40","7.0.54","8.0.6"],"sources":["ghsa","osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"tomcat","fixed_in":["0:7.0.42-8.el7_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"tomcat-servlet-3.0-api","fixed_in":["0:7.0.42-8.el7_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"tomcat-admin-webapps","fixed_in":["0:7.0.42-8.el7_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"tomcat-docs-webapp","fixed_in":["0:7.0.42-8.el7_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"tomcat-el-2.2-api","fixed_in":["0:7.0.42-8.el7_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"tomcat-javadoc","fixed_in":["0:7.0.42-8.el7_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"tomcat-jsp-2.2-api","fixed_in":["0:7.0.42-8.el7_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"tomcat-jsvc","fixed_in":["0:7.0.42-8.el7_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"tomcat-lib","fixed_in":["0:7.0.42-8.el7_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"tomcat-webapps","fixed_in":["0:7.0.42-8.el7_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"tomcat","fixed_in":["0:7.0.42-8.el7_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"tomcat-servlet-3.0-api","fixed_in":["0:7.0.42-8.el7_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"tomcat-admin-webapps","fixed_in":["0:7.0.42-8.el7_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"tomcat-docs-webapp","fixed_in":["0:7.0.42-8.el7_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"tomcat-el-2.2-api","fixed_in":["0:7.0.42-8.el7_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"tomcat-javadoc","fixed_in":["0:7.0.42-8.el7_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"tomcat-jsp-2.2-api","fixed_in":["0:7.0.42-8.el7_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"tomcat-jsvc","fixed_in":["0:7.0.42-8.el7_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"tomcat-lib","fixed_in":["0:7.0.42-8.el7_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"tomcat-webapps","fixed_in":["0:7.0.42-8.el7_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"tomcat","fixed_in":["0:7.0.42-8.el7_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"tomcat-admin-webapps","fixed_in":["0:7.0.42-8.el7_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"tomcat-el-2.2-api","fixed_in":["0:7.0.42-8.el7_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"tomcat-jsp-2.2-api","fixed_in":["0:7.0.42-8.el7_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"tomcat-lib","fixed_in":["0:7.0.42-8.el7_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"tomcat-servlet-3.0-api","fixed_in":["0:7.0.42-8.el7_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"tomcat-webapps","fixed_in":["0:7.0.42-8.el7_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"tomcat-docs-webapp","fixed_in":["0:7.0.42-8.el7_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"tomcat-javadoc","fixed_in":["0:7.0.42-8.el7_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"tomcat-jsvc","fixed_in":["0:7.0.42-8.el7_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"tomcat","fixed_in":["0:7.0.42-8.el7_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"tomcat-admin-webapps","fixed_in":["0:7.0.42-8.el7_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"tomcat-el-2.2-api","fixed_in":["0:7.0.42-8.el7_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"tomcat-jsp-2.2-api","fixed_in":["0:7.0.42-8.el7_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"tomcat-lib","fixed_in":["0:7.0.42-8.el7_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"tomcat-servlet-3.0-api","fixed_in":["0:7.0.42-8.el7_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"tomcat-webapps","fixed_in":["0:7.0.42-8.el7_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"tomcat-docs-webapp","fixed_in":["0:7.0.42-8.el7_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"tomcat-javadoc","fixed_in":["0:7.0.42-8.el7_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"tomcat-jsvc","fixed_in":["0:7.0.42-8.el7_0"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"tomcat6","fixed_in":["6.0.39-1ubuntu0.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"tomcat7","fixed_in":["7.0.52-1ubuntu0.3"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.apache.tomcat:tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.40"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.tomcat:tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.0"},{"fixed":"7.0.54"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.tomcat:tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0"},{"fixed":"8.0.6"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.tomcat:tomcat-catalina","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.40"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.tomcat:tomcat-catalina","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.0"},{"fixed":"7.0.54"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.tomcat:tomcat-catalina","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0"},{"fixed":"8.0.6"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.tomcat:tomcat-jasper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.40"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.tomcat:tomcat-jasper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.0"},{"fixed":"7.0.54"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.tomcat:tomcat-jasper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0"},{"fixed":"8.0.6"}]}]},{"source":"osv","ecosystem":"Debian:7","package":"tomcat6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.45+dfsg-1~deb7u1"}]}],"versions":["6.0.35-6","6.0.35-6+deb7u1","6.0.35-7","6.0.37-1","6.0.39-1","6.0.41-1","6.0.41-2","6.0.41-2+squeeze5","6.0.41-2+squeeze6","6.0.41-2+squeeze7","6.0.41-3","6.0.41-4","6.0.45-1~deb6u1"],"bundled":18},{"source":"osv","ecosystem":"Maven","package":"org.apache.tomcat:tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.40"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.apache.tomcat:tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.0"},{"fixed":"7.0.54"}]}],"versions":["7.0.35","7.0.37","7.0.39","7.0.40","7.0.41","7.0.42","7.0.47","7.0.50","7.0.52","7.0.53"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.tomcat:tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0"},{"fixed":"8.0.6"}]}],"versions":["8.0.1","8.0.3","8.0.5"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.tomcat:tomcat-catalina","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.40"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.apache.tomcat:tomcat-catalina","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.0"},{"fixed":"7.0.54"}]}],"versions":["7.0.0","7.0.11","7.0.12","7.0.14","7.0.16","7.0.19","7.0.2","7.0.20","7.0.21","7.0.22","7.0.23","7.0.25","7.0.26","7.0.27","7.0.28","7.0.29","7.0.30","7.0.32","7.0.33","7.0.34","7.0.35","7.0.37","7.0.39","7.0.4","7.0.40","7.0.41","7.0.42","7.0.47","7.0.5","7.0.50","7.0.52","7.0.53","7.0.6","7.0.8"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.tomcat:tomcat-catalina","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0"},{"fixed":"8.0.6"}]}],"versions":["8.0.1","8.0.3","8.0.5"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.tomcat:tomcat-jasper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.40"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.apache.tomcat:tomcat-jasper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.0"},{"fixed":"7.0.54"}]}],"versions":["7.0.0","7.0.11","7.0.12","7.0.14","7.0.16","7.0.19","7.0.2","7.0.20","7.0.21","7.0.22","7.0.23","7.0.25","7.0.26","7.0.27","7.0.28","7.0.29","7.0.30","7.0.32","7.0.33","7.0.34","7.0.35","7.0.37","7.0.39","7.0.4","7.0.40","7.0.41","7.0.42","7.0.47","7.0.5","7.0.50","7.0.52","7.0.53","7.0.6","7.0.8"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.tomcat:tomcat-jasper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0"},{"fixed":"8.0.6"}]}],"versions":["8.0.1","8.0.3","8.0.5"]},{"source":"osv","ecosystem":"Mageia:3","package":"tomcat6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.41-1.mga3"}]}],"bundled":4},{"source":"osv","ecosystem":"Mageia:3","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.54-1.mga3"}]}],"bundled":4},{"source":"osv","ecosystem":"Mageia:4","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.54-1.mga4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el5","package":"jbossweb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.2-4.Final_redhat_3.1.ep6.el5"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el6","package":"jbossweb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.2-4.Final_redhat_3.1.ep6.el6"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.42-8.el7_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"tomcat-servlet-3.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.42-8.el7_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"tomcat-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.42-8.el7_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"tomcat-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.42-8.el7_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"tomcat-el-2.2-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.42-8.el7_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"tomcat-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.42-8.el7_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"tomcat-jsp-2.2-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.42-8.el7_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"tomcat-jsvc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.42-8.el7_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"tomcat-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.42-8.el7_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"tomcat-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.42-8.el7_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.42-8.el7_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"tomcat-servlet-3.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.42-8.el7_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"tomcat-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.42-8.el7_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"tomcat-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.42-8.el7_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"tomcat-el-2.2-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.42-8.el7_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"tomcat-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.42-8.el7_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"tomcat-jsp-2.2-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.42-8.el7_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"tomcat-jsvc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.42-8.el7_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"tomcat-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.42-8.el7_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"tomcat-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.42-8.el7_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.42-8.el7_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"tomcat-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.42-8.el7_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"tomcat-el-2.2-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.42-8.el7_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"tomcat-jsp-2.2-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.42-8.el7_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"tomcat-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.42-8.el7_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"tomcat-servlet-3.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.42-8.el7_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"tomcat-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.42-8.el7_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"tomcat-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.42-8.el7_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"tomcat-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.42-8.el7_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"tomcat-jsvc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.42-8.el7_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.42-8.el7_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"tomcat-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.42-8.el7_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"tomcat-el-2.2-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.42-8.el7_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"tomcat-jsp-2.2-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.42-8.el7_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"tomcat-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.42-8.el7_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"tomcat-servlet-3.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.42-8.el7_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"tomcat-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.42-8.el7_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"tomcat-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.42-8.el7_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"tomcat-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.42-8.el7_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"tomcat-jsvc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.42-8.el7_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"tomcat6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-78.el6_5"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"tomcat6-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-78.el6_5"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"tomcat6-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-78.el6_5"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"tomcat6-el-2.1-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-78.el6_5"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"tomcat6-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-78.el6_5"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"tomcat6-jsp-2.1-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