The following problems were fixed in Apache Tomcat version 7.0.28:
Important: Denial of service CVE-2012-2733
The checks that limited the permitted size of request headers were implemented too late in the request parsing process for the HTTP NIO connector. This enabled a malicious user to trigger an OutOfMemoryError by sending a single request with very large headers.This was fixed in revision 1350301.
Important: Denial of service CVE-2012-4534
When using the NIO connector with sendfile and HTTPS enabled, if a client breaks the connection while reading the response an infinite loop is entered leading to a denial of service. This was originally reported as bug 52858. This was fixed in revision 1340218.
Affected Apache Tomcat versions (7.0.0 - 7.0.27).
- Important: Denial of service CVE-2012-2733
- Upgrade to the latest version of Apache Tomcat.
- WordPress Plugin Contact Form Builder by Contact Bank Unspecified Vulnerability (2.1.26)
- WordPress 4.0.x Cross-Site Scripting Vulnerability (4.0 - 4.0.8)
- WordPress Plugin Captcha by BestWebSoft Security Bypass (4.0.6)
- WordPress Plugin Video Embed & Thumbnail Generator Information Disclosure (1.1)
- WordPress Plugin Answer My Question Multiple Cross-Site Scripting Vulnerabilities (1.1)