Apache Tomcat Multiple Vunerabilities

Multipule vulnerabilities have been reported in Apache Tomcat, which can be exploited by malicious people to bypass certain security restrictions and cause a DoS (Denial of Service).

1. An error within the "parseHeaders()" function (InternalNioInputBuffer.java) when parsing request headers does not properly verify the permitted size and can be exploited to trigger an OutOfMemoryError exception via specially crafted headers.
2. Three vulnerabilities in Tomcat's implementation of DIGEST authentication:

- Tomcat tracked client rather than server nonces and nonce count.
- When a session ID was present, authentication was bypassed.
- The user name and password were not checked before when indicating that a nonce was stale.