Most recent entries from all

cnvd-2016-08082

EUVD-2026-82039

fkie_cve-2016-1240

The Tomcat init script in the tomcat7 package before 7.0.56-3+deb8u4 and tomcat8 package before 8.0.14-1+deb8u3 on Debian jessie and the tomcat6 and libtomcat6-java packages before 6.0.35-1ubuntu3.8 on Ubuntu 12.04 LTS, the tomcat7 and libtomcat7-java packages before 7.0.52-1ubuntu0.7 on Ubuntu 14.04 LTS, and tomcat8 and libtomcat8-java packages before 8.0.32-1ubuntu1.2 on Ubuntu 16.04 LTS allows local users with access to the tomcat account to gain root privileges via a symlink attack on the Catalina log file, as demonstrated by /var/log/tomcat7/catalina.out.

GHSA-8c5c-v572-37xf

gsd-2016-1240

RHSA-2017:0455 — Red Hat Security Advisory: Red Hat JBoss Web Server 3.1.0 security and enhancement update

tomcat: timing attack in Realm implementation tomcat: unsafe chown of catalina.log in tomcat init script allows privilege escalation tomcat: Usage of vulnerable FileUpload package can result in denial of service tomcat: security manager bypass via IntrospectHelper utility function tomcat: tomcat writable config files allow privilege escalation tomcat: system property disclosure tomcat: security manager bypass via JSP Servlet config parameters tomcat: unrestricted access to global resources tomcat: HTTP Request smuggling vulnerability due to permitting invalid character in HTTP requests tomcat: Remote code execution vulnerability in JmxRemoteLifecycleListener tomcat: information disclosure due to incorrect Processor sharing

UBUNTU-CVE-2016-1240

Affected: Ubuntu:14.04:LTS: tomcat6, Ubuntu:14.04:LTS: tomcat7, Ubuntu:16.04:LTS: tomcat6, Ubuntu:16.04:LTS: tomcat7, Ubuntu:16.04:LTS: tomcat8