CVE-2016-3092: apache commons_fileupload Improper Input Validation

Modified

AliasesMGASA-2016-0260RHSA-2016:2068RHSA-2016:2069+10 more

Published 04-07-2016Last modified 07-10-2026

Vulnerability summary

CVE-2016-3092 is a high (CVSS 7.8) Improper Input Validation vulnerability in apache commons_fileupload. EPSS estimates a 37.17% chance of exploitation in the next 30 days, higher than 98.5% of scored vulnerabilities.

Priority

Prioritisesevere

Severe, CVSS 7.5 (CVE.org); no exploitation reported by the 5 checked sources; EPSS 37% (FIRST, 03-11-2026)

Source freshness unavailable

How is this decided?

CVSS score

7.8/10

010

High · v2.0 (NVD)

EPSS score

37.17%

0%100%

High · +1.24 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 12 · Related 7

DSA-3609-1 OPENSUSE-SU-2024:10446-1 OPENSUSE-SU-2024:13441-1 RHSA-2016:2599 RHSA-2016:2807 RHSA-2017:0455+6 more

Timeline

04-07-2016
PublishedVulnerability first disclosed.
07-10-2026
Last modifiedVulnerability information updated.

Description

The MultipartStream class in Apache Commons Fileupload before 1.3.2, as used in Apache Tomcat 7.x before 7.0.70, 8.x before 8.0.36, 8.5.x before 8.5.3, and 9.x before 9.0.0.M7 and other products, allows remote attackers to cause a denial of service (CPU consumption) via a long boundary string.

CVSS metrics

9 scores · 6 sources · 3 versions

v3.17.5v3.07.5v2.07.8

EPSS trend

Probability

37.17%

Chance of exploitation in the next 30 days

Percentile

99%

Versus all other CVEs

30-day change

Increase +1.24 pp

From 35.93% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-20Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Redhat72 products

apache-cxf< 0:2.7.18-4.SP3_redhat_1.1.ep6.el6 | < 0:2.7.18-4.SP3_redhat_1.1.ep6.el7 | < 0:2.7.18-4.SP3_redhat_1.1.ep6.el5
hornetq< 0:2.3.25-16.SP14_redhat_1.1.ep6.el6 | < 0:2.3.25-16.SP14_redhat_1.1.ep6.el7 | < 0:2.3.25-16.SP14_redhat_1.1.ep6.el5
jboss-as-appclient< 0:7.5.11-1.Final_redhat_1.1.ep6.el6 | < 0:7.5.11-1.Final_redhat_1.1.ep6.el7 | < 0:7.5.11-1.Final_redhat_1.1.ep6.el5
jboss-as-cli< 0:7.5.11-1.Final_redhat_1.1.ep6.el6 | < 0:7.5.11-1.Final_redhat_1.1.ep6.el7 | < 0:7.5.11-1.Final_redhat_1.1.ep6.el5
jboss-as-client-all< 0:7.5.11-1.Final_redhat_1.1.ep6.el6 | < 0:7.5.11-1.Final_redhat_1.1.ep6.el7 | < 0:7.5.11-1.Final_redhat_1.1.ep6.el5

