USN-3519-1

Dashboard / Vulnerabilities / USN-3519-1

USN-3519-1

Summary: tomcat7, tomcat8 vulnerabilities

Details: It was discovered that Tomcat incorrectly handled certain pipelined requests when sendfile was used. A remote attacker could use this issue to obtain wrong responses possibly containing sensitive information. (CVE-2017-5647) It was discovered that Tomcat incorrectly used the appropriate facade object. A malicious application could possibly use this to bypass Security Manager restrictions. (CVE-2017-5648) It was discovered that Tomcat incorrectly handled error pages. A remote attacker could possibly use this issue to replace or remove the custom error page. (CVE-2017-5664) It was discovered that Tomcat incorrectly handled the CORS filter. A remote attacker could possibly use this issue to perform cache poisoning. (CVE-2017-7674)

References: https://ubuntu.com/security/notices/USN-3519-1, https://ubuntu.com/security/CVE-2017-5647, https://ubuntu.com/security/CVE-2017-5648, https://ubuntu.com/security/CVE-2017-5664, https://ubuntu.com/security/CVE-2017-7674