CVE-2016-5018
Critical · 9.1CVSS
9.1
EPSS
10.3%
Published
Aug 10, 2017
CISA due date
—
The record
In Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 a malicious web application was able to bypass a configured SecurityManager via a Tomcat utility method that was accessible to web applications.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Maven | org.apache.tomcat.embed:tomcat-embed-jasper | 6.0.0 | 6.0.47 |
| Maven | org.apache.tomcat.embed:tomcat-embed-jasper | 7.0.0 | 7.0.72 |
| Maven | org.apache.tomcat.embed:tomcat-embed-jasper | 8.0.0RC1 | 8.0.37 |
| Maven | org.apache.tomcat.embed:tomcat-embed-jasper | 8.5.0 | 8.5.5 |
| Maven | org.apache.tomcat.embed:tomcat-embed-jasper | 9.0.0.M1 | 9.0.0.M10 |
| Maven | org.apache.tomcat:jasper | 6.0.0 | 6.0.47 |
| Maven | org.apache.tomcat:tomcat-jasper | 7.0.0 | 7.0.72 |
| Maven | org.apache.tomcat:tomcat-jasper | 8.0.0RC1 | 8.0.37 |
| Maven | org.apache.tomcat:tomcat-jasper | 8.5.0 | 8.5.5 |
| Maven | org.apache.tomcat:tomcat-jasper | 9.0.0.M1 | 9.0.0.M10 |
| Debian:7 | tomcat6 | 0 | 6.0.45+dfsg-1~deb7u3 |
| Debian:7 | tomcat7 | 0 | 7.0.28-4+deb7u7 |
| Debian:8 | tomcat7 | 0 | 7.0.56-3+deb8u5 |
| Debian:8 | tomcat8 | 0 | 8.0.14-1+deb8u4 |
| Mageia:5 | tomcat | 0 | 7.0.72-1.mga5 |
| Red Hat:enterprise_linux:7::client | tomcat | 0 | 0:7.0.76-2.el7 |
| Red Hat:enterprise_linux:7::client | tomcat-admin-webapps | 0 | 0:7.0.76-2.el7 |
| Red Hat:enterprise_linux:7::client | tomcat-docs-webapp | 0 | 0:7.0.76-2.el7 |
| Red Hat:enterprise_linux:7::client | tomcat-el-2.2-api | 0 | 0:7.0.76-2.el7 |
| Red Hat:enterprise_linux:7::client | tomcat-javadoc | 0 | 0:7.0.76-2.el7 |
| Red Hat:enterprise_linux:7::client | tomcat-jsp-2.2-api | 0 | 0:7.0.76-2.el7 |
| Red Hat:enterprise_linux:7::client | tomcat-jsvc | 0 | 0:7.0.76-2.el7 |
| Red Hat:enterprise_linux:7::client | tomcat-lib | 0 | 0:7.0.76-2.el7 |
| Red Hat:enterprise_linux:7::client | tomcat-servlet-3.0-api | 0 | 0:7.0.76-2.el7 |
| Red Hat:enterprise_linux:7::client | tomcat-webapps | 0 | 0:7.0.76-2.el7 |
| Red Hat:enterprise_linux:7::computenode | tomcat | 0 | 0:7.0.76-2.el7 |
| Red Hat:enterprise_linux:7::computenode | tomcat-admin-webapps | 0 | 0:7.0.76-2.el7 |
| Red Hat:enterprise_linux:7::computenode | tomcat-docs-webapp | 0 | 0:7.0.76-2.el7 |
| Red Hat:enterprise_linux:7::computenode | tomcat-el-2.2-api | 0 | 0:7.0.76-2.el7 |
| Red Hat:enterprise_linux:7::computenode | tomcat-javadoc | 0 | 0:7.0.76-2.el7 |
| Red Hat:enterprise_linux:7::computenode | tomcat-jsp-2.2-api | 0 | 0:7.0.76-2.el7 |
| Red Hat:enterprise_linux:7::computenode | tomcat-jsvc | 0 | 0:7.0.76-2.el7 |
| Red Hat:enterprise_linux:7::computenode | tomcat-lib | 0 | 0:7.0.76-2.el7 |
| Red Hat:enterprise_linux:7::computenode | tomcat-servlet-3.0-api | 0 | 0:7.0.76-2.el7 |
| Red Hat:enterprise_linux:7::computenode | tomcat-webapps | 0 | 0:7.0.76-2.el7 |
