Vulnerability Name:

CVE-2008-2938 (CCN-44411)

Assigned:2008-08-11
Published:2008-08-11
Updated:2023-02-13
Summary:Directory traversal vulnerability in Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16, when allowLinking and UTF-8 are enabled, allows remote attackers to read arbitrary files via encoded directory traversal sequences in the URI, a different vulnerability than CVE-2008-2370.
Note: versions earlier than 6.0.18 were reported affected, but the vendor advisory lists 6.0.16 as the last affected version.
CVSS v3 Severity:5.3 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): Low
Integrity (I): None
Availibility (A): None
CVSS v2 Severity:4.3 Medium (CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:N/A:N)
3.7 Low (Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:N/A:N/E:H/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Medium
Authentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): None
Availibility (A): None
4.3 Medium (CCN CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:N/A:N)
3.7 Low (CCN Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:N/A:N/E:H/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Medium
Athentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): None
Availibility (A): None
Vulnerability Consequences:Obtain Information
References:Source: CCN
Type: BugTraq Mailing List, Mon Aug 11 2008 - 03:52:44 CDT
Apache Tomcat <= 6.0.18 UTF8 Directory Traversal Vulnerability

Source: CCN
Type: BugTraq Mailing List, Thu Dec 18 2008 - 10:46:17 CST
[SECURITY] CVE-2008-2938 - Apache Tomcat information disclosure vulnerability - Update 2

Source: CCN
Type: BugTraq Mailing List, Mon Jan 19 2009 - 22:56:32 CST
Oracle Containers For Java Directory Traversal (OC4J) Oracle Application Server 10g (10.1.3.1.0) Oracle HTTP Server

Source: MITRE
Type: CNA
CVE-2008-2938

Source: CCN
Type: HP Security Bulletin HPSBUX02401 SSRT090005 rev.1
HP-UX Running Apache Web Server Suite, Remote Denial of Service (DoS), Cross-site Scripting (XSS), Execution of Arbitrary Code, Cross-Site Request Forgery (CSRF)

Source: secalert@redhat.com
Type: Mailing List, Third Party Advisory
secalert@redhat.com

Source: secalert@redhat.com
Type: Third Party Advisory
secalert@redhat.com

Source: secalert@redhat.com
Type: Third Party Advisory
secalert@redhat.com

Source: secalert@redhat.com
Type: Third Party Advisory
secalert@redhat.com

Source: CCN
Type: RHSA-2008-0648
Important: tomcat security update

Source: CCN
Type: RHSA-2008-0862
Important: tomcat security update

Source: CCN
Type: RHSA-2008-0864
Important: tomcat security update

Source: CCN
Type: RHSA-2008-0877
Important: jbossweb security update

Source: CCN
Type: RHSA-2008-1007
Low: tomcat security update for Red Hat Network Satellite Server

Source: CCN
Type: SA32222
Apple Mac OS X Security Update Fixes Multiple Vulnerabilities

Source: CCN
Type: SA32266
Avaya AES / MX Apache Tomcat Multiple Vulnerabilities

Source: CCN
Type: SA37297
ToutVirtual VirtualIQ Pro Multiple Vulnerabilities

Source: CCN
Type: SA40425
Novell ZENworks Linux Management Tomcat Multiple Vulnerabilities

Source: CCN
Type: SA41889
Fujitsu Interstage Products Directory Traversal Vulnerability

Source: secalert@redhat.com
Type: Third Party Advisory
secalert@redhat.com

Source: CCN
Type: SECTRACK ID: 1020665
Tomcat UTF-8 'AllowLinking' Java Bug Lets Remote Users Traverse the Directory

Source: CCN
Type: Apple Web site
About Security Update 2008-007

Source: secalert@redhat.com
Type: Third Party Advisory
secalert@redhat.com

Source: CCN
Type: ASA-2008-390
tomcat security update (RHSA-2008-0864)

Source: secalert@redhat.com
Type: Third Party Advisory
secalert@redhat.com

Source: CCN
Type: ASA-2008-401
tomcat security update (RHSA-2008-0862)

Source: CCN
Type: ASA-2009-061
HPSBUX02401 SSRT090005 rev.2 - HP-UX Running Apache Web Server SuiteRemote Denial of Service (DoS) Cross-site Scripting (XSS) Execution of Arbitrary Code Cross-Site Request Forgery (CSRF)

