{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2014-05-27T00:00:00", "descriptions": [{"lang": "en", "value": "Apache Tomcat before 6.0.40, 7.x before 7.0.54, and 8.x before 8.0.6 does not properly constrain the class loader that accesses the XML parser used with an XSLT stylesheet, which allows remote attackers to (1) read arbitrary files via a crafted web application that provides an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue, or (2) read files associated with different web applications on a single Tomcat instance via a crafted web application."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2020-02-13T16:10:07", "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "http://svn.apache.org/viewvc?view=revision&revision=1590036"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://advisories.mageia.org/MGASA-2014-0268.html"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://svn.apache.org/viewvc?view=revision&revision=1589837"}, {"name": "USN-2654-1", "tags": ["vendor-advisory", "x_refsource_UBUNTU"], "url": "http://www.ubuntu.com/usn/USN-2654-1"}, {"name": "RHSA-2015:0765", "tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "http://rhn.redhat.com/errata/RHSA-2015-0765.html"}, {"name": "59732", "tags": ["third-party-advisory", "x_refsource_SECUNIA"], "url": "http://secunia.com/advisories/59732"}, {"name": "RHSA-2015:0675", "tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "http://rhn.redhat.com/errata/RHSA-2015-0675.html"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://www.vmware.com/security/advisories/VMSA-2014-0012.html"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21681528"}, {"name": "MDVSA-2015:052", "tags": ["vendor-advisory", "x_refsource_MANDRIVA"], "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2015:052"}, {"name": "RHSA-2015:0720", "tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "http://rhn.redhat.com/errata/RHSA-2015-0720.html"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://svn.apache.org/viewvc?view=revision&revision=1590028"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://svn.apache.org/viewvc?view=revision&revision=1589992"}, {"name": "MDVSA-2015:084", "tags": ["vendor-advisory", "x_refsource_MANDRIVA"], "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2015:084"}, {"name": "DSA-3530", "tags": ["vendor-advisory", "x_refsource_DEBIAN"], "url": "http://www.debian.org/security/2016/dsa-3530"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://svn.apache.org/viewvc?view=revision&revision=1589983"}, {"name": "HPSBUX03102", "tags": ["vendor-advisory", "x_refsource_HP"], "url": "http://marc.info/?l=bugtraq&m=141017844705317&w=2"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://tomcat.apache.org/security-7.html"}, {"name": "20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities", "tags": ["mailing-list", "x_refsource_BUGTRAQ"], "url": "http://www.securityfocus.com/archive/1/534161/100/0/threaded"}, {"name": "MDVSA-2015:053", "tags": ["vendor-advisory", "x_refsource_MANDRIVA"], "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2015:053"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://svn.apache.org/viewvc?view=revision&revision=1588199"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://svn.apache.org/viewvc?view=revision&revision=1589997"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://tomcat.apache.org/security-8.html"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21678231"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://svn.apache.org/viewvc?view=revision&revision=1589980"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://svn.apache.org/viewvc?view=revision&revision=1589640"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://tomcat.apache.org/security-6.html"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04851013"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html"}, {"name": "59873", "tags": ["third-party-advisory", "x_refsource_SECUNIA"], "url": "http://secunia.com/advisories/59873"}, {"name": "20140527 [SECURITY] CVE-2014-0119 Apache Tomcat information disclosure", "tags": ["mailing-list", "x_refsource_FULLDISC"], "url": "http://seclists.org/fulldisclosure/2014/May/141"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://svn.apache.org/viewvc?view=revision&revision=1589985"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://svn.apache.org/viewvc?view=revision&revision=1593815"}, {"name": "20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities", "tags": ["mailing-list", "x_refsource_FULLDISC"], "url": "http://seclists.org/fulldisclosure/2014/Dec/23"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://svn.apache.org/viewvc?view=revision&revision=1589990"}, {"name": "HPSBOV03503", "tags": ["vendor-advisory", "x_refsource_HP"], "url": "http://marc.info/?l=bugtraq&m=144498216801440&w=2"}, {"name": "SSRT101681", "tags": ["vendor-advisory", "x_refsource_HP"], "url": "http://marc.info/?l=bugtraq&m=141017844705317&w=2"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://svn.apache.org/viewvc?view=revision&revision=1588193"}, {"name": "67669", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/67669"}, {"name": "1030298", "tags": ["vdb-entry", "x_refsource_SECTRACK"], "url": "http://www.securitytracker.com/id/1030298"}, {"name": "DSA-3552", "tags": ["vendor-advisory", "x_refsource_DEBIAN"], "url": "http://www.debian.org/security/2016/dsa-3552"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://svn.apache.org/viewvc?view=revision&revision=1593821"}, {"name": "60729", "tags": ["third-party-advisory", "x_refsource_SECUNIA"], "url": "http://secunia.com/advisories/60729"}, {"name": "[tomcat-dev] 20190319 svn commit: r1855831 [23/30] - in /tomcat/site/trunk: ./ docs/ xdocs/", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "https://lists.apache.org/thread.html/b8a1bf18155b552dcf9a928ba808cbadad84c236d85eab3033662cfb%40%3Cdev.tomcat.apache.org%3E"}, {"name": "[tomcat-dev] 20190325 svn commit: r1856174 [21/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "https://lists.apache.org/thread.html/39ae1f0bd5867c15755a6f959b271ade1aea04ccdc3b2e639dcd903b%40%3Cdev.tomcat.apache.org%3E"}, {"name": "[tomcat-dev] 20190413 svn commit: r1857494 [15/20] - in /tomcat/site/trunk: ./ docs/ xdocs/", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "https://lists.apache.org/thread.html/37220405a377c0182d2afdbc36461c4783b2930fbeae3a17f1333113%40%3Cdev.tomcat.apache.org%3E"}, {"name": "[tomcat-dev] 20190415 svn commit: r1857582 [16/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "https://lists.apache.org/thread.html/b84ad1258a89de5c9c853c7f2d3ad77e5b8b2930be9e132d5cef6b95%40%3Cdev.tomcat.apache.org%3E"}, {"name": "[tomcat-dev] 20200203 svn commit: r1873527 [23/30] - /tomcat/site/trunk/docs/", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "https://lists.apache.org/thread.html/r03c597a64de790ba42c167efacfa23300c3d6c9fe589ab87fe02859c%40%3Cdev.tomcat.apache.org%3E"}, {"name": "[tomcat-dev] 20200213 svn commit: r1873980 [27/34] - /tomcat/site/trunk/docs/", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E"}, {"name": "[tomcat-dev] 20200213 svn commit: r1873980 [26/34] - /tomcat/site/trunk/docs/", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "https://lists.apache.org/thread.html/r587e50b86c1a96ee301f751d50294072d142fd6dc08a8987ae9f3a9b%40%3Cdev.tomcat.apache.org%3E"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "[email protected]", "ID": "CVE-2014-0119", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Apache Tomcat before 6.0.40, 7.x before 7.0.54, and 8.x before 8.0.6 does not properly constrain the class loader that accesses the XML parser used with an XSLT stylesheet, which allows remote attackers to (1) read arbitrary files via a crafted web application that provides an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue, or (2) read files associated with different web applications on a single Tomcat instance via a crafted web application."