CVE-2016-1240
The Tomcat init script in the tomcat7 package before 7.0.56-3+deb8u4 and tomcat8 package before 8...
The Tomcat init script in the tomcat7 package before 7.0.56-3+deb8u4 and tomcat8 package before 8.0.14-1+deb8u3 on Debian jessie and the tomcat6 and libtomcat6-java packages before 6.0.35-1ubuntu3.8 on Ubuntu 12.04 LTS, the tomcat7 and libtomcat7-java packages before 7.0.52-1ubuntu0.7 on Ubuntu 14.04 LTS, and tomcat8 and libtomcat8-java packages before 8.0.32-1ubuntu1.2 on Ubuntu 16.04 LTS allows local users with access to the tomcat account to gain root privileges via a symlink attack on the Catalina log file, as demonstrated by /var/log/tomcat7/catalina.out.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
The Tomcat init script in the tomcat7 package before 7.0.56-3+deb8u4 and tomcat8 package before 8.0.14-1+deb8u3 on Debian jessie and the tomcat6 and libtomcat6-java packages before 6.0.35-1ubuntu3.8 on Ubuntu 12.04 LTS, the tomcat7 and libtomcat7-java packages before 7.0.52-1ubuntu0.7 on Ubuntu 14.04 LTS, and tomcat8 and libtomcat8-java packages before 8.0.32-1ubuntu1.2 on Ubuntu 16.04 LTS allows local users with access to the tomcat account to gain root privileges via a symlink attack on the Catalina log file, as demonstrated by /var/log/tomcat7/catalina.out.
- Record
CVE-2016-1240- CVSS 3.0
- 7.8 High
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 7.2 High
AV:L/AC:L/Au:N/C:C/I:C/A:C - Weakness
- CWE-20
- Updated
- 2026-11-02
CVE List No score
The Tomcat init script in the tomcat7 package before 7.0.56-3+deb8u4 and tomcat8 package before 8.0.14-1+deb8u3 on Debian jessie and the tomcat6 and libtomcat6-java packages before 6.0.35-1ubuntu3.8 on Ubuntu 12.04 LTS, the tomcat7 and libtomcat7-java packages before 7.0.52-1ubuntu0.7 on Ubuntu 14.04 LTS, and tomcat8 and libtomcat8-java packages before 8.0.32-1ubuntu1.2 on Ubuntu 16.04 LTS allows local users with access to the tomcat account to gain root privileges via a symlink attack on the Catalina log file, as demonstrated by /var/log/tomcat7/catalina.out.
- Record
CVE-2016-1240- Updated
- 2026-11-02
EUVDEUVD-2016-2341 No score
The Tomcat init script in the tomcat7 package before 7.0.56-3+deb8u4 and tomcat8 package before 8.0.14-1+deb8u3 on Debian jessie and the tomcat6 and libtomcat6-java packages before 6.0.35-1ubuntu3.8 on Ubuntu 12.04 LTS, the tomcat7 and libtomcat7-java packages before 7.0.52-1ubuntu0.7 on Ubuntu 14.04 LTS, and tomcat8 and libtomcat8-java packages before 8.0.32-1ubuntu1.2 on Ubuntu 16.04 LTS allows local users with access to the tomcat account to gain root privileges via a symlink attack on the Catalina log file, as demonstrated by /var/log/tomcat7/catalina.out.
- Record
EUVD-2016-2341- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-8c5c-v572-37xf
The Tomcat init script in the tomcat7 package before 7.0.56-3+deb8u4 and tomcat8 package before 8...
The Tomcat init script in the tomcat7 package before 7.0.56-3+deb8u4 and tomcat8 package before 8.0.14-1+deb8u3 on Debian jessie and the tomcat6 and libtomcat6-java packages before 6.0.35-1ubuntu3.8 on Ubuntu 12.04 LTS, the tomcat7 and libtomcat7-java packages before 7.0.52-1ubuntu0.7 on Ubuntu 14.04 LTS, and tomcat8 and libtomcat8-java packages before 8.0.32-1ubuntu1.2 on Ubuntu 16.04 LTS allows local users with access to the tomcat account to gain root privileges via a symlink attack on the Catalina log file, as demonstrated by /var/log/tomcat7/catalina.out.
