Author: markt
Date: Tue Oct 28 09:13:16 2025
New Revision: 1929388
Log:
Fix version typo
Modified:
tomcat/site/trunk/docs/security-10.html
tomcat/site/trunk/docs/security-11.html
tomcat/site/trunk/docs/security-9.html
tomcat/site/trunk/xdocs/security-9.xml
Modified: tomcat/site/trunk/docs/security-10.html
==============================================================================
--- tomcat/site/trunk/docs/security-10.html Tue Oct 28 08:30:16 2025
(r1929387)
+++ tomcat/site/trunk/docs/security-10.html Tue Oct 28 09:13:16 2025
(r1929388)
@@ -51,11 +51,11 @@
<p>If an error occurred (including exceeding limits) during the processing
of a multipart upload, temporary copies of the uploaded parts written to
- disc were not cleaned up immediately but left for the garbage collection
- process to delete. Depending on JVM settings, application memory usage
- and application load, it was possible that space for the temporary
copies
- of uploaded parts would be filled faster than GC cleared it, leading to
a
- DoS.</p>
+ local storage were not cleaned up immediately but left for the garbage
+ collection process to delete. Depending on JVM settings, application
+ memory usage and application load, it was possible that space for the
+ temporary copies of uploaded parts would be filled faster than GC
cleared
+ it, leading to a DoS.</p>
<p>This was fixed with commit
<a
href="https://github.com/apache/tomcat/commit/af6e9181620304c0d818121c29c074e1330610d0";>af6e9181</a>.</p>
@@ -74,7 +74,7 @@
was running in a console on a Windows operating system, and the console
supported ANSI escape sequences, it was possible for an attacker to use
a
specially crafted URL to inject ANSI escape sequences to manipulate the
- console and the clip-board and attempt to trick an administrator into
+ console and the clipboard and attempt to trick an administrator into
running an attacker controlled command. While no attack vector was
found,
it may have been possible to mount this attack on other operating
systems.</p>
Modified: tomcat/site/trunk/docs/security-11.html
==============================================================================
--- tomcat/site/trunk/docs/security-11.html Tue Oct 28 08:30:16 2025
(r1929387)
+++ tomcat/site/trunk/docs/security-11.html Tue Oct 28 09:13:16 2025
(r1929388)
@@ -45,11 +45,11 @@
<p>If an error occurred (including exceeding limits) during the processing
of a multipart upload, temporary copies of the uploaded parts written to
- disc were not cleaned up immediately but left for the garbage collection
- process to delete. Depending on JVM settings, application memory usage
- and application load, it was possible that space for the temporary
copies
- of uploaded parts would be filled faster than GC cleared it, leading to
a
- DoS.</p>
+ local storage were not cleaned up immediately but left for the garbage
