At the moment, there aren't any of those vulnerabilities that we know. I was looking the docs on what damages can be done by hackers if apache tomcat favicon is revealed in web application.
For one thing it can be an information leakage as to the fact that you are using apache tomcat. In addition, if they change their icon over versions, you would be able to tell which version of tomcat you are using. Remember every attack starts with a bit of reconnoissance, if they know what servers you're using they can better attack it. Not saying that it's the only way to find out what you're using but limiting the information your attacker has about your configurations is the first step.