Early Access — Mondoo Vulnerability Intelligence is currently in preview.

SUSE-SU-2025:4086-1 | Mondoo Vulnerability Intelligence

SUSE-SU-2025:4086-1

UNKNOWN

Security update for tomcat11

Published Nov 12, 2025

Modified 2 months ago

Fix available

Details

This update for tomcat11 fixes the following issues:

Update to Tomcat 11.0.13

CVE-2025-55752: Fixed directory traversal via rewrite with possible RCE if PUT is enabled (bsc#1252753)
CVE-2025-55754: Fixed improper neutralization of escape, meta, or control sequences vulnerability (bsc#1252905)
CVE-2025-61795: Fixed denial of service due to temporary copies during the processing of multipart upload (bsc#1252756)

Affected Packages

SUSE:Linux Enterprise Module for Web and Scripting 15 SP6tomcat11

Fixed in:

11.0.13-150600.13.12.1

SUSE:Linux Enterprise Module for Web and Scripting 15 SP6tomcat11-admin-webapps

Fixed in:

11.0.13-150600.13.12.1

SUSE:Linux Enterprise Module for Web and Scripting 15 SP6tomcat11-el-6_0-api

Fixed in:

11.0.13-150600.13.12.1

SUSE:Linux Enterprise Module for Web and Scripting 15 SP6tomcat11-jsp-4_0-api

Fixed in:

11.0.13-150600.13.12.1

SUSE:Linux Enterprise Module for Web and Scripting 15 SP6tomcat11-lib

Fixed in:

11.0.13-150600.13.12.1

SUSE:Linux Enterprise Module for Web and Scripting 15 SP6tomcat11-servlet-6_1-api

Fixed in:

11.0.13-150600.13.12.1

SUSE:Linux Enterprise Module for Web and Scripting 15 SP6tomcat11-webapps

Fixed in:

11.0.13-150600.13.12.1

SUSE:Linux Enterprise Module for Web and Scripting 15 SP7tomcat11

Fixed in:

11.0.13-150600.13.12.1

SUSE:Linux Enterprise Module for Web and Scripting 15 SP7tomcat11-admin-webapps

Fixed in:

11.0.13-150600.13.12.1

SUSE:Linux Enterprise Module for Web and Scripting 15 SP7tomcat11-el-6_0-api

Fixed in:

11.0.13-150600.13.12.1

SUSE:Linux Enterprise Module for Web and Scripting 15 SP7tomcat11-jsp-4_0-api

Fixed in:

11.0.13-150600.13.12.1

SUSE:Linux Enterprise Module for Web and Scripting 15 SP7tomcat11-lib

Fixed in:

11.0.13-150600.13.12.1

SUSE:Linux Enterprise Module for Web and Scripting 15 SP7tomcat11-servlet-6_1-api

Fixed in:

11.0.13-150600.13.12.1

SUSE:Linux Enterprise Module for Web and Scripting 15 SP7tomcat11-webapps

Fixed in:

11.0.13-150600.13.12.1

openSUSE:Leap 15.6tomcat11

Fixed in:

11.0.13-150600.13.12.1

openSUSE:Leap 15.6tomcat11-admin-webapps

Fixed in:

11.0.13-150600.13.12.1

openSUSE:Leap 15.6tomcat11-doc

Fixed in:

11.0.13-150600.13.12.1

openSUSE:Leap 15.6tomcat11-docs-webapp

Fixed in:

11.0.13-150600.13.12.1

openSUSE:Leap 15.6tomcat11-el-6_0-api

Fixed in:

11.0.13-150600.13.12.1

openSUSE:Leap 15.6tomcat11-embed

Fixed in:

11.0.13-150600.13.12.1

openSUSE:Leap 15.6tomcat11-jsp-4_0-api

Fixed in:

11.0.13-150600.13.12.1

openSUSE:Leap 15.6tomcat11-jsvc

Fixed in:

11.0.13-150600.13.12.1

openSUSE:Leap 15.6tomcat11-lib

Fixed in:

11.0.13-150600.13.12.1

openSUSE:Leap 15.6tomcat11-servlet-6_1-api

Fixed in:

11.0.13-150600.13.12.1

openSUSE:Leap 15.6tomcat11-webapps

Fixed in:

11.0.13-150600.13.12.1

References

REPORThttps://bugzilla.suse.com/1252753 REPORThttps://bugzilla.suse.com/1252756 REPORThttps://bugzilla.suse.com/1252905 WEBhttps://www.suse.com/security/cve/CVE-2025-55752 WEBhttps://www.suse.com/security/cve/CVE-2025-55754 WEBhttps://www.suse.com/security/cve/CVE-2025-61795 ADVISORYhttps://www.suse.com/support/update/announcement/2025/suse-su-20254086-1/

Upstream

CVE-2025-55752 CVE-2025-55754 CVE-2025-61795

Related

CVE-2025-55752 CVE-2025-55754 CVE-2025-61795

Ecosystems

SUSE Linux Enterprise Module for Web and Scripting 15 SP6 SUSE Linux Enterprise Module for Web and Scripting 15 SP7 openSUSE Leap 15.6

Timeline

PublishedNov 12, 2025

ModifiedNov 12, 2025