Linux · Security advisory · June 27, 2025

ELSA-2025-7494: Security update for 8 packages

ELSA-2025-7494, released June 27, 2025, fixes 1 CVE across 8 products. One of them is being exploited (CVE-2025-24813); 1 on CISA KEV. Patch Radar priority: Patch now.

Patch now1 on CISA KEV
CVEs closed
1
None rated Critical
Exploited
1
CVE-2025-24813
Exploitation more likely
0
Vendor assessment
Highest EPSS
0.9994
99th percentile

Fixed package versions

ProductReleaseFixed in
tomcat9ol 101:9.0.87-5.el10_0
tomcat9-admin-webappsol 101:9.0.87-5.el10_0
tomcat9-docs-webappol 101:9.0.87-5.el10_0
tomcat9-el-3.0-apiol 101:9.0.87-5.el10_0
tomcat9-jsp-2.3-apiol 101:9.0.87-5.el10_0
tomcat9-libol 101:9.0.87-5.el10_0
tomcat9-servlet-4.0-apiol 101:9.0.87-5.el10_0
tomcat9-webappsol 101:9.0.87-5.el10_0

CVEs this fix closes

PriorityCVETitleImpactCVSSEPSSExploitation
Patch now CVE-2025-24813 libtomcat9-java: Path Equivalence: 'file.Name' (Internal Dot) leading to Remote CodeExecution and/or Information disclosure and/or mal... 9.8 0.9994 KEVExploited
Showing 1 to 1 of 1 1