-78.el6_5"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"tomcat6-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-78.el6_5"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"tomcat6-servlet-2.5-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-78.el6_5"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"tomcat6-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-78.el6_5"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"tomcat6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-78.el6_5"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"tomcat6-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-78.el6_5"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"tomcat6-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-78.el6_5"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"tomcat6-el-2.1-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-78.el6_5"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"tomcat6-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-78.el6_5"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"tomcat6-jsp-2.1-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-78.el6_5"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"tomcat6-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-78.el6_5"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"tomcat6-servlet-2.5-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-78.el6_5"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"tomcat6-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-78.el6_5"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"tomcat6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-78.el6_5"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"tomcat6-el-2.1-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-78.el6_5"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"tomcat6-jsp-2.1-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-78.el6_5"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"tomcat6-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-78.el6_5"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"tomcat6-servlet-2.5-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-78.el6_5"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"tomcat6-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-78.el6_5"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"tomcat6-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-78.el6_5"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"tomcat6-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-78.el6_5"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"tomcat6-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-78.el6_5"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"tomcat6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-78.el6_5"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"tomcat6-el-2.1-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-78.el6_5"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"tomcat6-jsp-2.1-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-78.el6_5"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"tomcat6-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-78.el6_5"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"tomcat6-servlet-2.5-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-78.el6_5"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"tomcat6-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-78.el6_5"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"tomcat6-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-78.el6_5"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"tomcat6-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-78.el6_5"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"tomcat6-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-78.el6_5"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"antlr-eap6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.7-17.redhat_4.1.ep6.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"apache-commons-collections-eap6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.1-15.redhat_3.1.ep6.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"apache-commons-collections-tomcat-eap6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.1-15.redhat_3.1.ep6.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"apache-commons-daemon-eap6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.0.15-5.redhat_1.ep6.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"apache-commons-daemon-jsvc-eap6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.0.15-6.redhat_2.ep6.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"apache-commons-daemon-jsvc-eap6-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.0.15-6.redhat_2.ep6.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"apache-commons-logging-eap6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.1-7.9_redhat_1.ep6.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"apache-commons-logging-tomcat-eap6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.1-7.9_redhat_1.ep6.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"apache-commons-pool-eap6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6-7.redhat_6.1.ep6.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"apache-commons-pool-tomcat-eap6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6-7.redhat_6.1.ep6.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"dom4j-eap6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.1-20.redhat_6.1.ep6.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"ecj3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.7.2-9.redhat_3.1.ep6.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"hibernate4-c3p0-eap6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.14-3.SP1_redhat_1.1.ep6.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"hibernate4-core-eap6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.14-3.SP1_redhat_1.1.ep6.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"hibernate4-eap6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.14-3.SP1_redhat_1.1.ep6.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"hibernate4-entitymanager-eap6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.14-3.SP1_redhat_1.1.ep6.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"hibernate4-envers-eap6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.14-3.SP1_redhat_1.1.ep6.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"hibernate4-infinispan-eap6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.14-3.SP1_redhat_1.1.ep6.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"httpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.26-35.ep6.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"httpd-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.26-35.ep6.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"httpd-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.26-35.ep6.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"httpd-manual","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.26-35.ep6.