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "http://svn.apache.org/viewvc?view=revision&revision=1590036", "refsource": "CONFIRM", "url": "http://svn.apache.org/viewvc?view=revision&revision=1590036"}, {"name": "http://advisories.mageia.org/MGASA-2014-0268.html", "refsource": "CONFIRM", "url": "http://advisories.mageia.org/MGASA-2014-0268.html"}, {"name": "http://svn.apache.org/viewvc?view=revision&revision=1589837", "refsource": "CONFIRM", "url": "http://svn.apache.org/viewvc?view=revision&revision=1589837"}, {"name": "USN-2654-1", "refsource": "UBUNTU", "url": "http://www.ubuntu.com/usn/USN-2654-1"}, {"name": "RHSA-2015:0765", "refsource": "REDHAT", "url": "http://rhn.redhat.com/errata/RHSA-2015-0765.html"}, {"name": "59732", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/59732"}, {"name": "RHSA-2015:0675", "refsource": "REDHAT", "url": "http://rhn.redhat.com/errata/RHSA-2015-0675.html"}, {"name": "http://www.vmware.com/security/advisories/VMSA-2014-0012.html", "refsource": "CONFIRM", "url": "http://www.vmware.com/security/advisories/VMSA-2014-0012.html"}, {"name": "http://www-01.ibm.com/support/docview.wss?uid=swg21681528", "refsource": "CONFIRM", "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21681528"}, {"name": "MDVSA-2015:052", "refsource": "MANDRIVA", "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2015:052"}, {"name": "RHSA-2015:0720", "refsource": "REDHAT", "url": "http://rhn.redhat.com/errata/RHSA-2015-0720.html"}, {"name": "http://svn.apache.org/viewvc?view=revision&revision=1590028", "refsource": "CONFIRM", "url": "http://svn.apache.org/viewvc?view=revision&revision=1590028"}, {"name": "http://svn.apache.org/viewvc?view=revision&revision=1589992", "refsource": "CONFIRM", "url": "http://svn.apache.org/viewvc?view=revision&revision=1589992"}, {"name": "MDVSA-2015:084", "refsource": "MANDRIVA", "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2015:084"}, {"name": "DSA-3530", "refsource": "DEBIAN", "url": "http://www.debian.org/security/2016/dsa-3530"}, {"name": "http://svn.apache.org/viewvc?view=revision&revision=1589983", "refsource": "CONFIRM", "url": "http://svn.apache.org/viewvc?view=revision&revision=1589983"}, {"name": "HPSBUX03102", "refsource": "HP", "url": "http://marc.info/?l=bugtraq&m=141017844705317&w=2"}, {"name": "http://tomcat.apache.org/security-7.html", "refsource": "CONFIRM", "url": "http://tomcat.apache.org/security-7.html"}, {"name": "20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities", "refsource": "BUGTRAQ", "url": "http://www.securityfocus.com/archive/1/534161/100/0/threaded"}, {"name": "MDVSA-2015:053", "refsource": "MANDRIVA", "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2015:053"}, {"name": "http://svn.apache.org/viewvc?view=revision&revision=1588199", "refsource": "CONFIRM", "url": "http://svn.apache.org/viewvc?view=revision&revision=1588199"}, {"name": "http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html", "refsource": "CONFIRM", "url": "http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html"}, {"name": "http://svn.apache.org/viewvc?view=revision&revision=1589997", "refsource": "CONFIRM", "url": "http://svn.apache.org/viewvc?view=revision&revision=1589997"}, {"name": "http://tomcat.apache.org/security-8.html", "refsource": "CONFIRM", "url": "http://tomcat.apache.org/security-8.html"}, {"name": "http://www-01.ibm.com/support/docview.wss?uid=swg21678231", "refsource": "CONFIRM", "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21678231"}, {"name": "http://svn.apache.org/viewvc?view=revision&revision=1589980", "refsource": "CONFIRM", "url": "http://svn.apache.org/viewvc?view=revision&revision=1589980"}, {"name": "http://svn.apache.org/viewvc?view=revision&revision=1589640", "refsource": "CONFIRM", "url": "http://svn.apache.org/viewvc?view=revision&revision=1589640"}, {"name": "http://tomcat.apache.org/security-6.html", "refsource": "CONFIRM", "url": "http://tomcat.apache.org/security-6.html"}, {"name": "https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04851013", "refsource": "CONFIRM", "url": "https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04851013"}, {"name": "http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html", "refsource": "CONFIRM", "url": "http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html"}, {"name": "59873", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/59873"}, {"name": "20140527 [SECURITY] CVE-2014-0119 Apache Tomcat information disclosure", "refsource": "FULLDISC", "url": "http://seclists.org/fulldisclosure/2014/May/141"}, {"name": "http://svn.apache.org/viewvc?view=revision&revision=1589985", "refsource": "CONFIRM", "url": "http://svn.apache.org/viewvc?view=revision&revision=1589985"}, {"name": "http://svn.apache.org/viewvc?view=revision&revision=1593815", "refsource": "CONFIRM", "url": "http://svn.apache.org/viewvc?view=revision&revision=1593815"}, {"name": "20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities", "refsource": "FULLDISC", "url": "http://seclists.org/fulldisclosure/2014/Dec/23"}, {"name": "http://svn.apache.org/viewvc?view=revision&revision=1589990", "refsource": "CONFIRM", "url": "http://svn.apache.org/viewvc?view=revision&revision=1589990"}, {"name": "HPSBOV03503", "refsource": "HP", "url": "http://marc.info/?l=bugtraq&m=144498216801440&w=2"}, {"name": "SSRT101681", "refsource": "HP", "url": "http://marc.info/?l=bugtraq&m=141017844705317&w=2"}, {"name": "http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html", "refsource": "CONFIRM", "url": "http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html"}, {"name": "http://svn.apache.org/viewvc?view=revision&revision=1588193", "refsource": "CONFIRM", "url": "http://svn.apache.org/viewvc?view=revision&revision=1588193"}, {"name": "67669", "refsource": "BID", "url": "http://www.securityfocus.com/bid/67669"}, {"name": "1030298", "refsource": "SECTRACK", "url": "http://www.securitytracker.com/id/1030298"}, {"name": "DSA-3552", "refsource": "DEBIAN", "url": "http://www.debian.org/security/2016/dsa-3552"}, {"name": "http://svn.apache.org/viewvc?view=revision&revision=1593821", "refsource": "CONFIRM", "url": "http://svn.apache.org/viewvc?view=revision&revision=1593821"}, {"name": "60729", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/60729"}, {"name": "[tomcat-dev] 20190319 svn commit: r1855831 [23/30] - in /tomcat/site/trunk: ./ docs/ xdocs/", "refsource": "MLIST", "url": "https://lists.apache.org/thread.html/b8a1bf18155b552dcf9a928ba808cbadad84c236d85eab3033662cfb@%3Cdev.tomcat.apache.org%3E"}, {"name": "[tomcat-dev] 20190325 svn commit: r1856174 [21/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/", "refsource": "MLIST", "url": "https://lists.apache.org/thread.html/39ae1f0bd5867c15755a6f959b271ade1aea04ccdc3b2e639dcd903b@%3Cdev.tomcat.apache.org%3E"}, {"name": "[tomcat-dev] 20190413 svn commit: r1857494 [15/20] - in /tomcat/site/trunk: ./ docs/ xdocs/", "refsource": "MLIST", "url": "https://lists.apache.org/thread.html/37220405a377c0182d2afdbc36461c4783b2930fbeae3a17f1333113@%3Cdev.tomcat.apache.org%3E"}, {"name": "[tomcat-dev] 20190415 svn commit: r1857582 [16/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/", "refsource": "MLIST", "url": "https://lists.apache.org/thread.html/b84ad1258a89de5c9c853c7f2d3ad77e5b8b2930be9e132d5cef6b95@%3Cdev.tomcat.apache.org%3E"}, {"name": "[tomcat-dev] 20200203 svn commit: r1873527 [23/30] - /tomcat/site/trunk/docs/", "refsource": "MLIST", "url": "https://lists.apache.org/thread.html/r03c597a64de790ba42c167efacfa23300c3d6c9fe589ab87fe02859c@%3Cdev.tomcat.apache.org%3E"}, {"name": "[tomcat-dev] 20200213 svn commit: r1873980 [27/34] - /tomcat/site/trunk/docs/", "refsource": "MLIST", "url": "https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c@%3Cdev.tomcat.apache.org%3E"}, {"name": "[tomcat-dev] 20200213 svn commit: r1873980 [26/34] - /tomcat/site/trunk/docs/", "refsource": "MLIST", "url": "https://lists.apache.org/thread.html/r587e50b86c1a96ee301f751d50294072d142fd6dc08a8987ae9f3a9b@%3Cdev.tomcat.apache.org%3E"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-06T09:05:39.129Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://svn.apache.org/viewvc?view=revision&revision=1590036"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://advisories.mageia.org/MGASA-2014-0268.html"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://svn.apache.org/viewvc?view=revision&revision=1589837"}, {"name": "USN-2654-1", "tags": ["vendor-advisory", "x_refsource_UBUNTU", "x_transferred"], "url": "http://www.ubuntu.com/usn/USN-2654-1"}, {"name": "RHSA-2015:0765", "tags": ["vendor-advisory", "x_refsource_REDHAT", "x_transferred"], "url": "http://rhn.redhat.com/errata/RHSA-2015-0765.html"}, {"name": "59732", "tags": ["third-party-advisory", "x_refsource_SECUNIA", "x_transferred"], "url": "http://secunia.com/advisories/59732"}, {"name": "RHSA-2015:0675", "tags": ["vendor-advisory", "x_refsource_REDHAT", "x_transferred"], "url": "http://rhn.redhat.com/errata/RHSA-2015-0675.html"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://www.vmware.com/security/advisories/VMSA-2014-0012.html"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21681528"}, {"name": "MDVSA-2015:052", "tags": ["vendor-advisory", "x_refsource_MANDRIVA", "x_transferred"], "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2015:052"}, {"name": "RHSA-2015:0720", "tags": ["vendor-advisory", "x_refsource_REDHAT", "x_transferred"], "url": "http://rhn.redhat.com/errata/RHSA-2015-0720.html"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://svn.apache.org/viewvc?view=revision&revision=1590028"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://svn.apache.org/viewvc?view=revision&revision=1589992"}, {"name": "MDVSA-2015:084", "tags": ["vendor-advisory", "x_refsource_MANDRIVA", "x_transferred"], "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2015:084"}, {"name": "DSA-3530", "tags": ["vendor-advisory", "x_refsource_DEBIAN", "x_transferred"], "url": "http://www.debian.org/security/2016/dsa-3530"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://svn.apache.org/viewvc?view=revision&revision=1589983"}, {"name": "HPSBUX03102", "tags": ["vendor-advisory", "x_refsource_HP", "x_transferred"], "url": "http://marc.info/?l=bugtraq&m=141017844705317&w=2"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://tomcat.apache.org/security-7.html"}, {"name": "20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities", "tags": ["mailing-list", "x_refsource_BUGTRAQ", "x_transferred"], "url": "http://www.securityfocus.com/archive/1/534161/100/0/threaded"}, {"name": "MDVSA-2015:053", "tags": ["vendor-advisory", "x_refsource_MANDRIVA", "x_transferred"], "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2015:053"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://svn.apache.org/viewvc?view=revision&revision=1588199"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://svn.apache.org/viewvc?view=revision&revision=1589997"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://tomcat.apache.org/security-8.html"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21678231"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://svn.apache.org/viewvc?view=revision&revision=1589980"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://svn.apache.org/viewvc?view=revision&revision=1589640"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://tomcat.apache.org/security-6.html"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04851013"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html"}, {"name": "59873", "tags": ["third-party-advisory", "x_refsource_SECUNIA", "x_transferred"], "url": "http://secunia.com/advisories/59873"}, {"name": "20140527 [SECURITY] CVE-2014-0119 Apache Tomcat information disclosure", "tags": ["mailing-list", "x_refsource_FULLDISC", "x_transferred"], "url": "http://seclists.org/fulldisclosure/2014/May/141"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://svn.apache.org/viewvc?view=revision&revision=1589985"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://svn.apache.org/viewvc?view=revision&revision=1593815"}, {"name": "20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities", "tags": ["mailing-list", "x_refsource_FULLDISC", "x_transferred"], "url": "http://seclists.org/fulldisclosure/2014/Dec/23"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://svn.apache.org/viewvc?view=revision&revision=1589990"}, {"name": "HPSBOV03503", "tags": ["vendor-advisory", "x_refsource_HP", "x_transferred"], "url": "http://marc.info/?l=bugtraq&m=144498216801440&w=2"}, {"name": "SSRT101681", "tags": ["vendor-advisory", "x_refsource_HP", "x_transferred"], "url": "http://marc.info/?l=bugtraq&m=141017844705317&w=2"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://svn.apache.org/viewvc?view=revision&revision=1588193"}, {"name": "67669", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/67669"}, {"name": "1030298", "tags": ["vdb-entry", "x_refsource_SECTRACK", "x_transferred"], "url": "http://www.securitytracker.com/id/1030298"}, {"name": "DSA-3552", "tags": ["vendor-advisory", "x_refsource_DEBIAN", "x_transferred"], "url": "http://www.debian.org/security/2016/dsa-3552"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://svn.apache.org/viewvc?view=revision&revision=1593821"}, {"name": "60729", "tags": ["third-party-advisory", "x_refsource_SECUNIA", "x_transferred"], "url": "http://secunia.com/advisories/60729"}, {"name": "[tomcat-dev] 20190319 svn commit: r1855831 [23/30] - in /tomcat/site/trunk: ./ docs/ xdocs/", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "https://lists.apache.org/thread.html/b8a1bf18155b552dcf9a928ba808cbadad84c236d85eab3033662cfb%40%3Cdev.tomcat.apache.org%3E"}, {"name": "[tomcat-dev] 20190325 svn commit: r1856174 [21/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "https://lists.apache.org/thread.html/39ae1f0bd5867c15755a6f959b271ade1aea04ccdc3b2e639dcd903b%40%3Cdev.tomcat.apache.org%3E"}, {"name": "[tomcat-dev] 20190413 svn commit: r1857494 [15/20] - in /tomcat/site/trunk: ./ docs/ xdocs/", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "https://lists.apache.org/thread.html/37220405a377c0182d2afdbc36461c4783b2930fbeae3a17f1333113%40%3Cdev.tomcat.apache.org%3E"}, {"name": "[tomcat-dev] 20190415 svn commit: r1857582 [16/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "https://lists.apache.org/thread.html/b84ad1258a89de5c9c853c7f2d3ad77e5b8b2930be9e132d5cef6b95%40%3Cdev.tomcat.apache.org%3E"}, {"name": "[tomcat-dev] 20200203 svn commit: r1873527 [23/30] - /tomcat/site/trunk/docs/", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "https://lists.apache.org/thread.html/r03c597a64de790ba42c167efacfa23300c3d6c9fe589ab87fe02859c%40%3Cdev.tomcat.apache.org%3E"}, {"name": "[tomcat-dev] 20200213 svn commit: r1873980 [27/34] - /tomcat/site/trunk/docs/", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E"}, {"name": "[tomcat-dev] 20200213 svn commit: r1873980 [26/34] - /tomcat/site/trunk/docs/", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "https://lists.apache.org/thread.html/r587e50b86c1a96ee301f751d50294072d142fd6dc08a8987ae9f3a9b%40%3Cdev.tomcat.apache.org%3E"}]}]}, "cveMetadata": {"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "assignerShortName": "redhat", "cveId": "CVE-2014-0119", "datePublished": "2014-05-31T10:00:00", "dateReserved": "2013-12-03T00:00:00", "dateUpdated": "2024-08-06T09:05:39.129Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:apache:tomcat:8.0.0:rc1:*:*:*:*:*:*", "matchCriteriaId": "4752862B-7D26-4285-B8A0-CF082C758353", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:8.0.0:rc10:*:*:*:*:*:*", "matchCriteriaId": "58EA7199-3373-4F97-9907-3A479A02155E", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:8.0.0:rc2:*:*:*:*:*:*", "matchCriteriaId": "4693BD36-E522-4C8E-9667-8F3E14A05EF3", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:8.0.0:rc5:*:*:*:*:*:*", "matchCriteriaId": "2BBBC5EA-012C-4C5D-A61B-BAF134B300DA", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:8.0.1:*:*:*:*:*:*:*", "matchCriteriaId": "2A358FDF-C249-4D7A-9445-8B9E7D9D40AF", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:8.0.3:*:*:*:*:*:*:*", "matchCriteriaId": "AFF96F96-34DB-4EB3-BF59-11220673FA26", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:8.0.5:*:*:*:*:*:*:*", "matchCriteriaId": "EDF3E379-47D2-4C86-8C6D-8B3C25A0E1C4", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*", "matchCriteriaId": "029C1DD4-3B41-47D2-97D2-73A7D3D89817", "versionEndIncluding": "6.0.39", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:6:*:*:*:*:*:*:*", "matchCriteriaId": "83BA996F-C770-4E36-8FD8-916EA64E9A34", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:6.0:*:*:*:*:*:*:*", "matchCriteriaId": "D11D6FB7-CBDB-48C1-98CB-1B3CAA36C5D7", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:6.0.0:*:*:*:*:*:*:*", "matchCriteriaId": "49E3C039-A949-4F1B-892A-57147EECB249", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:6.0.0:alpha:*:*:*:*:*:*", "matchCriteriaId": "0A354C34-A3FE-4B8A-9985-8874A0634BC7", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:6.0.1:*:*:*:*:*:*:*", "matchCriteriaId": "F28C7801-41B9-4552-BA1E-577967BCBBEE", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:6.0.1:alpha:*:*:*:*:*:*", "