A tomcat7 security update is available for Debian 7 LTS

Package : tomcat7
Version : 7.0.28-4+deb7u9
CVE ID : CVE-2016-8745
Debian Bug : 849949

A bug in the error handling of the send file code for the NIO HTTP
connector resulted in the current Processor object being added to the
Processor cache multiple times. This in turn meant that the same
Processor could be used for concurrent requests. Sharing a Processor
can result in information leakage between requests including, not
limited to, session ID and the response body.

In addition this update also addresses a regression when running
Tomcat 7 with SecurityManager enabled due to an incomplete fix for
CVE-2016-6816.

For Debian 7 "Wheezy", these problems have been fixed in version
7.0.28-4+deb7u9.

We recommend that you upgrade your tomcat7 packages.

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS