{"id":"CVE-2014-7810","aliases":["DEBIAN-CVE-2014-7810","DLA-232-1","DSA-3428-1","DSA-3447-1","DSA-3530-1","EUVD-2022-2350","GHSA-4c43-cwvx-9crh","RHSA-2015:1622","RHSA-2016:0492","RHSA-2016:2046","SUSE-SU-2015:1281-1","SUSE-SU-2015:1337-1","SUSE-SU-2015:1565-1","UBUNTU-CVE-2014-7810","USN-2654-1"],"status":"published","title":"Improper Access Control in Apache Tomcat","description":"The Expression Language (EL) implementation in Apache Tomcat 6.x before 6.0.44, 7.x before 7.0.58, and 8.x before 8.0.16 does not properly consider the possibility of an accessible interface implemented by an inaccessible class, which allows attackers to bypass a SecurityManager protection mechanism via a web application that leverages use of incorrect privileges during EL evaluation.","severity":{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.13349,"percentile":0.96438,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-284"],"published":"2013-08-02T13:29:14Z","modified":"2026-10-14T17:17:33Z","fixes":[{"ecosystem":"Maven","package":"org.apache.tomcat:tomcat","fixed_in":["6.0.44","7.0.58","8.0.16"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:8","package":"tomcat8","fixed_in":["8.0.14-1+deb8u1"],"sources":["osv"]},{"ecosystem":"Debian:7","package":"tomcat7","fixed_in":["7.0.28-4+deb7u3"],"sources":["osv"]},{"ecosystem":"Debian:8","package":"tomcat7","fixed_in":["7.0.56-3+deb8u1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::client","package":"tomcat6","fixed_in":["0:6.0.24-94.el6_7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::client","package":"tomcat6-admin-webapps","fixed_in":["0:6.0.24-94.el6_7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::client","package":"tomcat6-debuginfo","fixed_in":["0:6.0.24-94.el6_7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::client","package":"tomcat6-docs-webapp","fixed_in":["0:6.0.24-94.el6_7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::client","package":"tomcat6-el-2.1-api","fixed_in":["0:6.0.24-94.el6_7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::client","package":"tomcat6-javadoc","fixed_in":["0:6.0.24-94.el6_7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::client","package":"tomcat6-jsp-2.1-api","fixed_in":["0:6.0.24-94.el6_7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::client","package":"tomcat6-lib","fixed_in":["0:6.0.24-94.el6_7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::client","package":"tomcat6-servlet-2.5-api","fixed_in":["0:6.0.24-94.el6_7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::client","package":"tomcat6-webapps","fixed_in":["0:6.0.24-94.el6_7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"tomcat6","fixed_in":["0:6.0.24-94.el6_7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"tomcat6-admin-webapps","fixed_in":["0:6.0.24-94.el6_7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"tomcat6-debuginfo","fixed_in":["0:6.0.24-94.el6_7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"tomcat6-docs-webapp","fixed_in":["0:6.0.24-94.el6_7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"tomcat6-el-2.1-api","fixed_in":["0:6.0.24-94.el6_7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"tomcat6-javadoc","fixed_in":["0:6.0.24-94.el6_7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"tomcat6-jsp-2.1-api","fixed_in":["0:6.0.24-94.el6_7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"tomcat6-lib","fixed_in":["0:6.0.24-94.el6_7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"tomcat6-servlet-2.5-api","fixed_in":["0:6.0.24-94.el6_7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"tomcat6-webapps","fixed_in":["0:6.0.24-94.el6_7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::server","package":"tomcat6","fixed_in":["0:6.0.24-94.el6_7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::server","package":"tomcat6-debuginfo","fixed_in":["0:6.0.24-94.el6_7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::server","package":"tomcat6-el-2.1-api","fixed_in":["0:6.0.24-94.el6_7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::server","package":"tomcat6-jsp-2.1-api","fixed_in":["0:6.0.24-94.el6_7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::server","package":"tomcat6-lib","fixed_in":["0:6.0.24-94.el6_7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::server","package":"tomcat6-servlet-2.5-api","fixed_in":["0:6.0.24-94.el6_7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::server","package":"tomcat6-admin-webapps","fixed_in":["0:6.0.24-94.el6_7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::server","package":"tomcat6-docs-webapp","fixed_in":["0:6.0.24-94.el6_7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::server","package":"tomcat6-javadoc","fixed_in":["0:6.0.24-94.el6_7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::server","package":"tomcat6-webapps","fixed_in":["0:6.0.24-94.el6_7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"tomcat6","fixed_in":["0:6.0.24-94.el6_7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"tomcat6-debuginfo","fixed_in":["0:6.0.24-94.el6_7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"tomcat6-el-2.1-api","fixed_in":["0:6.0.24-94.el6_7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"tomcat6-jsp-2.1-api","fixed_in":["0:6.0.24-94.el6_7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"tomcat6-lib","fixed_in":["0:6.0.24-94.el6_7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"tomcat6-servlet-2.5-api","fixed_in":["0:6.0.24-94.el6_7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"tomcat6-admin-webapps","fixed_in":["0:6.0.24-94.el6_7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"tomcat6-docs-webapp","fixed_in":["0:6.0.24-94.el6_7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"tomcat6-javadoc","fixed_in":["0:6.0.24-94.el6_7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"tomcat6-webapps","fixed_in":["0:6.0.24-94.el6_7"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12","package":"tomcat","fixed_in":["7.0.55-8.