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"httpd-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.26-35.ep6.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"javassist-eap6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.18.1-1.GA_redhat_1.1.ep6.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"jboss-logging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.4-1.GA_redhat_1.1.ep6.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"jboss-transaction-api_1.1_spec","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.1-12.Final_redhat_2.2.ep6.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"mod_cluster","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.9-1.Final_redhat_1.1.ep6.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"mod_cluster-native","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.9-3.Final_redhat_2.ep6.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"mod_cluster-native-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.9-3.Final_redhat_2.ep6.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"mod_cluster-tomcat6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.9-1.Final_redhat_1.1.ep6.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"mod_cluster-tomcat7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.9-1.Final_redhat_1.1.ep6.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"mod_jk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.40-2.redhat_1.ep6.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"mod_jk-ap22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.40-2.redhat_1.ep6.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"mod_jk-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.40-2.redhat_1.ep6.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"mod_jk-manual","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.40-2.redhat_1.ep6.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"mod_rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.1-6.GA.ep6.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"mod_rt-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.1-6.GA.ep6.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"mod_snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.1-13.GA.ep6.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"mod_snmp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.1-13.GA.ep6.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"mod_ssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.2.26-35.ep6.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"storeconfig-tc6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.0.1-7.Alpha3_redhat_12.3.ep6.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"storeconfig-tc7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.0.1-7.Alpha3_redhat_12.5.ep6.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"tomcat-native","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.30-2.redhat_1.ep6.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"tomcat-native-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.30-2.redhat_1.ep6.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"tomcat6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.41-5_patch_02.ep6.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"tomcat6-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.41-5_patch_02.ep6.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"tomcat6-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.41-5_patch_02.ep6.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"tomcat6-el-2.1-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.41-5_patch_02.ep6.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"tomcat6-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.41-5_patch_02.ep6.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"tomcat6-jsp-2.1-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.41-5_patch_02.ep6.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"tomcat6-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.41-5_patch_02.ep6.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"tomcat6-log4j","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.41-5_patch_02.ep6.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"tomcat6-servlet-2.5-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.41-5_patch_02.ep6.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"tomcat6-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.41-5_patch_02.ep6.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"tomcat7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.54-6_patch_02.ep6.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"tomcat7-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.54-6_patch_02.ep6.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"tomcat7-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.54-6_patch_02.ep6.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"tomcat7-el-2.2-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.54-6_patch_02.ep6.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"tomcat7-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.54-6_patch_02.ep6.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"tomcat7-jsp-2.2-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.54-6_patch_02.ep6.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"tomcat7-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.54-6_patch_02.ep6.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"tomcat7-log4j","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.54-6_patch_02.ep6.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"tomcat7-servlet-3.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.54-6_patch_02.ep6.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"tomcat7-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.54-6_patch_02.ep6.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"antlr-eap6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.7-17.redhat_4.1.ep6.el5"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"apache-commons-collections-eap6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.1-15.redhat_3.1.ep6.el5"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"apache-commons-collections-tomcat-eap6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.1-15.redhat_3.1.ep6.el5"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"apache-commons-daemon-eap6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.0.15-5.redhat_1.ep6.el5"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"apache-commons-daemon-jsvc-eap6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.0.15-6.redhat_2.ep6.el5"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"apache-commons-pool-eap6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6-7.redhat_6.1.ep6.el5"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"apache-commons-pool-tomcat-eap6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6-7.redhat_6.1.ep6.el5"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"dom4j-eap6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.1-20.redhat_6.1.ep6.el5