Source: CCN
Type: Apache Tomcat Web site
Apache Tomcat 6 Downloads

Source: secalert@redhat.com
Type: Vendor Advisory
secalert@redhat.com

Source: secalert@redhat.com
Type: Vendor Advisory
secalert@redhat.com

Source: CCN
Type: Apache Tomcat Security Web site
Fixed in Apache Tomcat 6.0.18

Source: secalert@redhat.com
Type: Vendor Advisory
secalert@redhat.com

Source: CCN
Type: US-CERT VU#343355
Apache Tomcat UTF8 Directory Traversal Vulnerability

Source: secalert@redhat.com
Type: Third Party Advisory, US Government Resource
secalert@redhat.com

Source: secalert@redhat.com
Type: Third Party Advisory
secalert@redhat.com

Source: CCN
Type: Novell Document ID: 7006398
Tomcat 5.0.28 in ZLM 7.3 subject to "Multiple Vendor Multiple HTTP Request Smuggling Vulnerabilities"

Source: secalert@redhat.com
Type: Third Party Advisory
secalert@redhat.com

Source: secalert@redhat.com
Type: Third Party Advisory
secalert@redhat.com

Source: secalert@redhat.com
Type: Third Party Advisory
secalert@redhat.com

Source: secalert@redhat.com
Type: Third Party Advisory
secalert@redhat.com

Source: secalert@redhat.com
Type: Third Party Advisory, VDB Entry
secalert@redhat.com

Source: secalert@redhat.com
Type: Third Party Advisory, VDB Entry
secalert@redhat.com

Source: CCN
Type: BID-30633
Multiple Java Runtime Implementations UTF-8 Input Validation Vulnerability

Source: secalert@redhat.com
Type: Third Party Advisory, VDB Entry
secalert@redhat.com

Source: CCN
Type: BID-31681
RETIRED: Apple Mac OS X 2008-007 Multiple Security Vulnerabilities

Source: secalert@redhat.com
Type: Third Party Advisory, VDB Entry
secalert@redhat.com

Source: secalert@redhat.com
Type: Third Party Advisory, VDB Entry
secalert@redhat.com

Source: secalert@redhat.com
Type: Third Party Advisory
secalert@redhat.com

Source: secalert@redhat.com
Type: Third Party Advisory
secalert@redhat.com

Source: secalert@redhat.com
Type: Third Party Advisory
secalert@redhat.com

Source: secalert@redhat.com
Type: Third Party Advisory
secalert@redhat.com

Source: secalert@redhat.com
Type: Third Party Advisory, VDB Entry
secalert@redhat.com

Source: XF
Type: UNKNOWN
tomcat-allowlinking-utf8-directory-traversal(44411)

Source: secalert@redhat.com
Type: UNKNOWN
secalert@redhat.com

Source: secalert@redhat.com
Type: UNKNOWN
secalert@redhat.com

Source: secalert@redhat.com
Type: UNKNOWN
secalert@redhat.com

Source: secalert@redhat.com
Type: Tool Signature
secalert@redhat.com

Source: EXPLOIT-DB
Type: EXPLOIT
Offensive Security Exploit Database [07-28-2010]

Source: secalert@redhat.com
Type: Third Party Advisory, VDB Entry
secalert@redhat.com

Source: secalert@redhat.com
Type: Third Party Advisory
secalert@redhat.com

Source: secalert@redhat.com
Type: Third Party Advisory
secalert@redhat.com

Source: secalert@redhat.com
Type: Third Party Advisory
secalert@redhat.com

Source: SUSE
Type: SUSE-SR:2008:018
SUSE Security Summary Report

Source: SUSE
Type: SUSE-SR:2009:004
SUSE Security Summary Report

Vulnerable Configuration:Configuration RedHat 1:
  • cpe:/o:redhat:enterprise_linux:5:*:*:*:*:*:*:*
    • Configuration RedHat 2:
  • cpe:/o:redhat:enterprise_linux:5::client:*:*:*:*:*
    • Configuration RedHat 3:
  • cpe:/o:redhat:enterprise_linux:5::client_workstation:*:*:*:*:*
    • Configuration RedHat 4:
  • cpe:/o:redhat:enterprise_linux:5::server:*:*:*:*:*