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12","package":"tomcat","fixed_in":["7.0.55-8.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"tomcat6","fixed_in":["6.0.39-1ubuntu0.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"tomcat7","fixed_in":["7.0.52-1ubuntu0.3"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"tomcat6","fixed_in":["6.0.45+dfsg-1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.apache.tomcat:tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"6.0.44"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.tomcat:tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.0"},{"fixed":"7.0.58"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.tomcat:tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0"},{"fixed":"8.0.16"}]}]},{"source":"osv","ecosystem":"Debian:6.0","package":"tomcat6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.41-2+squeeze7"}]}],"versions":["6.0.28-10","6.0.28-9","6.0.28-9+squeeze1","6.0.32-1","6.0.32-2","6.0.32-3","6.0.32-4","6.0.32-5","6.0.32-6","6.0.32-7","6.0.33-1","6.0.35-1","6.0.35-1+squeeze2","6.0.35-1+squeeze3","6.0.35-1+squeeze4","6.0.35-2","6.0.35-3","6.0.35-4","6.0.35-5","6.0.35-5+nmu1","6.0.35-6","6.0.35-7","6.0.37-1","6.0.39-1","6.0.41-1","6.0.41-2","6.0.41-2+squeeze5","6.0.41-2+squeeze6"],"bundled":3},{"source":"osv","ecosystem":"Debian:8","package":"tomcat8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.14-1+deb8u1"}]}],"versions":["8.0.14-1"]},{"source":"osv","ecosystem":"Debian:7","package":"tomcat7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.28-4+deb7u3"}]}],"versions":["7.0.28-4","7.0.28-4+deb7u1","7.0.28-4+deb7u2"]},{"source":"osv","ecosystem":"Debian:8","package":"tomcat7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.56-3+deb8u1"}]}],"versions":["7.0.56-3"]},{"source":"osv","ecosystem":"Debian:7","package":"tomcat6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.45+dfsg-1~deb7u1"}]}],"versions":["6.0.35-6","6.0.35-6+deb7u1","6.0.35-7","6.0.37-1","6.0.39-1","6.0.41-1","6.0.41-2","6.0.41-2+squeeze5","6.0.41-2+squeeze6","6.0.41-2+squeeze7","6.0.41-3","6.0.41-4","6.0.45-1~deb6u1"],"bundled":18},{"source":"osv","ecosystem":"Maven","package":"org.apache.tomcat:tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"6.0.44"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.apache.tomcat:tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.0"},{"fixed":"7.0.58"}]}],"versions":["7.0.35","7.0.37","7.0.39","7.0.40","7.0.41","7.0.42","7.0.47","7.0.50","7.0.52","7.0.53","7.0.54","7.0.55","7.0.56","7.0.57"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.tomcat:tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0"},{"fixed":"8.0.16"}]}],"versions":["8.0.1","8.0.11","8.0.12","8.0.14","8.0.15","8.0.3","8.0.5","8.0.8","8.0.9"]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"tomcat6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.41-15_patch_04.ep6.el5"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"tomcat6-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.41-15_patch_04.ep6.el5"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"tomcat6-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.41-15_patch_04.ep6.el5"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"tomcat6-el-2.1-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.41-15_patch_04.ep6.el5"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"tomcat6-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.41-15_patch_04.ep6.el5"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"tomcat6-jsp-2.1-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.41-15_patch_04.ep6.el5"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"tomcat6-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.41-15_patch_04.ep6.el5"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"tomcat6-log4j","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.41-15_patch_04.ep6.el5"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"tomcat6-maven-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.41-15_patch_04.ep6.el5"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"tomcat6-servlet-2.5-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.41-15_patch_04.ep6.el5"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"tomcat6-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.41-15_patch_04.ep6.el5"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"tomcat7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.54-19_patch_04.ep6.el5"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"tomcat7-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.54-19_patch_04.ep6.el5"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"tomcat7-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.54-19_patch_04.ep6.el5"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"tomcat7-el-2.2-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.54-19_patch_04.ep6.el5"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"tomcat7-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.54-19_patch_04.ep6.el5"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"tomcat7-jsp-2.2-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.54-19_patch_04.ep6.el5"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"tomcat7-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.54-19_patch_04.ep6.el5"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"tomcat7-log4j","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.54-19_patch_04.ep6.el5"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"tomcat7-maven-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.54-19_patch_04.ep6.el5"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"tomcat7-servlet-3.