Jakarta Tomcat before 3.3.1a, when used with JDK 1.3.1 or earlier, uses trusted privileges when processing the web.xml file, which could allow remote attackers to read portions of some files through the web.xml file.
jakarta.apache.org/builds/jakarta-tomcat/release/v3.3.1a/
jakarta.apache.org/builds/jakarta-tomcat/release/v3.3.1a/RELEASE-NOTES-3.3.1a.txt
www.ciac.org/ciac/bulletins/n-060.shtml
www.debian.org/security/2003/dsa-246
www.securityfocus.com/advisories/5111
www.securityfocus.com/bid/6722
exchange.xforce.ibmcloud.com/vulnerabilities/11195