"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"ecj3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.7.2-9.redhat_3.1.ep6.el5"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"hibernate4-c3p0-eap6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.14-3.SP1_redhat_1.1.ep6.el5"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"hibernate4-core-eap6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.14-3.SP1_redhat_1.1.ep6.el5"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"hibernate4-eap6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.14-3.SP1_redhat_1.1.ep6.el5"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"hibernate4-entitymanager-eap6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.14-3.SP1_redhat_1.1.ep6.el5"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"hibernate4-envers-eap6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.14-3.SP1_redhat_1.1.ep6.el5"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"hibernate4-infinispan-eap6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.14-3.SP1_redhat_1.1.ep6.el5"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"httpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.26-35.ep6.el5"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"httpd-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.26-35.ep6.el5"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"httpd-manual","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.26-35.ep6.el5"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"httpd-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.26-35.ep6.el5"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"javassist-eap6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.18.1-1.GA_redhat_1.1.ep6.el5"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"jboss-logging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.4-1.GA_redhat_1.1.ep6.el5"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"jboss-transaction-api_1.1_spec","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.1-12.Final_redhat_2.2.ep6.el5"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"mod_cluster","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.9-1.Final_redhat_1.1.ep6.el5"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"mod_cluster-native","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.9-3.Final_redhat_2.ep6.el5"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"mod_cluster-tomcat6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.9-1.Final_redhat_1.1.ep6.el5"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"mod_cluster-tomcat7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.9-1.Final_redhat_1.1.ep6.el5"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"mod_jk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.40-2.redhat_1.ep6.el5"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"mod_jk-ap22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.40-2.redhat_1.ep6.el5"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"mod_jk-manual","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.40-2.redhat_1.ep6.el5"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"mod_rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.1-6.GA.ep6.el5"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"mod_snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.1-13.GA.ep6.el5"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"mod_ssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.2.26-35.ep6.el5"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"storeconfig-tc6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.0.1-7.Alpha3_redhat_12.3.ep6.el5"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"storeconfig-tc7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.0.1-7.Alpha3_redhat_12.5.ep6.el5"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"tomcat-native","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.30-2.redhat_1.ep6.el5"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"tomcat6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.41-6_patch_02.ep6.el5"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"tomcat6-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.41-6_patch_02.ep6.el5"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"tomcat6-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.41-6_patch_02.ep6.el5"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"tomcat6-el-2.1-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.41-6_patch_02.ep6.el5"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"tomcat6-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.41-6_patch_02.ep6.el5"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"tomcat6-jsp-2.1-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.41-6_patch_02.ep6.el5"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"tomcat6-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.41-6_patch_02.ep6.el5"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"tomcat6-log4j","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.41-6_patch_02.ep6.el5"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"tomcat6-servlet-2.5-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.41-6_patch_02.ep6.el5"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"tomcat6-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.41-6_patch_02.ep6.el5"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"tomcat7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.54-6_patch_02.ep6.el5"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"tomcat7-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.54-6_patch_02.ep6.el5"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"tomcat7-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.54-6_patch_02.ep6.el5"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"tomcat7-el-2.2-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.54-6_patch_02.ep6.el5"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"tomcat7-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.54-6_patch_02.ep6.el5"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"tomcat7-jsp-2.2-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.54-6_patch_02.ep6.el5"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"tomcat7-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.54-6_patch_02.ep6.el5"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"tomcat7-log4j","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.54-6_patch_02.ep6.el5"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"tomcat7-servlet-3.