jboss-as-clustering< 0:7.5.11-1.Final_redhat_1.1.ep6.el6 | < 0:7.5.11-1.Final_redhat_1.1.ep6.el7 | < 0:7.5.11-1.Final_redhat_1.1.ep6.el5
jboss-as-cmp< 0:7.5.11-1.Final_redhat_1.1.ep6.el6 | < 0:7.5.11-1.Final_redhat_1.1.ep6.el7 | < 0:7.5.11-1.Final_redhat_1.1.ep6.el5
jboss-as-configadmin< 0:7.5.11-1.Final_redhat_1.1.ep6.el6 | < 0:7.5.11-1.Final_redhat_1.1.ep6.el7 | < 0:7.5.11-1.Final_redhat_1.1.ep6.el5
jboss-as-connector< 0:7.5.11-1.Final_redhat_1.1.ep6.el6 | < 0:7.5.11-1.Final_redhat_1.1.ep6.el7 | < 0:7.5.11-1.Final_redhat_1.1.ep6.el5
jboss-as-controller< 0:7.5.11-1.Final_redhat_1.1.ep6.el6 | < 0:7.5.11-1.Final_redhat_1.1.ep6.el7 | < 0:7.5.11-1.Final_redhat_1.1.ep6.el5
jboss-as-controller-client< 0:7.5.11-1.Final_redhat_1.1.ep6.el6 | < 0:7.5.11-1.Final_redhat_1.1.ep6.el7 | < 0:7.5.11-1.Final_redhat_1.1.ep6.el5
jboss-as-core-security< 0:7.5.11-1.Final_redhat_1.1.ep6.el6 | < 0:7.5.11-1.Final_redhat_1.1.ep6.el7 | < 0:7.5.11-1.Final_redhat_1.1.ep6.el5
jboss-as-deployment-repository< 0:7.5.11-1.Final_redhat_1.1.ep6.el6 | < 0:7.5.11-1.Final_redhat_1.1.ep6.el7 | < 0:7.5.11-1.Final_redhat_1.1.ep6.el5
jboss-as-deployment-scanner< 0:7.5.11-1.Final_redhat_1.1.ep6.el6 | < 0:7.5.11-1.Final_redhat_1.1.ep6.el7 | < 0:7.5.11-1.Final_redhat_1.1.ep6.el5
jboss-as-domain-http< 0:7.5.11-1.Final_redhat_1.1.ep6.el6 | < 0:7.5.11-1.Final_redhat_1.1.ep6.el7 | < 0:7.5.11-1.Final_redhat_1.1.ep6.el5
jboss-as-domain-management< 0:7.5.11-1.Final_redhat_1.1.ep6.el6 | < 0:7.5.11-1.Final_redhat_1.1.ep6.el7 | < 0:7.5.11-1.Final_redhat_1.1.ep6.el5
jboss-as-ee< 0:7.5.11-1.Final_redhat_1.1.ep6.el6 | < 0:7.5.11-1.Final_redhat_1.1.ep6.el7 | < 0:7.5.11-1.Final_redhat_1.1.ep6.el5
jboss-as-ee-deployment< 0:7.5.11-1.Final_redhat_1.1.ep6.el6 | < 0:7.5.11-1.Final_redhat_1.1.ep6.el7 | < 0:7.5.11-1.Final_redhat_1.1.ep6.el5
jboss-as-ejb3< 0:7.5.11-1.Final_redhat_1.1.ep6.el6 | < 0:7.5.11-1.Final_redhat_1.1.ep6.el7 | < 0:7.5.11-1.Final_redhat_1.1.ep6.el5
jboss-as-embedded< 0:7.5.11-1.Final_redhat_1.1.ep6.el6 | < 0:7.5.11-1.Final_redhat_1.1.ep6.el7 | < 0:7.5.11-1.Final_redhat_1.1.ep6.el5
jboss-as-host-controller< 0:7.5.11-1.Final_redhat_1.1.ep6.el6 | < 0:7.5.11-1.Final_redhat_1.1.ep6.el7 | < 0:7.5.11-1.Final_redhat_1.1.ep6.el5
jboss-as-jacorb< 0:7.5.11-1.Final_redhat_1.1.ep6.el6 | < 0:7.5.11-1.Final_redhat_1.1.ep6.el7 | < 0:7.5.11-1.Final_redhat_1.1.ep6.el5
jboss-as-jaxr< 0:7.5.11-1.Final_redhat_1.1.ep6.el6 | < 0:7.5.11-1.Final_redhat_1.1.ep6.el7 | < 0:7.5.11-1.Final_redhat_1.1.ep6.el5
jboss-as-jaxrs< 0:7.5.11-1.Final_redhat_1.1.ep6.el6 | < 0:7.5.11-1.Final_redhat_1.1.ep6.el7 | < 0:7.5.11-1.Final_redhat_1.1.ep6.el5
jboss-as-jdr< 0:7.5.11-1.Final_redhat_1.1.ep6.el6 | < 0:7.5.11-1.Final_redhat_1.1.ep6.el7 | < 0:7.5.11-1.Final_redhat_1.1.ep6.el5
jboss-as-jmx< 0:7.5.11-1.Final_redhat_1.1.ep6.el6 | < 0:7.5.11-1.Final_redhat_1.1.ep6.el7 | < 0:7.5.11-1.Final_redhat_1.1.ep6.el5
jboss-as-jpa< 0:7.5.11-1.Final_redhat_1.1.ep6.el6 | < 0:7.5.11-1.Final_redhat_1.1.ep6.el7 | < 0:7.5.11-1.Final_redhat_1.1.ep6.el5