+ collection process to delete. Depending on JVM settings, application
+ memory usage and application load, it was possible that space for the
+ temporary copies of uploaded parts would be filled faster than GC
cleared
+ it, leading to a DoS.</p>
<p>This was fixed with commit
<a
href="https://github.com/apache/tomcat/commit/1cdf5f730ede75a0759492f179ac21ca4ff68e06";>1cdf5f73</a>.</p>
@@ -68,7 +68,7 @@
was running in a console on a Windows operating system, and the console
supported ANSI escape sequences, it was possible for an attacker to use
a
specially crafted URL to inject ANSI escape sequences to manipulate the
- console and the clip-board and attempt to trick an administrator into
+ console and the clipboard and attempt to trick an administrator into
running an attacker controlled command. While no attack vector was
found,
it may have been possible to mount this attack on other operating
systems.</p>
Modified: tomcat/site/trunk/docs/security-9.html
==============================================================================
--- tomcat/site/trunk/docs/security-9.html Tue Oct 28 08:30:16 2025
(r1929387)
+++ tomcat/site/trunk/docs/security-9.html Tue Oct 28 09:13:16 2025
(r1929388)
@@ -36,7 +36,7 @@
</p>
</div><h3 id="Table_of_Contents">Table of Contents</h3><div class="text">
- <ul><li><a href="#Fixed_in_Apache_Tomcat_9.0.110">Fixed in Apache Tomcat
9.0.110</a></li><li><a href="#Fixed_in_Apache_Tomcat_9.1.109">Fixed in Apache
Tomcat 9.1.109</a></li><li><a href="#Fixed_in_Apache_Tomcat_9.0.108">Fixed in
Apache Tomcat 9.0.108</a></li><li><a
href="#Fixed_in_Apache_Tomcat_9.0.107">Fixed in Apache Tomcat
9.0.107</a></li><li><a href="#Fixed_in_Apache_Tomcat_9.0.106">Fixed in Apache
Tomcat 9.0.106</a></li><li><a href="#Fixed_in_Apache_Tomcat_9.0.105">Fixed in
Apache Tomcat 9.0.105</a></li><li><a
href="#Fixed_in_Apache_Tomcat_9.0.104">Fixed in Apache Tomcat
9.0.104</a></li><li><a href="#Fixed_in_Apache_Tomcat_9.0.99">Fixed in Apache
Tomcat 9.0.99</a></li><li><a href="#Fixed_in_Apache_Tomcat_9.0.98">Fixed in
Apache Tomcat 9.0.98</a></li><li><a href="#Fixed_in_Apache_Tomcat_9.0.97">Fixed
in Apache Tomcat 9.0.97</a></li><li><a
href="#Fixed_in_Apache_Tomcat_9.0.96">Fixed in Apache Tomcat
9.0.96</a></li><li><a href="#Fixed_in_Apache_Tomcat_9.0.90">Fixed in Apache T
omcat 9.0.90</a></li><li><a href="#Fixed_in_Apache_Tomcat_9.0.86">Fixed in
Apache Tomcat 9.0.86</a></li><li><a href="#Fixed_in_Apache_Tomcat_9.0.83">Fixed
in Apache Tomcat 9.0.83</a></li><li><a
href="#Fixed_in_Apache_Tomcat_9.0.81">Fixed in Apache Tomcat
9.0.81</a></li><li><a href="#Fixed_in_Apache_Tomcat_9.0.80">Fixed in Apache
Tomcat 9.0.80</a></li><li><a href="#Fixed_in_Apache_Tomcat_9.0.75">Fixed in
Apache Tomcat 9.0.75</a></li><li><a href="#Fixed_in_Apache_Tomcat_9.0.74">Fixed
in Apache Tomcat 9.0.74</a></li><li><a
href="#Fixed_in_Apache_Tomcat_9.0.72">Fixed in Apache Tomcat
9.0.72</a></li><li><a href="#Fixed_in_Apache_Tomcat_9.0.71">Fixed in Apache
Tomcat 9.0.71</a></li><li><a href="#Fixed_in_Apache_Tomcat_9.0.69">Fixed in
Apache Tomcat 9.0.69</a></li><li><a href="#Fixed_in_Apache_Tomcat_9.0.68">Fixed
in Apache Tomcat 9.0.68</a></li><li><a
href="#Fixed_in_Apache_Tomcat_9.0.65">Fixed in Apache Tomcat
9.0.65</a></li><li><a href="#Fixed_in_Apache_Tomcat_9.0.63">Fixed in Apache To
mcat 9.0.63</a></li><li><a href="#Fixed_in_Apache_Tomcat_9.0.62">Fixed in
Apache Tomcat 9.0.62</a></li><li><a href="#Fixed_in_Apache_Tomcat_9.0.58">Fixed
in Apache Tomcat 9.0.58</a></li><li><a
href="#Fixed_in_Apache_Tomcat_9.0.54">Fixed in Apache Tomcat
9.0.54</a></li><li><a href="#Fixed_in_Apache_Tomcat_9.0.48">Fixed in Apache
Tomcat 9.0.48</a></li><li><a href="#Fixed_in_Apache_Tomcat_9.0.46">Fixed in
Apache Tomcat 9.0.46</a></li><li><a href="#Fixed_in_Apache_Tomcat_9.0.45">Fixed
in Apache Tomcat 9.0.45</a></li><li><a
href="#Fixed_in_Apache_Tomcat_9.0.44">Fixed in Apache Tomcat
9.0.44</a></li><li><a href="#Fixed_in_Apache_Tomcat_9.0.43">Fixed in Apache
Tomcat 9.0.43</a></li><li><a href="#Fixed_in_Apache_Tomcat_9.0.40">Fixed in
Apache Tomcat 9.0.40</a></li><li><a href="#Fixed_in_Apache_Tomcat_9.0.38">Fixed
in Apache Tomcat 9.0.38</a></li><li><a
href="#Fixed_in_Apache_Tomcat_9.0.37">Fixed in Apache Tomcat
9.0.37</a></li><li><a href="#Fixed_in_Apache_Tomcat_9.0.36">Fixed in Apache Tom
cat 9.0.36</a></li><li><a href="#Fixed_in_Apache_Tomcat_9.0.35">Fixed in
Apache Tomcat 9.0.35</a></li><li><a href="#Fixed_in_Apache_Tomcat_9.0.31">Fixed
in Apache Tomcat 9.0.31</a></li><li><a
href="#Fixed_in_Apache_Tomcat_9.0.30">Fixed in Apache Tomcat
9.0.30</a></li><li><a href="#Fixed_in_Apache_Tomcat_9.0.29">Fixed in Apache
Tomcat 9.0.29</a></li><li><a href="#Fixed_in_Apache_Tomcat_9.0.21">Fixed in
Apache Tomcat 9.0.21</a></li><li><a href="#Fixed_in_Apache_Tomcat_9.0.20">Fixed
in Apache Tomcat 9.0.20</a></li><li><a
href="#Fixed_in_Apache_Tomcat_9.0.19">Fixed in Apache Tomcat
9.0.19</a></li><li><a href="#Fixed_in_Apache_Tomcat_9.0.16">Fixed in Apache
Tomcat 9.0.16</a></li><li><a href="#Fixed_in_Apache_Tomcat_9.0.12">Fixed in
Apache Tomcat 9.0.12</a></li><li><a href="#Fixed_in_Apache_Tomcat_9.0.10">Fixed
in Apache Tomcat 9.0.10</a></li><li><a
href="#Fixed_in_Apache_Tomcat_9.0.9">Fixed in Apache Tomcat
9.0.9</a></li><li><a href="#Fixed_in_Apache_Tomcat_9.0.8">Fixed in Apache
Tomcat
9.0.8</a></li><li><a href="#Fixed_in_Apache_Tomcat_9.0.5">Fixed in Apache
Tomcat 9.0.5</a></li><li><a href="#Fixed_in_Apache_Tomcat_9.0.2">Fixed in
Apache Tomcat 9.0.2</a></li><li><a href="#Fixed_in_Apache_Tomcat_9.0.1">Fixed
in Apache Tomcat 9.0.1</a></li><li><a
href="#Fixed_in_Apache_Tomcat_9.0.0.M22">Fixed in Apache Tomcat
9.0.0.M22</a></li><li><a href="#Fixed_in_Apache_Tomcat_9.0.0.M21">Fixed in
Apache Tomcat 9.0.0.M21</a></li><li><a
href="#Fixed_in_Apache_Tomcat_9.0.0.M19">Fixed in Apache Tomcat
