7.8

CVE-2016-3092

The MultipartStream class in Apache Commons Fileupload before 1.3.2, as used in Apache Tomcat 7.x before 7.0.70, 8.x before 8.0.36, 8.5.x before 8.5.3, and 9.x before 9.0.0.M7 and other products, allows remote attackers to cause a denial of service (CPU consumption) via a long boundary string.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Hp ≫ Icewall Identity Manager Version 5.0
Hp ≫ Icewall Sso Agent Option Version 10.0
Apache ≫ Tomcat Version 9.0.0 Update milestone1
Apache ≫ Tomcat Version 9.0.0 Update milestone3
Apache ≫ Tomcat Version 9.0.0 Update milestone4
Apache ≫ Tomcat Version 9.0.0 Update milestone6
Apache ≫ Tomcat Version 8.0.0 Update rc1
Apache ≫ Tomcat Version 8.0.0 Update rc10
Apache ≫ Tomcat Version 8.0.0 Update rc2
Apache ≫ Tomcat Version 8.0.0 Update rc5
Apache ≫ Tomcat Version 8.0.1
Apache ≫ Tomcat Version 8.0.3
Apache ≫ Tomcat Version 8.0.5
Apache ≫ Tomcat Version 8.0.8
Apache ≫ Tomcat Version 8.0.11
Apache ≫ Tomcat Version 8.0.12
Apache ≫ Tomcat Version 8.0.14
Apache ≫ Tomcat Version 8.0.15
Apache ≫ Tomcat Version 8.0.17
Apache ≫ Tomcat Version 8.0.18
Apache ≫ Tomcat Version 8.0.20
Apache ≫ Tomcat Version 8.0.21
Apache ≫ Tomcat Version 8.0.22
Apache ≫ Tomcat Version 8.0.23
Apache ≫ Tomcat Version 8.0.24
Apache ≫ Tomcat Version 8.0.26
Apache ≫ Tomcat Version 8.0.27
Apache ≫ Tomcat Version 8.0.28
Apache ≫ Tomcat Version 8.0.29
Apache ≫ Tomcat Version 8.0.30
Apache ≫ Tomcat Version 8.0.32
Apache ≫ Tomcat Version 8.0.33
Apache ≫ Tomcat Version 8.0.35
Debian ≫ Debian Linux Version 8.0
Apache ≫ Tomcat Version 8.5.0
Apache ≫ Tomcat Version 8.5.2
Apache ≫ Commons Fileupload Version <= 1.3.1
Canonical ≫ Ubuntu Linux Version 12.04 SwEdition lts
Canonical ≫ Ubuntu Linux Version 14.04 SwEdition lts
Canonical ≫ Ubuntu Linux Version 15.10
Canonical ≫ Ubuntu Linux Version 16.04 SwEdition lts
Apache ≫ Tomcat Version 7.0.0
Apache ≫ Tomcat Version 7.0.0 Update beta
Apache ≫ Tomcat Version 7.0.1
Apache ≫ Tomcat Version 7.0.2
Apache ≫ Tomcat Version 7.0.2 Update beta
Apache ≫ Tomcat Version 7.0.4
Apache ≫ Tomcat Version 7.0.4 Update beta
Apache ≫ Tomcat Version 7.0.5
Apache ≫ Tomcat Version 7.0.5 Update beta
Apache ≫ Tomcat Version 7.0.6
Apache ≫ Tomcat Version 7.0.8
Apache ≫ Tomcat Version 7.0.10
Apache ≫ Tomcat Version 7.0.11
Apache ≫ Tomcat Version 7.0.12
Apache ≫ Tomcat Version 7.0.14
Apache ≫ Tomcat Version 7.0.16
Apache ≫ Tomcat Version 7.0.19
Apache ≫ Tomcat Version 7.0.20
Apache ≫ Tomcat Version 7.0.21
Apache ≫ Tomcat Version 7.0.22
Apache ≫ Tomcat Version 7.0.23
Apache ≫ Tomcat Version 7.0.25
Apache ≫ Tomcat Version 7.0.26
Apache ≫ Tomcat Version 7.0.27
Apache ≫ Tomcat Version 7.0.28
Apache ≫ Tomcat Version 7.0.29
Apache ≫ Tomcat Version 7.0.30
Apache ≫ Tomcat Version 7.0.32
Apache ≫ Tomcat Version 7.0.33
Apache ≫ Tomcat Version 7.0.34
Apache ≫ Tomcat Version 7.0.35
Apache ≫ Tomcat Version 7.0.37
Apache ≫ Tomcat Version 7.0.39
Apache ≫ Tomcat Version 7.0.40
Apache ≫ Tomcat Version 7.0.41
Apache ≫ Tomcat Version 7.0.42
Apache ≫ Tomcat Version 7.0.47
Apache ≫ Tomcat Version 7.0.50
Apache ≫ Tomcat Version 7.0.52
Apache ≫ Tomcat Version 7.0.53
Apache ≫ Tomcat Version 7.0.54
Apache ≫ Tomcat Version 7.0.55
Apache ≫ Tomcat Version 7.0.56
Apache ≫ Tomcat Version 7.0.57
Apache ≫ Tomcat Version 7.0.59
Apache ≫ Tomcat Version 7.0.61
Apache ≫ Tomcat Version 7.0.62
Apache ≫ Tomcat Version 7.0.63