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.54-19_patch_04.ep6.el5"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"tomcat7-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.54-19_patch_04.ep6.el5"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"tomcat6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.41-15_patch_04.ep6.el6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"tomcat6-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.41-15_patch_04.ep6.el6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"tomcat6-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.41-15_patch_04.ep6.el6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"tomcat6-el-2.1-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.41-15_patch_04.ep6.el6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"tomcat6-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.41-15_patch_04.ep6.el6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"tomcat6-jsp-2.1-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.41-15_patch_04.ep6.el6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"tomcat6-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.41-15_patch_04.ep6.el6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"tomcat6-log4j","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.41-15_patch_04.ep6.el6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"tomcat6-maven-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.41-15_patch_04.ep6.el6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"tomcat6-servlet-2.5-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.41-15_patch_04.ep6.el6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"tomcat6-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.41-15_patch_04.ep6.el6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"tomcat7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.54-19_patch_04.ep6.el6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"tomcat7-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.54-19_patch_04.ep6.el6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"tomcat7-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.54-19_patch_04.ep6.el6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"tomcat7-el-2.2-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.54-19_patch_04.ep6.el6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"tomcat7-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.54-19_patch_04.ep6.el6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"tomcat7-jsp-2.2-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.54-19_patch_04.ep6.el6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"tomcat7-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.54-19_patch_04.ep6.el6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"tomcat7-log4j","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.54-19_patch_04.ep6.el6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"tomcat7-maven-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.54-19_patch_04.ep6.el6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"tomcat7-servlet-3.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.54-19_patch_04.ep6.el6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"tomcat7-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.54-19_patch_04.ep6.el6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el7","package":"tomcat6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.41-15_patch_04.ep6.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el7","package":"tomcat6-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.41-15_patch_04.ep6.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el7","package":"tomcat6-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.41-15_patch_04.ep6.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el7","package":"tomcat6-el-2.1-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.41-15_patch_04.ep6.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el7","package":"tomcat6-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.41-15_patch_04.ep6.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el7","package":"tomcat6-jsp-2.1-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.41-15_patch_04.ep6.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el7","package":"tomcat6-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.41-15_patch_04.ep6.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el7","package":"tomcat6-log4j","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.41-15_patch_04.ep6.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el7","package":"tomcat6-maven-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.41-15_patch_04.ep6.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el7","package":"tomcat6-servlet-2.5-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.41-15_patch_04.ep6.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el7","package":"tomcat6-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.41-15_patch_04.ep6.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el7","package":"tomcat7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.54-20_patch_04.ep6.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el7","package":"tomcat7-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.54-20_patch_04.ep6.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el7","package":"tomcat7-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.54-20_patch_04.ep6.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el7","package":"tomcat7-el-2.2-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.54-20_patch_04.ep6.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el7","package":"tomcat7-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.54-20_patch_04.ep6.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el7","package":"tomcat7-jsp-2.2-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.54-20_patch_04.ep6.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el7","package":"tomcat7-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.54-20_patch_04.ep6.