jboss-as-jsf< 0:7.5.11-1.Final_redhat_1.1.ep6.el6 | < 0:7.5.11-1.Final_redhat_1.1.ep6.el7 | < 0:7.5.11-1.Final_redhat_1.1.ep6.el5
jboss-as-jsr77< 0:7.5.11-1.Final_redhat_1.1.ep6.el6 | < 0:7.5.11-1.Final_redhat_1.1.ep6.el7 | < 0:7.5.11-1.Final_redhat_1.1.ep6.el5
jboss-as-logging< 0:7.5.11-1.Final_redhat_1.1.ep6.el6 | < 0:7.5.11-1.Final_redhat_1.1.ep6.el7 | < 0:7.5.11-1.Final_redhat_1.1.ep6.el5
jboss-as-mail< 0:7.5.11-1.Final_redhat_1.1.ep6.el6 | < 0:7.5.11-1.Final_redhat_1.1.ep6.el7 | < 0:7.5.11-1.Final_redhat_1.1.ep6.el5
jboss-as-management-client-content< 0:7.5.11-1.Final_redhat_1.1.ep6.el6 | < 0:7.5.11-1.Final_redhat_1.1.ep6.el7 | < 0:7.5.11-1.Final_redhat_1.1.ep6.el5
jboss-as-messaging< 0:7.5.11-1.Final_redhat_1.1.ep6.el6 | < 0:7.5.11-1.Final_redhat_1.1.ep6.el7 | < 0:7.5.11-1.Final_redhat_1.1.ep6.el5
jboss-as-modcluster< 0:7.5.11-1.Final_redhat_1.1.ep6.el6 | < 0:7.5.11-1.Final_redhat_1.1.ep6.el7 | < 0:7.5.11-1.Final_redhat_1.1.ep6.el5
jboss-as-naming< 0:7.5.11-1.Final_redhat_1.1.ep6.el6 | < 0:7.5.11-1.Final_redhat_1.1.ep6.el7 | < 0:7.5.11-1.Final_redhat_1.1.ep6.el5
jboss-as-network< 0:7.5.11-1.Final_redhat_1.1.ep6.el6 | < 0:7.5.11-1.Final_redhat_1.1.ep6.el7 | < 0:7.5.11-1.Final_redhat_1.1.ep6.el5
jboss-as-osgi< 0:7.5.11-1.Final_redhat_1.1.ep6.el6 | < 0:7.5.11-1.Final_redhat_1.1.ep6.el7 | < 0:7.5.11-1.Final_redhat_1.1.ep6.el5
jboss-as-osgi-configadmin< 0:7.5.11-1.Final_redhat_1.1.ep6.el6 | < 0:7.5.11-1.Final_redhat_1.1.ep6.el7 | < 0:7.5.11-1.Final_redhat_1.1.ep6.el5
jboss-as-osgi-service< 0:7.5.11-1.Final_redhat_1.1.ep6.el6 | < 0:7.5.11-1.Final_redhat_1.1.ep6.el7 | < 0:7.5.11-1.Final_redhat_1.1.ep6.el5
jboss-as-picketlink< 0:7.5.11-1.Final_redhat_1.1.ep6.el6 | < 0:7.5.11-1.Final_redhat_1.1.ep6.el7 | < 0:7.5.11-1.Final_redhat_1.1.ep6.el5
jboss-as-platform-mbean< 0:7.5.11-1.Final_redhat_1.1.ep6.el6 | < 0:7.5.11-1.Final_redhat_1.1.ep6.el7 | < 0:7.5.11-1.Final_redhat_1.1.ep6.el5
jboss-as-pojo< 0:7.5.11-1.Final_redhat_1.1.ep6.el6 | < 0:7.5.11-1.Final_redhat_1.1.ep6.el7 | < 0:7.5.11-1.Final_redhat_1.1.ep6.el5
jboss-as-process-controller< 0:7.5.11-1.Final_redhat_1.1.ep6.el6 | < 0:7.5.11-1.Final_redhat_1.1.ep6.el7 | < 0:7.5.11-1.Final_redhat_1.1.ep6.el5
jboss-as-protocol< 0:7.5.11-1.Final_redhat_1.1.ep6.el6 | < 0:7.5.11-1.Final_redhat_1.1.ep6.el7 | < 0:7.5.11-1.Final_redhat_1.1.ep6.el5
jboss-as-remoting< 0:7.5.11-1.Final_redhat_1.1.ep6.el6 | < 0:7.5.11-1.Final_redhat_1.1.ep6.el7 | < 0:7.5.11-1.Final_redhat_1.1.ep6.el5
jboss-as-sar< 0:7.5.11-1.Final_redhat_1.1.ep6.el6 | < 0:7.5.11-1.Final_redhat_1.1.ep6.el7 | < 0:7.5.11-1.Final_redhat_1.1.ep6.el5
jboss-as-security< 0:7.5.11-1.Final_redhat_1.1.ep6.el6 | < 0:7.5.11-1.Final_redhat_1.1.ep6.el7 | < 0:7.5.11-1.Final_redhat_1.1.ep6.el5
jboss-as-server< 0:7.5.11-1.Final_redhat_1.1.ep6.el6 | < 0:7.5.11-1.Final_redhat_1.1.ep6.el7 | < 0:7.5.11-1.Final_redhat_1.1.ep6.el5
jboss-as-system-jmx< 0:7.5.11-1.Final_redhat_1.1.ep6.el6 | < 0:7.5.11-1.Final_redhat_1.1.ep6.el7 | < 0:7.5.11-1.Final_redhat_1.1.ep6.el5