| Red Hat:enterprise_linux:7::server | tomcat | 0 | 0:7.0.76-2.el7 |
| Red Hat:enterprise_linux:7::server | tomcat-admin-webapps | 0 | 0:7.0.76-2.el7 |
| Red Hat:enterprise_linux:7::server | tomcat-docs-webapp | 0 | 0:7.0.76-2.el7 |
| Red Hat:enterprise_linux:7::server | tomcat-el-2.2-api | 0 | 0:7.0.76-2.el7 |
| Red Hat:enterprise_linux:7::server | tomcat-javadoc | 0 | 0:7.0.76-2.el7 |
| Red Hat:enterprise_linux:7::server | tomcat-jsp-2.2-api | 0 | 0:7.0.76-2.el7 |
| Red Hat:enterprise_linux:7::server | tomcat-jsvc | 0 | 0:7.0.76-2.el7 |
| Red Hat:enterprise_linux:7::server | tomcat-lib | 0 | 0:7.0.76-2.el7 |
| Red Hat:enterprise_linux:7::server | tomcat-servlet-3.0-api | 0 | 0:7.0.76-2.el7 |
| Red Hat:enterprise_linux:7::server | tomcat-webapps | 0 | 0:7.0.76-2.el7 |
| Red Hat:enterprise_linux:7::workstation | tomcat | 0 | 0:7.0.76-2.el7 |
| Red Hat:enterprise_linux:7::workstation | tomcat-admin-webapps | 0 | 0:7.0.76-2.el7 |
| Red Hat:enterprise_linux:7::workstation | tomcat-docs-webapp | 0 | 0:7.0.76-2.el7 |
| Red Hat:enterprise_linux:7::workstation | tomcat-el-2.2-api | 0 | 0:7.0.76-2.el7 |
| Red Hat:enterprise_linux:7::workstation | tomcat-javadoc | 0 | 0:7.0.76-2.el7 |
| Red Hat:enterprise_linux:7::workstation | tomcat-jsp-2.2-api | 0 | 0:7.0.76-2.el7 |
| Red Hat:enterprise_linux:7::workstation | tomcat-jsvc | 0 | 0:7.0.76-2.el7 |
| Red Hat:enterprise_linux:7::workstation | tomcat-lib | 0 | 0:7.0.76-2.el7 |
| Red Hat:enterprise_linux:7::workstation | tomcat-servlet-3.0-api | 0 | 0:7.0.76-2.el7 |
| Red Hat:enterprise_linux:7::workstation | tomcat-webapps | 0 | 0:7.0.76-2.el7 |
| Red Hat:jboss_enterprise_application_platform:6::el5 | hornetq | 0 | 0:2.3.25-21.SP19_redhat_1.1.ep6.el5 |
| Red Hat:jboss_enterprise_application_platform:6::el5 | ironjacamar-common-api-eap6 | 0 | 0:1.0.39-1.Final_redhat_1.1.ep6.el5 |
| Red Hat:jboss_enterprise_application_platform:6::el5 | ironjacamar-common-impl-eap6 | 0 | 0:1.0.39-1.Final_redhat_1.1.ep6.el5 |
| Red Hat:jboss_enterprise_application_platform:6::el5 | ironjacamar-common-spi-eap6 | 0 | 0:1.0.39-1.Final_redhat_1.1.ep6.el5 |
| Red Hat:jboss_enterprise_application_platform:6::el5 | ironjacamar-core-api-eap6 | 0 | 0:1.0.39-1.Final_redhat_1.1.ep6.el5 |
| Red Hat:jboss_enterprise_application_platform:6::el5 | ironjacamar-core-impl-eap6 | 0 | 0:1.0.39-1.Final_redhat_1.1.ep6.el5 |
| Red Hat:jboss_enterprise_application_platform:6::el5 | ironjacamar-deployers-common-eap6 | 0 | 0:1.0.39-1.Final_redhat_1.1.ep6.el5 |
| Red Hat:jboss_enterprise_application_platform:6::el5 | ironjacamar-eap6 | 0 | 0:1.0.39-1.Final_redhat_1.1.ep6.el5 |
| Red Hat:jboss_enterprise_application_platform:6::el5 | ironjacamar-jdbc-eap6 | 0 | 0:1.0.39-1.Final_redhat_1.1.ep6.el5 |
| Red Hat:jboss_enterprise_application_platform:6::el5 | ironjacamar-spec-api-eap6 | 0 | 0:1.0.39-1.Final_redhat_1.1.ep6.el5 |