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el7","package":"tomcat7-log4j","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.54-20_patch_04.ep6.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el7","package":"tomcat7-maven-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.54-20_patch_04.ep6.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el7","package":"tomcat7-servlet-3.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.54-20_patch_04.ep6.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el7","package":"tomcat7-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.54-20_patch_04.ep6.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"tomcat6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-94.el6_7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"tomcat6-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-94.el6_7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"tomcat6-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-94.el6_7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"tomcat6-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-94.el6_7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"tomcat6-el-2.1-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-94.el6_7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"tomcat6-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-94.el6_7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"tomcat6-jsp-2.1-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-94.el6_7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"tomcat6-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-94.el6_7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"tomcat6-servlet-2.5-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-94.el6_7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"tomcat6-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-94.el6_7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"tomcat6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-94.el6_7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"tomcat6-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-94.el6_7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"tomcat6-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-94.el6_7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"tomcat6-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-94.el6_7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"tomcat6-el-2.1-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-94.el6_7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"tomcat6-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-94.el6_7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"tomcat6-jsp-2.1-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-94.el6_7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"tomcat6-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-94.el6_7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"tomcat6-servlet-2.5-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-94.el6_7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"tomcat6-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-94.el6_7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"tomcat6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-94.el6_7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"tomcat6-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-94.el6_7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"tomcat6-el-2.1-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-94.el6_7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"tomcat6-jsp-2.1-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-94.el6_7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"tomcat6-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-94.el6_7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"tomcat6-servlet-2.5-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-94.el6_7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"tomcat6-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-94.el6_7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"tomcat6-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-94.el6_7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"tomcat6-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-94.el6_7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"tomcat6-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-94.el6_7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"tomcat6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-94.el6_7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"tomcat6-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-94.el6_7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"tomcat6-el-2.1-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-94.el6_7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"tomcat6-jsp-2.1-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-94.el6_7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"tomcat6-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-94.el6_7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"tomcat6-servlet-2.5-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-94.el6_7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"tomcat6-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-94.el6_7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"tomcat6-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-94.el6_7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"tomcat6-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-94.el6_7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"tomcat6-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-94.el6_7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.54-8.el7_2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"tomcat-servlet-3.