jboss-as-threads< 0:7.5.11-1.Final_redhat_1.1.ep6.el6 | < 0:7.5.11-1.Final_redhat_1.1.ep6.el7 | < 0:7.5.11-1.Final_redhat_1.1.ep6.el5
jboss-as-transactions< 0:7.5.11-1.Final_redhat_1.1.ep6.el6 | < 0:7.5.11-1.Final_redhat_1.1.ep6.el7 | < 0:7.5.11-1.Final_redhat_1.1.ep6.el5
jboss-as-version< 0:7.5.11-1.Final_redhat_1.1.ep6.el6 | < 0:7.5.11-1.Final_redhat_1.1.ep6.el7 | < 0:7.5.11-1.Final_redhat_1.1.ep6.el5
jboss-as-web< 0:7.5.11-1.Final_redhat_1.1.ep6.el6 | < 0:7.5.11-1.Final_redhat_1.1.ep6.el7 | < 0:7.5.11-1.Final_redhat_1.1.ep6.el5
jboss-as-webservices< 0:7.5.11-1.Final_redhat_1.1.ep6.el6 | < 0:7.5.11-1.Final_redhat_1.1.ep6.el7 | < 0:7.5.11-1.Final_redhat_1.1.ep6.el5
jboss-as-weld< 0:7.5.11-1.Final_redhat_1.1.ep6.el6 | < 0:7.5.11-1.Final_redhat_1.1.ep6.el7 | < 0:7.5.11-1.Final_redhat_1.1.ep6.el5
jboss-as-xts< 0:7.5.11-1.Final_redhat_1.1.ep6.el6 | < 0:7.5.11-1.Final_redhat_1.1.ep6.el7 | < 0:7.5.11-1.Final_redhat_1.1.ep6.el5
jboss-ec2-eap< 0:7.5.11-1.Final_redhat_1.ep6.el6
jboss-ec2-eap-samples< 0:7.5.11-1.Final_redhat_1.ep6.el6
jboss-remote-naming< 0:1.0.13-1.Final_redhat_1.1.ep6.el6 | < 0:1.0.13-1.Final_redhat_1.1.ep6.el7 | < 0:1.0.13-1.Final_redhat_1.1.ep6.el5
jbossas-appclient< 0:7.5.11-1.Final_redhat_1.1.ep6.el6 | < 0:7.5.11-1.Final_redhat_1.1.ep6.el7 | < 0:7.5.11-1.Final_redhat_1.1.ep6.el5
jbossas-bundles< 0:7.5.11-1.Final_redhat_1.1.ep6.el6 | < 0:7.5.11-1.Final_redhat_1.1.ep6.el7 | < 0:7.5.11-1.Final_redhat_1.1.ep6.el5
jbossas-core< 0:7.5.11-1.Final_redhat_1.1.ep6.el6 | < 0:7.5.11-1.Final_redhat_1.1.ep6.el7 | < 0:7.5.11-1.Final_redhat_1.1.ep6.el5
jbossas-domain< 0:7.5.11-1.Final_redhat_1.1.ep6.el6 | < 0:7.5.11-1.Final_redhat_1.1.ep6.el7 | < 0:7.5.11-1.Final_redhat_1.1.ep6.el5
jbossas-javadocs< 0:7.5.11-1.Final_redhat_1.1.ep6.el6 | < 0:7.5.11-1.Final_redhat_1.1.ep6.el7 | < 0:7.5.11-1.Final_redhat_1.1.ep6.el5
jbossas-modules-eap< 0:7.5.11-2.Final_redhat_1.1.ep6.el6 | < 0:7.5.11-2.Final_redhat_1.1.ep6.el7 | < 0:7.5.11-2.Final_redhat_1.1.ep6.el5
jbossas-product-eap< 0:7.5.11-1.Final_redhat_1.1.ep6.el6 | < 0:7.5.11-1.Final_redhat_1.1.ep6.el7 | < 0:7.5.11-1.Final_redhat_1.1.ep6.el5
jbossas-standalone< 0:7.5.11-1.Final_redhat_1.1.ep6.el6 | < 0:7.5.11-1.Final_redhat_1.1.ep6.el7 | < 0:7.5.11-1.Final_redhat_1.1.ep6.el5
jbossas-welcome-content-eap< 0:7.5.11-1.Final_redhat_1.1.ep6.el6 | < 0:7.5.11-1.Final_redhat_1.1.ep6.el7 | < 0:7.5.11-1.Final_redhat_1.1.ep6.el5
jbossts< 1:4.17.35-1.Final_redhat_1.1.ep6.el6 | < 1:4.17.35-1.Final_redhat_1.1.ep6.el7 | < 1:4.17.35-1.Final_redhat_1.1.ep6.el5
jbossweb< 0:7.5.19-1.Final_redhat_1.1.ep6.el6 | < 0:7.5.19-1.Final_redhat_1.1.ep6.el7 | < 0:7.5.19-1.Final_redhat_1.1.ep6.el5
picketlink-bindings< 0:2.5.4-13.SP11_redhat_1.1.ep6.el6 | < 0:2.5.4-13.SP11_redhat_1.1.ep6.el7 | < 0:2.5.4-13.SP11_redhat_1.1.ep6.el5
picketlink-federation< 0:2.5.4-13.SP11_redhat_1.1.ep6.el6 | < 0:2.5.4-13.SP11_redhat_1.1.ep6.el7 | < 0:2.5.4-13.SP11_redhat_1.1.ep6.el5

