p PatchFirst

CVE-2018-1336

CVE-2018-1336

This page contains facts from public vulnerability sources. Check the original advisory before updating.

This page shows selected source facts. See the linked advisories for the complete description and affected versions.

An improper handing of overflow in the UTF-8 decoder with supplementary characters can lead to an infinite loop in the decoder causing a Denial of Service. Versions Affected: Apache Tomcat 9.0.0.M9 to 9.0.7, 8.5.0 to 8.5.30, 8.0.0.RC1 to 8.0.51, and 7.0.28 to 7.0.86.

CVSS 7.5 · High · EPSS 20.4% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • apache tomcat

    Versions
    • 9.0.0.M9 to 9.0.7: Affected
    • 8.5.0 to 8.5.30: Affected
    • 8.0.0.RC1 to 8.0.51: Affected
    • 7.0.28 to 7.0.86: Affected

    No fix published

  • tomcat7 Ubuntu:14.04:LTS

    Versions
    • 7.0.42-1
    • 7.0.47-1
    • 7.0.50-1
    • 7.0.52-1
    • 7.0.52-1ubuntu0.1
    • 7.0.52-1ubuntu0.3
    • 7.0.52-1ubuntu0.6
    • 7.0.52-1ubuntu0.7
    • 7.0.52-1ubuntu0.8
    • 7.0.52-1ubuntu0.9
    • 7.0.52-1ubuntu0.10
    • 7.0.52-1ubuntu0.11
    • 7.0.52-1ubuntu0.13
    • 7.0.52-1ubuntu0.14
    Affected ranges
    • ECOSYSTEM: < 7.0.52-1ubuntu0.15

    Update to 7.0.52-1ubuntu0.15

  • tomcat8 Ubuntu:16.04:LTS

    Versions
    • 8.0.26-1
    • 8.0.28-1
    • 8.0.30-1
    • 8.0.32-1
    • 8.0.32-1ubuntu1
    • 8.0.32-1ubuntu1.1
    • 8.0.32-1ubuntu1.2
    • 8.0.32-1ubuntu1.3
    • 8.0.32-1ubuntu1.4
    • 8.0.32-1ubuntu1.5
    • 8.0.32-1ubuntu1.6
    Affected ranges
    • ECOSYSTEM: < 8.0.32-1ubuntu1.7

    Update to 8.0.32-1ubuntu1.7

  • tomcat7 Ubuntu:Pro:16.04:LTS

    Versions
    • 7.0.64-1
    • 7.0.68-1
    • 7.0.68-1ubuntu0.1
    • 7.0.68-1ubuntu0.3
    • 7.0.68-1ubuntu0.4
    Affected ranges
    • ECOSYSTEM: < 7.0.68-1ubuntu0.4+esm1

    Update to 7.0.68-1ubuntu0.4+esm1

  • tomcat8 Ubuntu:18.04:LTS

    Versions
    • 8.5.21-1ubuntu1
    • 8.5.29-1
    • 8.5.30-1
    • 8.5.30-1ubuntu1
    • 8.5.30-1ubuntu1.2
    • 8.5.30-1ubuntu1.3
    • 8.5.30-1ubuntu1.4
    Affected ranges
    • ECOSYSTEM: < 8.5.39-1ubuntu1~18.04.1

    Update to 8.5.39-1ubuntu1~18.04.1

Original sources

Check your server →