| Red Hat:jboss_enterprise_application_platform:6::el5 | ironjacamar-validator-eap6 | 0 | 0:1.0.39-1.Final_redhat_1.1.ep6.el5 |
| Red Hat:jboss_enterprise_application_platform:6::el5 | jboss-as-appclient | 0 | 0:7.5.16-1.Final_redhat_1.1.ep6.el5 |
| Red Hat:jboss_enterprise_application_platform:6::el5 | jboss-as-cli | 0 | 0:7.5.16-1.Final_redhat_1.1.ep6.el5 |
| Red Hat:jboss_enterprise_application_platform:6::el5 | jboss-as-client-all | 0 | 0:7.5.16-1.Final_redhat_1.1.ep6.el5 |
| Red Hat:jboss_enterprise_application_platform:6::el5 | jboss-as-clustering | 0 | 0:7.5.16-1.Final_redhat_1.1.ep6.el5 |
| Red Hat:jboss_enterprise_application_platform:6::el5 | jboss-as-cmp | 0 | 0:7.5.16-1.Final_redhat_1.1.ep6.el5 |
| Red Hat:jboss_enterprise_application_platform:6::el5 | jboss-as-configadmin | 0 | 0:7.5.16-1.Final_redhat_1.1.ep6.el5 |
| Red Hat:jboss_enterprise_application_platform:6::el5 | jboss-as-connector | 0 | 0:7.5.16-1.Final_redhat_1.1.ep6.el5 |
| Red Hat:jboss_enterprise_application_platform:6::el5 | jboss-as-console | 0 | 0:2.5.17-1.Final_redhat_1.1.ep6.el5 |
| Red Hat:jboss_enterprise_application_platform:6::el5 | jboss-as-controller | 0 | 0:7.5.16-1.Final_redhat_1.1.ep6.el5 |
| Red Hat:jboss_enterprise_application_platform:6::el5 | jboss-as-controller-client | 0 | 0:7.5.16-1.Final_redhat_1.1.ep6.el5 |
| Red Hat:jboss_enterprise_application_platform:6::el5 | jboss-as-core-security | 0 | 0:7.5.16-1.Final_redhat_1.1.ep6.el5 |
| Red Hat:jboss_enterprise_application_platform:6::el5 | jboss-as-deployment-repository | 0 | 0:7.5.16-1.Final_redhat_1.1.ep6.el5 |
| Red Hat:jboss_enterprise_application_platform:6::el5 | jboss-as-deployment-scanner | 0 | 0:7.5.16-1.Final_redhat_1.1.ep6.el5 |
| Red Hat:jboss_enterprise_application_platform:6::el5 | jboss-as-domain-http | 0 | 0:7.5.16-1.Final_redhat_1.1.ep6.el5 |
| Red Hat:jboss_enterprise_application_platform:6::el5 | jboss-as-domain-management | 0 | 0:7.5.16-1.Final_redhat_1.1.ep6.el5 |
| Red Hat:jboss_enterprise_application_platform:6::el5 | jboss-as-ee | 0 | 0:7.5.16-1.Final_redhat_1.1.ep6.el5 |
| Red Hat:jboss_enterprise_application_platform:6::el5 | jboss-as-ee-deployment | 0 | 0:7.5.16-1.Final_redhat_1.1.ep6.el5 |
| Red Hat:jboss_enterprise_application_platform:6::el5 | jboss-as-ejb3 | 0 | 0:7.5.16-1.Final_redhat_1.1.ep6.el5 |
| Red Hat:jboss_enterprise_application_platform:6::el5 | jboss-as-embedded | 0 | 0:7.5.16-1.Final_redhat_1.1.ep6.el5 |
| Red Hat:jboss_enterprise_application_platform:6::el5 | jboss-as-host-controller | 0 | 0:7.5.16-1.Final_redhat_1.1.ep6.el5 |
| Red Hat:jboss_enterprise_application_platform:6::el5 | jboss-as-jacorb | 0 | 0:7.5.16-1.Final_redhat_1.1.ep6.el5 |
| Red Hat:jboss_enterprise_application_platform:6::el5 | jboss-as-jaxr | 0 | 0:7.5.16-1.Final_redhat_1.1.ep6.el5 |
| Red Hat:jboss_enterprise_application_platform:6::el5 | jboss-as-jaxrs | 0 | 0:7.5.16-1.Final_redhat_1.1.ep6.el5 |