Show all 72

Ubuntu4 products

libcommons-fileupload-java< 1.3.1-2ubuntu0.1
tomcat6< 6.0.39-1ubuntu0.1+esm1
tomcat7< 7.0.52-1ubuntu0.6 | < 7.0.68-1ubuntu0.1
tomcat8< 8.0.32-1ubuntu1.1

Debian3 products

libcommons-fileupload-java< 1.3.2-1 | < 1.3.1-1+deb8u1 | < 1.2.2-1+deb7u3
tomcat7< 7.0.56-3+deb8u3 | < 7.0.28-4+deb7u5
debian_linuxEOL8.0

Apache2 products

commons_fileupload≤ 1.3.1
tomcatEOL9.0.0:milestone1 | 9.0.0:milestone3 | 9.0.0:milestone4 | 9.0.0:milestone6 | 8.0.0:rc1 | 8.0.0:rc10 | 8.0.0:rc2 | 8.0.0:rc5 | 8.0.1 | 8.0.3 | 8.0.5 | 8.0.8 | 8.0.11 | 8.0.12 | 8.0.14 | 8.0.15 | 8.0.17 | 8.0.18 | 8.0.20 | 8.0.21 | 8.0.22 | 8.0.23 | 8.0.24 | 8.0.26 | 8.0.27 | 8.0.28 | 8.0.29 | 8.0.30 | 8.0.32 | 8.0.33 | 8.0.35 | 8.5.0 | 8.5.2 | 7.0.0 | 7.0.0:beta | 7.0.1 | 7.0.2 | 7.0.2:beta | 7.0.4 | 7.0.4:beta | 7.0.5 | 7.0.5:beta | 7.0.6 | 7.0.8 | 7.0.10 | 7.0.11 | 7.0.12 | 7.0.14 | 7.0.16 | 7.0.19 | 7.0.20 | 7.0.21 | 7.0.22 | 7.0.23 | 7.0.25 | 7.0.26 | 7.0.27 | 7.0.28 | 7.0.29 | 7.0.30 | 7.0.32 | 7.0.33 | 7.0.34 | 7.0.35 | 7.0.37 | 7.0.39 | 7.0.40 | 7.0.41 | 7.0.42 | 7.0.47 | 7.0.50 | 7.0.52 | 7.0.53 | 7.0.54 | 7.0.55 | 7.0.56 | 7.0.57 | 7.0.59 | 7.0.61 | 7.0.62 | 7.0.63 | 7.0.64 | 7.0.65 | 7.0.67 | 7.0.68 | 7.0.69