- Record
GHSA-8c5c-v572-37xf- CVSS 3.0
- 7.8 High
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-20
- Updated
- 2026-11-02
OSV
The Tomcat init script in the tomcat7 package before 7.0.56-3+deb8u4 and tomcat8 package before 8.0.14-1+deb8u3 on Debian jessie and the tomcat6 and libtomcat6-java packages before 6.0.35-1ubuntu3.8 on Ubuntu 12.04 LTS, the tomcat7 and libtomcat7-java packages before 7.0.52-1ubuntu0.7 on Ubuntu 14.04 LTS, and tomcat8 and libtomcat8-java packages before 8.0.32-1ubuntu1.2 on Ubuntu 16.04 LTS allows local users with access to the tomcat account to gain root privileges via a symlink attack on the Catalina log file, as demonstrated by /var/log/tomcat7/catalina.out.
- Record
CVE-2016-1240- CVSS 3.0
- 7.8 High
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2017:0455
Red Hat Security Advisory: Red Hat JBoss Web Server 3.1.0 security and enhancement update
- Record
RHSA-2017:0455- CVSS 3.0
- 8.1 High
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Show 4 moreShow less
OSVRHSA-2017:0456
Red Hat Security Advisory: Red Hat JBoss Web Server 3.1.0 security and enhancement update
- Record
RHSA-2017:0456- CVSS 3.0
- 8.1 High
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2016-1240
The Tomcat init script in the tomcat7 package before 7.0.56-3+deb8u4 and tomcat8 package before 8.0.14-1+deb8u3 on Debian jessie and the tomcat6 and libtomcat6-java packages before 6.0.35-1ubuntu3.8 on Ubuntu 12.04 LTS, the tomcat7 and libtomcat7-java packages before 7.0.52-1ubuntu0.7 on Ubuntu 14.04 LTS, and tomcat8 and libtomcat8-java packages before 8.0.32-1ubuntu1.2 on Ubuntu 16.04 LTS allows local users with access to the tomcat account to gain root privileges via a symlink attack on the Catalina log file, as demonstrated by /var/log/tomcat7/catalina.out.
- Record
UBUNTU-CVE-2016-1240- CVSS 3.0
- 7.8 High
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUSN-3081-1 No score
tomcat6, tomcat7, tomcat8 vulnerability
Dawid Golunski discovered that the Tomcat init script incorrectly handled creating log files. A remote attacker could possibly use this issue to obtain root privileges. (CVE-2016-1240)
This update also reverts a change in behaviour introduced in USN-3024-1 by setting mapperContextRootRedirectEnabled to True by default.
- Record
USN-3081-1- Updated
- 2026-11-02
OSVUSN-3081-2 No score
tomcat6 vulnerability
Dawid Golunski discovered that the Tomcat init script incorrectly handled creating log files. A remote attacker could possibly use this issue to obtain root privileges.
