Synopsis
The remote Debian host is missing a security-related update.
Description
Multiple security vulnerabilities have been discovered in the Tomcat servlet and JSP engine, which may result in possible timing attacks to determine valid user names, bypass of the SecurityManager, disclosure of system properties, unrestricted access to global resources, arbitrary file overwrites, and potentially escalation of privileges.
Solution
Upgrade the tomcat8 packages.
For the stable distribution (jessie), these problems have been fixed in version 8.0.14-1+deb8u4.