matchCriteriaId": "CFE300CC-FD4A-444E-8506-E5E269D0A0A5", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:6.0.2:*:*:*:*:*:*:*", "matchCriteriaId": "25B21085-7259-4685-9D1F-FF98E6489E10", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:6.0.2:alpha:*:*:*:*:*:*", "matchCriteriaId": "F50A3EC9-516E-48A7-839B-A73F491B5B9F", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:6.0.2:beta:*:*:*:*:*:*", "matchCriteriaId": "8C28F09D-5CAA-4CA7-A2B5-3B2820F5F409", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:6.0.3:*:*:*:*:*:*:*", "matchCriteriaId": "635EE321-2A1F-4FF8-95BE-0C26591969D9", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:6.0.4:*:*:*:*:*:*:*", "matchCriteriaId": "9A81B035-8598-4D2C-B45F-C6C9D4B10C2F", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:6.0.4:alpha:*:*:*:*:*:*", "matchCriteriaId": "FAC2FC75-97D2-4EA1-A1A0-F592A6D7C1F3", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:6.0.5:*:*:*:*:*:*:*", "matchCriteriaId": "E1096947-82A6-4EA8-A4F2-00D91E3F7DAF", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:6.0.6:*:*:*:*:*:*:*", "matchCriteriaId": "0EBFA1D3-16A6-4041-BB30-51D2EE0F2AF4", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:6.0.6:alpha:*:*:*:*:*:*", "matchCriteriaId": "C4871FD1-7F8C-4677-A80B-4A0BBC71DD7C", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:6.0.7:*:*:*:*:*:*:*", "matchCriteriaId": "B70B372F-EFFD-4AF7-99B5-7D1B23A0C54C", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:6.0.7:alpha:*:*:*:*:*:*", "matchCriteriaId": "31AB969A-9ACE-44EF-B2E5-CEC008F47C46", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:6.0.7:beta:*:*:*:*:*:*", "matchCriteriaId": "06217215-72E4-4478-BACB-628A0836A645", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:6.0.8:*:*:*:*:*:*:*", "matchCriteriaId": "9C95ADA4-66F5-45C4-A677-ACE22367A75A", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:6.0.8:alpha:*:*:*:*:*:*", "matchCriteriaId": "EA810F3F-ADD3-4D3F-9DFC-DBDD87B3079C", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:6.0.9:*:*:*:*:*:*:*", "matchCriteriaId": "11951A10-39A2-4FF5-8C43-DF94730FB794", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:6.0.9:beta:*:*:*:*:*:*", "matchCriteriaId": "8B79F2EA-C893-4359-80EC-24AE38D982E5", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:6.0.10:*:*:*:*:*:*:*", "matchCriteriaId": "351E5BCF-A56B-4D91-BA3C-21A4B77D529A", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:6.0.11:*:*:*:*:*:*:*", "matchCriteriaId": "2DC2BBB4-171E-4EFF-A575-A5B7FF031755", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:6.0.12:*:*:*:*:*:*:*", "matchCriteriaId": "6B6B0504-27C1-4824-A928-A878CBBAB32D", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:6.0.13:*:*:*:*:*:*:*", "matchCriteriaId": "CE81AD36-ACD1-4C6C-8E7C-5326D1DA3045", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:6.0.14:*:*:*:*:*:*:*", "matchCriteriaId": "D903956B-14F5-4177-AF12-0A5F1846D3C4", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:6.0.15:*:*:*:*:*:*:*", "matchCriteriaId": "81F847DC-A2F5-456C-9038-16A0E85F4C3B", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:6.0.16:*:*:*:*:*:*:*", "matchCriteriaId": "AF3EBD00-1E1E-452D-AFFB-08A6BD111DDD", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:6.0.17:*:*:*:*:*:*:*", "matchCriteriaId": "C6B93A3A-D487-4CA1-8257-26F8FE287B8B", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:6.0.18:*:*:*:*:*:*:*", "matchCriteriaId": "BD8802B2-57E0-4AA6-BC8E-00DE60468569", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:6.0.19:*:*:*:*:*:*:*", "matchCriteriaId": "8461DF95-18DC-4BF5-A703-7F19DA88DC30", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:6.0.20:*:*:*:*:*:*:*", "matchCriteriaId": "1F4C9BCF-9C73-4991-B02F-E08C5DA06EBA", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:6.0.24:*:*:*:*:*:*:*", "matchCriteriaId": "2823789C-2CB6-4300-94DB-BDBE83ABA8E3", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:6.0.26:*:*:*:*:*:*:*", "matchCriteriaId": "C5416C76-46ED-4CB1-A7F8-F24EA16DE7F9", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:6.0.27:*:*:*:*:*:*:*", "matchCriteriaId": "A61429EE-4331-430C-9830-58DCCBCBCB58", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:6.0.28:*:*:*:*:*:*:*", "matchCriteriaId": "31B3593F-CEDF-423C-90F8-F88EED87DC3E", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:6.0.29:*:*:*:*:*:*:*", "matchCriteriaId": "AE7862B2-E1FA-4E16-92CD-8918AB461D9A", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:6.0.30:*:*:*:*:*:*:*", "matchCriteriaId": "A9E03BE3-60CC-4415-B993-D0BB00F87A30", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:6.0.31:*:*:*:*:*:*:*", "matchCriteriaId": "CE92E59A-FF0D-4D1A-8B12-CC41A7E1FD3C", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:6.0.32:*:*:*:*:*:*:*", "matchCriteriaId": "BFD64FE7-ABAF-49F3-B8D0-91C37C822F4B", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:6.0.33:*:*:*:*:*:*:*", "matchCriteriaId": "48E5E8C3-21AD-4230-B945-AB7DE66307B9", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:6.0.35:*:*:*:*:*:*:*", "matchCriteriaId": "4945C8C1-C71B-448B-9075-07C6C92599CF", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:6.0.36:*:*:*:*:*:*:*", "matchCriteriaId": "ED4730B0-2E09-408B-AFD4-FE00F73700FD", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:6.0.37:*:*:*:*:*:*:*", "matchCriteriaId": "B8DE8A8A-7643-4292-BCC1-758AE0940207", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:apache:tomcat:7.0.0:*:*:*:*:*:*:*", "matchCriteriaId": "0F8C62EF-1B67-456A-9C66-755439CF8556", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:7.0.0:beta:*:*:*:*:*:*", "matchCriteriaId": "33E9607B-4D28-460D-896B-E4B7FA22441E", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:7.0.1:*:*:*:*:*:*:*", "matchCriteriaId": "A819E245-D641-4F19-9139-6C940504F6E7", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:7.0.2:*:*:*:*:*:*:*", "matchCriteriaId": "8C381275-10C5-4939-BCE3-0D1F3B3CB2EE", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:7.0.2:beta:*:*:*:*:*:*", "matchCriteriaId": "81A31CA0-A209-4C49-AA06-C38E165E5B68", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:7.0.3:*:*:*:*:*:*:*", "matchCriteriaId": "7205475A-6D04-4042-B24E-1DA5A57029B7", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:7.0.4:*:*:*:*:*:*:*", "matchCriteriaId": "08022987-B36B-4F63-88A5-A8F59195DF4A", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:7.0.4:beta:*:*:*:*:*:*", "matchCriteriaId": "0AA563BF-A67A-477D-956A-167ABEF885C5", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:7.0.5:*:*:*:*:*:*:*", "matchCriteriaId": "FF4B7557-EF35-451E-B55D-3296966695AC", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:7.0.6:*:*:*:*:*:*:*", "matchCriteriaId": "8980E61E-27BE-4858-82B3-C0E8128AF521", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:7.0.7:*:*:*:*:*:*:*", "matchCriteriaId": "8756BF9B-3E24-4677-87AE-31CE776541F0", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:7.0.8:*:*:*:*:*:*:*", "matchCriteriaId": "88CE057E-2092-4C98-8D0C-75CF439D0A9C", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:7.0.9:*:*:*:*:*:*:*", "matchCriteriaId": "8F194580-EE6D-4E38-87F3-F0661262256B", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:7.0.10:*:*:*:*:*:*:*", "matchCriteriaId": "A9731BAA-4C6C-4259-B786-F577D8A90FA1", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:7.0.11:*:*:*:*:*:*:*", "matchCriteriaId": "1F74A421-D019-4248-84B8-C70D4D9A8A95", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:7.0.12:*:*:*:*:*:*:*", "matchCriteriaId": "2BA27FF9-4C66-4E17-95C0-1CB2DAA6AFC8", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:7.0.13:*:*:*:*:*:*:*", "matchCriteriaId": "05346F5A-FB52-4376-AAC7-9A5308216545", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:7.0.14:*:*:*:*:*:*:*", "matchCriteriaId": "305688F2-50A6-41FB-8614-BC589DB9A789", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:7.0.15:*:*:*:*:*:*:*", "matchCriteriaId": "D24AA431-C436-4AA5-85DF-B9AAFF2548FC", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:7.0.16:*:*:*:*:*:*:*", "matchCriteriaId": "25966344-15D5-4101-9346-B06BFD2DFFF5", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:7.0.17:*:*:*:*:*:*:*", "matchCriteriaId": "11F4CBAC-27B1-4EFF-955A-A63B457D0578", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:7.0.18:*:*:*:*:*:*:*", "matchCriteriaId": "FD55B338-9DBE-4643-ABED-A08964D3AF7C", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:7.0.19:*:*:*:*:*:*:*", "matchCriteriaId": "0D4F710E-06EA-48F4-