9.0.0.M19</a></li><li><a href="#Fixed_in_Apache_Tomcat_9.0.0.M18">Fixed in
Apache Tomcat 9.0.0.M18</a></li><li><a
href="#Fixed_in_Apache_Tomcat_9.0.0.M17">Fixed in Apache Tomcat
9.0.0.M17</a></li><li><a href="#Fixed_in_Apache_Tomcat_9.0.0.M15">Fixed in
Apache Tomcat 9.0.0.M15</a></li><li><a
href="#Fixed_in_Apache_Tomcat_9.0.0.M13">Fixed in Apache Tomcat
9.0.0.M13</a></li><li><a href="#Fixed_in_Apache_Tomcat_9.0.0.M10">Fixed in
Apache Tomcat 9.0.0.M10</a></li><li><a href="#Fixed_in_Apach
e_Tomcat_9.0.0.M8">Fixed in Apache Tomcat 9.0.0.M8</a></li><li><a
href="#Fixed_in_Apache_Tomcat_9.0.0.M3">Fixed in Apache Tomcat
9.0.0.M3</a></li><li><a href="#Not_a_vulnerability_in_Tomcat">Not a
vulnerability in Tomcat</a></li></ul>
+ <ul><li><a href="#Fixed_in_Apache_Tomcat_9.0.110">Fixed in Apache Tomcat
9.0.110</a></li><li><a href="#Fixed_in_Apache_Tomcat_9.0.109">Fixed in Apache
Tomcat 9.0.109</a></li><li><a href="#Fixed_in_Apache_Tomcat_9.0.108">Fixed in
Apache Tomcat 9.0.108</a></li><li><a
href="#Fixed_in_Apache_Tomcat_9.0.107">Fixed in Apache Tomcat
9.0.107</a></li><li><a href="#Fixed_in_Apache_Tomcat_9.0.106">Fixed in Apache
Tomcat 9.0.106</a></li><li><a href="#Fixed_in_Apache_Tomcat_9.0.105">Fixed in
Apache Tomcat 9.0.105</a></li><li><a
href="#Fixed_in_Apache_Tomcat_9.0.104">Fixed in Apache Tomcat
9.0.104</a></li><li><a href="#Fixed_in_Apache_Tomcat_9.0.99">Fixed in Apache
Tomcat 9.0.99</a></li><li><a href="#Fixed_in_Apache_Tomcat_9.0.98">Fixed in
Apache Tomcat 9.0.98</a></li><li><a href="#Fixed_in_Apache_Tomcat_9.0.97">Fixed
in Apache Tomcat 9.0.97</a></li><li><a
href="#Fixed_in_Apache_Tomcat_9.0.96">Fixed in Apache Tomcat
9.0.96</a></li><li><a href="#Fixed_in_Apache_Tomcat_9.0.90">Fixed in Apache T
omcat 9.0.90</a></li><li><a href="#Fixed_in_Apache_Tomcat_9.0.86">Fixed in
Apache Tomcat 9.0.86</a></li><li><a href="#Fixed_in_Apache_Tomcat_9.0.83">Fixed
in Apache Tomcat 9.0.83</a></li><li><a
href="#Fixed_in_Apache_Tomcat_9.0.81">Fixed in Apache Tomcat
9.0.81</a></li><li><a href="#Fixed_in_Apache_Tomcat_9.0.80">Fixed in Apache
Tomcat 9.0.80</a></li><li><a href="#Fixed_in_Apache_Tomcat_9.0.75">Fixed in
Apache Tomcat 9.0.75</a></li><li><a href="#Fixed_in_Apache_Tomcat_9.0.74">Fixed
in Apache Tomcat 9.0.74</a></li><li><a
href="#Fixed_in_Apache_Tomcat_9.0.72">Fixed in Apache Tomcat
9.0.72</a></li><li><a href="#Fixed_in_Apache_Tomcat_9.0.71">Fixed in Apache
Tomcat 9.0.71</a></li><li><a href="#Fixed_in_Apache_Tomcat_9.0.69">Fixed in
Apache Tomcat 9.0.69</a></li><li><a href="#Fixed_in_Apache_Tomcat_9.0.68">Fixed
in Apache Tomcat 9.0.68</a></li><li><a
href="#Fixed_in_Apache_Tomcat_9.0.65">Fixed in Apache Tomcat
9.0.65</a></li><li><a href="#Fixed_in_Apache_Tomcat_9.0.63">Fixed in Apache To
mcat 9.0.63</a></li><li><a href="#Fixed_in_Apache_Tomcat_9.0.62">Fixed in
Apache Tomcat 9.0.62</a></li><li><a href="#Fixed_in_Apache_Tomcat_9.0.58">Fixed
