CVE-2013-2185 SUSE CVE security@suse.de SUSE Security Team SUSE CVE-2013-2185 Interim 1 20 2025-11-05T05:24:11Z current 2021-05-30T13:11:43Z 2025-11-05T05:24:11Z cve-database/bin/generate-cvrf-cve.pl 2020-12-27T01:00:00Z CVE-2013-2185 The readObject method in the DiskFileItem class in Apache Tomcat and JBoss Web, as used in Red Hat JBoss Enterprise Application Platform 6.1.0 and Red Hat JBoss Portal 6.0.0, allows remote attackers to write to arbitrary files via a NULL byte in a file name in a serialized instance, a similar issue to CVE-2013-2186. NOTE: this issue is reportedly disputed by the Apache Tomcat team, although Red Hat considers it a vulnerability. The dispute appears to regard whether it is the responsibility of applications to avoid providing untrusted data to be deserialized, or whether this class should inherently protect against this issue The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). https://www.suse.com/support/security/rating/ SUSE Security Ratings SLES for SAP Applications 11 SP3 SUSE Linux Enterprise High Performance Computing 12 SP4 SUSE Linux Enterprise Module for Web and Scripting 15 SUSE Linux Enterprise Server 11 SP1 for Teradata SUSE Linux Enterprise Server 11 SP3 LTSS SUSE Linux Enterprise Server 11 SP3 for Teradata SUSE Linux Enterprise Server 11 SP4 LTSS SUSE Linux Enterprise Server 12 SP2-LTSS SUSE Linux Enterprise Server 12 SP3 SUSE Linux Enterprise Server 12 SP4 SUSE Linux Enterprise Server 12-LTSS SUSE Linux Enterprise Module for Web and Scripting 15 SUSE Linux Enterprise Server for SAP Applications 12 SUSE Linux Enterprise Server for SAP Applications 12 SP2 SUSE Linux Enterprise Server for SAP Applications 12 SP4 SUSE Linux Enterprise Module for Web and Scripting 15 tomcat tomcat-admin-webapps tomcat-docs-webapp tomcat-el-2_2-api tomcat-el-3_0-api tomcat-javadoc tomcat-jsp-2_2-api tomcat-jsp-2_3-api tomcat-lib tomcat-servlet-3_0-api tomcat-servlet-3_1-api tomcat-servlet-4_0-api tomcat-webapps tomcat6 tomcat6 as a component of SLES for SAP Applications 11 SP3 tomcat as a component of SUSE Linux Enterprise High Performance Computing 12 SP4 tomcat as a component of SUSE Linux Enterprise Module for Web and Scripting 15 tomcat-admin-webapps as a component of SUSE Linux Enterprise Module for Web and Scripting 15 tomcat-el-3_0-api as a component of SUSE Linux Enterprise Module for Web and Scripting 15 tomcat-jsp-2_3-api as a component of SUSE Linux Enterprise Module for Web and Scripting 15 tomcat-lib as a component of SUSE Linux Enterprise Module for Web and Scripting 15 tomcat-servlet-4_0-api as a component of SUSE Linux Enterprise Module for Web and Scripting 15 tomcat-webapps as a component of SUSE Linux Enterprise Module for Web and Scripting 15 tomcat6 as a component of SUSE Linux Enterprise Server 11 SP1 for Teradata tomcat6 as a component of SUSE Linux Enterprise Server 11 SP3 LTSS tomcat6 as a component of SUSE Linux Enterprise Server 11 SP3 for Teradata tomcat6 as a component of SUSE Linux Enterprise Server 11 SP4 LTSS tomcat as a component of SUSE Linux Enterprise Server 12 SP2-LTSS tomcat-admin-webapps as a component of SUSE Linux Enterprise Server 12 SP2-LTSS tomcat-docs-webapp as a component of SUSE Linux Enterprise Server 12 SP2-LTSS tomcat-el-3_0-api as a component of SUSE Linux Enterprise Server 12 SP2-LTSS tomcat-javadoc as a component of SUSE Linux Enterprise Server 12 SP2-LTSS tomcat-jsp-2_3-api as a component of SUSE Linux Enterprise Server 12 SP2-LTSS tomcat-lib as a component of SUSE Linux Enterprise Server 12 SP2-LTSS tomcat-servlet-3_1-api as a component of SUSE Linux Enterprise Server 12 SP2-LTSS tomcat-webapps as a component of SUSE Linux Enterprise Server 12 SP2-LTSS tomcat as a component of SUSE Linux Enterprise Server 12 SP3 tomcat-admin-webapps as a component of SUSE Linux Enterprise Server 12 SP3 tomcat-docs-webapp as a component of SUSE Linux Enterprise Server 12 SP3 tomcat-el-3_0-api as a component of SUSE Linux