| Red Hat:jboss_enterprise_application_platform:6::el5 | jboss-as-jdr | 0 | 0:7.5.16-1.Final_redhat_1.1.ep6.el5 |
| Red Hat:jboss_enterprise_application_platform:6::el5 | jboss-as-jmx | 0 | 0:7.5.16-1.Final_redhat_1.1.ep6.el5 |
| Red Hat:jboss_enterprise_application_platform:6::el5 | jboss-as-jpa | 0 | 0:7.5.16-1.Final_redhat_1.1.ep6.el5 |
| Red Hat:jboss_enterprise_application_platform:6::el5 | jboss-as-jsf | 0 | 0:7.5.16-1.Final_redhat_1.1.ep6.el5 |
| Red Hat:jboss_enterprise_application_platform:6::el5 | jboss-as-jsr77 | 0 | 0:7.5.16-1.Final_redhat_1.1.ep6.el5 |
| Red Hat:jboss_enterprise_application_platform:6::el5 | jboss-as-logging | 0 | 0:7.5.16-1.Final_redhat_1.1.ep6.el5 |
| Red Hat:jboss_enterprise_application_platform:6::el5 | jboss-as-mail | 0 | 0:7.5.16-1.Final_redhat_1.1.ep6.el5 |
| Red Hat:jboss_enterprise_application_platform:6::el5 | jboss-as-management-client-content | 0 | 0:7.5.16-1.Final_redhat_1.1.ep6.el5 |
| Red Hat:jboss_enterprise_application_platform:6::el5 | jboss-as-messaging | 0 | 0:7.5.16-1.Final_redhat_1.1.ep6.el5 |
| Red Hat:jboss_enterprise_application_platform:6::el5 | jboss-as-modcluster | 0 | 0:7.5.16-1.Final_redhat_1.1.ep6.el5 |
| Red Hat:jboss_enterprise_application_platform:6::el5 | jboss-as-naming | 0 | 0:7.5.16-1.Final_redhat_1.1.ep6.el5 |
| Red Hat:jboss_enterprise_application_platform:6::el5 | jboss-as-network | 0 | 0:7.5.16-1.Final_redhat_1.1.ep6.el5 |
| Red Hat:jboss_enterprise_application_platform:6::el5 | jboss-as-osgi | 0 | 0:7.5.16-1.Final_redhat_1.1.ep6.el5 |
| Red Hat:jboss_enterprise_application_platform:6::el5 | jboss-as-osgi-configadmin | 0 | 0:7.5.16-1.Final_redhat_1.1.ep6.el5 |
| Red Hat:jboss_enterprise_application_platform:6::el5 | jboss-as-osgi-service | 0 | 0:7.5.16-1.Final_redhat_1.1.ep6.el5 |
| Red Hat:jboss_enterprise_application_platform:6::el5 | jboss-as-picketlink | 0 | 0:7.5.16-1.Final_redhat_1.1.ep6.el5 |
| Red Hat:jboss_enterprise_application_platform:6::el5 | jboss-as-platform-mbean | 0 | 0:7.5.16-1.Final_redhat_1.1.ep6.el5 |
| Red Hat:jboss_enterprise_application_platform:6::el5 | jboss-as-pojo | 0 | 0:7.5.16-1.Final_redhat_1.1.ep6.el5 |
| Red Hat:jboss_enterprise_application_platform:6::el5 | jboss-as-process-controller | 0 | 0:7.5.16-1.Final_redhat_1.1.ep6.el5 |
| Red Hat:jboss_enterprise_application_platform:6::el5 | jboss-as-protocol | 0 | 0:7.5.16-1.Final_redhat_1.1.ep6.el5 |
| Red Hat:jboss_enterprise_application_platform:6::el5 | jboss-as-remoting | 0 | 0:7.5.16-1.Final_redhat_1.1.ep6.el5 |
| Red Hat:jboss_enterprise_application_platform:6::el5 | jboss-as-sar | 0 | 0:7.5.16-1.Final_redhat_1.1.ep6.el5 |
| Red Hat:jboss_enterprise_application_platform:6::el5 | jboss-as-security | 0 | 0:7.5.16-1.Final_redhat_1.1.ep6.el5 |
| Red Hat:jboss_enterprise_application_platform:6::el5 | jboss-as-server | 0 | 0:7.5.16-1.Final_redhat_1.1.ep6.el5 |