in Apache Tomcat 9.0.58</a></li><li><a
href="#Fixed_in_Apache_Tomcat_9.0.54">Fixed in Apache Tomcat
9.0.54</a></li><li><a href="#Fixed_in_Apache_Tomcat_9.0.48">Fixed in Apache
Tomcat 9.0.48</a></li><li><a href="#Fixed_in_Apache_Tomcat_9.0.46">Fixed in
Apache Tomcat 9.0.46</a></li><li><a href="#Fixed_in_Apache_Tomcat_9.0.45">Fixed
in Apache Tomcat 9.0.45</a></li><li><a
href="#Fixed_in_Apache_Tomcat_9.0.44">Fixed in Apache Tomcat
9.0.44</a></li><li><a href="#Fixed_in_Apache_Tomcat_9.0.43">Fixed in Apache
Tomcat 9.0.43</a></li><li><a href="#Fixed_in_Apache_Tomcat_9.0.40">Fixed in
Apache Tomcat 9.0.40</a></li><li><a href="#Fixed_in_Apache_Tomcat_9.0.38">Fixed
in Apache Tomcat 9.0.38</a></li><li><a
href="#Fixed_in_Apache_Tomcat_9.0.37">Fixed in Apache Tomcat
9.0.37</a></li><li><a href="#Fixed_in_Apache_Tomcat_9.0.36">Fixed in Apache Tom
cat 9.0.36</a></li><li><a href="#Fixed_in_Apache_Tomcat_9.0.35">Fixed in
Apache Tomcat 9.0.35</a></li><li><a href="#Fixed_in_Apache_Tomcat_9.0.31">Fixed
in Apache Tomcat 9.0.31</a></li><li><a
href="#Fixed_in_Apache_Tomcat_9.0.30">Fixed in Apache Tomcat
9.0.30</a></li><li><a href="#Fixed_in_Apache_Tomcat_9.0.29">Fixed in Apache
Tomcat 9.0.29</a></li><li><a href="#Fixed_in_Apache_Tomcat_9.0.21">Fixed in
Apache Tomcat 9.0.21</a></li><li><a href="#Fixed_in_Apache_Tomcat_9.0.20">Fixed
in Apache Tomcat 9.0.20</a></li><li><a
href="#Fixed_in_Apache_Tomcat_9.0.19">Fixed in Apache Tomcat
9.0.19</a></li><li><a href="#Fixed_in_Apache_Tomcat_9.0.16">Fixed in Apache
Tomcat 9.0.16</a></li><li><a href="#Fixed_in_Apache_Tomcat_9.0.12">Fixed in
Apache Tomcat 9.0.12</a></li><li><a href="#Fixed_in_Apache_Tomcat_9.0.10">Fixed
in Apache Tomcat 9.0.10</a></li><li><a
href="#Fixed_in_Apache_Tomcat_9.0.9">Fixed in Apache Tomcat
9.0.9</a></li><li><a href="#Fixed_in_Apache_Tomcat_9.0.8">Fixed in Apache
Tomcat
9.0.8</a></li><li><a href="#Fixed_in_Apache_Tomcat_9.0.5">Fixed in Apache
Tomcat 9.0.5</a></li><li><a href="#Fixed_in_Apache_Tomcat_9.0.2">Fixed in
Apache Tomcat 9.0.2</a></li><li><a href="#Fixed_in_Apache_Tomcat_9.0.1">Fixed
in Apache Tomcat 9.0.1</a></li><li><a
href="#Fixed_in_Apache_Tomcat_9.0.0.M22">Fixed in Apache Tomcat
9.0.0.M22</a></li><li><a href="#Fixed_in_Apache_Tomcat_9.0.0.M21">Fixed in
Apache Tomcat 9.0.0.M21</a></li><li><a
href="#Fixed_in_Apache_Tomcat_9.0.0.M19">Fixed in Apache Tomcat
9.0.0.M19</a></li><li><a href="#Fixed_in_Apache_Tomcat_9.0.0.M18">Fixed in
Apache Tomcat 9.0.0.M18</a></li><li><a
href="#Fixed_in_Apache_Tomcat_9.0.0.M17">Fixed in Apache Tomcat
9.0.0.M17</a></li><li><a href="#Fixed_in_Apache_Tomcat_9.0.0.M15">Fixed in
Apache Tomcat 9.0.0.M15</a></li><li><a
href="#Fixed_in_Apache_Tomcat_9.0.0.M13">Fixed in Apache Tomcat
9.0.0.M13</a></li><li><a href="#Fixed_in_Apache_Tomcat_9.0.0.M10">Fixed in
Apache Tomcat 9.0.0.M10</a></li><li><a href="#Fixed_in_Apach
e_Tomcat_9.0.0.M8">Fixed in Apache Tomcat 9.0.0.M8</a></li><li><a
