GCVE - cpe:2.3:a:apache:tomcat:6.0.42:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:apache:tomcat:6.0.42:*:*:*:*:*:*:*

part: a version: 6.0.42 update: *

Vendor	Apache (`b0303047-b7dd-5cf8-abcc-71b7d9d80b95`)
Product	Tomcat (`caaa56d3-0cc4-5735-aab9-a3a1a7f4dc56`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:apache/tomcat`	purl2cpe	2026-06-01 10:14:27.124430
`pkg:github/apache/tomcat`	purl2cpe	2026-06-01 10:14:27.124431
`pkg:maven/org.apache.tomcat/tomcat`	purl2cpe	2026-06-01 10:14:27.124433
`pkg:rpm/fedora/tomcat`	purl2cpe	2026-06-01 10:14:27.124434
`pkg:rpm/opensuse/tomcat`	purl2cpe	2026-06-01 10:14:27.124435

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2017-5647`	vulnerable	2026-06-08 05:09:47.624346	Details available A bug in the handling of the pipelined requests in Apache Tomcat 9.0.0.M1 to 9.0.0.M18, 8.5.0 to 8.5.12, 8.0.0.RC1 to 8.0.42, 7.0.0 to 7.0.76, and 6.0.0 to 6.0.52, when send file was used, results in the pipelined request being lost when send file processing of the previous request completed. This could result in responses appearing to be sent for the wrong request. For example, a user agent that sent requests A, B and C could see the correct response for request A, the response for request C for request B and no response for request C. Published: 2017-04-17T16:00:00.000Z Updated: 2024-08-05T15:11:48.364Z Open on db.gcve.eu Reference links https://security.gentoo.org/glsa/201705-09 https://security.netapp.com/advisory/ntap-20180614-0001/ https://access.redhat.com/errata/RHSA-2017:3080 https://access.redhat.com/errata/RHSA-2017:1801 http://www.debian.org/security/2017/dsa-3843	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2016-6816`	vulnerable	2026-06-08 05:08:11.069589	Details available The code in Apache Tomcat 9.0.0.M1 to 9.0.0.M11, 8.5.0 to 8.5.6, 8.0.0.RC1 to 8.0.38, 7.0.0 to 7.0.72, and 6.0.0 to 6.0.47 that parsed the HTTP request line permitted invalid characters. This could be exploited, in conjunction with a proxy that also permitted the invalid characters but with a different interpretation, to inject data into the HTTP response. By manipulating the HTTP response the attacker could poison a web-cache, perform an XSS attack and/or obtain sensitive information from requests other then their own. Published: 2017-03-20T18:00:00.000Z Updated: 2024-11-14T20:05:46.260Z Open on db.gcve.eu Reference links http://rhn.redhat.com/errata/RHSA-2017-0250.html https://www.exploit-db.com/exploits/41783/ https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.0.39 https://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.0.M13 http://www.securityfocus.com/bid/94461	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.