Early Access — Mondoo Vulnerability Intelligence is currently in preview.

SUSE-SU-2025:4159-1 | Mondoo Vulnerability Intelligence

SUSE-SU-2025:4159-1

UNKNOWN

Security update for tomcat

Published Nov 21, 2025

Modified 1 months ago

Fix available

Details

This update for tomcat fixes the following issues:

Update to Tomcat 9.0.111:

CVE-2025-55752: Fixed directory traversal via rewrite with possible RCE if PUT is enabled (bsc#1252753)
CVE-2025-55754: Fixed improper neutralization of escape, meta, or control sequences vulnerability (bsc#1252905)
CVE-2025-61795: Fixed denial of service due to temporary copies during the processing of multipart upload (bsc#1252756)

Affected Packages

SUSE:Enterprise Storage 7.1tomcat

Fixed in:

9.0.111-150200.96.1

SUSE:Enterprise Storage 7.1tomcat-admin-webapps

Fixed in:

9.0.111-150200.96.1

SUSE:Enterprise Storage 7.1tomcat-el-3_0-api

Fixed in:

9.0.111-150200.96.1

SUSE:Enterprise Storage 7.1tomcat-jsp-2_3-api

Fixed in:

9.0.111-150200.96.1

SUSE:Enterprise Storage 7.1tomcat-lib

Fixed in:

9.0.111-150200.96.1

SUSE:Enterprise Storage 7.1tomcat-servlet-4_0-api

Fixed in:

9.0.111-150200.96.1

SUSE:Enterprise Storage 7.1tomcat-webapps

Fixed in:

9.0.111-150200.96.1

SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSStomcat

Fixed in:

9.0.111-150200.96.1

SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSStomcat-admin-webapps

Fixed in:

9.0.111-150200.96.1

SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSStomcat-el-3_0-api

Fixed in:

9.0.111-150200.96.1

SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSStomcat-jsp-2_3-api

Fixed in:

9.0.111-150200.96.1

SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSStomcat-lib

Fixed in:

9.0.111-150200.96.1

SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSStomcat-servlet-4_0-api

Fixed in:

9.0.111-150200.96.1

SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSStomcat-webapps

Fixed in:

9.0.111-150200.96.1

SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOStomcat

Fixed in:

9.0.111-150200.96.1

SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOStomcat-admin-webapps

Fixed in:

9.0.111-150200.96.1

SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOStomcat-el-3_0-api

Fixed in:

9.0.111-150200.96.1

SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOStomcat-jsp-2_3-api

Fixed in:

9.0.111-150200.96.1

SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOStomcat-lib

Fixed in:

9.0.111-150200.96.1

SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOStomcat-servlet-4_0-api

Fixed in:

9.0.111-150200.96.1

SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOStomcat-webapps

Fixed in:

9.0.111-150200.96.1

SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSStomcat

Fixed in:

9.0.111-150200.96.1

SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSStomcat-admin-webapps

Fixed in:

9.0.111-150200.96.1

SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSStomcat-el-3_0-api

Fixed in:

9.0.111-150200.96.1

SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSStomcat-jsp-2_3-api

Fixed in:

9.0.111-150200.96.1

SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSStomcat-lib

Fixed in:

9.0.111-150200.96.1

SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSStomcat-servlet-4_0-api

Fixed in:

9.0.111-150200.96.1

SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSStomcat-webapps

Fixed in:

9.0.111-150200.96.1

SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOStomcat

Fixed in:

9.0.111-150200.96.1

SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOStomcat-admin-webapps

Fixed in:

9.0.111-150200.96.1

SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOStomcat-el-3_0-api

Fixed in:

9.0.111-150200.96.1

SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOStomcat-jsp-2_3-api

Fixed in:

9.0.111-150200.96.1

SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOStomcat-lib

Fixed in:

9.0.111-150200.96.1

SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOStomcat-servlet-4_0-api

Fixed in:

9.0.111-150200.96.1

SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOStomcat-webapps

Fixed in:

9.0.111-150200.96.1

SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSStomcat

Fixed in:

9.0.111-150200.96.1

SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSStomcat-admin-webapps

Fixed in:

9.0.111-150200.96.1

SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSStomcat-el-3_0-api

Fixed in:

9.0.111-150200.96.1

SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSStomcat-jsp-2_3-api

Fixed in:

9.0.111-150200.96.1

SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSStomcat-lib

Fixed in:

9.0.111-150200.96.1

SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSStomcat-servlet-4_0-api

Fixed in:

9.0.111-150200.96.1

SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSStomcat-webapps

Fixed in:

9.0.111-150200.96.1

SUSE:Linux Enterprise Module for Web and Scripting 15 SP6tomcat

Fixed in:

9.0.111-150200.96.1

SUSE:Linux Enterprise Module for Web and Scripting 15 SP6tomcat-admin-webapps

Fixed in:

9.0.111-150200.96.1

SUSE:Linux Enterprise Module for Web and Scripting 15 SP6tomcat-el-3_0-api

Fixed in:

9.0.111-150200.96.1

SUSE:Linux Enterprise Module for Web and Scripting 15 SP6tomcat-jsp-2_3-api

Fixed in:

9.0.111-150200.96.1

SUSE:Linux Enterprise Module for Web and Scripting 15 SP6tomcat-lib

Fixed in:

9.0.111-150200.96.1

SUSE:Linux Enterprise Module for Web and Scripting 15 SP6tomcat-servlet-4_0-api

Fixed in:

9.0.111-150200.96.1

SUSE:Linux Enterprise Module for Web and Scripting 15 SP6tomcat-webapps

Fixed in:

9.0.111-150200.96.1

SUSE:Linux Enterprise Module for Web and Scripting 15 SP7tomcat

Fixed in:

9.0.111-150200.96.1

SUSE:Linux Enterprise Module for Web and Scripting 15 SP7tomcat-admin-webapps

Fixed in:

9.0.111-150200.96.1

SUSE:Linux Enterprise Module for Web and Scripting 15 SP7tomcat-el-3_0-api

Fixed in:

9.0.111-150200.96.1

SUSE:Linux Enterprise Module for Web and Scripting 15 SP7tomcat-jsp-2_3-api

Fixed in:

9.0.111-150200.96.1

SUSE:Linux Enterprise Module for Web and Scripting 15 SP7tomcat-lib

Fixed in:

9.0.111-150200.96.1

SUSE:Linux Enterprise Module for Web and Scripting 15 SP7tomcat-servlet-4_0-api

Fixed in:

9.0.111-150200.96.1

SUSE:Linux Enterprise Module for Web and Scripting 15 SP7tomcat-webapps

Fixed in:

9.0.111-150200.96.1

SUSE:Linux Enterprise Server 15 SP3-LTSStomcat

Fixed in:

9.0.111-150200.96.1

SUSE:Linux Enterprise Server 15 SP3-LTSStomcat-admin-webapps

Fixed in:

9.0.111-150200.96.1

SUSE:Linux Enterprise Server 15 SP3-LTSStomcat-el-3_0-api

Fixed in:

9.0.111-150200.96.1

SUSE:Linux Enterprise Server 15 SP3-LTSStomcat-jsp-2_3-api

Fixed in:

9.0.111-150200.96.1

SUSE:Linux Enterprise Server 15 SP3-LTSStomcat-lib

Fixed in:

9.0.111-150200.96.1

SUSE:Linux Enterprise Server 15 SP3-LTSStomcat-servlet-4_0-api

Fixed in:

9.0.111-150200.96.1

SUSE:Linux Enterprise Server 15 SP3-LTSStomcat-webapps

Fixed in:

9.0.111-150200.96.1

SUSE:Linux Enterprise Server 15 SP4-LTSStomcat

Fixed in:

9.0.111-150200.96.1

SUSE:Linux Enterprise Server 15 SP4-LTSStomcat-admin-webapps

Fixed in:

9.0.111-150200.96.1

SUSE:Linux Enterprise Server 15 SP4-LTSStomcat-el-3_0-api

Fixed in:

9.0.111-150200.96.1

SUSE:Linux Enterprise Server 15 SP4-LTSStomcat-jsp-2_3-api

Fixed in:

9.0.111-150200.96.1

SUSE:Linux Enterprise Server 15 SP4-LTSStomcat-lib

Fixed in:

9.0.111-150200.96.1

SUSE:Linux Enterprise Server 15 SP4-LTSStomcat-servlet-4_0-api

Fixed in:

9.0.111-150200.96.1

SUSE:Linux Enterprise Server 15 SP4-LTSStomcat-webapps

Fixed in:

9.0.111-150200.96.1

SUSE:Linux Enterprise Server 15 SP5-LTSStomcat

Fixed in:

9.0.111-150200.96.1

SUSE:Linux Enterprise Server 15 SP5-LTSStomcat-admin-webapps

Fixed in:

9.0.111-150200.96.1

SUSE:Linux Enterprise Server 15 SP5-LTSStomcat-el-3_0-api

Fixed in:

9.0.111-150200.96.1

SUSE:Linux Enterprise Server 15 SP5-LTSStomcat-jsp-2_3-api

Fixed in:

9.0.111-150200.96.1

SUSE:Linux Enterprise Server 15 SP5-LTSStomcat-lib

Fixed in:

9.0.111-150200.96.1

SUSE:Linux Enterprise Server 15 SP5-LTSStomcat-servlet-4_0-api

Fixed in:

9.0.111-150200.96.1

SUSE:Linux Enterprise Server 15 SP5-LTSStomcat-webapps

Fixed in:

9.0.111-150200.96.1

SUSE:Linux Enterprise Server for SAP Applications 15 SP3tomcat

Fixed in:

9.0.111-150200.96.1

SUSE:Linux Enterprise Server for SAP Applications 15 SP3tomcat-admin-webapps

Fixed in:

9.0.111-150200.96.1

SUSE:Linux Enterprise Server for SAP Applications 15 SP3tomcat-el-3_0-api

Fixed in:

9.0.111-150200.96.1

SUSE:Linux Enterprise Server for SAP Applications 15 SP3tomcat-jsp-2_3-api

Fixed in:

9.0.111-150200.96.1

SUSE:Linux Enterprise Server for SAP Applications 15 SP3tomcat-lib

Fixed in:

9.0.111-150200.96.1

SUSE:Linux Enterprise Server for SAP Applications 15 SP3tomcat-servlet-4_0-api

Fixed in:

9.0.111-150200.96.1

SUSE:Linux Enterprise Server for SAP Applications 15 SP3tomcat-webapps

Fixed in:

9.0.111-150200.96.1

SUSE:Linux Enterprise Server for SAP Applications 15 SP4tomcat

Fixed in:

9.0.111-150200.96.1

SUSE:Linux Enterprise Server for SAP Applications 15 SP4tomcat-admin-webapps

Fixed in:

9.0.111-150200.96.1

SUSE:Linux Enterprise Server for SAP Applications 15 SP4tomcat-el-3_0-api

Fixed in:

9.0.111-150200.96.1

SUSE:Linux Enterprise Server for SAP Applications 15 SP4tomcat-jsp-2_3-api

Fixed in:

9.0.111-150200.96.1

SUSE:Linux Enterprise Server for SAP Applications 15 SP4tomcat-lib

Fixed in:

9.0.111-150200.96.1

SUSE:Linux Enterprise Server for SAP Applications 15 SP4tomcat-servlet-4_0-api

Fixed in:

9.0.111-150200.96.1

SUSE:Linux Enterprise Server for SAP Applications 15 SP4tomcat-webapps

Fixed in:

9.0.111-150200.96.1

SUSE:Linux Enterprise Server for SAP Applications 15 SP5tomcat

Fixed in:

9.0.111-150200.96.1

SUSE:Linux Enterprise Server for SAP Applications 15 SP5tomcat-admin-webapps

Fixed in:

9.0.111-150200.96.1

SUSE:Linux Enterprise Server for SAP Applications 15 SP5tomcat-el-3_0-api

Fixed in:

9.0.111-150200.96.1

SUSE:Linux Enterprise Server for SAP Applications 15 SP5tomcat-jsp-2_3-api

Fixed in:

9.0.111-150200.96.1

SUSE:Linux Enterprise Server for SAP Applications 15 SP5tomcat-lib

Fixed in:

9.0.111-150200.96.1

SUSE:Linux Enterprise Server for SAP Applications 15 SP5tomcat-servlet-4_0-api

Fixed in:

9.0.111-150200.96.1

SUSE:Linux Enterprise Server for SAP Applications 15 SP5tomcat-webapps

Fixed in:

9.0.111-150200.96.1

SUSE:Manager Server LTS 4.3tomcat

Fixed in:

9.0.111-150200.96.1

SUSE:Manager Server LTS 4.3tomcat-admin-webapps

Fixed in:

9.0.111-150200.96.1

SUSE:Manager Server LTS 4.3tomcat-el-3_0-api

Fixed in:

9.0.111-150200.96.1

SUSE:Manager Server LTS 4.3tomcat-jsp-2_3-api

Fixed in:

9.0.111-150200.96.1

SUSE:Manager Server LTS 4.3tomcat-lib

Fixed in:

9.0.111-150200.96.1

SUSE:Manager Server LTS 4.3tomcat-servlet-4_0-api

Fixed in:

9.0.111-150200.96.1

SUSE:Manager Server LTS 4.3tomcat-webapps

Fixed in:

9.0.111-150200.96.1

openSUSE:Leap 15.6tomcat

Fixed in:

9.0.111-150200.96.1

openSUSE:Leap 15.6tomcat-admin-webapps

Fixed in:

9.0.111-150200.96.1

openSUSE:Leap 15.6tomcat-docs-webapp

Fixed in:

9.0.111-150200.96.1

openSUSE:Leap 15.6tomcat-el-3_0-api

Fixed in:

9.0.111-150200.96.1

openSUSE:Leap 15.6tomcat-embed

Fixed in:

9.0.111-150200.96.1

openSUSE:Leap 15.6tomcat-javadoc

Fixed in:

9.0.111-150200.96.1

openSUSE:Leap 15.6tomcat-jsp-2_3-api

Fixed in:

9.0.111-150200.96.1

openSUSE:Leap 15.6tomcat-jsvc

Fixed in:

9.0.111-150200.96.1

openSUSE:Leap 15.6tomcat-lib

Fixed in:

9.0.111-150200.96.1

openSUSE:Leap 15.6tomcat-servlet-4_0-api

Fixed in:

9.0.111-150200.96.1

openSUSE:Leap 15.6tomcat-webapps

Fixed in:

9.0.111-150200.96.1

References

REPORThttps://bugzilla.suse.com/1252753 REPORThttps://bugzilla.suse.com/1252756 REPORThttps://bugzilla.suse.com/1252905 WEBhttps://www.suse.com/security/cve/CVE-2025-55752 WEBhttps://www.suse.com/security/cve/CVE-2025-55754 WEBhttps://www.suse.com/security/cve/CVE-2025-61795 ADVISORYhttps://www.suse.com/support/update/announcement/2025/suse-su-20254159-1/

Upstream

CVE-2025-55752 CVE-2025-55754 CVE-2025-61795

Ecosystems

Timeline

PublishedNov 21, 2025

ModifiedNov 21, 2025

SUSE-SU-2025:4159-1

Details

Affected Packages

References

Upstream

Related

Ecosystems

Timeline