{"id":"CVE-2016-6325","aliases":["EUVD-2016-7252","GHSA-398j-w8vh-r865","MGASA-2016-0367","RHSA-2016:2045","RHSA-2016:2046","RHSA-2017:0455","RHSA-2017:0456"],"status":"published","title":"The Tomcat package on Red Hat Enterprise Linux (RHEL) 5 through 7, JBoss Web Server 3.0, and...","description":"The Tomcat package on Red Hat Enterprise Linux (RHEL) 5 through 7, JBoss Web Server 3.0, and JBoss EWS 2 uses weak permissions for (1) /etc/sysconfig/tomcat and (2) /etc/tomcat/tomcat.conf, which allows local users to gain privileges by leveraging membership in the tomcat group.","severity":{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.00693,"percentile":0.53153,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-264"],"published":"2016-10-13T14:00:00Z","modified":"2026-10-15T10:01:25Z","affected":[{"source":"osv","ecosystem":"Mageia:5","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.72-1.mga5"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"tomcat6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-98.el6_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"tomcat6-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-98.el6_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"tomcat6-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-98.el6_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"tomcat6-el-2.1-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-98.el6_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"tomcat6-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-98.el6_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"tomcat6-jsp-2.1-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-98.el6_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"tomcat6-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-98.el6_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"tomcat6-servlet-2.5-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-98.el6_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"tomcat6-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-98.el6_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"tomcat6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-98.el6_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"tomcat6-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-98.el6_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"tomcat6-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-98.el6_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"tomcat6-el-2.1-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-98.el6_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"tomcat6-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-98.el6_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"tomcat6-jsp-2.1-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-98.el6_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"tomcat6-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-98.el6_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"tomcat6-servlet-2.5-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-98.el6_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"tomcat6-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-98.el6_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"tomcat6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-98.el6_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"tomcat6-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-98.el6_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"tomcat6-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-98.el6_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"tomcat6-el-2.1-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-98.el6_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"tomcat6-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-98.el6_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"tomcat6-jsp-2.1-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-98.el6_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"tomcat6-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-98.el6_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"tomcat6-servlet-2.5-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-98.el6_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"tomcat6-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-98.el6_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"tomcat6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-98.el6_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"tomcat6-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-98.el6_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"tomcat6-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-98.el6_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"tomcat6-el-2.1-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-98.el6_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"tomcat6-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-98.el6_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"tomcat6-jsp-2.1-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-98.el6_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"tomcat6-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-98.el6_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"tomcat6-servlet-2.5-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-98.el6_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"tomcat6-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-98.el6_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.54-8.el7_2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"tomcat-servlet-3.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.54-8.el7_2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"tomcat-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.54-8.el7_2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"tomcat-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.54-8.el7_2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"tomcat-el-2.2-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.54-8.el7_2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"tomcat-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.54-8.el7_2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"tomcat-jsp-2.2-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.54-8.el7_2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"tomcat-jsvc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.54-8.el7_2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"tomcat-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.54-8.el7_2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"tomcat-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.54-8.el7_2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.54-8.el7_2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"tomcat-servlet-3.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.54-8.el7_2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"tomcat-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.54-8.el7_2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"tomcat-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.54-8.el7_2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"tomcat-el-2.2-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.54-8.el7_2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"tomcat-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.54-8.el7_2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"tomcat-jsp-2.2-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.54-8.el7_2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"tomcat-jsvc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.54-8.el7_2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"tomcat-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.54-8.el7_2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"tomcat-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.54-8.el7_2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.54-8.el7_2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"tomcat-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.54-8.el7_2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"tomcat-el-2.2-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.54-8.el7_2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"tomcat-jsp-2.2-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.54-8.el7_2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"tomcat-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.54-8.el7_2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"tomcat-servlet-3.