- Record
USN-3081-2- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
tomcat6Debian:7 |
before 6.0.45+dfsg-1~deb7u2, plus listed versions 6.0.35-66.0.35-6+deb7u16.0.35-76.0.37-16.0.39-1 Show 9 moreShow less6.0.41-16.0.41-26.0.41-2+squeeze56.0.41-2+squeeze66.0.41-2+squeeze76.0.41-36.0.41-46.0.45+dfsg-1~deb7u16.0.45-1~deb6u1 |
6.0.45+dfsg-1~deb7u2 |
tomcat7Debian:7 |
before 7.0.28-4+deb7u6, plus listed versions 7.0.28-47.0.28-4+deb7u17.0.28-4+deb7u27.0.28-4+deb7u37.0.28-4+deb7u47.0.28-4+deb7u5 |
7.0.28-4+deb7u6 |
tomcat7Debian:8 |
before 7.0.56-3+deb8u4, plus listed versions 7.0.56-37.0.56-3+deb8u17.0.56-3+deb8u27.0.56-3+deb8u3 |
7.0.56-3+deb8u4 |
tomcat8Debian:8 |
before 8.0.14-1+deb8u3, plus listed versions 8.0.14-18.0.14-1+deb8u18.0.14-1+deb8u2 |
8.0.14-1+deb8u3 |
hibernate4-c3p0-eap6Red Hat:jboss_enterprise_web_server:3.1::el6 |
before 0:4.2.23-1.Final_redhat_1.1.ep6.el6 | 0:4.2.23-1.Final_redhat_1.1.ep6.el6 |
hibernate4-core-eap6Red Hat:jboss_enterprise_web_server:3.1::el6 |
before 0:4.2.23-1.Final_redhat_1.1.ep6.el6 | 0:4.2.23-1.Final_redhat_1.1.ep6.el6 |
hibernate4-eap6Red Hat:jboss_enterprise_web_server:3.1::el6 |
before 0:4.2.23-1.Final_redhat_1.1.ep6.el6 | 0:4.2.23-1.Final_redhat_1.1.ep6.el6 |
hibernate4-entitymanager-eap6Red Hat:jboss_enterprise_web_server:3.1::el6 |
before 0:4.2.23-1.Final_redhat_1.1.ep6.el6 | 0:4.2.23-1.Final_redhat_1.1.ep6.el6 |
hibernate4-envers-eap6Red Hat:jboss_enterprise_web_server:3.1::el6 |
before 0:4.2.23-1.Final_redhat_1.1.ep6.el6 | 0:4.2.23-1.Final_redhat_1.1.ep6.el6 |
jbcs-httpd24-apache-commons-daemonRed Hat:jboss_enterprise_web_server:3.1::el6 |
before 0:1.0.15-1.redhat_2.1.jbcs.el6 | 0:1.0.15-1.redhat_2.1.jbcs.el6 |
Show 77 moreShow less
| Package | Affected | Fixed |
|---|---|---|
jbcs-httpd24-apache-commons-daemon-jsvcRed Hat:jboss_enterprise_web_server:3.1::el6 |
before 1:1.0.15-17.redhat_2.jbcs.el6 | 1:1.0.15-17.redhat_2.jbcs.el6 |
jbcs-httpd24-apache-commons-daemon-jsvc-debuginfoRed Hat:jboss_enterprise_web_server:3.1::el6 |
before 1:1.0.15-17.redhat_2.jbcs.el6 | 1:1.0.15-17.redhat_2.jbcs.el6 |
jbcs-httpd24-runtimeRed Hat:jboss_enterprise_web_server:3.1::el6 |
before 0:1-3.jbcs.el6 | 0:1-3.jbcs.el6 |
mod_clusterRed Hat:jboss_enterprise_web_server:3.1::el6 |
before 0:1.3.5-2.Final_redhat_2.1.ep7.el6 | 0:1.3.5-2.Final_redhat_2.1.ep7.el6 |
mod_cluster-tomcat7Red Hat:jboss_enterprise_web_server:3.1::el6 |
before 0:1.3.5-2.Final_redhat_2.1.ep7.el6 | 0:1.3.5-2.Final_redhat_2.1.ep7.el6 |
mod_cluster-tomcat8Red Hat:jboss_enterprise_web_server:3.1::el6 |
before 0:1.3.5-2.Final_redhat_2.1.ep7.el6 | 0:1.3.5-2.Final_redhat_2.1.ep7.el6 |
tomcat-nativeRed Hat:jboss_enterprise_web_server:3.1::el6 |
before 0:1.2.8-9.redhat_9.ep7.el6 | 0:1.2.8-9.redhat_9.ep7.el6 |
tomcat-native-debuginfoRed Hat:jboss_enterprise_web_server:3.1::el6 |
before 0:1.2.8-9.redhat_9.ep7.el6 | 0:1.2.8-9.redhat_9.ep7.el6 |
tomcat-vaultRed Hat:jboss_enterprise_web_server:3.1::el6 |
before 0:1.0.8-9.Final_redhat_2.1.ep7.el6 | 0:1.0.8-9.Final_redhat_2.1.ep7.el6 |
tomcat7Red Hat:jboss_enterprise_web_server:3.1::el6 |
before 0:7.0.70-16.ep7.el6 | 0:7.0.70-16.ep7.el6 |
tomcat7-admin-webappsRed Hat:jboss_enterprise_web_server:3.1::el6 |
before 0:7.0.70-16.ep7.el6 | 0:7.0.70-16.ep7.el6 |
tomcat7-docs-webappRed Hat:jboss_enterprise_web_server:3.1::el6 |
before 0:7.0.70-16.ep7.el6 | 0:7.0.70-16.ep7.el6 |
tomcat7-el-2.2-apiRed Hat:jboss_enterprise_web_server:3.1::el6 |
before 0:7.0.70-16.ep7.el6 | 0:7.0.70-16.ep7.el6 |
tomcat7-javadocRed Hat:jboss_enterprise_web_server:3.1::el6 |
before 0:7.0.70-16.ep7.el6 | 0:7.0.70-16.ep7.el6 |
tomcat7-jsp-2.2-apiRed Hat:jboss_enterprise_web_server:3.1::el6 |
before 0:7.0.70-16.ep7.el6 | 0:7.0.70-16.ep7.el6 |
tomcat7-jsvcRed Hat:jboss_enterprise_web_server:3.1::el6 |
before 0:7.0.70-16.ep7.el6 | 0:7.0.70-16.ep7.el6 |
tomcat7-libRed Hat:jboss_enterprise_web_server:3.1::el6 |
before 0:7.0.70-16.ep7.el6 | 0:7.0.70-16.ep7.el6 |
tomcat7-log4jRed Hat:jboss_enterprise_web_server:3.1::el6 |
before 0:7.0.70-16.ep7.el6 | 0:7.0.70-16.ep7.el6 |
tomcat7-selinuxRed Hat:jboss_enterprise_web_server:3.1::el6 |
before 0:7.0.70-16.ep7.el6 | 0:7.0.70-16.ep7.el6 |
tomcat7-servlet-3.0-apiRed Hat:jboss_enterprise_web_server:3.1::el6 |
before 0:7.0.70-16.ep7.el6 | 0:7.0.70-16.ep7.el6 |
tomcat7-webappsRed Hat:jboss_enterprise_web_server:3.1::el6 |
before 0:7.0.70-16.ep7.el6 | 0:7.0.70-16.ep7.el6 |
tomcat8Red Hat:jboss_enterprise_web_server:3.1::el6 |
before 0:8.0.36-17.ep7.el6 | 0:8.0.36-17.ep7.el6 |
tomcat8-admin-webappsRed Hat:jboss_enterprise_web_server:3.1::el6 |
before 0:8.0.36-17.ep7.el6 | 0:8.0.36-17.ep7.el6 |
tomcat8-docs-webappRed Hat:jboss_enterprise_web_server:3.1::el6 |
before 0:8.0.36-17.ep7.el6 | 0:8.0.36-17.ep7.el6 |
tomcat8-el-2.2-apiRed Hat:jboss_enterprise_web_server:3.1::el6 |
before 0:8.0.36-17.ep7.el6 | 0:8.0.36-17.ep7.el6 |
tomcat8-javadocRed Hat:jboss_enterprise_web_server:3.1::el6 |
before 0:8.0.36-17.ep7.el6 | 0:8.0.36-17.ep7.el6 |
tomcat8-jsp-2.3-apiRed Hat:jboss_enterprise_web_server:3.1::el6 |
before 0:8.0.36-17.ep7.el6 | 0:8.0.36-17.ep7.el6 |
tomcat8-jsvcRed Hat:jboss_enterprise_web_server:3.1::el6 |
before 0:8.0.36-17.ep7.el6 | 0:8.0.36-17.ep7.el6 |
tomcat8-libRed Hat:jboss_enterprise_web_server:3.1::el6 |
before 0:8.0.36-17.ep7.el6 | 0:8.0.36-17.ep7.el6 |
tomcat8-log4jRed Hat:jboss_enterprise_web_server:3.1::el6 |
before 0:8.0.36-17.ep7.el6 | 0:8.0.36-17.ep7.el6 |
tomcat8-selinuxRed Hat:jboss_enterprise_web_server:3.1::el6 |
before 0:8.0.36-17.ep7.el6 | 0:8.0.36-17.ep7.el6 |
tomcat8-servlet-3.1-apiRed Hat:jboss_enterprise_web_server:3.1::el6 |
before 0:8.0.36-17.ep7.el6 | 0:8.0.36-17.ep7.el6 |
tomcat8-webappsRed Hat:jboss_enterprise_web_server:3.1::el6 |
before 0:8.0.36-17.ep7.el6 | 0:8.0.36-17.ep7.el6 |
hibernate4-c3p0-eap6Red Hat:jboss_enterprise_web_server:3.1::el7 |
before 0:4.2.23-1.Final_redhat_1.1.ep6.el7 | 0:4.2.23-1.Final_redhat_1.1.ep6.el7 |
hibernate4-core-eap6Red Hat:jboss_enterprise_web_server:3.1::el7 |
before 0:4.2.23-1.Final_redhat_1.1.ep6.el7 | 0:4.2.23-1.Final_redhat_1.1.ep6.el7 |
hibernate4-eap6Red Hat:jboss_enterprise_web_server:3.1::el7 |
before 0:4.2.23-1.Final_redhat_1.1.ep6.el7 | 0:4.2.23-1.Final_redhat_1.1.ep6.el7 |
hibernate4-entitymanager-eap6Red Hat:jboss_enterprise_web_server:3.1::el7 |
before 0:4.2.23-1.Final_redhat_1.1.ep6.el7 | 0:4.2.23-1.Final_redhat_1.1.ep6.el7 |
hibernate4-envers-eap6Red Hat:jboss_enterprise_web_server:3.1::el7 |
before 0:4.2.23-1.Final_redhat_1.1.ep6.el7 | 0:4.2.23-1.Final_redhat_1.1.ep6.el7 |
jbcs-httpd24-apache-commons-daemonRed Hat:jboss_enterprise_web_server:3.1::el7 |
before 0:1.0.15-1.redhat_2.1.jbcs.el7 | 0:1.0.15-1.redhat_2.1.jbcs.el7 |
jbcs-httpd24-apache-commons-daemon-jsvcRed Hat:jboss_enterprise_web_server:3.1::el7 |
before 1:1.0.15-17.redhat_2.jbcs.el7 | 1:1.0.15-17.redhat_2.jbcs.el7 |
jbcs-httpd24-apache-commons-daemon-jsvc-debuginfoRed Hat:jboss_enterprise_web_server:3.1::el7 |
before 1:1.0.15-17.redhat_2.jbcs.el7 | 1:1.0.15-17.redhat_2.jbcs.el7 |
jbcs-httpd24-runtimeRed Hat:jboss_enterprise_web_server:3.1::el7 |
before 0:1-3.jbcs.el7 | 0:1-3.jbcs.el7 |
mod_clusterRed Hat:jboss_enterprise_web_server:3.1::el7 |
before 0:1.3.5-2.Final_redhat_2.1.ep7.el7 | 0:1.3.5-2.Final_redhat_2.1.ep7.el7 |
mod_cluster-tomcat7Red Hat:jboss_enterprise_web_server:3.1::el7 |
before 0:1.3.5-2.Final_redhat_2.1.ep7.el7 | 0:1.3.5-2.Final_redhat_2.1.ep7.el7 |
mod_cluster-tomcat8Red Hat:jboss_enterprise_web_server:3.1::el7 |
before 0:1.3.5-2.Final_redhat_2.1.ep7.el7 | 0:1.3.5-2.Final_redhat_2.1.ep7.el7 |
tomcat-nativeRed Hat:jboss_enterprise_web_server:3.1::el7 |
before 0:1.2.8-9.redhat_9.ep7.el7 | 0:1.2.8-9.redhat_9.ep7.el7 |
tomcat-native-debuginfoRed Hat:jboss_enterprise_web_server:3.1::el7 |
before 0:1.2.8-9.redhat_9.ep7.el7 | 0:1.2.8-9.redhat_9.ep7.el7 |
tomcat-vaultRed Hat:jboss_enterprise_web_server:3.1::el7 |
before 0:1.0.8-9.Final_redhat_2.1.ep7.el7 | 0:1.0.8-9.Final_redhat_2.1.ep7.el7 |
tomcat7Red Hat:jboss_enterprise_web_server:3.1::el7 |
before 0:7.0.70-16.ep7.el7 | 0:7.0.70-16.ep7.el7 |
tomcat7-admin-webappsRed Hat:jboss_enterprise_web_server:3.1::el7 |
before 0:7.0.70-16.ep7.el7 | 0:7.0.70-16.ep7.el7 |
tomcat7-docs-webappRed Hat:jboss_enterprise_web_server:3.1::el7 |
before 0:7.0.70-16.ep7.el7 | 0:7.0.70-16.ep7.el7 |
tomcat7-el-2.2-apiRed Hat:jboss_enterprise_web_server:3.1::el7 |
before 0:7.0.70-16.ep7.el7 | 0:7.0.70-16.ep7.el7 |
tomcat7-javadocRed Hat:jboss_enterprise_web_server:3.1::el7 |
before 0:7.0.70-16.ep7.el7 | 0:7.0.70-16.ep7.el7 |
tomcat7-jsp-2.2-apiRed Hat:jboss_enterprise_web_server:3.1::el7 |
before 0:7.0.70-16.ep7.el7 | 0:7.0.70-16.ep7.el7 |
tomcat7-jsvcRed Hat:jboss_enterprise_web_server:3.1::el7 |
before 0:7.0.70-16.ep7.el7 | 0:7.0.70-16.ep7.el7 |
tomcat7-libRed Hat:jboss_enterprise_web_server:3.1::el7 |
before 0:7.0.70-16.ep7.el7 | 0:7.0.70-16.ep7.el7 |
tomcat7-log4jRed Hat:jboss_enterprise_web_server:3.1::el7 |
before 0:7.0.70-16.ep7.el7 | 0:7.0.70-16.ep7.el7 |
tomcat7-selinuxRed Hat:jboss_enterprise_web_server:3.1::el7 |
before 0:7.0.70-16.ep7.el7 | 0:7.0.70-16.ep7.el7 |
tomcat7-servlet-3.0-apiRed Hat:jboss_enterprise_web_server:3.1::el7 |
before 0:7.0.70-16.ep7.el7 | 0:7.0.70-16.ep7.el7 |
tomcat7-webappsRed Hat:jboss_enterprise_web_server:3.1::el7 |
before 0:7.0.70-16.ep7.el7 | 0:7.0.70-16.ep7.el7 |
tomcat8Red Hat:jboss_enterprise_web_server:3.1::el7 |
before 0:8.0.36-17.ep7.el7 | 0:8.0.36-17.ep7.el7 |
tomcat8-admin-webappsRed Hat:jboss_enterprise_web_server:3.1::el7 |
before 0:8.0.36-17.ep7.el7 | 0:8.0.36-17.ep7.el7 |
tomcat8-docs-webappRed Hat:jboss_enterprise_web_server:3.1::el7 |
before 0:8.0.36-17.ep7.el7 | 0:8.0.36-17.ep7.el7 |
tomcat8-el-2.2-apiRed Hat:jboss_enterprise_web_server:3.1::el7 |
before 0:8.0.36-17.ep7.el7 | 0:8.0.36-17.ep7.el7 |
tomcat8-javadocRed Hat:jboss_enterprise_web_server:3.1::el7 |
before 0:8.0.36-17.ep7.el7 | 0:8.0.36-17.ep7.el7 |
tomcat8-jsp-2.3-apiRed Hat:jboss_enterprise_web_server:3.1::el7 |
before 0:8.0.36-17.ep7.el7 | 0:8.0.36-17.ep7.el7 |
tomcat8-jsvcRed Hat:jboss_enterprise_web_server:3.1::el7 |
before 0:8.0.36-17.ep7.el7 | 0:8.0.36-17.ep7.el7 |
tomcat8-libRed Hat:jboss_enterprise_web_server:3.1::el7 |
before 0:8.0.36-17.ep7.el7 | 0:8.0.36-17.ep7.el7 |
tomcat8-log4jRed Hat:jboss_enterprise_web_server:3.1::el7 |
before 0:8.0.36-17.ep7.el7 | 0:8.0.36-17.ep7.el7 |
tomcat8-selinuxRed Hat:jboss_enterprise_web_server:3.1::el7 |
before 0:8.0.36-17.ep7.el7 | 0:8.0.36-17.ep7.el7 |
tomcat8-servlet-3.1-apiRed Hat:jboss_enterprise_web_server:3.1::el7 |
before 0:8.0.36-17.ep7.el7 | 0:8.0.36-17.ep7.el7 |
tomcat8-webappsRed Hat:jboss_enterprise_web_server:3.1::el7 |
before 0:8.0.36-17.ep7.el7 | 0:8.0.36-17.ep7.el7 |
tomcat6Ubuntu:14.04:LTS |
before 6.0.39-1ubuntu0.1, plus listed versions 6.0.37-16.0.39-1 |
6.0.39-1ubuntu0.1 |
tomcat7Ubuntu:14.04:LTS |
before 7.0.52-1ubuntu0.7, plus listed versions 7.0.42-17.0.47-17.0.50-17.0.52-17.0.52-1ubuntu0.17.0.52-1ubuntu0.37.0.52-1ubuntu0.6 |
7.0.52-1ubuntu0.7 |
tomcat6Ubuntu:16.04:LTS |
before 6.0.45+dfsg-1ubuntu0.2, plus listed versions 6.0.41-46.0.45+dfsg-16.0.45+dfsg-1ubuntu0.1 |
6.0.45+dfsg-1ubuntu0.2 |
tomcat7Ubuntu:16.04:LTS |
before 7.0.68-1ubuntu0.3, plus listed versions 7.0.64-17.0.68-17.0.68-1ubuntu0.1 |
7.0.68-1ubuntu0.3 |
tomcat8Ubuntu:16.04:LTS |
before 8.0.32-1ubuntu1.2, plus listed versions 8.0.26-18.0.28-18.0.30-18.0.32-18.0.32-1ubuntu18.0.32-1ubuntu1.1 |
8.0.32-1ubuntu1.2 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | Apache Tomcat 8/7/6 (Debian-Based Distros) - Local Privilege Escalation | 2016-10-03 |
| Metasploit | Apache Tomcat on Ubuntu Log Init Privilege Escalation | 2016-09-30 |
| PoC in GitHub | Naramsim/Offensive | 2016-10-13 |
| PoC in GitHub | mhe18/CVE_Project | 2018-12-02 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, Metasploit, NVD, OSV, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2016-1240 is a high vulnerability (CVSS 7.8) in Apache Tomcat, published September 15, 2016. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 9.78%, the 95th percentile. Fixed in tomcat6 6.0.45+dfsg-1~deb7u2.
References
securitytracker.com/id/1036845
debian.org/security/2016/dsa-3670
security.gentoo.org/glsa/201705-09
legalhackers.com/advisories/Tomcat-DebPkgs-Root-Privilege-Escalation-Exploit-CVE-2016-1240.html
securityfocus.com/bid/93263
rhn.redhat.com/errata/RHSA-2017-0457.html
Show 69 moreShow less
security.netapp.com/advisory/ntap-20180731-0002
exploit-db.com/exploits/40450
access.redhat.com/errata/RHSA-2017:0455
ubuntu.com/usn/USN-3081-1
packetstormsecurity.com/files/170857/Apache-Tomcat-On-Ubuntu-Log-Init-Privilege-Escalation.html
nvd.nist.gov/vuln/detail/CVE-2016-1240
github.com/advisories/GHSA-8c5c-v572-37xf
bugzilla.redhat.com/show_bug.cgi?id=1349468
issues.redhat.com/browse/JWS-267
security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_0455.json
cve.org/CVERecord?id=CVE-2016-0762
tomcat.apache.org/security-6.html
cisa.gov/known-exploited-vulnerabilities-catalog
ubuntu.com/security/CVE-2016-1240
launchpad.net/bugs/1609819