DeutschShown in its original language — a full translation is planned for a future version.
Apache Tomcat: Mehrere Schwachstellen
view advisory published 2016-11-22
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Apache Tomcat ausnutzen, um einen Denial of Service Angriff durchzuführen, vertrauliche Informationen offenzulegen oder beliebigen Code zur Ausführung zu bringen.
01
describes (3)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2016-6817US | high7.5 | — | ||
The HTTP/2 header parser in Apache Tomcat 9.0.0.M1 to 9.0.0.M11 and 8.5.0 to 8.5.6 entered an infinite loop if a header was received that was larger than the available buffer. This… | ||||
| CVE-2016-8735US | critical9.8OT critical | KEV | ||
Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12 if JmxRemoteLifecycleListener… | ||||
| CVE-2016-6816US | high7.1 | Exploit | ||
The code in Apache Tomcat 9.0.0.M1 to 9.0.0.M11, 8.5.0 to 8.5.6, 8.0.0.RC1 to 8.0.38, 7.0.0 to 7.0.72, and 6.0.0 to 6.0.47 that parsed the HTTP request line permitted invalid chara… | ||||
02
references
External citations — patches, advisories, analysis.
- Oracle Linux Security Advisory ELSA-2017-0527 vom 2017-03-15external
- Oracle Linux Security Advisory ELSA-2017-0935 vom 2017-04-13external
- Openwall OSS-Security vom 2016-11-22external
- Openwall OSS-Security vom 2016-11-22external
- Openwall OSS-Security vom 2016-11-22external
- Apache Tomcat 6.0.48 vom 2016-11-22external
- Apache Tomcat 7.0.73 vom 2016-11-22external
- Apache Tomcat 8.0.39 vom 2016-11-22external
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan