CVE-2018-1336

State: Published
Severity: Not scored
Published: Aug 2, 2018
Updated: Nov 14, 2024
Reserved: Dec 7, 2017

Description

An improper handing of overflow in the UTF-8 decoder with supplementary characters can lead to an infinite loop in the decoder causing a Denial of Service. Versions Affected: Apache Tomcat 9.0.0.M9 to 9.0.7, 8.5.0 to 8.5.30, 8.0.0.RC1 to 8.0.51, and 7.0.28 to 7.0.86.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
Apache TomcatApache Software Foundation	9.0.0.M9 to 9.0.7Affected 8.5.0 to 8.5.30Affected 8.0.0.RC1 to 8.0.51Affected 7.0.28 to 7.0.86Affected

References

USN-3723-1vendor-advisory
104898vdb-entry
RHSA-2018:2740vendor-advisory
RHSA-2018:2741vendor-advisory
RHSA-2018:2921vendor-advisory
RHSA-2018:2742vendor-advisory
DSA-4281vendor-advisory
RHSA-2018:2945vendor-advisory
RHSA-2018:2939vendor-advisory
RHSA-2018:2701vendor-advisory
https://security.netapp.com/advisory/ntap-20180817-0001/
RHEA-2018:2188vendor-advisory
[www-announce] 20180722 [SECURITY] CVE-2018-1336 Apache Tomcat - Denial of Servicemailing-list
RHEA-2018:2189vendor-advisory
RHSA-2018:2743vendor-advisory
RHSA-2018:2700vendor-advisory
[debian-lts-announce] 20180902 [SECURITY] [DLA 1491-1] tomcat8 security updatemailing-list
RHSA-2018:3768vendor-advisory
RHSA-2018:2930vendor-advisory
1041375vdb-entry
[tomcat-dev] 20190319 svn commit: r1855831 [24/30] - in /tomcat/site/trunk: ./ docs/ xdocs/mailing-list
[tomcat-dev] 20190319 svn commit: r1855831 [25/30] - in /tomcat/site/trunk: ./ docs/ xdocs/mailing-list
[tomcat-dev] 20190325 svn commit: r1856174 [22/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/mailing-list
[tomcat-dev] 20190325 svn commit: r1856174 [23/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/mailing-list
[tomcat-dev] 20190325 svn commit: r1856174 [24/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/mailing-list
[tomcat-dev] 20190413 svn commit: r1857494 [17/20] - in /tomcat/site/trunk: ./ docs/ xdocs/mailing-list
[tomcat-dev] 20190413 svn commit: r1857496 [3/4] - in /tomcat/site/trunk: ./ docs/ xdocs/mailing-list
[tomcat-dev] 20190413 svn commit: r1857494 [16/20] - in /tomcat/site/trunk: ./ docs/ xdocs/mailing-list
[tomcat-dev] 20190415 svn commit: r1857582 [18/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/mailing-list
[tomcat-dev] 20190415 svn commit: r1857582 [17/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/mailing-list
[tomcat-dev] 20190415 svn commit: r1857582 [19/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/mailing-list
https://support.f5.com/csp/article/K73008537?utm_source=f5support&amp%3Butm_medium=RSS
[tomcat-dev] 20200203 svn commit: r1873527 [24/30] - /tomcat/site/trunk/docs/mailing-list
[tomcat-dev] 20200203 svn commit: r1873527 [25/30] - /tomcat/site/trunk/docs/mailing-list
[tomcat-dev] 20200213 svn commit: r1873980 [27/34] - /tomcat/site/trunk/docs/mailing-list
[tomcat-dev] 20200213 svn commit: r1873980 [28/34] - /tomcat/site/trunk/docs/mailing-list
[tomcat-dev] 20200213 svn commit: r1873980 [29/34] - /tomcat/site/trunk/docs/mailing-list
https://www.oracle.com/security-alerts/cpuapr2020.html

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.