CVE - CVE-2018-1336 1/16/20, 2(34 PM

CVE List CNAs WGs Board About

News & Blog Go to for:
CVSS Scores
CPE Info
Advanced Search
Common Vulnerabilities and Exposures

Full-Screen View
CVE-ID

CVE-2018-1336 Learn more at National Vulnerability Database (NVD)

• CVSS Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings • CPE Information

Description
An improper handing of overflow in the UTF-8 decoder with supplementary characters can lead to an infinite loop in the decoder causing a Denial of
Service. Versions Affected: Apache Tomcat 9.0.0.M9 to 9.0.7, 8.5.0 to 8.5.30, 8.0.0.RC1 to 8.0.51, and 7.0.28 to 7.0.86.
References
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.

BID:104898
URL:http://www.securityfocus.com/bid/104898
CONFIRM:https://security.netapp.com/advisory/ntap-20180817-0001/
CONFIRM:https://support.f5.com/csp/article/K73008537?utm_source=f5support&utm_medium=RSS
DEBIAN:DSA-4281
URL:https://www.debian.org/security/2018/dsa-4281
MLIST:[debian-lts-announce] 20180902 [SECURITY] [DLA 1491-1] tomcat8 security update
URL:https://lists.debian.org/debian-lts-announce/2018/09/msg00001.html
MLIST:[tomcat-dev] 20190319 svn commit: r1855831 [24/30] - in /tomcat/site/trunk: ./ docs/ xdocs/
URL:https://lists.apache.org/thread.html/eb6efa8d59c45a7a9eff94c4b925467d3b3fec8ba7697f3daa314b04@%3Cdev.tomcat.apache.org%3E
MLIST:[tomcat-dev] 20190319 svn commit: r1855831 [25/30] - in /tomcat/site/trunk: ./ docs/ xdocs/
URL:https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551@%3Cdev.tomcat.apache.org%3E
MLIST:[tomcat-dev] 20190325 svn commit: r1856174 [22/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/
URL:https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708@%3Cdev.tomcat.apache.org%3E
MLIST:[tomcat-dev] 20190325 svn commit: r1856174 [23/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/
URL:https://lists.apache.org/thread.html/5c0e00fd31efc11e147bf99d0f03c00a734447d3b131ab0818644cdb@%3Cdev.tomcat.apache.org%3E
MLIST:[tomcat-dev] 20190325 svn commit: r1856174 [24/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/
URL:https://lists.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc@%3Cdev.tomcat.apache.org%3E
MLIST:[tomcat-dev] 20190413 svn commit: r1857494 [16/20] - in /tomcat/site/trunk: ./ docs/ xdocs/
URL:https://lists.apache.org/thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c77424@%3Cdev.tomcat.apache.org%3E
MLIST:[tomcat-dev] 20190413 svn commit: r1857494 [17/20] - in /tomcat/site/trunk: ./ docs/ xdocs/
URL:https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a@%3Cdev.tomcat.apache.org%3E
MLIST:[tomcat-dev] 20190413 svn commit: r1857496 [3/4] - in /tomcat/site/trunk: ./ docs/ xdocs/
URL:https://lists.apache.org/thread.html/e85e83e9954f169bbb77b44baae5a33d8de878df557bb32b7f793661@%3Cdev.tomcat.apache.org%3E
MLIST:[tomcat-dev] 20190415 svn commit: r1857582 [17/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/
URL:https://lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7@%3Cdev.tomcat.apache.org%3E
MLIST:[tomcat-dev] 20190415 svn commit: r1857582 [18/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/
URL:https://lists.apache.org/thread.html/1dd0a59c1295cc08ce4c9e7edae5ad2268acc9ba55adcefa0532e5ba@%3Cdev.tomcat.apache.org%3E
MLIST:[tomcat-dev] 20190415 svn commit: r1857582 [19/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/
URL:https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3@%3Cdev.tomcat.apache.org%3E
MLIST:[www-announce] 20180722 [SECURITY] CVE-2018-1336 Apache Tomcat - Denial of Service
URL:http://mail-archives.us.apache.org/mod_mbox/www-
announce/201807.mbox/%3C20180722090435.GA60759%40minotaur.apache.org%3E
REDHAT:RHEA-2018:2188
URL:https://access.redhat.com/errata/RHEA-2018:2188
REDHAT:RHEA-2018:2189
URL:https://access.redhat.com/errata/RHEA-2018:2189
REDHAT:RHSA-2018:2700
URL:https://access.redhat.com/errata/RHSA-2018:2700
REDHAT:RHSA-2018:2701
URL:https://access.redhat.com/errata/RHSA-2018:2701
REDHAT:RHSA-2018:2740

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1336 Page 1 of 2
CVE - CVE-2018-1336 1/16/20, 2(34 PM

URL:https://access.redhat.com/errata/RHSA-2018:2740
REDHAT:RHSA-2018:2741
URL:https://access.redhat.com/errata/RHSA-2018:2741
REDHAT:RHSA-2018:2742
URL:https://access.redhat.com/errata/RHSA-2018:2742
REDHAT:RHSA-2018:2743
URL:https://access.redhat.com/errata/RHSA-2018:2743
REDHAT:RHSA-2018:2921
URL:https://access.redhat.com/errata/RHSA-2018:2921
REDHAT:RHSA-2018:2930
URL:https://access.redhat.com/errata/RHSA-2018:2930
REDHAT:RHSA-2018:2939
URL:https://access.redhat.com/errata/RHSA-2018:2939
REDHAT:RHSA-2018:2945
URL:https://access.redhat.com/errata/RHSA-2018:2945
REDHAT:RHSA-2018:3768
URL:https://access.redhat.com/errata/RHSA-2018:3768
SECTRACK:1041375
URL:http://www.securitytracker.com/id/1041375
UBUNTU:USN-3723-1
URL:https://usn.ubuntu.com/3723-1/

Assigning CNA
Apache Software Foundation
Date Entry Created
20171207 Disclaimer: The entry creation date may reflect when the CVE ID was allocated or reserved, and does not necessarily
indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.
Phase (Legacy)
Assigned (20171207)
Votes (Legacy)

Comments (Legacy)

Proposed (Legacy)
N/A
This is an entry on the CVE List, which provides common identifiers for publicly known cybersecurity vulnerabilities.

SEARCH CVE USING KEYWORDS: Submit

You can also search by reference using the CVE Reference Maps.

For More Information: CVE Request Web Form (select “Other” from dropdown)

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1336 Page 2 of 2