Hp2 products

Mageia2 products

apache-commons-fileupload< 1.3.1-4.1.mga5
tomcat< 7.0.68-1.1.mga5

Canonical1 product

ubuntu_linuxEOL12.04 | 14.04 | 15.10 | 16.04

Commons-fileupload1 product

commons-fileupload< 1.3.2

8 vendors · 87 products

References

91 links

jvndb.jvn.jp/jvndb/JVNDB-2016-000121Third Party AdvisoryX Refsource JVNDBVDB EntryVendor AdvisoryWEB
security.netapp.com/advisory/ntap-20190212-0001/X Refsource CONFIRM
h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05324759X Refsource CONFIRMWEB
svn.apache.org/viewvc?view=revision&revision=1743480X Refsource CONFIRMWEB
www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.htmlX Refsource CONFIRMWEB
security.gentoo.org/glsa/201705-09Vendor AdvisoryX Refsource GENTOOWEB
svn.apache.org/viewvc?view=revision&revision=1743738X Refsource CONFIRMVendor AdvisoryWEB
h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05289840X Refsource CONFIRMWEB
tomcat.apache.org/security-9.htmlX Refsource CONFIRMVendor AdvisoryWEB
www.ubuntu.com/usn/USN-3024-1Vendor AdvisoryX Refsource UBUNTUThird Party AdvisoryWEB

Show all 91 references

rhn.redhat.com/errata/RHSA-2016-2069.htmlVendor AdvisoryX Refsource REDHATWEB
www.securitytracker.com/id/1037029VDB EntryX Refsource SECTRACK
rhn.redhat.com/errata/RHSA-2016-2068.htmlVendor AdvisoryX Refsource REDHATWEB
tomcat.apache.org/security-7.htmlX Refsource CONFIRMVendor AdvisoryARTICLEWEB
www.securitytracker.com/id/1036900VDB EntryX Refsource SECTRACK
www.securityfocus.com/bid/91453VDB EntryX Refsource BIDThird Party Advisory
tomcat.apache.org/security-8.htmlX Refsource CONFIRMVendor AdvisoryARTICLEWEB
rhn.redhat.com/errata/RHSA-2016-2072.htmlVendor AdvisoryX Refsource REDHATWEB
www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.htmlX Refsource CONFIRMWEB
www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.htmlX Refsource CONFIRMWEB
svn.apache.org/viewvc?view=revision&revision=1743722X Refsource CONFIRMVendor AdvisoryWEB
www.debian.org/security/2016/dsa-3611Vendor AdvisoryX Refsource DEBIANThird Party AdvisoryWEB
h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05204371X Refsource CONFIRMPatchPermissions RequiredThird Party AdvisoryWEB
rhn.redhat.com/errata/RHSA-2016-2807.htmlVendor AdvisoryX Refsource REDHATWEB
www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.htmlX Refsource CONFIRMWEB
lists.opensuse.org/opensuse-updates/2016-09/msg00025.htmlVendor AdvisoryX Refsource SUSEWEB
jvn.jp/en/jp/JVN89379547/index.htmlThird Party AdvisoryX Refsource JVNVendor AdvisoryWEB
www.securitytracker.com/id/1036427VDB EntryX Refsource SECTRACK
rhn.redhat.com/errata/RHSA-2016-2070.htmlVendor AdvisoryX Refsource REDHATWEB
rhn.redhat.com/errata/RHSA-2017-0457.htmlVendor AdvisoryX Refsource REDHATWEB
rhn.redhat.com/errata/RHSA-2016-2808.htmlVendor AdvisoryX Refsource REDHATWEB
www.securitytracker.com/id/1039606VDB EntryX Refsource SECTRACK
svn.apache.org/viewvc?view=revision&revision=1743742X Refsource CONFIRMVendor AdvisoryWEB
rhn.redhat.com/errata/RHSA-2016-2599.htmlVendor AdvisoryX Refsource REDHATWEB
www.debian.org/security/2016/dsa-3609Vendor AdvisoryX Refsource DEBIANThird Party AdvisoryWEB
access.redhat.com/errata/RHSA-2017:0455Vendor AdvisoryX Refsource REDHATWEB
www.debian.org/security/2016/dsa-3614Vendor AdvisoryX Refsource DEBIANThird Party AdvisoryWEB
www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.htmlX Refsource CONFIRMWEB
mail-archives.apache.org/mod_mbox/…Mailing ListX Refsource MLISTWEB
access.redhat.com/errata/RHSA-2017:0456Vendor AdvisoryX Refsource REDHATWEB
bugzilla.redhat.com/show_bug.cgi?id=1349468X Refsource CONFIRMIssue TrackingREPORTWEB
rhn.redhat.com/errata/RHSA-2016-2071.htmlVendor AdvisoryX Refsource REDHATWEB
www.ubuntu.com/usn/USN-3027-1Vendor AdvisoryX Refsource UBUNTUThird Party AdvisoryWEB
lists.apache.org/thread.html/…Mailing ListX Refsource MLISTWEB
lists.apache.org/thread.html/…Mailing ListX Refsource MLISTWEB
www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.htmlX Refsource MISCWEB
lists.apache.org/thread.html/…Mailing ListX Refsource MLISTWEB
www.oracle.com/security-alerts/cpuapr2020.htmlX Refsource MISCWEB
security.gentoo.org/glsa/202107-39Vendor AdvisoryX Refsource GENTOOWEB
advisories.mageia.org/MGASA-2016-0260.htmlAdvisory
bugs.mageia.org/show_bug.cgi?id=18803REPORT
tomcat.apache.org/security-7.htmlWEB
www.debian.org/security/2016/dsa-3611WEB
www.debian.org/security/2016/dsa-3614WEB
access.redhat.com/errata/RHSA-2016:2068Advisory
access.redhat.com/security/updates/classification/ARTICLE
access.redhat.com/documentation/en-US/JBoss_Enterprise_Application_Platform/6.4/index.htmlARTICLE
bugzilla.redhat.com/show_bug.cgi?id=1375625REPORT
bugzilla.redhat.com/show_bug.cgi?id=1376065REPORT
bugzilla.redhat.com/show_bug.cgi?id=1376185REPORT
security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_2068.jsonAdvisory
access.redhat.com/security/cve/CVE-2016-3092REPORT
www.cve.org/CVERecord?id=CVE-2016-3092AdvisoryREPORT
nvd.nist.gov/vuln/detail/CVE-2016-3092Advisory
access.redhat.com/errata/RHSA-2016:2069Advisory
bugzilla.redhat.com/show_bug.cgi?id=1375627REPORT
bugzilla.redhat.com/show_bug.cgi?id=1376067REPORT
bugzilla.redhat.com/show_bug.cgi?id=1376187REPORT
security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_2069.jsonAdvisory
access.redhat.com/errata/RHSA-2016:2070Advisory
bugzilla.redhat.com/show_bug.cgi?id=1375626REPORT
bugzilla.redhat.com/show_bug.cgi?id=1376066REPORT
bugzilla.redhat.com/show_bug.cgi?id=1376186REPORT
security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_2070.jsonAdvisory
access.redhat.com/errata/RHSA-2016:2072Advisory
security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_2072.jsonAdvisory
ubuntu.com/security/CVE-2016-3092REPORT
markmail.org/message/oyxfv73jb2g7rjg3REPORT
ubuntu.com/security/notices/USN-3024-1Advisory
ubuntu.com/security/notices/USN-3027-1Advisory
security-tracker.debian.org/tracker/CVE-2016-3092Advisory
web.archive.org/web/20171111060434/http://www.securitytracker.com/id/1039606WEB
web.archive.org/web/20171103224941/http://www.securitytracker.com/id/1036900WEB
web.archive.org/web/20170317103106/http://www.securitytracker.com/id/1037029WEB
web.archive.org/web/20160924080828/http://www.securityfocus.com/bid/91453WEB
web.archive.org/web/20160726114129/http://www.securitytracker.com/id/1036427WEB
security.netapp.com/advisory/ntap-20190212-0001WEB
lists.apache.org/thread.html/…WEB
lists.apache.org/thread.html/…WEB
lists.apache.org/thread.html/…WEB
github.com/advisories/GHSA-fvm3-cfvj-gxqqAdvisory