| Red Hat:jboss_enterprise_application_platform:6::el5 | jboss-as-system-jmx | 0 | 0:7.5.16-1.Final_redhat_1.1.ep6.el5 |
| Red Hat:jboss_enterprise_application_platform:6::el5 | jboss-as-threads | 0 | 0:7.5.16-1.Final_redhat_1.1.ep6.el5 |
| Red Hat:jboss_enterprise_application_platform:6::el5 | jboss-as-transactions | 0 | 0:7.5.16-1.Final_redhat_1.1.ep6.el5 |
| Red Hat:jboss_enterprise_application_platform:6::el5 | jboss-as-version | 0 | 0:7.5.16-1.Final_redhat_1.1.ep6.el5 |
| Red Hat:jboss_enterprise_application_platform:6::el5 | jboss-as-web | 0 | 0:7.5.16-1.Final_redhat_1.1.ep6.el5 |
| Red Hat:jboss_enterprise_application_platform:6::el5 | jboss-as-webservices | 0 | 0:7.5.16-1.Final_redhat_1.1.ep6.el5 |
| Red Hat:jboss_enterprise_application_platform:6::el5 | jboss-as-weld | 0 | 0:7.5.16-1.Final_redhat_1.1.ep6.el5 |
| Red Hat:jboss_enterprise_application_platform:6::el5 | jboss-as-xts | 0 | 0:7.5.16-1.Final_redhat_1.1.ep6.el5 |
| Red Hat:jboss_enterprise_application_platform:6::el5 | jboss-hal | 0 | 0:2.5.17-1.Final_redhat_1.1.ep6.el5 |
| Red Hat:jboss_enterprise_application_platform:6::el5 | jboss-logmanager | 0 | 0:1.5.7-1.Final_redhat_1.1.ep6.el5 |
| Red Hat:jboss_enterprise_application_platform:6::el5 | jboss-marshalling | 0 | 0:1.4.10-2.SP2_redhat_1.1.ep6.el5 |
| Red Hat:jboss_enterprise_application_platform:6::el5 | jboss-modules | 0 | 0:1.3.9-1.Final_redhat_1.1.ep6.el5 |
| Red Hat:jboss_enterprise_application_platform:6::el5 | jbossas-appclient | 0 | 0:7.5.16-1.Final_redhat_1.1.ep6.el5 |
| Red Hat:jboss_enterprise_application_platform:6::el5 | jbossas-bundles | 0 | 0:7.5.16-1.Final_redhat_1.1.ep6.el5 |
| Red Hat:jboss_enterprise_application_platform:6::el5 | jbossas-core | 0 | 0:7.5.16-1.Final_redhat_1.1.ep6.el5 |
| Red Hat:jboss_enterprise_application_platform:6::el5 | jbossas-domain | 0 | 0:7.5.16-1.Final_redhat_1.1.ep6.el5 |
| Red Hat:jboss_enterprise_application_platform:6::el5 | jbossas-javadocs | 0 | 0:7.5.16-1.Final_redhat_1.1.ep6.el5 |
| Red Hat:jboss_enterprise_application_platform:6::el5 | jbossas-modules-eap | 0 | 0:7.5.16-1.Final_redhat_1.1.ep6.el5 |
| Red Hat:jboss_enterprise_application_platform:6::el5 | jbossas-product-eap | 0 | 0:7.5.16-1.Final_redhat_1.1.ep6.el5 |
| Red Hat:jboss_enterprise_application_platform:6::el5 | jbossas-standalone | 0 | 0:7.5.16-1.Final_redhat_1.1.ep6.el5 |
| Red Hat:jboss_enterprise_application_platform:6::el5 | jbossas-welcome-content-eap | 0 | 0:7.5.16-1.Final_redhat_1.1.ep6.el5 |
| Red Hat:jboss_enterprise_application_platform:6::el5 | jbossts | 0 | 1:4.17.42-1.Final_redhat_1.1.ep6.el5 |
| Red Hat:jboss_enterprise_application_platform:6::el5 | jbossweb | 0 | 0:7.5.23-1.Final_redhat_1.1.ep6.el5 |
| Red Hat:jboss_enterprise_application_platform:6::el5 | jgroups | 0 | 1:3.2.17-1.Final_redhat_1.1.ep6.el5 |
