Security update for tomcat

Moderate: tomcat9 security update

Important: tomcat security update

Apache Tomcat DoS Via Requests Including Null Characters

Apache Tomcat XSS In Accept-Language Headers

Improper Neutralization of CRLF Sequences in HTTP Headers in Apache Tomcat

Apache Tomcat - Authentication Bypass

Apache Tomcat Discloses MS-DOS Pathname

Cross-site scripting (XSS) vulnerability in jsp/cal/cal2.jsp in the calendar application in the examples web application in Apache Tomcat on Red Hat Enterprise Linux 5, Desktop Workstation 5, and Linux Desktop 5 allows remote attackers to inject arbitrary web script or HTML via the time parameter, related to "invalid HTML." NOTE: this is due to a missing fix for CVE-2009-0781.

Apache Tomcat Allows Source Disclosure

Apache Tomcat Catalina is vulnerable to DoS attack through bypassing of size limits

Improper Input Validation in Apache Tomcat

Apache Tomcat Denial of Service vulnerability

Apache Tomcat Vulnerable to Relative Path Traversal

Apache Tomcat SendMailServlet XSS

The postinst script in the tomcat6 package before 6.0.45+dfsg-1~deb7u4 on Debian wheezy, before 6.0.35-1ubuntu3.9 on Ubuntu 12.04 LTS and on Ubuntu 14.04 LTS; the tomcat7 package before 7.0.28-4+deb7u8 on Debian wheezy, before 7.0.56-3+deb8u6 on Debian jessie, before 7.0.52-1ubuntu0.8 on Ubuntu 14.04 LTS, and on Ubuntu 12.04 LTS, 16.04 LTS, and 16.10; and the tomcat8 package before 8.0.14-1+deb8u5 on Debian jessie, before 8.0.32-1ubuntu1.3 on Ubuntu 16.04 LTS, before 8.0.37-1ubuntu0.1 on Ubuntu 16.10, and before 8.0.38-2ubuntu1 on Ubuntu 17.04 might allow local users with access to the tomcat account to obtain sensitive information or gain root privileges via a symlink attack on the Catalina localhost directory.

Apache Tomcat Reveals Directories

Denial of service in Apache Tomcat

Apache Tomcat - Security constraint bypass for pre/post-resources

Jakarta Tomcat Denial of Service vulnerability