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.54-6_patch_02.ep6.el5"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"tomcat7-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.54-6_patch_02.ep6.el5"}]}],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"tomcat6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.39-1ubuntu0.1"}]}],"versions":["6.0.37-1","6.0.39-1"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"tomcat7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.52-1ubuntu0.3"}]}],"versions":["7.0.42-1","7.0.47-1","7.0.50-1","7.0.52-1","7.0.52-1ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"tomcat7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.52-1ubuntu0.3"}]}],"versions":["7.0.42-1","7.0.47-1","7.0.50-1","7.0.52-1","7.0.52-1ubuntu0.1"],"bundled":4}],"products":[{"vendor":"apache","product":"tomcat"}],"references":[{"url":"http://svn.apache.org/viewvc?view=revision\u0026revision=1590036","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://advisories.mageia.org/MGASA-2014-0268.html","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://svn.apache.org/viewvc?view=revision\u0026revision=1589837","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://www.ubuntu.com/usn/USN-2654-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","web"]},{"url":"http://rhn.redhat.com/errata/RHSA-2015-0765.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","web"]},{"url":"http://secunia.com/advisories/59732","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","web"]},{"url":"http://rhn.redhat.com/errata/RHSA-2015-0675.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","web"]},{"url":"http://www.vmware.com/security/advisories/VMSA-2014-0012.html","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://www-01.ibm.com/support/docview.wss?uid=swg21681528","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://www.mandriva.com/security/advisories?name=MDVSA-2015:052","tags":["vendor-advisory","x_refsource_MANDRIVA","x_transferred","web"]},{"url":"http://rhn.redhat.com/errata/RHSA-2015-0720.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","web"]},{"url":"http://svn.apache.org/viewvc?view=revision\u0026revision=1590028","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://svn.apache.org/viewvc?view=revision\u0026revision=1589992","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://www.mandriva.com/security/advisories?name=MDVSA-2015:084","tags":["vendor-advisory","x_refsource_MANDRIVA","x_transferred","web"]},{"url":"http://www.debian.org/security/2016/dsa-3530","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","web"]},{"url":"http://svn.apache.org/viewvc?view=revision\u0026revision=1589983","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://marc.info/?l=bugtraq\u0026m=141017844705317\u0026w=2","tags":["vendor-advisory","x_refsource_HP","x_transferred","web"]},{"url":"http://tomcat.apache.org/security-7.html","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","web"]},{"url":"http://www.securityfocus.com/archive/1/534161/100/0/threaded","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred","web"]},{"url":"http://www.mandriva.com/security/advisories?name=MDVSA-2015:053","tags":["vendor-advisory","x_refsource_MANDRIVA","x_transferred","web"]},{"url":"http://svn.apache.org/viewvc?view=revision\u0026revision=1588199","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://svn.apache.org/viewvc?view=revision\u0026revision=1589997","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://tomcat.apache.org/security-8.html","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","web"]},{"url":"http://www-01.ibm.com/support/docview.wss?uid=swg21678231","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://svn.apache.org/viewvc?view=revision\u0026revision=1589980","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://svn.apache.org/viewvc?view=revision\u0026revision=1589640","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://tomcat.apache.org/security-6.html","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","web"]},{"url":"https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04851013","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://secunia.com/advisories/59873","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","web"]},{"url":"http://seclists.org/fulldisclosure/2014/May/141","tags":["mailing-list","x_refsource_FULLDISC","x_transferred","web"]},{"url":"http://svn.apache.org/viewvc?view=revision\u0026revision=1589985","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://svn.apache.org/viewvc?view=revision\u0026revision=1593815","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://seclists.org/fulldisclosure/2014/Dec/23","tags":["mailing-list","x_refsource_FULLDISC","x_transferred","web"]},{"url":"http://svn.apache.org/viewvc?view=revision\u0026revision=1589990","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://marc.info/?l=bugtraq\u0026m=144498216801440\u0026w=2","tags":["vendor-advisory","x_refsource_HP","x_transferred","web"]},{"url":"http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://svn.apache.org/viewvc?view=revision\u0026revision=1588193","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://www.securityfocus.com/bid/67669","tags":["vdb-entry","x_refsource_BID","x_transferred","web"]},{"url":"http://www.securitytracker.com/id/1030298","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","web"]},{"url":"http://www.debian.org/security/2016/dsa-3552","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","web"]},{"url":"http://svn.apache.org/viewvc?view=revision\u0026revision=1593821","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://secunia.com/advisories/60729","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/b8a1bf18155b552dcf9a928ba808cbadad84c236d85eab3033662cfb%40%3Cdev.tomcat.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/39ae1f0bd5867c15755a6f959b271ade1aea04ccdc3b2e639dcd903b%40%3Cdev.tomcat.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/37220405a377c0182d2afdbc36461c4783b2930fbeae3a17f1333113%40%3Cdev.tomcat.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/b84ad1258a89de5c9c853c7f2d3ad77e5b8b2930be9e132d5cef6b95%40%3Cdev.tomcat.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r03c597a64de790ba42c167efacfa23300c3d6c9fe589ab87fe02859c%40%3Cdev.tomcat.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r587e50b86c1a96ee301f751d50294072d142fd6dc08a8987ae9f3a9b%40%3Cdev.tomcat.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-0119","tags":["advisory"]},{"url":"https://lists.apache.org/thread.html/37220405a377c0182d2afdbc36461c4783b2930fbeae3a17f1333113@%3Cdev.tomcat.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/39ae1f0bd5867c15755a6f959b271ade1aea04ccdc3b2e639dcd903b@%3Cdev.tomcat.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/b84ad1258a89de5c9c853c7f2d3ad77e5b8b2930be9e132d5cef6b95@%3Cdev.tomcat.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/b8a1bf18155b552dcf9a928ba808cbadad84c236d85eab3033662cfb@%3Cdev.tomcat.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/r03c597a64de790ba42c167efacfa23300c3d6c9fe589ab87fe02859c@%3Cdev.tomcat.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/r587e50b86c1a96ee301f751d50294072d142fd6dc08a8987ae9f3a9b@%3Cdev.tomcat.