| Red Hat:jboss_enterprise_application_platform:6::el5 | picketbox | 0 | 0:4.1.6-1.Final_redhat_1.1.ep6.el5 |
| Red Hat:jboss_enterprise_application_platform:6::el5 | resteasy | 0 | 0:2.3.20-1.Final_redhat_1.1.ep6.el5 |
| Red Hat:jboss_enterprise_application_platform:6::el6 | hornetq | 0 | 0:2.3.25-21.SP19_redhat_1.1.ep6.el6 |
| Red Hat:jboss_enterprise_application_platform:6::el6 | ironjacamar-common-api-eap6 | 0 | 0:1.0.39-1.Final_redhat_1.1.ep6.el6 |
| Red Hat:jboss_enterprise_application_platform:6::el6 | ironjacamar-common-impl-eap6 | 0 | 0:1.0.39-1.Final_redhat_1.1.ep6.el6 |
| Red Hat:jboss_enterprise_application_platform:6::el6 | ironjacamar-common-spi-eap6 | 0 | 0:1.0.39-1.Final_redhat_1.1.ep6.el6 |
| Red Hat:jboss_enterprise_application_platform:6::el6 | ironjacamar-core-api-eap6 | 0 | 0:1.0.39-1.Final_redhat_1.1.ep6.el6 |
| Red Hat:jboss_enterprise_application_platform:6::el6 | ironjacamar-core-impl-eap6 | 0 | 0:1.0.39-1.Final_redhat_1.1.ep6.el6 |
| Red Hat:jboss_enterprise_application_platform:6::el6 | ironjacamar-deployers-common-eap6 | 0 | 0:1.0.39-1.Final_redhat_1.1.ep6.el6 |
| Red Hat:jboss_enterprise_application_platform:6::el6 | ironjacamar-eap6 | 0 | 0:1.0.39-1.Final_redhat_1.1.ep6.el6 |
| Red Hat:jboss_enterprise_application_platform:6::el6 | ironjacamar-jdbc-eap6 | 0 | 0:1.0.39-1.Final_redhat_1.1.ep6.el6 |
| Red Hat:jboss_enterprise_application_platform:6::el6 | ironjacamar-spec-api-eap6 | 0 | 0:1.0.39-1.Final_redhat_1.1.ep6.el6 |
| Red Hat:jboss_enterprise_application_platform:6::el6 | ironjacamar-validator-eap6 | 0 | 0:1.0.39-1.Final_redhat_1.1.ep6.el6 |
| Red Hat:jboss_enterprise_application_platform:6::el6 | jboss-as-appclient | 0 | 0:7.5.16-1.Final_redhat_1.1.ep6.el6 |
| Red Hat:jboss_enterprise_application_platform:6::el6 | jboss-as-cli | 0 | 0:7.5.16-1.Final_redhat_1.1.ep6.el6 |
| Red Hat:jboss_enterprise_application_platform:6::el6 | jboss-as-client-all | 0 | 0:7.5.16-1.Final_redhat_1.1.ep6.el6 |
| Red Hat:jboss_enterprise_application_platform:6::el6 | jboss-as-clustering | 0 | 0:7.5.16-1.Final_redhat_1.1.ep6.el6 |
| Red Hat:jboss_enterprise_application_platform:6::el6 | jboss-as-cmp | 0 | 0:7.5.16-1.Final_redhat_1.1.ep6.el6 |
| Red Hat:jboss_enterprise_application_platform:6::el6 | jboss-as-configadmin | 0 | 0:7.5.16-1.Final_redhat_1.1.ep6.el6 |
| Red Hat:jboss_enterprise_application_platform:6::el6 | jboss-as-connector | 0 | 0:7.5.16-1.Final_redhat_1.1.ep6.el6 |
| Red Hat:jboss_enterprise_application_platform:6::el6 | jboss-as-console | 0 | 0:2.5.17-1.Final_redhat_1.1.ep6.el6 |
| Red Hat:jboss_enterprise_application_platform:6::el6 | jboss-as-controller | 0 | 0:7.5.16-1.Final_redhat_1.1.ep6.el6 |
| Red Hat:jboss_enterprise_application_platform:6::el6 | jboss-as-controller-client | 0 | 0:7.5.16-1.Final_redhat_1.1.ep6.el6 |
| Red Hat:jboss_enterprise_application_platform:6::el6 | jboss-as-core-security | 0 | 0:7.5.16-1.Final_redhat_1.1.ep6.el6 |