AC6A-6F143950F015", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:7.0.20:*:*:*:*:*:*:*", "matchCriteriaId": "2C4936C2-0B2D-4C44-98C3-443090965F5E", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:7.0.21:*:*:*:*:*:*:*", "matchCriteriaId": "48453405-2319-4327-9F4C-6F70B49452C6", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:7.0.22:*:*:*:*:*:*:*", "matchCriteriaId": "49DD9544-6424-41A6-AEC0-EC19B8A10E71", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:7.0.23:*:*:*:*:*:*:*", "matchCriteriaId": "E4670E65-2E11-49A4-B661-57C2F60D411F", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:7.0.24:*:*:*:*:*:*:*", "matchCriteriaId": "5E8FF71D-4710-4FBB-9925-A6A26C450F7D", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:7.0.25:*:*:*:*:*:*:*", "matchCriteriaId": "31002A23-4788-4BC7-AE11-A3C2AA31716D", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:7.0.26:*:*:*:*:*:*:*", "matchCriteriaId": "7144EDDF-8265-4642-8EEB-ED52527E0A26", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:7.0.27:*:*:*:*:*:*:*", "matchCriteriaId": "DF06B5C1-B9DD-4673-A101-56E1E593ACDD", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:7.0.28:*:*:*:*:*:*:*", "matchCriteriaId": "7D731065-626B-4425-8E49-F708DD457824", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:7.0.29:*:*:*:*:*:*:*", "matchCriteriaId": "B3D850EA-E537-42C8-93B9-96E15CB26747", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:7.0.30:*:*:*:*:*:*:*", "matchCriteriaId": "E037DA05-2BEF-4F64-B8BB-307247B6A05C", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:7.0.31:*:*:*:*:*:*:*", "matchCriteriaId": "BCAF1EB5-FB34-40FC-96ED-9D073890D8BF", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:7.0.32:*:*:*:*:*:*:*", "matchCriteriaId": "D395D95B-1F4A-420E-A0F6-609360AF7B69", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:7.0.33:*:*:*:*:*:*:*", "matchCriteriaId": "9BD221BA-0AB6-4972-8AD9-5D37AC07762F", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:7.0.34:*:*:*:*:*:*:*", "matchCriteriaId": "E55B6565-96CB-4F6A-9A80-C3FB82F30546", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:7.0.35:*:*:*:*:*:*:*", "matchCriteriaId": "D3300AFE-49A4-4904-B9A0-5679F09FA01E", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:7.0.36:*:*:*:*:*:*:*", "matchCriteriaId": "ED5125CC-05F9-4678-90DB-A5C7CD24AE6F", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:7.0.37:*:*:*:*:*:*:*", "matchCriteriaId": "7BD93669-1B30-4BF8-AD7D-F60DD8D63CC8", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:7.0.38:*:*:*:*:*:*:*", "matchCriteriaId": "1B904C74-B92E-4EAE-AE6C-78E2B844C3DB", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:7.0.39:*:*:*:*:*:*:*", "matchCriteriaId": "B8C8C97F-6C9D-4647-AB8A-ADAA5536DDE2", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:7.0.40:*:*:*:*:*:*:*", "matchCriteriaId": "2C6109D1-BC36-40C5-A02A-7AEBC949BAC0", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:7.0.41:*:*:*:*:*:*:*", "matchCriteriaId": "DA8A7333-B4C3-4876-AE01-62F2FD315504", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:7.0.42:*:*:*:*:*:*:*", "matchCriteriaId": "92993E23-D805-407B-8B87-11CEEE8B212F", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:7.0.43:*:*:*:*:*:*:*", "matchCriteriaId": "7A11BD74-305C-41E2-95B1-5008EEF5FA5F", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:7.0.44:*:*:*:*:*:*:*", "matchCriteriaId": "595442D0-9DB7-475A-AE30-8535B70E122E", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:7.0.45:*:*:*:*:*:*:*", "matchCriteriaId": "4B0BA92A-0BD3-4CE4-9465-95E949104BAC", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:7.0.46:*:*:*:*:*:*:*", "matchCriteriaId": "6F944B72-B9EB-4EB8-AEA3-E0D7ADBE1305", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:7.0.47:*:*:*:*:*:*:*", "matchCriteriaId": "6AA28D3A-3EE5-4F90-B8F5-4943F7607DA6", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:7.0.48:*:*:*:*:*:*:*", "matchCriteriaId": "BFD3EB84-2ED2-49D4-8BC9-6398C2E46F0A", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:7.0.49:*:*:*:*:*:*:*", "matchCriteriaId": "DEDF6E1A-0DD6-42AB-9510-F6F4B6002C91", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:7.0.50:*:*:*:*:*:*:*", "matchCriteriaId": "C947E549-2459-4AFB-84A7-36BDA30B5F29", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:7.0.52:*:*:*:*:*:*:*", "matchCriteriaId": "5D55DF79-F9BE-4907-A4D8-96C4B11189ED", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:7.0.53:*:*:*:*:*:*:*", "matchCriteriaId": "14AB5787-82D7-4F78-BE93-4556AB7A7D0E", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Apache Tomcat before 6.0.40, 7.x before 7.0.54, and 8.x before 8.0.6 does not properly constrain the class loader that accesses the XML parser used with an XSLT stylesheet, which allows remote attackers to (1) read arbitrary files via a crafted web application that provides an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue, or (2) read files associated with different web applications on a single Tomcat instance via a crafted web application."}, {"lang": "es", "value": "Apache Tomcat anterior a 6.0.40, 7.x anterior a 7.0.54 y 8.x anterior a 8.0.6 no restringe debidamente el cargador de clase que accede al analizador XML utilizado con una hoja de estilo XSLT, lo que permite a atacantes remotos (1) leer archivos arbitrarios a trav\u00e9s de una aplicaci\u00f3n web manipulada que proporciona una declaraci\u00f3n de entidad externa XML en conjunto con una referencia de entidad, relacionado con un problema de entidad externa XML (XXE) o (2) leer archivos asociados con aplicaciones web diferentes en una instancia Tomcat \u00fanica a trav\u00e9s de una aplicaci\u00f3n web manipulada."}], "id": "CVE-2014-0119", "lastModified": "2024-11-21T02:01:25.113", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "[email protected]", "type": "Primary", "userInteractionRequired": false}]}, "published": "2014-05-31T11:17:13.357", "references": [{"source": "[email protected]", "url": "http://advisories.mageia.org/MGASA-2014-0268.html"}, {"source": "[email protected]", "url": "http://marc.info/?l=bugtraq&m=141017844705317&w=2"}, {"source": "[email protected]", "url": "http://marc.info/?l=bugtraq&m=141017844705317&w=2"}, {"source": "[email protected]", "url": "http://marc.info/?l=bugtraq&m=144498216801440&w=2"}, {"source": "[email protected]", "url": "http://rhn.redhat.com/errata/RHSA-2015-0675.html"}, {"source": "[email protected]", "url": "http://rhn.redhat.com/errata/RHSA-2015-0720.html"}, {"source": "[email protected]", "url": "http://rhn.redhat.com/errata/RHSA-2015-0765.html"}, {"source": "[email protected]", "url": "http://seclists.org/fulldisclosure/2014/Dec/23"}, {"source": "[email protected]", "url": "http://seclists.org/fulldisclosure/2014/May/141"}, {"source": "[email protected]", "url": "http://secunia.com/advisories/59732"}, {"source": "[email protected]", "url": "http://secunia.com/advisories/59873"}, {"source": "[email protected]", "url": "http://secunia.com/advisories/60729"}, {"source": "[email protected]", "url": "http://svn.apache.org/viewvc?view=revision&revision=1588193"}, {"source": "[email protected]", "url": "http://svn.apache.org/viewvc?view=revision&revision=1588199"}, {"source": "[email protected]", "url": "http://svn.apache.org/viewvc?view=revision&revision=1589640"}, {"source": "[email protected]", "url": "http://svn.apache.org/viewvc?view=revision&revision=1589837"}, {"source": "[email protected]", "url": "http://svn.apache.org/viewvc?view=revision&revision=1589980"}, {"source": "[email protected]", "url": "http://svn.apache.org/viewvc?view=revision&revision=1589983"}, {"source": "[email protected]", "url": "http://svn.apache.org/viewvc?view=revision&revision=1589985"}, {"source": "[email protected]", "url": "http://svn.apache.org/viewvc?view=revision&revision=1589990"}, {"source": "[email protected]", "url": "http://svn.apache.org/viewvc?view=revision&revision=1589992"}, {"source": "[email protected]", "url": "http://svn.apache.org/viewvc?view=revision&revision=1589997"}, {"source": "[email protected]", "url": "http://svn.apache.org/viewvc?view=revision&revision=1590028"}, {"source": "[email protected]", "url": "http://svn.apache.org/viewvc?view=revision&revision=1590036"}, {"source": "[email protected]", "url": "http://svn.apache.org/viewvc?view=revision&revision=1593815"}, {"source": "[email protected]", "url": "http://svn.apache.org/viewvc?view=revision&revision=1593821"}, {"source": "[email protected]", "tags": ["Vendor Advisory"], "url": "http://tomcat.apache.org/security-6.html"}, {"source": "[email protected]", "tags": ["Vendor Advisory"], "url": "http://tomcat.apache.org/security-7.html"}, {"source": "[email protected]", "tags": ["Vendor Advisory"], "url": "http://tomcat.apache.org/security-8.html"}, {"source": "[email protected]", "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21678231"}, {"source": "[email protected]", "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21681528"}, {"source": "[email protected]", "url": "http://www.debian.org/security/2016/dsa-3530"}, {"source": "[email protected]", "url": "http://www.debian.org/security/2016/dsa-3552"}, {"source": "[email protected]", "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2015:052"}, {"source": "[email protected]", "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2015:053"}, {"source": "[email protected]", "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2015:084"}, {"source": "[email protected]", "url": "http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html"}, {"source": "[email protected]", "url": "http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html"}, {"source": "[email protected]", "url": "http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html"}, {"source": "[email protected]", "url": "http://www.securityfocus.com/archive/1/534161/100/0/threaded"}, {"source": "[email protected]", "url": "http://www.securityfocus.com/bid/67669"}, {"source": "[email protected]", "url": "http://www.securitytracker.com/id/1030298"}, {"source": "[email protected]", "url": "http://www.ubuntu.com/usn/USN-2654-1"}, {"source": "[email protected]", "url": "http://www.vmware.com/security/advisories/VMSA-2014-0012.html"}, {"source": "[email protected]", "url": "https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04851013"}, {"source": "[email protected]", "url": "https://lists.apache.org/thread.html/37220405a377c0182d2afdbc36461c4783b2930fbeae3a17f1333113%40%3Cdev.tomcat.apache.org%3E"}, {"source": "[email protected]", "url": "https://lists.apache.org/thread.html/39ae1f0bd5867c15755a6f959b271ade1aea04ccdc3b2e639dcd903b%40%3Cdev.tomcat.apache.org%3E"}, {"source": "[email protected]", "url": "https://lists.apache.org/thread.html/b84ad1258a89de5c9c853c7f2d3ad77e5b8b2930be9e132d5cef6b95%40%3Cdev.tomcat.apache.org%3E"}, {"source": "[email protected]", "url": "https://lists.apache.org/thread.html/b8a1bf18155b552dcf9a928ba808cbadad84c236d85eab3033662cfb%40%3Cdev.tomcat.apache.org%3E"}, {"source": "[email protected]", "url": "https://lists.apache.org/thread.html/r03c597a64de790ba42c167efacfa23300c3d6c9fe589ab87fe02859c%40%3Cdev.tomcat.apache.org%3E"}, {"source": "[email protected]", "url": "https://lists.apache.org/thread.html/r587e50b86c1a96ee301f751d50294072d142fd6dc08a8987ae9f3a9b%40%3Cdev.tomcat.apache.org%3E"}, {"source": "[email protected]", "url": "https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://advisories.mageia.org/MGASA-2014-0268.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://marc.info/?l=bugtraq&m=141017844705317&w=2"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://marc.info/?l=bugtraq&m=141017844705317&w=2"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://marc.info/?l=bugtraq&m=144498216801440&w=2"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://rhn.redhat.com/errata/RHSA-2015-0675.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://rhn.redhat.com/errata/RHSA-2015-0720.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://rhn.redhat.com/errata/RHSA-2015-0765.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://seclists.org/fulldisclosure/2014/Dec/23"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://seclists.org/fulldisclosure/2014/May/141"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://secunia.com/advisories/59732"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://secunia.com/advisories/59873"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://secunia.com/advisories/60729"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://svn.apache.org/viewvc?view=revision&revision=1588193"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://svn.apache.org/viewvc?view=revision&revision=1588199"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://svn.apache.org/viewvc?view=revision&revision=1589640"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://svn.apache.org/viewvc?view=revision&revision=1589837"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://svn.apache.org/viewvc?view=revision&revision=1589980"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://svn.apache.org/viewvc?view=revision&revision=1589983"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://svn.apache.org/viewvc?view=revision&revision=1589985"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://svn.apache.org/viewvc?view=revision&revision=1589990"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://svn.apache.org/viewvc?view=revision&revision=1589992"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://svn.apache.org/viewvc?view=revision&revision=1589997"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://svn.apache.org/viewvc?view=revision&revision=1590028"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://svn.apache.org/viewvc?view=revision&revision=1590036"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://svn.apache.org/viewvc?view=revision&revision=1593815"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://svn.apache.org/viewvc?view=revision&revision=1593821"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "http://tomcat.apache.org/security-6.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "http://tomcat.apache.org/security-7.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "http://tomcat.apache.org/security-8.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21678231"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21681528"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.debian.org/security/2016/dsa-3530"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.debian.org/security/2016/dsa-3552"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2015:052"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2015:053"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2015:084"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/archive/1/534161/100/0/threaded"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/bid/67669"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securitytracker.com/id/1030298"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.ubuntu.com/usn/USN-2654-1"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.vmware.com/security/advisories/VMSA-2014-0012.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04851013"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.apache.org/thread.html/37220405a377c0182d2afdbc36461c4783b2930fbeae3a17f1333113%40%3Cdev.tomcat.apache.org%3E"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.apache.org/thread.html/39ae1f0bd5867c15755a6f959b271ade1aea04ccdc3b2e639dcd903b%40%3Cdev.tomcat.apache.org%3E"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.apache.org/thread.html/b84ad1258a89de5c9c853c7f2d3ad77e5b8b2930be9e132d5cef6b95%40%3Cdev.tomcat.apache.org%3E"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.apache.org/thread.html/b8a1bf18155b552dcf9a928ba808cbadad84c236d85eab3033662cfb%40%3Cdev.tomcat.apache.org%3E"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.apache.org/thread.html/r03c597a64de790ba42c167efacfa23300c3d6c9fe589ab87fe02859c%40%3Cdev.tomcat.apache.org%3E"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.apache.org/thread.html/r587e50b86c1a96ee301f751d50294072d142fd6dc08a8987ae9f3a9b%40%3Cdev.tomcat.apache.org%3E"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E"}], "sourceIdentifier": "[email protected]", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-264"}], "source": "[email protected]", "type": "Primary"}]}

{"affected_release": [{"advisory": "RHSA-2014:1038", "cpe": "cpe:/o:redhat:enterprise_linux:6", "package": "tomcat6-0:6.0.24-78.el6_5", "product_name": "Red Hat Enterprise Linux 6", "release_date": "2014-08-11T00:00:00Z"}, {"advisory": "RHSA-2014:1034", "cpe": "cpe:/o:redhat:enterprise_linux:7", "package": "tomcat-0:7.0.42-8.el7_0", "product_name": "Red Hat Enterprise Linux 7", "release_date": "2014-08-07T00:00:00Z"}, {"advisory": "RHSA-2015:0234", "cpe": "cpe:/a:redhat:jboss_bpms:6.0", "package": "jbossweb", "product_name": "Red Hat JBoss BPMS 6.0", "release_date": "2015-02-17T00:00:00Z"}, {"advisory": "RHSA-2015:0235", "cpe": "cpe:/a:redhat:jboss_brms:6.0", "package": "jbossweb", "product_name": "Red Hat JBoss BRMS 6.0", "release_date": "2015-02-17T00:00:00Z"}, {"advisory": "RHSA-2014:0895", "cpe": "cpe:/a:redhat:jboss_data_grid:6.3.0", "package": "jbossweb", "product_name": "Red Hat JBoss Data Grid 6.3", "release_date": "2014-07-16T00:00:00Z"}, {"advisory": "RHSA-2015:0765", "cpe": "cpe:/a:redhat:jboss_data_virtualization:6.0", "package": "jbossweb", "product_name": "Red Hat JBoss Data Virtualization 6.0", "release_date": "2015-03-31T00:00:00Z"}, {"advisory": "RHSA-2015:0675", "cpe": "cpe:/a:redhat:jboss_data_virtualization:6.1", "product_name": "Red Hat JBoss Data Virtualization 6.1", "release_date": "2015-03-11T00:00:00Z"}, {"advisory": "RHSA-2014:0842", "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:6.2.4", "package": "jbossweb", "product_name": "Red Hat JBoss Enterprise Application Platform 6.2", "release_date": "2014-07-07T00:00:00Z"}, {"advisory": "RHSA-2014:0843", "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:6::el5", "package": "jbossweb-0:7.3.2-4.Final_redhat_3.1.ep6.el5", "product_name": "Red Hat JBoss Enterprise Application Platform 6.2 for RHEL 5", "release_date": "2014-07-07T00:00:00Z"}, {"advisory": "RHSA-2014:0843", "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:6::el6", "package": "jbossweb-0:7.3.2-4.Final_redhat_3.1.ep6.el6", "product_name": "Red Hat JBoss Enterprise Application Platform 6.2 for RHEL 6", "release_date": "2014-07-07T00:00:00Z"}, {"advisory": "RHSA-2014:1088", "cpe": "cpe:/a:redhat:jboss_enterprise_web_server:2::el5", "package": "antlr-eap6-0:2.7.7-17.redhat_4.1.ep6.el5", "product_name": "Red Hat JBoss Enterprise Web Server 2 for RHEL 5", "release_date": "2014-08-21T00:00:00Z"}, {"advisory": "RHSA-2014:1088", "cpe": "cpe:/a:redhat:jboss_enterprise_web_server:2::el5", "package": "apache-commons-collections-eap6-0:3.2.1-15.redhat_3.1.ep6.el5", "product_name": "Red Hat JBoss Enterprise Web Server 2 for RHEL 5", "release_date": "2014-08-21T00:00:00Z"}, {"advisory": "RHSA-2014:1088", "cpe": "cpe:/a:redhat:jboss_enterprise_web_server:2::el5", "package": "apache-commons-daemon-eap6-1:1.0.15-5.redhat_1.ep6.el5", "product_name": "Red Hat JBoss Enterprise Web Server 2 for RHEL 5", "release_date": "2014-08-21T00:00:00Z"}, {"advisory": "RHSA-2014:1088", "cpe": "cpe:/a:redhat:jboss_enterprise_web_server:2::el5", "package": "apache-commons-daemon-jsvc-eap6-1:1.0.15-6.redhat_2.ep6.el5", "product_name": "Red Hat JBoss Enterprise Web Server 2 for RHEL 5", "release_date": "2014-08-21T00:00:00Z"}, {"advisory": "RHSA-2014:1088", "cpe": "cpe:/a:redhat:jboss_enterprise_web_server:2::el5", "package": "apache-commons-pool-eap6-0:1.6-7.redhat_6.1.ep6.el5", "product_name": "Red Hat JBoss Enterprise Web Server 2 for RHEL 5", "release_date": "2014-08-21T00:00:00Z"}, {"advisory": "RHSA-2014:1088", "cpe": "cpe:/a:redhat:jboss_enterprise_web_server:2::el5", "package": "dom4j-eap6-0:1.6.1-20.redhat_6.1.ep6.el5", "product_name": "Red Hat JBoss Enterprise Web Server 2 for RHEL 5", "release_date": "2014-08-21T00:00:00Z"}, {"advisory": "RHSA-2014:1088", "cpe": "cpe:/a:redhat:jboss_enterprise_web_server:2::el5", "package": "ecj3-1:3.7.2-9.redhat_3.1.ep6.el5", "product_name": "Red Hat JBoss Enterprise Web Server 2 for RHEL 5", "release_date": "2014-08-21T00:00:00Z"}, {"advisory": "RHSA-2014:1088", "cpe": "cpe:/a:redhat:jboss_enterprise_web_server:2::el5", "package": "hibernate4-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5", "product_name": "Red Hat JBoss Enterprise Web Server 2 for RHEL 5", "release_date": "2014-08-21T00:00:00Z"}, {"advisory": "RHSA-2014:1088", "cpe": "cpe:/a:redhat:jboss_enterprise_web_server:2::el5", "package": "httpd-0:2.2.26-35.ep6.el5", "product_name": "Red Hat JBoss Enterprise Web Server 2 for RHEL 5", "release_date": "2014-08-21T00:00:00Z"}, {"advisory": "RHSA-2014:1088", "cpe": "cpe:/a:redhat:jboss_enterprise_web_server:2::el5", "package": "javassist-eap6-0:3.18.1-1.GA_redhat_1.1.ep6.el5", "product_name": "Red Hat JBoss Enterprise Web Server 2 for RHEL 5", "release_date": "2014-08-21T00:00:00Z"}, {"advisory": "RHSA-2014:1088", "cpe": "cpe:/a:redhat:jboss_enterprise_web_server:2::el5", "package": "jboss-logging-0:3.1.4-1.GA_redhat_1.1.ep6.el5", "product_name": "Red Hat JBoss Enterprise Web Server 2 for RHEL 5", "release_date": "2014-08-21T00:00:00Z"}, {"advisory": "RHSA-2014:1088", "cpe": "cpe:/a:redhat:jboss_enterprise_web_server:2::el5", "package": "jboss-transaction-api_1.1_spec-0:1.0.1-12.Final_redhat_2.2.ep6.el5", "product_name": "Red Hat JBoss Enterprise Web Server 2 for RHEL 5", "release_date": "2014-08-21T00:00:00Z"}, {"advisory": "RHSA-2014:1088", "cpe": "cpe:/a:redhat:jboss_enterprise_web_server:2::el5", "package": "mod_cluster-0:1.2.9-1.Final_redhat_1.1.ep6.el5", "product_name": "Red Hat JBoss Enterprise Web Server 2 for RHEL 5", "release_date": "2014-08-21T00:00:00Z"}, {"advisory": "RHSA-2014:1088", "cpe": "cpe:/a:redhat:jboss_enterprise_web_server:2::el5", "package": "mod_cluster-native-0:1.2.9-3.Final_redhat_2.ep6.el5", "product_name": "Red Hat JBoss Enterprise Web Server 2 for RHEL 5", "release_date": "2014-08-21T00:00:00Z"}, {"advisory": "RHSA-2014:1088", "cpe": "cpe:/a:redhat:jboss_enterprise_web_server:2::el5", "package": "mod_jk-0:1.2.40-2.redhat_1.ep6.el5", "product_name": "Red Hat JBoss Enterprise Web Server 2 for RHEL 5", "release_date": "2014-08-21T00:00:00Z"}, {"advisory": "RHSA-2014:1088", "cpe": "cpe:/a:redhat:jboss_enterprise_web_server:2::el5", "package": "mod_rt-0:2.4.1-6.GA.ep6.el5", "product_name": "Red Hat JBoss Enterprise Web Server 2 for RHEL 5", "release_date": "2014-08-21T00:00:00Z"}, {"advisory": "RHSA-2014:1088", "cpe": "cpe:/a:redhat:jboss_enterprise_web_server:2::el5", "package": "mod_snmp-0:2.4.1-13.GA.ep6.el5", "product_name": "Red Hat JBoss Enterprise Web Server 2 for RHEL 5", "release_date": "2014-08-21T00:00:00Z"}, {"advisory": "RHSA-2014:1088", "cpe": "cpe:/a:redhat:jboss_enterprise_web_server:2::el5", "package": "storeconfig-tc6-0:0.0.1-7.Alpha3_redhat_12.3.ep6.el5", "product_name": "Red Hat JBoss Enterprise Web Server 2 for RHEL 5", "release_date": "2014-08-21T00:00:00Z"}, {"advisory": "RHSA-2014:1088", "cpe": "cpe:/a:redhat:jboss_enterprise_web_server:2::el5", "package": "storeconfig-tc7-0:0.0.1-7.Alpha3_redhat_12.5.ep6.el5", "product_name": "Red Hat JBoss Enterprise Web Server 2 for RHEL 5", "release_date": "2014-08-21T00:00:00Z"}, {"advisory": "RHSA-2014:1088", "cpe": "cpe:/a:redhat:jboss_enterprise_web_server:2::el5", "package": "tomcat6-0:6.0.41-6_patch_02.ep6.el5", "product_name": "Red Hat JBoss Enterprise Web Server 2 for RHEL 5", "release_date": "2014-08-21T00:00:00Z"}, {"advisory": "RHSA-2014:1088", "cpe": "cpe:/a:redhat:jboss_enterprise_web_server:2::el5", "package": "tomcat7-0:7.0.54-6_patch_02.ep6.el5", "product_name": "Red Hat JBoss Enterprise Web Server 2 for RHEL 5", "release_date": "2014-08-21T00:00:00Z"}, {"advisory": "RHSA-2014:1088", "cpe": "cpe:/a:redhat:jboss_enterprise_web_server:2::el5", "package": "tomcat-native-0:1.1.30-2.redhat_1.ep6.el5", "product_name": "Red Hat JBoss Enterprise Web Server 2 for RHEL 5", "release_date": "2014-08-21T00:00:00Z"}, {"advisory": "RHSA-2014:1087", "cpe": "cpe:/a:redhat:jboss_enterprise_web_server:2::el6", "package": "antlr-eap6-0:2.7.7-17.redhat_4.1.ep6.el6", "product_name": "Red Hat JBoss Enterprise Web Server 2 for RHEL 6", "release_date": "2014-08-21T00:00:00Z"}, {"advisory": "RHSA-2014:1087", "cpe": "cpe:/a:redhat:jboss_enterprise_web_server:2::el6", "package": "apache-commons-collections-eap6-0:3.2.1-15.redhat_3.1.ep6.el6", "product_name": "Red Hat JBoss Enterprise Web Server 2 for RHEL 6", "release_date": "2014-08-21T00:00:00Z"}, {"advisory": "RHSA-2014:1087", "cpe": "cpe:/a:redhat:jboss_enterprise_web_server:2::el6", "package": "apache-commons-daemon-eap6-1:1.0.15-5.redhat_1.ep6.el6", "product_name": "Red Hat JBoss Enterprise Web Server 2 for RHEL 6", "release_date": "2014-08-21T00:00:00Z"}, {"advisory": "RHSA-2014:1087", "cpe": "cpe:/a:redhat:jboss_enterprise_web_server:2::el6", "package": "apache-commons-daemon-jsvc-eap6-1:1.0.15-6.redhat_2.ep6.el6", "product_name": "Red Hat JBoss Enterprise Web Server 2 for RHEL 