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c@%3Cdev.tomcat.apache.org%3E","tags":["web"]},{"url":"https://github.com/apache/tomcat/commit/080878ea519d8c74c53721a9ebf7be6fcf6f1f2f","tags":["web"]},{"url":"https://github.com/apache/tomcat/commit/50311bed8d87e452ff0e69838ba312c4fe899b2d","tags":["web"]},{"url":"https://github.com/apache/tomcat/commit/5517c5517e8a7ddb994504f0c5c05001a376b10c","tags":["web"]},{"url":"https://github.com/apache/tomcat/commit/5aae1323c31d643afa9f2db80713b8e97b5123af","tags":["web"]},{"url":"https://github.com/apache/tomcat/commit/6246d8307fb5f2b4ff0b0f4d6d1b0250dff01a81","tags":["web"]},{"url":"https://github.com/apache/tomcat/commit/769477b9bc8442db3f571385fa0c3e206242cbf1","tags":["web"]},{"url":"https://github.com/apache/tomcat/commit/934f884f330dad192d2c5dc950e28f4cd281461b","tags":["web"]},{"url":"https://github.com/apache/tomcat/commit/ad3b34a290a0255d2a4c356a3611ab41ed9d04f5","tags":["web"]},{"url":"https://github.com/apache/tomcat/commit/ce70ee6b8fe437a498a375215011056702b0c481","tags":["web"]},{"url":"https://github.com/apache/tomcat/commit/ebe5c16f18ce1559e8462a94b3876a98525980d2","tags":["web"]},{"url":"https://github.com/apache/tomcat/commit/f8b316acbbf9fabf87cc137e9777e912eda0d834","tags":["web"]},{"url":"https://github.com/apache/tomcat80/commit/25251de791a6a7be13f2f3d3a66119a77025272d","tags":["web"]},{"url":"https://github.com/apache/tomcat80/commit/4d90e355dc5ced4c53585c2b4700f71a52d8f447","tags":["web"]},{"url":"https://github.com/apache/tomcat80/commit/51e59532ad4c604f55575963dc7a7f0250cb420f","tags":["web"]},{"url":"https://github.com/apache/tomcat80/commit/69a8a72283c3395ece8b899cf8562e126de97a27","tags":["web"]},{"url":"https://github.com/apache/tomcat80/commit/77e014cef5d5af619bcf77eaebf22c284d420802","tags":["web"]},{"url":"https://github.com/apache/tomcat80/commit/7d33457de5fc5a652a88fb9bbc9ba4cbbda58f04","tags":["web"]},{"url":"https://github.com/apache/tomcat80/commit/d59fd4398c8ae6361e0b13c491f66b51e49a7441","tags":["web"]},{"url":"https://github.com/advisories/GHSA-prc3-7f44-w48j"},{"url":"https://github.com/apache/tomcat","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2014-0268.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=13442","tags":["report"]},{"url":"https://access.redhat.com/errata/RHSA-2014:0843","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1072776","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1088342","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1102030","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1102038","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_0843.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-0075","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-0075","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-0075","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-0096","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-0096","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-0096","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-0099","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-0099","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-0099","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-0119","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-0119","tags":["advisory","report"]},{"url":"https://access.redhat.com/errata/RHSA-2014:1034","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#low","tags":["article"]},{"url":"https://tomcat.apache.org/security-6.html","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_1034.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2014:1038","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1069911","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_1038.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2013-4590","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-4590","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-4590","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2014:1087","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-US/JBoss_Enterprise_Web_Server/2.1/html/2.1.0_Release_Notes/index.html","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1120596","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1120601","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1120603","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_1087.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-0118","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-0118","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-0118","tags":["advisory"]},{"url":"http://httpd.apache.org/security/vulnerabilities_24.html","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-0226","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-0226","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-0226","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-0227","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1109196","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-0227","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-0227","tags":["advisory"]},{"url":"https://tomcat.apache.org/security-6.html#Fixed_in_Apache_Tomcat_6.0.43","tags":["article"]},{"url":"https://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.55","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-0231","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-0231","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-0231","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2014:1088","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_1088.json","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2014-0119","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-2654-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2014-0227","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2014-0230","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2014-7810","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2014-0119","description":"Apache Tomcat before 6.0.40, 7.x before 7.0.54, and 8.x before 8.0.6 does not properly constrain the class loader that accesses the XML parser used with an XSLT stylesheet, which allows remote attackers to (1) read arbitrary files via a crafted web application that provides an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue, or (2) read files associated with different web applications on a single Tomcat instance via a crafted web application.","status":"published","published":"2014-05-31T10:00:00Z","modified":"2026-10-14T16:21:34.104Z","updated_at":"2026-11-02T14:33:47.330011Z"}],"euvd":[{"id":"EUVD-2022-4817","description":"Apache Tomcat before 6.0.40, 7.x before 7.0.54, and 8.x before 8.0.6 does not properly constrain the class loader that accesses the XML parser used with an XSLT stylesheet, which allows remote attackers to (1) read arbitrary files via a crafted web application that provides an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue, or (2) read files associated with different web applications on a single Tomcat instance via a crafted web application.","status":"published","published":"2014-05-31T10:00:00Z","modified":"2026-10-14T16:21:34Z","updated_at":"2026-11-02T17:27:14.304159Z"}],"ghsa":[{"id":"GHSA-prc3-7f44-w48j","title":"Missing XML Validation in Apache Tomcat","description":"Apache Tomcat before 6.0.40, 7.x before 7.0.54, and 8.x before 8.0.6 does not properly constrain