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.54-8.el7_2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"tomcat-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.54-8.el7_2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"tomcat-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.54-8.el7_2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"tomcat-el-2.2-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.54-8.el7_2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"tomcat-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.54-8.el7_2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"tomcat-jsp-2.2-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.54-8.el7_2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"tomcat-jsvc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.54-8.el7_2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"tomcat-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.54-8.el7_2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"tomcat-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.54-8.el7_2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.54-8.el7_2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"tomcat-servlet-3.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.54-8.el7_2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"tomcat-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.54-8.el7_2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"tomcat-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.54-8.el7_2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"tomcat-el-2.2-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.54-8.el7_2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"tomcat-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.54-8.el7_2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"tomcat-jsp-2.2-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.54-8.el7_2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"tomcat-jsvc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.54-8.el7_2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"tomcat-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.54-8.el7_2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"tomcat-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.54-8.el7_2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.54-8.el7_2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"tomcat-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.54-8.el7_2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"tomcat-el-2.2-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.54-8.el7_2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"tomcat-jsp-2.2-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.54-8.el7_2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"tomcat-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.54-8.el7_2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"tomcat-servlet-3.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.54-8.el7_2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"tomcat-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.54-8.el7_2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"tomcat-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.54-8.el7_2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"tomcat-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.54-8.el7_2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"tomcat-jsvc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.54-8.el7_2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.54-8.el7_2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"tomcat-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.54-8.el7_2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"tomcat-el-2.2-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.54-8.el7_2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"tomcat-jsp-2.2-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.54-8.el7_2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"tomcat-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.54-8.el7_2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"tomcat-servlet-3.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.54-8.el7_2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"tomcat-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.54-8.el7_2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"tomcat-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.54-8.el7_2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"tomcat-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.54-8.el7_2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"tomcat-jsvc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.54-8.el7_2"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.55-8.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.55-8.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"tomcat6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.41-0.47.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"tomcat6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.41-0.47.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"tomcat6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.39-1ubuntu0.1"}]}],"versions":["6.0.37-1","6.0.39-1"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"tomcat7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.52-1ubuntu0.3"}]}],"versions":["7.0.42-1","7.0.47-1","7.0.50-1","7.0.52-1","7.0.52-1ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"tomcat6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.45+dfsg-1"}]}],"versions":["6.0.41-4"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"tomcat7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.52-1ubuntu0.3"}]}],"versions":["7.0.42-1","7.0.47-1","7.0.50-1","7.0.52-1","7.0.52-1ubuntu0.1"],"bundled":4}],"products":[{"vendor":"apache","product":"tomcat"},{"vendor":"debian","product":"debian_linux"}],"references":[{"url":"http://rhn.redhat.com/errata/RHSA-2016-0492.