    • Configuration CCN 1:
  • cpe:/a:apache:tomcat:6.0.0:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:6.0.1:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:6.0.10:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:6.0.11:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:6.0.12:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:6.0.13:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:6.0.14:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:6.0.15:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:6.0.2:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:6.0.3:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:6.0.4:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:6.0.5:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:6.0.6:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:6.0.7:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:6.0.8:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:6.0.9:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:6.0.16:*:*:*:*:*:*:*
  • AND
  • cpe:/o:hp:hp-ux:b.11.11:*:*:*:*:*:*:*
  • OR cpe:/o:hp:hp-ux:b.11.23:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:5:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:5:*:client_workstation:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux:2008.0:*:x86-64:*:*:*:*:*
  • OR cpe:/o:hp:hp-ux:b.11.31:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:5:*:client:*:*:*:*:*
  • OR cpe:/a:redhat:rhel_developer_suite:3:*:*:*:*:*:*:*
  • OR cpe:/a:redhat:rhel_application_server:2:*:*:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux:2008.0:*:*:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux:2008.1:x86_64:*:*:*:*:*:*
  • OR cpe:/o:apple:mac_os_x_server:10.5:*:*:*:*:*:*:*
  • OR cpe:/o:apple:mac_os_x_server:10.5.1:*:*:*:*:*:*:*
  • OR cpe:/o:apple:mac_os_x_server:10.5.2:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:application_server:10.1.3.1.0:*:*:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux:2008.1:*:*:*:*:*:*:*
  • OR cpe:/o:apple:mac_os_x_server:10.5.3:*:*:*:*:*:*:*
  • OR cpe:/o:apple:mac_os_x_server:10.5.4:*:*:*:*:*:*:*
  • OR cpe:/o:apple:mac_os_x_server:10.5.5:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.opensuse.security:def:20082938
    V
    		CVE-2008-2938
    2022-05-22
    oval:org.opensuse.security:def:26227
    P
    		Security update for the Linux Kernel (Important)
    2022-01-13
    oval:org.opensuse.security:def:31756
    P
    		Security update for apache2 (Important)
    2022-01-12
    oval:org.opensuse.security:def:32290
    P
    		Security update for apache2 (Important)
    2022-01-12
    oval:org.opensuse.security:def:42242
    P
    		Security update for the Linux Kernel (Important)
    2021-12-06
    oval:org.opensuse.security:def:32229
    P
    		Security update for ruby2.1 (Important)
    2021-12-01
    oval:org.opensuse.security:def:26174
    P
    		Security update for openexr (Moderate)
    2021-12-01
    oval:org.opensuse.security:def:31314
    P
    		Security update for xen (Moderate)
    2021-12-01
    oval:org.opensuse.security:def:32232
    P
    		Security update for webkit2gtk3 (Important)
    2021-12-01
    oval:org.opensuse.security:def:31303
    P
    		Security update for the Linux Kernel (Live Patch 37 for SLE 12 SP3) (Important)
    2021-11-19
    oval:org.opensuse.security:def:31302
    P
    		Security update for the Linux Kernel (Live Patch 36 for SLE 12 SP3) (Important)
    2021-11-19
    oval:org.opensuse.security:def:26161
    P
    		Security update for samba (Important)
    2021-11-10
    oval:org.opensuse.security:def:33011
    P
    		Security update for hivex (Moderate)
    2021-09-23
    oval:org.opensuse.security:def:26117
    P
    		Security update for xen (Important)
    2021-09-02
    oval:org.opensuse.security:def:32180
    P
    		Security update for file (Important)
    2021-09-02
    oval:org.opensuse.security:def:31669
    P
    		Security update for cpio (Important)
    2021-08-23
    oval:org.opensuse.security:def:26103
    P
    		Security update for the Linux Kernel (Important)
    2021-08-10
    oval:org.opensuse.security:def:32972
    P
    		Security update for webkit2gtk3 (Important)
    2021-08-03
    oval:org.opensuse.security:def:32145
    P
    		Security update for the Linux Kernel (Live Patch 37 for SLE 12 SP3) (Important)
    2021-07-21
    oval:org.opensuse.security:def:32124
    P
    		Security update for the Linux Kernel (Live Patch 39 for SLE 12 SP3) (Important)
    2021-06-18
    oval:org.opensuse.security:def:32122
    P
    		Security update for apache2 (Important)
    2021-06-17
    oval:org.opensuse.security:def:42719
    P
    		tomcat6-6.0.41-0.43.1 on GA media (Moderate)
    2021-06-08
    oval:org.opensuse.security:def:36312
    P
    		tomcat6-6.0.41-0.43.1 on GA media (Moderate)
    2021-06-08
    oval:org.opensuse.security:def:26065