the class loader that accesses the XML parser used with an XSLT stylesheet, which allows remote attackers to (1) read arbitrary files via a crafted web application that provides an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue, or (2) read files associated with different web applications on a single Tomcat instance via a crafted web application.","status":"published","published":"2022-05-14T01:10:18Z","modified":"2025-04-14T21:41:46Z","cwes":["CWE-112"],"updated_at":"2026-11-02T14:38:39.85223Z"}],"nvd":[{"id":"CVE-2014-0119","description":"Apache Tomcat before 6.0.40, 7.x before 7.0.54, and 8.x before 8.0.6 does not properly constrain the class loader that accesses the XML parser used with an XSLT stylesheet, which allows remote attackers to (1) read arbitrary files via a crafted web application that provides an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue, or (2) read files associated with different web applications on a single Tomcat instance via a crafted web application.","status":"published","published":"2014-05-31T11:17:13.357Z","modified":"2026-10-14T17:17:31.707Z","cvss":[{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-264"],"updated_at":"2026-11-02T14:02:54.464139Z"}],"osv":[{"id":"DSA-3530-1","title":"tomcat6 - security update","status":"published","published":"2016-03-25T00:00:00Z","modified":"2026-03-09T01:22:25.978219Z","updated_at":"2026-11-02T15:46:16.199525Z"},{"id":"GHSA-prc3-7f44-w48j","title":"Missing XML Validation in Apache Tomcat","description":"Apache Tomcat before 6.0.40, 7.x before 7.0.54, and 8.x before 8.0.6 does not properly constrain the class loader that accesses the XML parser used with an XSLT stylesheet, which allows remote attackers to (1) read arbitrary files via a crafted web application that provides an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue, or (2) read files associated with different web applications on a single Tomcat instance via a crafted web application.","status":"published","published":"2022-05-14T01:10:18Z","modified":"2025-04-14T22:12:32.57511Z","cwes":["CWE-112"],"updated_at":"2026-11-02T15:46:53.700556Z"},{"id":"MGASA-2014-0268","title":"Updated tomcat and tomcat6 packages fix security vulnerabilities","description":"Integer overflow in the parseChunkHeader function in\njava/org/apache/coyote/http11/filters/ChunkedInputFilter.java in Apache\nTomcat before 6.0.40 and 7.x before 7.0.53 allows remote attackers to cause\na denial of service (resource consumption) via a malformed chunk size in\nchunked transfer coding of a request during the streaming of data\n(CVE-2014-0075).\n\njava/org/apache/catalina/servlets/DefaultServlet.java in the default servlet\nin Apache Tomcat before 6.0.40 and 7.x before 7.0.53 does not properly\nrestrict XSLT stylesheets, which allows remote attackers to bypass\nsecurity-manager restrictions and read arbitrary files via a crafted web\napplication that provides an XML external entity declaration in conjunction\nwith an entity reference, related to an XML External Entity (XXE) issue\n(CVE-2014-0096).\n\nInteger overflow in java/org/apache/tomcat/util/buf/Ascii.java in Apache\nTomcat before 6.0.40 and 7.x before 7.0.53, when operated behind a reverse\nproxy, allows remote attackers to conduct HTTP request smuggling attacks via\na crafted Content-Length HTTP header (CVE-2014-0099).\n\nApache Tomcat before 6.0.40 and 7.x before 7.0.54 does not properly\nconstrain the class loader that accesses the XML parser used with an XSLT\nstylesheet, which allows remote attackers to read arbitrary files via a\ncrafted web application that provides an XML external entity declaration in\nconjunction with an entity reference, related to an XML External Entity\n(XXE) issue, or read files associated with different web applications on a\nsingle Tomcat instance via a crafted web application (CVE-2014-0119).\n","status":"published","published":"2014-06-19T20:30:12Z","modified":"2026-04-16T06:25:01.171414557Z","updated_at":"2026-11-02T15:49:39.488462Z"},{"id":"RHSA-2014:0843","title":"Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.2.4 security update","status":"published","published":"2024-09-15T21:33:23Z","modified":"2026-08-05T10:02:40Z","updated_at":"2026-11-02T15:53:02.532052Z"},{"id":"RHSA-2014:1034","title":"Red Hat Security Advisory: tomcat security update","status":"published","published":"2024-09-15T21:26:44Z","modified":"2026-08-05T10:02:45Z","updated_at":"2026-11-02T15:53:02.532052Z"},{"id":"RHSA-2014:1038","title":"Red Hat Security Advisory: tomcat6 security update","status":"published","published":"2024-09-15T21:26:39Z","modified":"2026-08-05T10:02:45Z","updated_at":"2026-11-02T15:53:02.532052Z"},{"id":"RHSA-2014:1087","title":"Red Hat Security Advisory: Red Hat JBoss Web Server 2.1.0 update","status":"published","published":"2024-09-15T21:26:07Z","modified":"2026-08-05T10:02:48Z","updated_at":"2026-11-02T15:53:02.532052Z"},{"id":"RHSA-2014:1088","title":"Red Hat Security Advisory: Red Hat JBoss Web Server 2.1.0 update","status":"published","published":"2024-09-15T21:26:13Z","modified":"2026-08-05T10:02:49Z","updated_at":"2026-11-02T15:53:02.532052Z"},{"id":"UBUNTU-CVE-2014-0119","description":"Apache Tomcat before 6.0.40, 7.x before 7.0.54, and 8.x before 8.0.6 does not properly constrain the class loader that accesses the XML parser used with an XSLT stylesheet, which allows remote attackers to (1) read arbitrary files via a crafted web application that provides an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue, or (2) read files associated with different web applications on a single Tomcat instance via a crafted web application.","status":"published","published":"2014-05-31T00:00:00Z","modified":"2026-02-04T03:13:32.756552Z","updated_at":"2026-11-02T15:54:07.855521Z"},{"id":"USN-2654-1","title":"tomcat7 vulnerabilities","description":"It was discovered that the Tomcat XML parser incorrectly handled XML\nExternal Entities (XXE). A remote attacker could possibly use this issue to\nread arbitrary files. This issue only affected Ubuntu 14.04 LTS.\n(CVE-2014-0119)\n\nIt was discovered that Tomcat incorrectly handled data with malformed\nchunked transfer coding. A remote attacker could possibly use this issue to\nconduct HTTP request smuggling attacks, or cause Tomcat to consume\nresources, resulting in a denial of service. This issue only affected\nUbuntu 14.04 LTS. (CVE-2014-0227)\n\nIt was discovered that Tomcat incorrectly handled HTTP responses occurring\nbefore the entire request body was finished being read. A remote attacker\ncould possibly use this issue to cause a limited denial of service. This\nissue only affected Ubuntu 14.04 LTS. (CVE-2014-0230)\n\nIt was discovered that the Tomcat Expression Language (EL) implementation\nincorrectly handled accessible interfaces implemented by inaccessible\nclasses. An attacker could possibly use this issue to bypass a\nSecurityManager protection mechanism. (CVE-2014-7810)\n","status":"published","published":"2015-06-25T12:32:34Z","modified":"2026-02-10T04:40:54Z","updated_at":"2026-11-02T16:58:09.227524Z"}]}}