| Red Hat:jboss_enterprise_application_platform:6::el6 | jboss-as-deployment-repository | 0 | 0:7.5.16-1.Final_redhat_1.1.ep6.el6 |
| Red Hat:jboss_enterprise_application_platform:6::el6 | jboss-as-deployment-scanner | 0 | 0:7.5.16-1.Final_redhat_1.1.ep6.el6 |
| Red Hat:jboss_enterprise_application_platform:6::el6 | jboss-as-domain-http | 0 | 0:7.5.16-1.Final_redhat_1.1.ep6.el6 |
| Red Hat:jboss_enterprise_application_platform:6::el6 | jboss-as-domain-management | 0 | 0:7.5.16-1.Final_redhat_1.1.ep6.el6 |
| Red Hat:jboss_enterprise_application_platform:6::el6 | jboss-as-ee | 0 | 0:7.5.16-1.Final_redhat_1.1.ep6.el6 |
| Red Hat:jboss_enterprise_application_platform:6::el6 | jboss-as-ee-deployment | 0 | 0:7.5.16-1.Final_redhat_1.1.ep6.el6 |
| Red Hat:jboss_enterprise_application_platform:6::el6 | jboss-as-ejb3 | 0 | 0:7.5.16-1.Final_redhat_1.1.ep6.el6 |
| Red Hat:jboss_enterprise_application_platform:6::el6 | jboss-as-embedded | 0 | 0:7.5.16-1.Final_redhat_1.1.ep6.el6 |
| Red Hat:jboss_enterprise_application_platform:6::el6 | jboss-as-host-controller | 0 | 0:7.5.16-1.Final_redhat_1.1.ep6.el6 |
| Red Hat:jboss_enterprise_application_platform:6::el6 | jboss-as-jacorb | 0 | 0:7.5.16-1.Final_redhat_1.1.ep6.el6 |
| Red Hat:jboss_enterprise_application_platform:6::el6 | jboss-as-jaxr | 0 | 0:7.5.16-1.Final_redhat_1.1.ep6.el6 |
| Red Hat:jboss_enterprise_application_platform:6::el6 | jboss-as-jaxrs | 0 | 0:7.5.16-1.Final_redhat_1.1.ep6.el6 |
| Red Hat:jboss_enterprise_application_platform:6::el6 | jboss-as-jdr | 0 | 0:7.5.16-1.Final_redhat_1.1.ep6.el6 |
| Red Hat:jboss_enterprise_application_platform:6::el6 | jboss-as-jmx | 0 | 0:7.5.16-1.Final_redhat_1.1.ep6.el6 |
| Red Hat:jboss_enterprise_application_platform:6::el6 | jboss-as-jpa | 0 | 0:7.5.16-1.Final_redhat_1.1.ep6.el6 |
| Red Hat:jboss_enterprise_application_platform:6::el6 | jboss-as-jsf | 0 | 0:7.5.16-1.Final_redhat_1.1.ep6.el6 |
| Red Hat:jboss_enterprise_application_platform:6::el6 | jboss-as-jsr77 | 0 | 0:7.5.16-1.Final_redhat_1.1.ep6.el6 |
| Red Hat:jboss_enterprise_application_platform:6::el6 | jboss-as-logging | 0 | 0:7.5.16-1.Final_redhat_1.1.ep6.el6 |
| Red Hat:jboss_enterprise_application_platform:6::el6 | jboss-as-mail | 0 | 0:7.5.16-1.Final_redhat_1.1.ep6.el6 |
| Red Hat:jboss_enterprise_application_platform:6::el6 | jboss-as-management-client-content | 0 | 0:7.5.16-1.Final_redhat_1.1.ep6.el6 |
| Red Hat:jboss_enterprise_application_platform:6::el6 | jboss-as-messaging | 0 | 0:7.5.16-1.Final_redhat_1.1.ep6.el6 |
| Red Hat:jboss_enterprise_application_platform:6::el6 | jboss-as-modcluster | 0 | 0:7.5.16-1.Final_redhat_1.1.ep6.el6 |
| Red Hat:jboss_enterprise_application_platform:6::el6 | jboss-as-naming | 0 | 0:7.5.16-1.Final_redhat_1.1.ep6.el6 |
| Red Hat:jboss_enterprise_application_platform:6::el6 | jboss-as-network | 0 | 0:7.5.16-1.Final_redhat_1.1.ep6.el6 |