Apache ≫ Tomcat Version 7.0.64
Apache ≫ Tomcat Version 7.0.65
Apache ≫ Tomcat Version 7.0.67
Apache ≫ Tomcat Version 7.0.68
Apache ≫ Tomcat Version 7.0.69
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 35.93% 0.983
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 7.5 3.9 3.6
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NIST 7.8 10 6.9
AV:N/AC:L/Au:N/C:N/I:N/A:C
CISA-ADP 7.5 3.9 3.6
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html
http://tomcat.apache.org/security-7.html
Vendor Advisory
http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html
http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html
https://security.gentoo.org/glsa/202107-39
http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html
http://tomcat.apache.org/security-8.html
Vendor Advisory
https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html
https://www.oracle.com/security-alerts/cpuapr2020.html
http://www.debian.org/security/2016/dsa-3609
Third Party Advisory
https://security.gentoo.org/glsa/201705-09
http://tomcat.apache.org/security-9.html
Vendor Advisory
http://lists.opensuse.org/opensuse-updates/2016-09/msg00025.html
http://svn.apache.org/viewvc?view=revision&revision=1743480
http://svn.apache.org/viewvc?view=revision&revision=1743722
Vendor Advisory
http://svn.apache.org/viewvc?view=revision&revision=1743738
Vendor Advisory
http://svn.apache.org/viewvc?view=revision&revision=1743742
Vendor Advisory
http://www.debian.org/security/2016/dsa-3611
Third Party Advisory
http://www.debian.org/security/2016/dsa-3614
Third Party Advisory
http://www.securityfocus.com/bid/91453
Third Party Advisory
VDB Entry
http://www.securitytracker.com/id/1036427
http://www.securitytracker.com/id/1036900
http://www.securitytracker.com/id/1037029
http://www.securitytracker.com/id/1039606
https://bugzilla.redhat.com/show_bug.cgi?id=1349468
Issue Tracking
https://security.netapp.com/advisory/ntap-20190212-0001/
https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708%40%3Cdev.tomcat.apache.org%3E
https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E
http://rhn.redhat.com/errata/RHSA-2017-0457.html
https://access.redhat.com/errata/RHSA-2017:0455
https://access.redhat.com/errata/RHSA-2017:0456
https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551%40%3Cdev.tomcat.apache.org%3E
http://jvn.jp/en/jp/JVN89379547/index.html
Vendor Advisory
http://jvndb.jvn.jp/jvndb/JVNDB-2016-000121
Vendor Advisory
VDB Entry
http://mail-archives.apache.org/mod_mbox/commons-dev/201606.mbox/%3CCAF8HOZ%2BPq2QH8RnxBuJyoK1dOz6jrTiQypAC%2BH8g6oZkBg%2BCxg%40mail.gmail.com%3E
Mailing List
http://rhn.redhat.com/errata/RHSA-2016-2068.html
http://rhn.redhat.com/errata/RHSA-2016-2069.html
http://rhn.redhat.com/errata/RHSA-2016-2070.html
http://rhn.redhat.com/errata/RHSA-2016-2071.html
http://rhn.redhat.com/errata/RHSA-2016-2072.html
http://rhn.redhat.com/errata/RHSA-2016-2599.html
http://rhn.redhat.com/errata/RHSA-2016-2807.html
http://rhn.redhat.com/errata/RHSA-2016-2808.html
http://www.ubuntu.com/usn/USN-3024-1
Third Party Advisory
http://www.ubuntu.com/usn/USN-3027-1
Third Party Advisory
https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05204371
Patch
Third Party Advisory
Permissions Required
https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05289840
https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05324759