Enterprise Server 12 SP3 tomcat-javadoc as a component of SUSE Linux Enterprise Server 12 SP3 tomcat-jsp-2_3-api as a component of SUSE Linux Enterprise Server 12 SP3 tomcat-lib as a component of SUSE Linux Enterprise Server 12 SP3 tomcat-servlet-3_1-api as a component of SUSE Linux Enterprise Server 12 SP3 tomcat-webapps as a component of SUSE Linux Enterprise Server 12 SP3 tomcat as a component of SUSE Linux Enterprise Server 12 SP4 tomcat-admin-webapps as a component of SUSE Linux Enterprise Server 12 SP4 tomcat-docs-webapp as a component of SUSE Linux Enterprise Server 12 SP4 tomcat-el-3_0-api as a component of SUSE Linux Enterprise Server 12 SP4 tomcat-javadoc as a component of SUSE Linux Enterprise Server 12 SP4 tomcat-jsp-2_3-api as a component of SUSE Linux Enterprise Server 12 SP4 tomcat-lib as a component of SUSE Linux Enterprise Server 12 SP4 tomcat-servlet-4_0-api as a component of SUSE Linux Enterprise Server 12 SP4 tomcat-webapps as a component of SUSE Linux Enterprise Server 12 SP4 tomcat as a component of SUSE Linux Enterprise Server 12-LTSS tomcat-admin-webapps as a component of SUSE Linux Enterprise Server 12-LTSS tomcat-docs-webapp as a component of SUSE Linux Enterprise Server 12-LTSS tomcat-el-2_2-api as a component of SUSE Linux Enterprise Server 12-LTSS tomcat-javadoc as a component of SUSE Linux Enterprise Server 12-LTSS tomcat-jsp-2_2-api as a component of SUSE Linux Enterprise Server 12-LTSS tomcat-lib as a component of SUSE Linux Enterprise Server 12-LTSS tomcat-servlet-3_0-api as a component of SUSE Linux Enterprise Server 12-LTSS tomcat-webapps as a component of SUSE Linux Enterprise Server 12-LTSS tomcat as a component of SUSE Linux Enterprise Server for SAP Applications 12 tomcat as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP2 tomcat-admin-webapps as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP2 tomcat-docs-webapp as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP2 tomcat-el-3_0-api as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP2 tomcat-javadoc as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP2 tomcat-jsp-2_3-api as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP2 tomcat-lib as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP2 tomcat-servlet-3_1-api as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP2 tomcat-webapps as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP2 tomcat as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP4 tomcat-admin-webapps as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP4 tomcat-docs-webapp as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP4 tomcat-el-3_0-api as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP4 tomcat-javadoc as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP4 tomcat-jsp-2_3-api as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP4 tomcat-lib as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP4 tomcat-servlet-4_0-api as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP4 tomcat-webapps as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP4 The readObject method in the DiskFileItem class in Apache Tomcat and JBoss Web, as used in Red Hat JBoss Enterprise Application Platform 6.1.0 and Red Hat JBoss Portal 6.0.0, allows remote attackers to write to arbitrary files via a NULL byte in a file name in a serialized instance, a similar issue to CVE-2013-2186. NOTE: this issue is reportedly disputed by the Apache Tomcat team, although Red Hat considers it a vulnerability. The dispute appears to regard whether it is the responsibility of applications to avoid providing untrusted data to be deserialized, or whether this class should inherently protect against this issue CVE-2013-2185 SLES for SAP Applications 11 SP3:tomcat6 SUSE Linux Enterprise High Performance Computing 12 SP4:tomcat SUSE Linux Enterprise Module for Web and Scripting 15:tomcat SUSE Linux Enterprise Module for Web and Scripting 15:tomcat-admin-webapps SUSE Linux Enterprise Module for Web and Scripting 15:tomcat-el-3_0-api SUSE Linux Enterprise Module for Web and Scripting 15:tomcat-jsp-2_3-api SUSE Linux Enterprise Module for Web and Scripting 15:tomcat-lib SUSE Linux Enterprise Module for Web and Scripting 15:tomcat-servlet-4_0-api SUSE Linux Enterprise Module for Web and Scripting 15:tomcat-webapps SUSE Linux Enterprise Server 11 SP1 for Teradata:tomcat6 SUSE Linux Enterprise Server 11 SP3 LTSS:tomcat6 SUSE Linux Enterprise Server 11 SP3 for Teradata:tomcat6 SUSE Linux Enterprise Server 11 SP4 LTSS:tomcat6 SUSE Linux Enterprise Server 12 SP2-LTSS:tomcat SUSE Linux Enterprise Server 12 SP2-LTSS:tomcat-admin-webapps SUSE Linux Enterprise Server 12 SP2-LTSS:tomcat-docs-webapp SUSE Linux Enterprise Server 12 SP2-LTSS:tomcat-el-3_0-api SUSE Linux Enterprise Server 12 SP2-LTSS:tomcat-javadoc SUSE Linux Enterprise Server 12 SP2-LTSS:tomcat-jsp-2_3-api SUSE Linux Enterprise Server 12 SP2-LTSS:tomcat-lib SUSE Linux Enterprise Server 12 SP2-LTSS:tomcat-servlet-3_1-api SUSE Linux Enterprise Server 12 SP2-LTSS:tomcat-webapps SUSE Linux Enterprise Server 12 SP3:tomcat SUSE Linux Enterprise Server 12 SP3:tomcat-admin-webapps SUSE Linux Enterprise Server 12 SP3:tomcat-docs-webapp SUSE Linux Enterprise Server 12 SP3:tomcat-el-3_0-api SUSE Linux Enterprise Server 12 SP3:tomcat-javadoc SUSE Linux Enterprise Server 12 SP3:tomcat-jsp-2_3-api SUSE Linux Enterprise Server 12 SP3:tomcat-lib SUSE Linux Enterprise Server 12 SP3:tomcat-servlet-3_1-api SUSE Linux Enterprise Server 12 SP3:tomcat-webapps SUSE Linux Enterprise Server 12 SP4:tomcat SUSE Linux Enterprise Server 12 SP4:tomcat-admin-webapps SUSE Linux Enterprise Server 12 SP4:tomcat-docs-webapp SUSE Linux Enterprise Server 12 SP4:tomcat-el-3_0-api SUSE Linux Enterprise Server 12 SP4:tomcat-javadoc SUSE Linux Enterprise Server 12 SP4:tomcat-jsp-2_3-api SUSE Linux Enterprise Server 12 SP4:tomcat-lib SUSE Linux Enterprise Server 12 SP4:tomcat-servlet-4_0-api SUSE Linux Enterprise Server 12 SP4:tomcat-webapps SUSE Linux Enterprise Server 12-LTSS:tomcat SUSE Linux Enterprise Server 12-LTSS:tomcat-admin-webapps SUSE Linux Enterprise Server 12-LTSS:tomcat-docs-webapp SUSE Linux Enterprise Server 12-LTSS:tomcat-el-2_2-api SUSE Linux Enterprise Server 12-LTSS:tomcat-javadoc SUSE Linux Enterprise Server 12-LTSS:tomcat-jsp-2_2-api SUSE Linux Enterprise Server 12-LTSS:tomcat-lib SUSE Linux Enterprise Server 12-LTSS:tomcat-servlet-3_0-api SUSE Linux Enterprise Server 12-LTSS:tomcat-webapps SUSE Linux Enterprise Server for SAP Applications 12 SP2:tomcat SUSE Linux Enterprise Server for SAP Applications 12 SP2:tomcat-admin-webapps SUSE Linux Enterprise Server for SAP Applications 12 SP2:tomcat-docs-webapp SUSE Linux Enterprise Server for SAP Applications 12 SP2:tomcat-el-3_0-api SUSE Linux Enterprise Server for SAP Applications 12 SP2:tomcat-javadoc SUSE Linux Enterprise Server for SAP Applications 12 SP2:tomcat-jsp-2_3-api SUSE Linux Enterprise Server for SAP Applications 12 SP2:tomcat-lib SUSE Linux Enterprise Server for SAP Applications 12 SP2:tomcat-servlet-3_1-api SUSE Linux Enterprise Server for SAP Applications 12 SP2:tomcat-webapps SUSE Linux Enterprise Server for SAP Applications 12 SP4:tomcat SUSE Linux Enterprise Server for SAP Applications 12 SP4:tomcat-admin-webapps SUSE Linux Enterprise Server for SAP Applications 12 SP4:tomcat-docs-webapp SUSE Linux Enterprise Server for SAP Applications 12 SP4:tomcat-el-3_0-api SUSE Linux Enterprise Server for SAP Applications 12 SP4:tomcat-javadoc SUSE Linux Enterprise Server for SAP Applications 12 SP4:tomcat-jsp-2_3-api SUSE Linux Enterprise Server for SAP Applications 12 SP4:tomcat-lib SUSE Linux Enterprise Server for SAP Applications 12 SP4:tomcat-servlet-4_0-api SUSE Linux Enterprise Server for SAP Applications 12 SP4:tomcat-webapps SUSE Linux Enterprise Server for SAP Applications 12:tomcat important 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P