6", "release_date": "2014-08-21T00:00:00Z"}, {"advisory": "RHSA-2014:1087", "cpe": "cpe:/a:redhat:jboss_enterprise_web_server:2::el6", "package": "apache-commons-logging-eap6-0:1.1.1-7.9_redhat_1.ep6.el6", "product_name": "Red Hat JBoss Enterprise Web Server 2 for RHEL 6", "release_date": "2014-08-21T00:00:00Z"}, {"advisory": "RHSA-2014:1087", "cpe": "cpe:/a:redhat:jboss_enterprise_web_server:2::el6", "package": "apache-commons-pool-eap6-0:1.6-7.redhat_6.1.ep6.el6", "product_name": "Red Hat JBoss Enterprise Web Server 2 for RHEL 6", "release_date": "2014-08-21T00:00:00Z"}, {"advisory": "RHSA-2014:1087", "cpe": "cpe:/a:redhat:jboss_enterprise_web_server:2::el6", "package": "dom4j-eap6-0:1.6.1-20.redhat_6.1.ep6.el6", "product_name": "Red Hat JBoss Enterprise Web Server 2 for RHEL 6", "release_date": "2014-08-21T00:00:00Z"}, {"advisory": "RHSA-2014:1087", "cpe": "cpe:/a:redhat:jboss_enterprise_web_server:2::el6", "package": "ecj3-1:3.7.2-9.redhat_3.1.ep6.el6", "product_name": "Red Hat JBoss Enterprise Web Server 2 for RHEL 6", "release_date": "2014-08-21T00:00:00Z"}, {"advisory": "RHSA-2014:1087", "cpe": "cpe:/a:redhat:jboss_enterprise_web_server:2::el6", "package": "hibernate4-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6", "product_name": "Red Hat JBoss Enterprise Web Server 2 for RHEL 6", "release_date": "2014-08-21T00:00:00Z"}, {"advisory": "RHSA-2014:1087", "cpe": "cpe:/a:redhat:jboss_enterprise_web_server:2::el6", "package": "httpd-0:2.2.26-35.ep6.el6", "product_name": "Red Hat JBoss Enterprise Web Server 2 for RHEL 6", "release_date": "2014-08-21T00:00:00Z"}, {"advisory": "RHSA-2014:1087", "cpe": "cpe:/a:redhat:jboss_enterprise_web_server:2::el6", "package": "javassist-eap6-0:3.18.1-1.GA_redhat_1.1.ep6.el6", "product_name": "Red Hat JBoss Enterprise Web Server 2 for RHEL 6", "release_date": "2014-08-21T00:00:00Z"}, {"advisory": "RHSA-2014:1087", "cpe": "cpe:/a:redhat:jboss_enterprise_web_server:2::el6", "package": "jboss-logging-0:3.1.4-1.GA_redhat_1.1.ep6.el6", "product_name": "Red Hat JBoss Enterprise Web Server 2 for RHEL 6", "release_date": "2014-08-21T00:00:00Z"}, {"advisory": "RHSA-2014:1087", "cpe": "cpe:/a:redhat:jboss_enterprise_web_server:2::el6", "package": "jboss-transaction-api_1.1_spec-0:1.0.1-12.Final_redhat_2.2.ep6.el6", "product_name": "Red Hat JBoss Enterprise Web Server 2 for RHEL 6", "release_date": "2014-08-21T00:00:00Z"}, {"advisory": "RHSA-2014:1087", "cpe": "cpe:/a:redhat:jboss_enterprise_web_server:2::el6", "package": "mod_cluster-0:1.2.9-1.Final_redhat_1.1.ep6.el6", "product_name": "Red Hat JBoss Enterprise Web Server 2 for RHEL 6", "release_date": "2014-08-21T00:00:00Z"}, {"advisory": "RHSA-2014:1087", "cpe": "cpe:/a:redhat:jboss_enterprise_web_server:2::el6", "package": "mod_cluster-native-0:1.2.9-3.Final_redhat_2.ep6.el6", "product_name": "Red Hat JBoss Enterprise Web Server 2 for RHEL 6", "release_date": "2014-08-21T00:00:00Z"}, {"advisory": "RHSA-2014:1087", "cpe": "cpe:/a:redhat:jboss_enterprise_web_server:2::el6", "package": "mod_jk-0:1.2.40-2.redhat_1.ep6.el6", "product_name": "Red Hat JBoss Enterprise Web Server 2 for RHEL 6", "release_date": "2014-08-21T00:00:00Z"}, {"advisory": "RHSA-2014:1087", "cpe": "cpe:/a:redhat:jboss_enterprise_web_server:2::el6", "package": "mod_rt-0:2.4.1-6.GA.ep6.el6", "product_name": "Red Hat JBoss Enterprise Web Server 2 for RHEL 6", "release_date": "2014-08-21T00:00:00Z"}, {"advisory": "RHSA-2014:1087", "cpe": "cpe:/a:redhat:jboss_enterprise_web_server:2::el6", "package": "mod_snmp-0:2.4.1-13.GA.ep6.el6", "product_name": "Red Hat JBoss Enterprise Web Server 2 for RHEL 6", "release_date": "2014-08-21T00:00:00Z"}, {"advisory": "RHSA-2014:1087", "cpe": "cpe:/a:redhat:jboss_enterprise_web_server:2::el6", "package": "storeconfig-tc6-0:0.0.1-7.Alpha3_redhat_12.3.ep6.el6", "product_name": "Red Hat JBoss Enterprise Web Server 2 for RHEL 6", "release_date": "2014-08-21T00:00:00Z"}, {"advisory": "RHSA-2014:1087", "cpe": "cpe:/a:redhat:jboss_enterprise_web_server:2::el6", "package": "storeconfig-tc7-0:0.0.1-7.Alpha3_redhat_12.5.ep6.el6", "product_name": "Red Hat JBoss Enterprise Web Server 2 for RHEL 6", "release_date": "2014-08-21T00:00:00Z"}, {"advisory": "RHSA-2014:1087", "cpe": "cpe:/a:redhat:jboss_enterprise_web_server:2::el6", "package": "tomcat6-0:6.0.41-5_patch_02.ep6.el6", "product_name": "Red Hat JBoss Enterprise Web Server 2 for RHEL 6", "release_date": "2014-08-21T00:00:00Z"}, {"advisory": "RHSA-2014:1087", "cpe": "cpe:/a:redhat:jboss_enterprise_web_server:2::el6", "package": "tomcat7-0:7.0.54-6_patch_02.ep6.el6", "product_name": "Red Hat JBoss Enterprise Web Server 2 for RHEL 6", "release_date": "2014-08-21T00:00:00Z"}, {"advisory": "RHSA-2014:1087", "cpe": "cpe:/a:redhat:jboss_enterprise_web_server:2::el6", "package": "tomcat-native-0:1.1.30-2.redhat_1.ep6.el6", "product_name": "Red Hat JBoss Enterprise Web Server 2 for RHEL 6", "release_date": "2014-08-21T00:00:00Z"}, {"advisory": "RHSA-2015:0720", "cpe": "cpe:/a:redhat:jboss_fuse_service_works:6.0", "package": "jbossweb", "product_name": "Red Hat JBoss Fuse Service Works 6.0", "release_date": "2015-03-24T00:00:00Z"}, {"advisory": "RHSA-2015:1009", "cpe": "cpe:/a:redhat:jboss_enterprise_portal_platform:6.2", "package": "jbossweb", "product_name": "Red Hat JBoss Portal 6.2", "release_date": "2015-05-14T00:00:00Z"}, {"advisory": "RHSA-2014:1086", "cpe": "cpe:/a:redhat:jboss_enterprise_web_server:2.1", "package": "tomcat6", "product_name": "Red Hat JBoss Web Server 2.1", "release_date": "2014-08-21T00:00:00Z"}, {"advisory": "RHSA-2014:1086", "cpe": "cpe:/a:redhat:jboss_enterprise_web_server:2.1", "package": "tomcat7", "product_name": "Red Hat JBoss Web Server 2.1", "release_date": "2014-08-21T00:00:00Z"}], "bugzilla": {"description": "Tomcat/JBossWeb: XML parser hijack by malicious web application", "id": "1102038", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1102038"}, "csaw": false, "cvss": {"cvss_base_score": "2.1", "cvss_scoring_vector": "AV:N/AC:H/Au:S/C:P/I:N/A:N", "status": "verified"}, "cwe": "CWE-470", "details": ["Apache Tomcat before 6.0.40, 7.x before 7.0.54, and 8.x before 8.0.6 does not properly constrain the class loader that accesses the XML parser used with an XSLT stylesheet, which allows remote attackers to (1) read arbitrary files via a crafted web application that provides an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue, or (2) read files associated with different web applications on a single Tomcat instance via a crafted web application.", "It was found that, in certain circumstances, it was possible for a malicious web application to replace the XML parsers used by JBoss Web / Apache Tomcat to process XSLTs for the default servlet, JSP documents, tag library descriptors (TLDs), and tag plug-in configuration files. The injected XML parser(s) could then bypass the limits imposed on XML external entities and/or gain access to the XML files processed for other web applications deployed on the same JBoss Web / Apache Tomcat instance."], "name": "CVE-2014-0119", "package_state": [{"cpe": "cpe:/a:redhat:developer_toolset:2.0", "fix_state": "Not affected", "package_name": "devtoolset-2-tomcat", "product_name": "Red Hat Developer Toolset 2.0"}, {"cpe": "cpe:/o:redhat:enterprise_linux:5", "fix_state": "Will not fix", "package_name": "tomcat5", "product_name": "Red Hat Enterprise Linux 5"}, {"cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:5", "fix_state": "Will not fix", "package_name": "jbossweb", "product_name": "Red Hat JBoss Enterprise Application Platform 5"}, {"cpe": "cpe:/a:redhat:jboss_enterprise_web_server:1", "fix_state": "Will not fix", "package_name": "others", "product_name": "Red Hat JBoss Enterprise Web Server 1"}, {"cpe": "cpe:/a:redhat:jboss_enterprise_web_server:1", "fix_state": "Will not fix", "package_name": "tomcat5", "product_name": "Red Hat JBoss Enterprise Web Server 1"}, {"cpe": "cpe:/a:redhat:jboss_enterprise_web_server:1", "fix_state": "Will not fix", "package_name": "tomcat6", "product_name": "Red Hat JBoss Enterprise Web Server 1"}, {"cpe": "cpe:/a:redhat:jboss_operations_network:3", "fix_state": "Affected", "package_name": "jbossweb", "product_name": "Red Hat JBoss Operations Network 3"}], "public_date": "2014-05-27T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2014-0119\nhttps://nvd.nist.gov/vuln/detail/CVE-2014-0119"], "threat_severity": "Low", "upstream_fix": "jbossweb 7.4.7.Final, tomcat 7.0.54, tomcat 6.0.41"}