SUSE-SU-2025:4103-1

UNKNOWN

Security update for tomcat10

Published Nov 14, 2025

Modified 4 months ago

Fix available

Details

This update for tomcat10 fixes the following issues:

Update to Tomcat 10.1.48

CVE-2025-55752: Fixed directory traversal via rewrite with possible RCE if PUT is enabled (bsc#1252753)
CVE-2025-55754: Fixed improper neutralization of escape, meta, or control sequences vulnerability (bsc#1252905)
CVE-2025-61795: Fixed denial of service due to temporary copies during the processing of multipart upload (bsc#1252756)

Affected Packages(11 packages)

tomcat10

SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOSSUSE Linux Enterprise High Performance Computing 15 SP5-LTSSSUSE Linux Enterprise Module for Web and Scripting 15 SP6SUSE Linux Enterprise Module for Web and Scripting 15 SP7SUSE Linux Enterprise Server 15 SP5-LTSS

Fixed in:

10.1.48-150200.5.54.1

tomcat10-admin-webapps

SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOSSUSE Linux Enterprise High Performance Computing 15 SP5-LTSSSUSE Linux Enterprise Module for Web and Scripting 15 SP6SUSE Linux Enterprise Module for Web and Scripting 15 SP7SUSE Linux Enterprise Server 15 SP5-LTSS

Fixed in:

10.1.48-150200.5.54.1

tomcat10-el-5_0-api

SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOSSUSE Linux Enterprise High Performance Computing 15 SP5-LTSSSUSE Linux Enterprise Module for Web and Scripting 15 SP6SUSE Linux Enterprise Module for Web and Scripting 15 SP7SUSE Linux Enterprise Server 15 SP5-LTSS

Fixed in:

10.1.48-150200.5.54.1

tomcat10-jsp-3_1-api

SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOSSUSE Linux Enterprise High Performance Computing 15 SP5-LTSSSUSE Linux Enterprise Module for Web and Scripting 15 SP6SUSE Linux Enterprise Module for Web and Scripting 15 SP7SUSE Linux Enterprise Server 15 SP5-LTSS

Fixed in:

10.1.48-150200.5.54.1

tomcat10-lib

SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOSSUSE Linux Enterprise High Performance Computing 15 SP5-LTSSSUSE Linux Enterprise Module for Web and Scripting 15 SP6SUSE Linux Enterprise Module for Web and Scripting 15 SP7SUSE Linux Enterprise Server 15 SP5-LTSS

Fixed in:

10.1.48-150200.5.54.1

tomcat10-servlet-6_0-api

SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOSSUSE Linux Enterprise High Performance Computing 15 SP5-LTSSSUSE Linux Enterprise Module for Web and Scripting 15 SP6SUSE Linux Enterprise Module for Web and Scripting 15 SP7SUSE Linux Enterprise Server 15 SP5-LTSS

Fixed in:

10.1.48-150200.5.54.1

tomcat10-webapps

SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOSSUSE Linux Enterprise High Performance Computing 15 SP5-LTSSSUSE Linux Enterprise Module for Web and Scripting 15 SP6SUSE Linux Enterprise Module for Web and Scripting 15 SP7SUSE Linux Enterprise Server 15 SP5-LTSS

Fixed in:

10.1.48-150200.5.54.1

tomcat10-doc

openSUSE Leap 15.6

Fixed in:

10.1.48-150200.5.54.1

tomcat10-docs-webapp

openSUSE Leap 15.6

Fixed in:

10.1.48-150200.5.54.1

tomcat10-embed

openSUSE Leap 15.6

Fixed in:

10.1.48-150200.5.54.1

References

https://bugzilla.suse.com/1252753

https://bugzilla.suse.com/1252756

https://bugzilla.suse.com/1252905

https://www.suse.com/security/cve/CVE-2025-55752

https://www.suse.com/security/cve/CVE-2025-55754

https://www.suse.com/security/cve/CVE-2025-61795

https://www.suse.com/support/update/announcement/2025/suse-su-20254103-1/

Upstream

CVE-2025-55752 CVE-2025-55754 CVE-2025-61795

Related

CVE-2025-55752 CVE-2025-55754 CVE-2025-61795

Ecosystems(7)

SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS SUSE Linux Enterprise Module for Web and Scripting 15 SP6 SUSE Linux Enterprise Module for Web and Scripting 15 SP7 SUSE Linux Enterprise Server 15 SP5-LTSS

Timeline

PublishedNov 14, 2025

ModifiedNov 14, 2025

SUSE-SU-2025:4103-1 | Mondoo Vulnerability Intelligence