| Red Hat:jboss_enterprise_application_platform:6::el6 | jboss-as-osgi | 0 | 0:7.5.16-1.Final_redhat_1.1.ep6.el6 |
| Red Hat:jboss_enterprise_application_platform:6::el6 | jboss-as-osgi-configadmin | 0 | 0:7.5.16-1.Final_redhat_1.1.ep6.el6 |
| Red Hat:jboss_enterprise_application_platform:6::el6 | jboss-as-osgi-service | 0 | 0:7.5.16-1.Final_redhat_1.1.ep6.el6 |
| Red Hat:jboss_enterprise_application_platform:6::el6 | jboss-as-picketlink | 0 | 0:7.5.16-1.Final_redhat_1.1.ep6.el6 |
| Red Hat:jboss_enterprise_application_platform:6::el6 | jboss-as-platform-mbean | 0 | 0:7.5.16-1.Final_redhat_1.1.ep6.el6 |
| Red Hat:jboss_enterprise_application_platform:6::el6 | jboss-as-pojo | 0 | 0:7.5.16-1.Final_redhat_1.1.ep6.el6 |
| Red Hat:jboss_enterprise_application_platform:6::el6 | jboss-as-process-controller | 0 | 0:7.5.16-1.Final_redhat_1.1.ep6.el6 |
| Red Hat:jboss_enterprise_application_platform:6::el6 | jboss-as-protocol | 0 | 0:7.5.16-1.Final_redhat_1.1.ep6.el6 |
| Red Hat:jboss_enterprise_application_platform:6::el6 | jboss-as-remoting | 0 | 0:7.5.16-1.Final_redhat_1.1.ep6.el6 |
| Red Hat:jboss_enterprise_application_platform:6::el6 | jboss-as-sar | 0 | 0:7.5.16-1.Final_redhat_1.1.ep6.el6 |
| Red Hat:jboss_enterprise_application_platform:6::el6 | jboss-as-security | 0 | 0:7.5.16-1.Final_redhat_1.1.ep6.el6 |
| Red Hat:jboss_enterprise_application_platform:6::el6 | jboss-as-server | 0 | 0:7.5.16-1.Final_redhat_1.1.ep6.el6 |
| Red Hat:jboss_enterprise_application_platform:6::el6 | jboss-as-system-jmx | 0 | 0:7.5.16-1.Final_redhat_1.1.ep6.el6 |
| Red Hat:jboss_enterprise_application_platform:6::el6 | jboss-as-threads | 0 | 0:7.5.16-1.Final_redhat_1.1.ep6.el6 |
| Red Hat:jboss_enterprise_application_platform:6::el6 | jboss-as-transactions | 0 | 0:7.5.16-1.Final_redhat_1.1.ep6.el6 |
Related vulnerabilities
- CVE-2024-52318 Incorrect object recycling and reuse vulnerability in Apache Tomcat. Also affects org.apache.tomcat:tomcat-jasper
- CVE-2014-0119 Apache Tomcat before 6.0.40, 7.x before 7.0.54, and 8.x before 8.0.6 does not properly… Also affects org.apache.tomcat:tomcat-jasper
- CVE-2016-0762 The Realm implementations in Apache Tomcat versions 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4… Also affects tomcat6
- CVE-2016-8735 Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73… Also affects tomcat6
- CVE-2016-6816 The code in Apache Tomcat 9.0.0.M1 to 9.0.0.M11, 8.5.0 to 8.5.6, 8.0.0.RC1 to 8.0.38… Also affects tomcat6
- CVE-2016-1240 The Tomcat init script in the tomcat7 package before 7.0.56-3+deb8u4 and tomcat8 package… Also affects tomcat6
- CVE-2016-0763 The setGlobalContext method in org/apache/naming/factory/ResourceLinkFactory.java in… Also affects tomcat6
- CVE-2016-0714 The session-persistence implementation in Apache Tomcat 6.x before 6.0.45, 7.x before… Also affects tomcat6