    P
    		Security update for polkit (Important)
    2021-06-03
    oval:org.opensuse.security:def:26064
    P
    		Security update for libwebp (Critical)
    2021-06-02
    oval:org.opensuse.security:def:32088
    P
    		Security update for bind (Important)
    2021-05-04
    oval:org.opensuse.security:def:32078
    P
    		Security update for the Linux Kernel (Live Patch 37 for SLE 12 SP3) (Important)
    2021-04-28
    oval:org.opensuse.security:def:31612
    P
    		Security update for gdm (Important)
    2021-04-28
    oval:org.opensuse.security:def:26203
    P
    		Security update for openldap2 (Important)
    2021-03-03
    oval:org.opensuse.security:def:32268
    P
    		Security update for openldap2 (Important)
    2021-03-03
    oval:org.opensuse.security:def:31732
    P
    		Security update for krb5-appl (Important)
    2021-02-19
    oval:org.opensuse.security:def:26146
    P
    		Security update for python3 (Important)
    2021-02-08
    oval:org.opensuse.security:def:35835
    P
    		tomcat6-6.0.18-20.35.36.1 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:42455
    P
    		tomcat6-6.0.18-20.35.40.1 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:36048
    P
    		tomcat6-6.0.18-20.35.40.1 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:31526
    P
    		Security update for rsyslog (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25962
    P
    		Security update for mariadb (Important)
    2020-12-01
    oval:org.opensuse.security:def:26593
    P
    		libnetpbm10 on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25861
    P
    		Security update for the Linux Kernel (Important)
    2020-12-01
    oval:org.opensuse.security:def:31824
    P
    		Security update for bash (Low)
    2020-12-01
    oval:org.opensuse.security:def:26315
    P
    		Security update for MozillaThunderbird (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:31520
    P
    		Security update for rpcbind (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:27310
    P
    		tomcat6 on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25937
    P
    		Security update for the Linux Kernel (Important)
    2020-12-01
    oval:org.opensuse.security:def:27011
    P
    		perl-32bit on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25609
    P
    		Security update for sysstat (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25386
    P
    		Security update for the Linux Kernel (Important)
    2020-12-01
    oval:org.opensuse.security:def:32532
    P
    		java-1_4_2-ibm on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25882
    P
    		Security update for python-tornado (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25589
    P
    		Security update for zabbix (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:26491
    P
    		Security update for nextcloud (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:33236
    P
    		ppc64-diag on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:31790
    P
    		Security update for MozillaFirefox (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:32334
    P
    		Security update for samba (Important)
    2020-12-01
    oval:org.opensuse.security:def:31515
    P
    		Security update for quagga (Low)
    2020-12-01
    oval:org.opensuse.security:def:25811
    P
    		Security update for libvirt (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:26579
    P
    		libMagickCore1-32bit on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:26276
    P
    		Security update for python (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:32799
    P
    		tomcat6 on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:31388
    P
    		Security update for openwsman (Important)
    2020-12-01
    oval:org.opensuse.security:def:32388
    P
    		Security update for tomcat6 (Important)
    2020-12-01
    oval:org.opensuse.security:def:27275
    P
    		pure-ftpd on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25873
    P
    		Security update for libcares2 (Low)
    2020-12-01
    oval:org.opensuse.security:def:31968
    P
    		Security update for ipmitool (Important)
    2020-12-01
    oval:org.opensuse.security:def:26373
    P
    		Security update for ffmpeg (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25598
    P
    		Security update for curl (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25385
    P
    		Security update for MozillaFirefox (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:32493
    P
    		bzip2 on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25801
    P
    		Security update for libvdpau (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:26834
    P
    		tomcat6 on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25461
    P
    		Security update for cpio (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:26438
    P
