Apache Tomcat before 6.0.40, 7.x before 7.0.54, and 8.x before 8.0.6 does not properly constrain the class loader that accesses the XML parser used with an XSLT stylesheet, which allows remote attackers to (1) read arbitrary files via a crafted web application that provides an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue, or (2) read files associated with different web applications on a single Tomcat instance via a crafted web application.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Apache Tomcat | — | Upgrade Apache Tomcat to 8.0.8Upgrade Apache Tomcat to the latest available versionUpgrade Apache Tomcat to 6.0.41Upgrade Apache Tomcat to 7.0.54 | May 31, 2014 | May 31, 2014 |
| Centos_linux | — | Upgrade tomcat-libUpgrade tomcat-javadocUpgrade tomcat-jsvcUpgrade tomcat-admin-webappsUpgrade tomcat-jsp-2.2-apiUpgrade tomcat6-admin-webappsUpgrade tomcat6Upgrade tomcat6-docs-webappUpgrade tomcat-webappsUpgrade tomcat6-jsp-2.1-apiUpgrade tomcat6-libUpgrade tomcat-docs-webappUpgrade tomcat-servlet-3.0-apiUpgrade tomcat-el-2.2-apiUpgrade tomcat6-servlet-2.5-apiUpgrade tomcat6-javadocUpgrade tomcatUpgrade tomcat6-el-2.1-apiUpgrade tomcat6-webapps | Dec 1, 2016 | May 31, 2014 |
| Debian | — | Upgrade tomcat6 | Mar 28, 2016 | May 31, 2014 |
| Gentoo Linux | — | Upgrade www-servers/tomcat. | Oct 30, 2017 | May 31, 2014 |
| Oracle Solaris | — | Upgrade web/java-servlet/tomcat/tomcat-examples to version 6.0.41-0.175.1.21.0.3.0 on Solaris 11.1Upgrade web/java-servlet/tomcat to version 6.0.41-0.175.1.21.0.3.0 on Solaris 11.1 | May 29, 2017 | May 31, 2014 |
| Oracle_linux | — | Upgrade tomcat6-el-2.1-apiUpgrade tomcat6-libUpgrade tomcat-jsvcUpgrade tomcat-libUpgrade tomcat6-servlet-2.5-apiUpgrade tomcat-servlet-3.0-apiUpgrade tomcat6-docs-webappUpgrade tomcat-webappsUpgrade tomcat6-jsp-2.1-apiUpgrade tomcatUpgrade tomcat6-admin-webappsUpgrade tomcat-jsp-2.2-apiUpgrade tomcat6Upgrade tomcat-el-2.2-apiUpgrade tomcat6-webappsUpgrade tomcat-admin-webappsUpgrade tomcat6-javadocUpgrade tomcat-docs-webappUpgrade tomcat-javadoc | Oct 16, 2024 | May 31, 2014 |
| Red Hat Jboss Eap | — | Upgrade Red Hat JBoss EAP to the latest version | Sep 19, 2024 | May 27, 2014 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | May 27, 2014 |
| Suse | — | Upgrade tomcat6-docs-webappUpgrade tomcat6-javadocUpgrade tomcat6-jsp-2_1-apiUpgrade tomcat6Upgrade tomcat6-admin-webappsUpgrade tomcat6-libUpgrade tomcat6-webappsUpgrade tomcat6-servlet-2_5-apiUpgrade libtcnative-1-0 | Dec 18, 2015 | May 31, 2014 |
| Ubuntu | — | Upgrade libtomcat7-java | Nov 8, 2024 | May 31, 2014 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub