SB2025112436 - SUSE update for tomcat 

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2025112436

SB2025112436 - SUSE update for tomcat

Published: November 24, 2025

Security Bulletin ID SB2025112436
Severity
High
Patch available
YES
Number of vulnerabilities 3
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

High 33% Medium 33% Low 33%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 3 secuirty vulnerabilities.


1) Path traversal (CVE-ID: CVE-2025-55752)

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to input validation error when processing directory traversal sequences passed via Rewrite Valve. A remote attacker can send a specially crafted HTTP PUT request and write arbitrary files to the server, leading to remote code execution. 


2) Improper Output Neutralization for Logs (CVE-ID: CVE-2025-55754)

The vulnerability allows a remote attacker to execute arbitrary OS commands.

The vulnerability exists due to improper input validation of ANSI escape sequences in log messages. A remote attacker can use a crafted URL to inject ANSI escape sequences to manipulate the console and the clip-boardand potentially execute arbitrary code.

The vulnerability affects Windows installations only.


3) Resource exhaustion (CVE-ID: CVE-2025-61795)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources when handling errors while processing multipart upload. Depending on JVM settings, application memory usage and application load, it is possible that space for the temporary copies of uploaded parts would be filled faster than GC cleared it, leading to a DoS.


Remediation

Install update from vendor's website.

References