href="#Fixed_in_Apache_Tomcat_9.0.0.M3">Fixed in Apache Tomcat
9.0.0.M3</a></li><li><a href="#Not_a_vulnerability_in_Tomcat">Not a
vulnerability in Tomcat</a></li></ul>
</div><h3 id="Fixed_in_Apache_Tomcat_9.0.110"><span
class="pull-right">2025-10-06</span> Fixed in Apache Tomcat 9.0.110</h3><div
class="text">
<p><strong>Low: Delayed cleaning of multipart upload temporary files may
@@ -45,11 +45,11 @@
<p>If an error occurred (including exceeding limits) during the processing
of a multipart upload, temporary copies of the uploaded parts written to
- disc were not cleaned up immediately but left for the garbage collection
- process to delete. Depending on JVM settings, application memory usage
- and application load, it was possible that space for the temporary
copies
- of uploaded parts would be filled faster than GC cleared it, leading to
a
- DoS.</p>
+ local storage were not cleaned up immediately but left for the garbage
+ collection process to delete. Depending on JVM settings, application
+ memory usage and application load, it was possible that space for the
+ temporary copies of uploaded parts would be filled faster than GC
cleared
+ it, leading to a DoS.</p>
<p>This was fixed with commit
<a
href="https://github.com/apache/tomcat/commit/afa422bd7ca1eef0f507259c682fd876494d9c3b";>afa422bd</a>.</p>
@@ -58,7 +58,7 @@
<p>Affects: 9.0.0.M1 to 9.0.109</p>
- </div><h3 id="Fixed_in_Apache_Tomcat_9.1.109"><span
class="pull-right">2025-09-05</span> Fixed in Apache Tomcat 9.1.109</h3><div
class="text">
+ </div><h3 id="Fixed_in_Apache_Tomcat_9.0.109"><span
class="pull-right">2025-09-05</span> Fixed in Apache Tomcat 9.0.109</h3><div
class="text">
<p><strong>Low: Console manipulation via escape sequences in log
messages</strong>
@@ -68,7 +68,7 @@
was running in a console on a Windows operating system, and the console
supported ANSI escape sequences, it was possible for an attacker to use
a
specially crafted URL to inject ANSI escape sequences to manipulate the
- console and the clip-board and attempt to trick an administrator into
+ console and the clipboard and attempt to trick an administrator into
running an attacker controlled command. While no attack vector was
found,
it may have been possible to mount this attack on other operating
systems.</p>
Modified: tomcat/site/trunk/xdocs/security-9.xml
==============================================================================
--- tomcat/site/trunk/xdocs/security-9.xml Tue Oct 28 08:30:16 2025
(r1929387)
+++ tomcat/site/trunk/xdocs/security-9.xml Tue Oct 28 09:13:16 2025
(r1929388)
@@ -73,7 +73,7 @@
</section>
- <section name="Fixed in Apache Tomcat 9.1.109" rtext="2025-09-05">
+ <section name="Fixed in Apache Tomcat 9.0.109" rtext="2025-09-05">
<p><strong>Low: Console manipulation via escape sequences in log
messages</strong>
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
