Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

SUSE-SU-2025:02745-1

Опубликовано: 11 авг. 2025
Источник: suse-cvrf

Описание

Security update for tomcat

This update for tomcat fixes the following issues:

  • CVE-2025-52520: Fixed integer overflow can lead to DoS for some unlikely configurations of multipart upload (bsc#1246388)
  • CVE-2025-53506: Fixed uncontrolled resource HTTP/2 client consumption vulnerability (bsc#1246318)

Список пакетов

SUSE Linux Enterprise Server LTSS Extended Security 12 SP5
tomcat-9.0.36-3.148.1
tomcat-admin-webapps-9.0.36-3.148.1
tomcat-docs-webapp-9.0.36-3.148.1
tomcat-el-3_0-api-9.0.36-3.148.1
tomcat-javadoc-9.0.36-3.148.1
tomcat-jsp-2_3-api-9.0.36-3.148.1
tomcat-lib-9.0.36-3.148.1
tomcat-servlet-4_0-api-9.0.36-3.148.1
tomcat-webapps-9.0.36-3.148.1

Ссылки

Описание

For some unlikely configurations of multipart upload, an Integer Overflow vulnerability in Apache Tomcat could lead to a DoS via bypassing of size limits. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.8, from 10.1.0-M1 through 10.1.42, from 9.0.0.M1 through 9.0.106. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 through 8.5.100. Other, older, EOL versions may also be affected. Users are recommended to upgrade to version 11.0.9, 10.1.43 or 9.0.107, which fix the issue.

Затронутые продукты
SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:tomcat-9.0.36-3.148.1
SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:tomcat-admin-webapps-9.0.36-3.148.1
SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:tomcat-docs-webapp-9.0.36-3.148.1
SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:tomcat-el-3_0-api-9.0.36-3.148.1
Ссылки

Описание

Uncontrolled Resource Consumption vulnerability in Apache Tomcat if an HTTP/2 client did not acknowledge the initial settings frame that reduces the maximum permitted concurrent streams. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.8, from 10.1.0-M1 through 10.1.42, from 9.0.0.M1 through 9.0.106. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 through 8.5.100. Users are recommended to upgrade to version 11.0.9, 10.1.43 or 9.0.107, which fix the issue.

Затронутые продукты
SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:tomcat-9.0.36-3.148.1
SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:tomcat-admin-webapps-9.0.36-3.148.1
SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:tomcat-docs-webapp-9.0.36-3.148.1
SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:tomcat-el-3_0-api-9.0.36-3.148.1
Ссылки