[<prev] [next>] [day] [month] [year] [list]
Message-ID: <3123d598-6089-42d7-802b-3720ce114ecf@apache.org>
Date: Mon, 16 Jun 2025 15:22:54 +0100
From: Mark Thomas <markt@...che.org>
To: oss-security@...ts.openwall.com
Subject: CVE-2025-49124: Apache Tomcat: exe side-loading via icalcs.exe in
Tomcat installer for Windows
Severity: low
Affected versions:
- Apache Tomcat 11.0.0-M1 through 11.0.7
- Apache Tomcat 10.1.0 through 10.1.41
- Apache Tomcat 9.0.23 through 9.0.105
Description:
Untrusted Search Path vulnerability in Apache Tomcat installer for
Windows. During installation, the Tomcat installer for Windows used
icacls.exe without specifying a full path.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from
10.1.0 through 10.1.41, from 9.0.23 through 9.0.105.
Users are recommended to upgrade to version 11.0.8, 10.1.42 or 9.0.106,
which fix the issue.
Credit:
T. Doğa Gelişli https://linkedin.com/in/tdogagelisli/ (finder)
References:
https://lists.apache.org/thread/lnow7tt2j6hb9kcpkggx32ht6o90vqzv
https://tomcat.apache.org/
https://www.cve.org/CVERecord?id=CVE-2025-49124
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
