git: e021f7c2c5cb - main - security/vuxml: document tomcat vulnerabilities
Date: Thu, 10 Jul 2025 21:25:14 UTC
The branch main has been updated by osa:
URL: https://cgit.FreeBSD.org/ports/commit/?id=e021f7c2c5cb428f54e3590d8889ce6fec957163
commit e021f7c2c5cb428f54e3590d8889ce6fec957163
Author: Sergey A. Osokin <osa@FreeBSD.org>
AuthorDate: 2025-07-10 21:24:29 +0000
Commit: Sergey A. Osokin <osa@FreeBSD.org>
CommitDate: 2025-07-10 21:24:29 +0000
security/vuxml: document tomcat vulnerabilities
---
security/vuxml/vuln/2025.xml | 52 ++++++++++++++++++++++++++++++++++++++++++++
1 file changed, 52 insertions(+)
diff --git a/security/vuxml/vuln/2025.xml b/security/vuxml/vuln/2025.xml
index c20a0f078021..07388fa47184 100644
--- a/security/vuxml/vuln/2025.xml
+++ b/security/vuxml/vuln/2025.xml
@@ -1,3 +1,55 @@
+ <vuln vid="ef87346f-5dd0-11f0-beb2-ac5afc632ba3">
+ <topic>Apache Tomcat -- Multiple Vulnerabilities</topic>
+ <affects>
+ <package>
+ <name>tomcat110</name>
+ <range><gt>11.0.0</gt></range>
+ <range><lt>11.0.9</lt></range>
+ </package>
+ <package>
+ <name>tomcat101</name>
+ <range><gt>10.1.0</gt></range>
+ <range><lt>10.1.43</lt></range>
+ </package>
+ <package>
+ <name>tomcat9</name>
+ <range><gt>9.0.0</gt></range>
+ <range><lt>9.0.107</lt></range>
+ </package>
+ </affects>
+ <description>
+ <body xmlns="http://www.w3.org/1999/xhtml">
+ <p>security@apache.org reports:</p>
+ <blockquote cite="https://www.mail-archive.com/announce@tomcat.apache.org/msg00710.html">
+ <p>A race condition on connection close could trigger a JVM crash when using the
+ APR/Native connector leading to a DoS. This was particularly noticeable with client
+ initiated closes of HTTP/2 connections.</p>
+ </blockquote>
+ <blockquote cite="https://www.mail-archive.com/announce@tomcat.apache.org/msg00713.html">
+ <p>An uncontrolled resource consumption vulnerability if an HTTP/2 client did not
+ acknowledge the initial settings frame that reduces the maximum permitted
+ concurrent streams could result in a DoS.</p>
+ </blockquote>
+ <blockquote cite="https://www.mail-archive.com/announce@tomcat.apache.org/msg00714.html">
+ <p>For some unlikely configurations of multipart upload, an Integer Overflow
+ vulnerability could lead to a DoS via bypassing of size limits.</p>
+ </blockquote>
+ </body>
+ </description>
+ <references>
+ <cvename>CVE-2025-52434</cvename>
+ <url>https://nvd.nist.gov/vuln/detail/CVE-2025-52434</url>
+ <cvename>CVE-2025-52520</cvename>
+ <url>https://nvd.nist.gov/vuln/detail/CVE-2025-52520</url>
+ <cvename>CVE-2025-53506</cvename>
+ <url>https://nvd.nist.gov/vuln/detail/CVE-2025-53506</url>
+ </references>
+ <dates>
+ <discovery>2025-07-10</discovery>
+ <entry>2025-07-10</entry>
+ </dates>
+ </vuln>
+
<vuln vid="20823cc0-5d45-11f0-966e-2cf05da270f3">
<topic>Gitlab -- vulnerabilities</topic>
<affects>