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","web"]},{"url":"https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05054964","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","web"]},{"url":"http://www.ubuntu.com/usn/USN-2654-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","web"]},{"url":"http://rhn.redhat.com/errata/RHSA-2015-1622.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","web"]},{"url":"http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://svn.apache.org/viewvc?view=revision\u0026revision=1644018","tags":["x_refsource_CONFIRM","x_transferred","Patch","web"]},{"url":"http://www.debian.org/security/2016/dsa-3530","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","web"]},{"url":"http://tomcat.apache.org/security-7.html","tags":["x_refsource_CONFIRM","x_transferred","Patch","Vendor Advisory","web"]},{"url":"http://svn.apache.org/viewvc?view=revision\u0026revision=1645642","tags":["x_refsource_CONFIRM","x_transferred","Patch","web"]},{"url":"http://marc.info/?l=bugtraq\u0026m=145974991225029\u0026w=2","tags":["vendor-advisory","x_refsource_HP","x_transferred","Third Party Advisory","web"]},{"url":"http://rhn.redhat.com/errata/RHSA-2016-2046.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","web"]},{"url":"http://tomcat.apache.org/security-8.html","tags":["x_refsource_CONFIRM","x_transferred","Patch","Vendor Advisory","web"]},{"url":"http://www.debian.org/security/2015/dsa-3428","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","web"]},{"url":"http://tomcat.apache.org/security-6.html","tags":["x_refsource_CONFIRM","x_transferred","Patch","Vendor Advisory","web"]},{"url":"http://www.securityfocus.com/bid/74665","tags":["vdb-entry","x_refsource_BID","x_transferred"]},{"url":"http://www.securitytracker.com/id/1032330","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"]},{"url":"http://www.ubuntu.com/usn/USN-2655-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","web"]},{"url":"http://rhn.redhat.com/errata/RHSA-2015-1621.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","web"]},{"url":"http://www.debian.org/security/2016/dsa-3447","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","web"]},{"url":"http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/b8a1bf18155b552dcf9a928ba808cbadad84c236d85eab3033662cfb%40%3Cdev.tomcat.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/39ae1f0bd5867c15755a6f959b271ade1aea04ccdc3b2e639dcd903b%40%3Cdev.tomcat.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/37220405a377c0182d2afdbc36461c4783b2930fbeae3a17f1333113%40%3Cdev.tomcat.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/b84ad1258a89de5c9c853c7f2d3ad77e5b8b2930be9e132d5cef6b95%40%3Cdev.tomcat.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/r03c597a64de790ba42c167efacfa23300c3d6c9fe589ab87fe02859c%40%3Cdev.tomcat.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/r587e50b86c1a96ee301f751d50294072d142fd6dc08a8987ae9f3a9b%40%3Cdev.tomcat.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-7810","tags":["advisory"]},{"url":"https://lists.apache.org/thread.html/37220405a377c0182d2afdbc36461c4783b2930fbeae3a17f1333113@%3Cdev.tomcat.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/39ae1f0bd5867c15755a6f959b271ade1aea04ccdc3b2e639dcd903b@%3Cdev.tomcat.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/b84ad1258a89de5c9c853c7f2d3ad77e5b8b2930be9e132d5cef6b95@%3Cdev.tomcat.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/b8a1bf18155b552dcf9a928ba808cbadad84c236d85eab3033662cfb@%3Cdev.tomcat.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/r03c597a64de790ba42c167efacfa23300c3d6c9fe589ab87fe02859c@%3Cdev.tomcat.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/r587e50b86c1a96ee301f751d50294072d142fd6dc08a8987ae9f3a9b@%3Cdev.tomcat.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c@%3Cdev.tomcat.apache.org%3E","tags":["web"]},{"url":"https://github.com/advisories/GHSA-4c43-cwvx-9crh"},{"url":"https://access.redhat.com/errata/RHSA-2015:1622","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1191200","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1222573","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2015/rhsa-2015_1622.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-0230","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-0230","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-0230","tags":["advisory"]},{"url":"http://tomcat.apache.org/security-6.html#Fixed_in_Apache_Tomcat_6.0.44","tags":["article","report"]},{"url":"http://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.55","tags":["article"]},{"url":"http://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.0.9","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-7810","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-7810","tags":["advisory","report"]},{"url":"http://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.59","tags":["article","report"]},{"url":"http://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.0.17","tags":["article","report"]},{"url":"https://access.redhat.com/errata/RHSA-2016:0492","tags":["advisory"]},{"url":"https://tomcat.apache.org/security-6.html#Fixed_in_Apache_Tomcat_6.0.44","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1301646","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_0492.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2016:2046","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.59","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1311085","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1353809","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1362545","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1367447","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_2046.