    		Security update for ansible (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:32598
    P
    		python on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:31779
    P
    		Security update for MozillaFirefox (Important)
    2020-12-01
    oval:org.opensuse.security:def:26023
    P
    		Security update for evince (Important)
    2020-12-01
    oval:org.opensuse.security:def:31514
    P
    		Security update for quagga (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25727
    P
    		Security update for libzypp (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:32056
    P
    		Security update for kvm (Important)
    2020-12-01
    oval:org.opensuse.security:def:31996
    P
    		Security update for java-1_7_1-ibm (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:26540
    P
    		enscript on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:31600
    P
    		Security update for tightvnc (Important)
    2020-12-01
    oval:org.opensuse.security:def:26015
    P
    		Security update for libplist (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:32760
    P
    		opie on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:26637
    P
    		ruby on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25862
    P
    		Recommended update for mariadb (Important)
    2020-12-01
    oval:org.opensuse.security:def:31881
    P
    		Security update for dnsmasq (Important)
    2020-12-01
    oval:org.opensuse.security:def:26329
    P
    		Security update for znc (Low)
    2020-12-01
    oval:org.opensuse.security:def:25597
    P
    		Security update for squid (Critical)
    2020-12-01
    oval:org.opensuse.security:def:32444
    P
    		Security update for xen (Important)
    2020-12-01
    oval:org.opensuse.security:def:27046
    P
    		tomcat6 on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25673
    P
    		Security update for openldap2 (Important)
    2020-12-01
    oval:org.opensuse.security:def:31912
    P
    		Security update for gcc43 (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:26799
    P
    		pam_mount on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25397
    P
    		Security update for java-1_7_0-openjdk (Important)
    2020-12-01
    oval:org.opensuse.security:def:26287
    P
    		Security update for zeromq (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:32554
    P
    		libltdl7 on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:31778
    P
    		Security update for MozillaFirefox (Important)
    2020-12-01
    oval:org.opensuse.security:def:25939
    P
    		Security update for gstreamer-0_10-plugins-base (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25670
    P
    		Security update for ucode-intel (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:32017
    P
    		Security update for the Linux Kernel (Important)
    2020-12-01
    oval:org.opensuse.security:def:33275
    P
    		tomcat6 on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:31864
    P
    		Security update for curl (Moderate)
    2020-12-01
    oval:org.mitre.oval:def:28407
    P
    		RHSA-2008:0648 -- tomcat security update (Important)
    2015-08-17
    oval:org.mitre.oval:def:21729
    P
    		ELSA-2008:0648: tomcat security update (Important)
    2014-05-26
    oval:org.mitre.oval:def:10587
    V
    		Directory traversal vulnerability in Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16, when allowLinking and UTF-8 are enabled, allows remote attackers to read arbitrary files via encoded directory traversal sequences in the URI, a different vulnerability than CVE-2008-2370. NOTE: versions earlier than 6.0.18 were reported affected, but the vendor advisory lists 6.0.16 as the last affected version.
    2013-04-29
    oval:com.redhat.rhsa:def:20080648
    P
    		RHSA-2008:0648: tomcat security update (Important)
    2008-08-27
    BACK
    apache tomcat 6.0.0
    apache tomcat 6.0.1
    apache tomcat 6.0.10
    apache tomcat 6.0.11
    apache tomcat 6.0.12
    apache tomcat 6.0.13
    apache tomcat 6.0.14
    apache tomcat 6.0.15
    apache tomcat 6.0.2
    apache tomcat 6.0.3
    apache tomcat 6.0.4
    apache tomcat 6.0.5
    apache tomcat 6.0.6
    apache tomcat 6.0.7
    apache tomcat 6.0.8
    apache tomcat 6.0.9
    apache tomcat 6.0.16
    hp hp-ux b.11.11
    hp hp-ux b.11.23
    redhat enterprise linux 5
    redhat enterprise linux 5
    mandrakesoft mandrake linux 2008.0
    hp hp-ux b.11.31
    redhat enterprise linux 5
    redhat rhel developer suite 3
    redhat rhel application server 2
    mandrakesoft mandrake linux 2008.0
    mandrakesoft mandrake linux 2008.1 x86_64
    apple mac os x server 10.5
    apple mac os x server 10.5.1
    apple mac os x server 10.5.2
    oracle application server 10.1.3.1.0
    mandrakesoft mandrake linux 2008.1
    apple mac os x server 10.5.3
    apple mac os x server 10.5.4
    apple mac os x server 10.5.5