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2015-5346","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-5346","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-5346","tags":["advisory"]},{"url":"http://seclists.org/bugtraq/2016/Feb/143","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-5388","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-5388","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-5388","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-5425","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-5425","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-5425","tags":["advisory"]},{"url":"http://legalhackers.com/advisories/Tomcat-RedHat-based-Root-Privilege-Escalation-Exploit.txt","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-6325","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-6325","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-6325","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2015/suse-su-20151281-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/931442","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2014-7810","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2015/suse-su-20151337-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/768772","tags":["report"]},{"url":"https://bugzilla.suse.com/804992","tags":["report"]},{"url":"https://bugzilla.suse.com/818948","tags":["report"]},{"url":"https://bugzilla.suse.com/822177","tags":["report"]},{"url":"https://bugzilla.suse.com/831119","tags":["report"]},{"url":"https://bugzilla.suse.com/906152","tags":["report"]},{"url":"https://bugzilla.suse.com/917127","tags":["report"]},{"url":"https://bugzilla.suse.com/918195","tags":["report"]},{"url":"https://bugzilla.suse.com/926762","tags":["report"]},{"url":"https://bugzilla.suse.com/932698","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2012-0022","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-3544","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-1976","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0227","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0230","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2015/suse-su-20151565-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/934219","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2014-7810","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-2655-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-2654-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2014-0119","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2014-0227","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2014-0230","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2014-7810","description":"The Expression Language (EL) implementation in Apache Tomcat 6.x before 6.0.44, 7.x before 7.0.58, and 8.x before 8.0.16 does not properly consider the possibility of an accessible interface implemented by an inaccessible class, which allows attackers to bypass a SecurityManager protection mechanism via a web application that leverages use of incorrect privileges during EL evaluation.","status":"published","published":"2015-06-07T23:00:00Z","modified":"2026-10-14T16:23:38.148Z","updated_at":"2026-11-02T14:33:46.631905Z"}],"euvd":[{"id":"EUVD-2022-2350","description":"The Expression Language (EL) implementation in Apache Tomcat 6.x before 6.0.44, 7.x before 7.0.58, and 8.x before 8.0.16 does not properly consider the possibility of an accessible interface implemented by an inaccessible class, which allows attackers to bypass a SecurityManager protection mechanism via a web application that leverages use of incorrect privileges during EL evaluation.","status":"published","published":"2015-06-07T23:00:00Z","modified":"2026-10-14T16:23:38Z","updated_at":"2026-11-02T17:27:14.304159Z"}],"ghsa":[{"id":"GHSA-4c43-cwvx-9crh","title":"Improper Access Control in Apache Tomcat","description":"The Expression Language (EL) implementation in Apache Tomcat 6.x before 6.0.44, 7.x before 7.0.58, and 8.x before 8.0.16 does not properly consider the possibility of an accessible interface implemented by an inaccessible class, which allows attackers to bypass a SecurityManager protection mechanism via a web application that leverages use of incorrect privileges during EL evaluation.","status":"published","published":"2022-05-14T01:10:17Z","modified":"2023-01-27T05:02:24Z","cwes":["CWE-284"],"updated_at":"2026-11-02T14:36:18.427692Z"}],"nvd":[{"id":"CVE-2014-7810","description":"The Expression Language (EL) implementation in Apache Tomcat 6.x before 6.0.44, 7.x before 7.0.58, and 8.x before 8.0.16 does not properly consider the possibility of an accessible interface implemented by an inaccessible class, which allows attackers to bypass a SecurityManager protection mechanism via a web application that leverages use of incorrect privileges during EL evaluation.","status":"published","published":"2015-06-07T23:59:03.58Z","modified":"2026-10-14T17:17:33.107Z","cvss":[{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T14:02:58.385843Z"}],"osv":[{"id":"RHSA-2016:2046","title":"Red Hat Security Advisory: tomcat security update","status":"published","published":"2024-09-15T23:31:33Z","modified":"2026-08-05T10:04:07Z","cvss":[{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:03.734507Z"},{"id":"DLA-232-1","title":"tomcat6 - security update","status":"published","published":"2015-05-28T00:00:00Z","modified":"2026-03-09T01:18:17.981696Z","updated_at":"2026-11-02T15:46:10.227108Z"},{"id":"DSA-3428-1","title":"tomcat8 - security update","status":"published","published":"2015-12-18T00:00:00Z","modified":"2026-03-09T01:20:59.882523Z","updated_at":"2026-11-02T15:46:16.199525Z"},{"id":"DSA-3447-1","title":"tomcat7 - security update","status":"published","published":"2016-01-17T00:00:00Z","modified":"2026-03-09T01:23:35.75088Z","updated_at":"2026-11-02T15:46:16.199525Z"},{"id":"DSA-3530-1","title":"tomcat6 - security update","status":"published","published":"2016-03-25T00:00:00Z","modified":"2026-03-09T01:22:25.978219Z","updated_at":"2026-11-02T15:46:16.199525Z"},{"id":"GHSA-4c43-cwvx-9crh","title":"Improper Access Control in Apache Tomcat","description":"The Expression Language (EL) implementation in Apache Tomcat 6.x before 6.0.44, 7.x before 7.0.58, and 8.x before 8.0.16 does not properly consider the possibility of an accessible interface implemented by an inaccessible class, which allows attackers to bypass a SecurityManager protection mechanism via a web application that leverages use of incorrect privileges during EL evaluation.","status":"published","published":"2022-05-14T01:10:17Z","modified":"2024-12-05T05:42:15.144662Z","cwes":["CWE-284"],"updated_at":"2026-11-02T15:46:36.782754Z"},{"id":"RHSA-2015:1622","title":"Red Hat Security Advisory: Red Hat JBoss Web Server 2.1.0 tomcat security update","status":"published","published":"2024-09-15T23:02:47Z","modified":"2026-08-05T10:03:18Z","updated_at":"2026-11-02T15:53:03.182161Z"},{"id":"RHSA-2016:0492","title":"Red Hat Security Advisory: tomcat6 security and bug fix update","status":"published","published":"2024-09-15T22:39:14Z","modified":"2026-08-05T10:03:49Z","updated_at":"2026-11-02T15:53:03.734507Z"},{"id":"SUSE-SU-2015:1281-1","title":"Security update for tomcat","description":"\n      This update fixes the following security issue:\n      - CVE-2014-7810: Security manager bypass via EL expression (bnc#931442)\n","status":"published","published":"2015-06-18T06:59:00Z","modified":"2026-02-04T02:57:03.851777Z","updated_at":"2026-11-02T15:53:43.030986Z"},{"id":"SUSE-SU-2015:1337-1","title":"Security update for tomcat6","description":"\nThis update of tomcat6 fixes:\n\n    * apache-tomcat-CVE-2012-3544.patch (bnc#831119)\n    * use chown --no-dereference to prevent symlink attacks on log\n      (bnc#822177#c7/prevents CVE-2013-1976)\n    * Fix tomcat init scripts generating malformed classpath (\n      http://youtrack.jetbrains.com/issue/JT-18545\n      \u003chttp://youtrack.jetbrains.com/issue/JT-18545\u003e ) bnc#804992 (patch\n      from m407)\n    * fix a typo in initscript (bnc#768772 )\n    * copy all shell scripts (bnc#818948)\n\nSecurity Issue references:\n\n    * CVE-2012-3544\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3544\u003e\n    * CVE-2013-1976\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1976\u003e\n    * CVE-2012-0022\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0022\u003e\n\n","status":"published","published":"2013-08-02T13:29:14Z","modified":"2026-02-04T03:53:07.546995Z","updated_at":"2026-11-02T15:53:43.030986Z"},{"id":"SUSE-SU-2015:1565-1","title":"Security update for tomcat6","description":"This update for Tomcat fixes the following security issues:\n\n- CVE-2014-7810: Security manager bypass via EL expressions. (bsc#931442)\nIt was found that the expression language resolver evaluated expressions within a\nprivileged code section. A malicious web application could have used this flaw to\nbypass security manager protections.\n\n- CVE-2014-0227: Limited DoS in chunked transfer encoding input filter. (bsc#917127)\nIt was discovered that the ChunkedInputFilter implementation did not fail subsequent\nattempts to read input early enough. A remote attacker could have used this flaw to\nperform a denial of service attack, by streaming an unlimited quantity of data,\nleading to consumption of server resources.\n\n- CVE-2014-0230: Non-persistent DoS attack by feeding data by aborting an upload\nIt was possible for a remote attacker to trigger a non-persistent DoS attack by\nfeeding data by aborting an upload. (bsc#926762)\n\nAdditionally, the following non-security issues have been fixed:\n\n- Fix rights of all files within /usr/share/tomcat6/bin. (bsc#906152)\n- Don't overwrite /var/run/tomcat6.pid when Tomcat is already running. (bsc#934219)\n- Miscellaneous fixes and improvements to Tomcat's init script. (bsc#932698)\n","status":"published","published":"2015-09-11T01:45:16Z","modified":"2026-02-04T03:45:06.548347Z","updated_at":"2026-11-02T15:53:43.030986Z"},{"id":"UBUNTU-CVE-2014-7810","description":"The Expression Language (EL) implementation in Apache Tomcat 6.x before 6.0.44, 7.x before 7.0.58, and 8.x before 8.0.16 does not properly consider the possibility of an accessible interface implemented by an inaccessible class, which allows attackers to bypass a SecurityManager protection mechanism via a web application that leverages use of incorrect privileges during EL evaluation.","status":"published","published":"2015-06-07T00:00:00Z","modified":"2026-02-04T02:50:31.118123Z","updated_at":"2026-11-02T15:54:09.378953Z"},{"id":"USN-2654-1","title":"tomcat7 vulnerabilities","description":"It was discovered that the Tomcat XML parser incorrectly handled XML\nExternal Entities (XXE). A remote attacker could possibly use this issue to\nread arbitrary files. This issue only affected Ubuntu 14.04 LTS.\n(CVE-2014-0119)\n\nIt was discovered that Tomcat incorrectly handled data with malformed\nchunked transfer coding. A remote attacker could possibly use this issue to\nconduct HTTP request smuggling attacks, or cause Tomcat to consume\nresources, resulting in a denial of service. This issue only affected\nUbuntu 14.04 LTS. (CVE-2014-0227)\n\nIt was discovered that Tomcat incorrectly handled HTTP responses occurring\nbefore the entire request body was finished being read. A remote attacker\ncould possibly use this issue to cause a limited denial of service. This\nissue only affected Ubuntu 14.04 LTS. (CVE-2014-0230)\n\nIt was discovered that the Tomcat Expression Language (EL) implementation\nincorrectly handled accessible interfaces implemented by inaccessible\nclasses. An attacker could possibly use this issue to bypass a\nSecurityManager protection mechanism. (CVE-2014-7810)\n","status":"published","published":"2015-06-25T12:32:34Z","modified":"2026-02-10T04:40:54Z","updated_at":"2026-11-02T16:58:09.227524Z"}]}}