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.54-8.el7_2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"tomcat-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.54-8.el7_2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"tomcat-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.54-8.el7_2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"tomcat-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.54-8.el7_2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"tomcat-jsvc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.54-8.el7_2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.54-8.el7_2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"tomcat-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.54-8.el7_2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"tomcat-el-2.2-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.54-8.el7_2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"tomcat-jsp-2.2-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.54-8.el7_2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"tomcat-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.54-8.el7_2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"tomcat-servlet-3.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.54-8.el7_2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"tomcat-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.54-8.el7_2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"tomcat-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.54-8.el7_2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"tomcat-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.54-8.el7_2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"tomcat-jsvc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.54-8.el7_2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el6","package":"hibernate4-c3p0-eap6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.23-1.Final_redhat_1.1.ep6.el6"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el6","package":"hibernate4-core-eap6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.23-1.Final_redhat_1.1.ep6.el6"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el6","package":"hibernate4-eap6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.23-1.Final_redhat_1.1.ep6.el6"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el6","package":"hibernate4-entitymanager-eap6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.23-1.Final_redhat_1.1.ep6.el6"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el6","package":"hibernate4-envers-eap6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.23-1.Final_redhat_1.1.ep6.el6"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el6","package":"jbcs-httpd24-apache-commons-daemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.15-1.redhat_2.1.jbcs.el6"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el6","package":"jbcs-httpd24-apache-commons-daemon-jsvc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.0.15-17.redhat_2.jbcs.el6"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el6","package":"jbcs-httpd24-apache-commons-daemon-jsvc-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.0.15-17.redhat_2.jbcs.el6"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el6","package":"jbcs-httpd24-runtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1-3.jbcs.el6"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el6","package":"mod_cluster","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.5-2.Final_redhat_2.1.ep7.el6"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el6","package":"mod_cluster-tomcat7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.5-2.Final_redhat_2.1.ep7.el6"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el6","package":"mod_cluster-tomcat8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.5-2.Final_redhat_2.1.ep7.el6"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el6","package":"tomcat-native","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.8-9.redhat_9.ep7.el6"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el6","package":"tomcat-native-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.8-9.redhat_9.ep7.el6"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el6","package":"tomcat-vault","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.8-9.Final_redhat_2.1.ep7.el6"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el6","package":"tomcat7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.70-16.ep7.el6"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el6","package":"tomcat7-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.70-16.ep7.el6"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el6","package":"tomcat7-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.70-16.ep7.el6"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el6","package":"tomcat7-el-2.2-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.70-16.ep7.el6"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el6","package":"tomcat7-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.70-16.ep7.el6"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el6","package":"tomcat7-jsp-2.2-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.70-16.ep7.el6"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el6","package":"tomcat7-jsvc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.70-16.ep7.el6"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el6","package":"tomcat7-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.70-16.ep7.el6"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el6","package":"tomcat7-log4j","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.70-16.ep7.el6"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el6","package":"tomcat7-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.70-16.ep7.el6"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el6","package":"tomcat7-servlet-3.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.70-16.ep7.el6"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el6","package":"tomcat7-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.70-16.ep7.el6"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el6","package":"tomcat8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.36-17.ep7.el6"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el6","package":"tomcat8-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.36-17.ep7.el6"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el6","package":"tomcat8-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.36-17.ep7.el6"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el6","package":"tomcat8-el-2.2-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.36-17.ep7.el6"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el6","package":"tomcat8-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.36-17.ep7.el6"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el6","package":"tomcat8-jsp-2.3-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.36-17.ep7.el6"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el6","package":"tomcat8-jsvc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.36-17.ep7.el6"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el6","package":"tomcat8-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.36-17.ep7.el6"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el6","package":"tomcat8-log4j","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.36-17.ep7.el6"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el6","package":"tomcat8-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.36-17.ep7.el6"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el6","package":"tomcat8-servlet-3.1-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.36-17.ep7.el6"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el6","package":"tomcat8-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.36-17.ep7.el6"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el7","package":"hibernate4-c3p0-eap6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.23-1.Final_redhat_1.1.ep6.el7"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el7","package":"hibernate4-core-eap6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.23-1.Final_redhat_1.1.ep6.el7"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el7","package":"hibernate4-eap6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.23-1.Final_redhat_1.1.ep6.el7"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el7","package":"hibernate4-entitymanager-eap6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.23-1.Final_redhat_1.1.ep6.el7"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el7","package":"hibernate4-envers-eap6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.23-1.Final_redhat_1.1.ep6.el7"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el7","package":"jbcs-httpd24-apache-commons-daemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.15-1.redhat_2.1.jbcs.el7"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el7","package":"jbcs-httpd24-apache-commons-daemon-jsvc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.0.15-17.redhat_2.jbcs.el7"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el7","package":"jbcs-httpd24-apache-commons-daemon-jsvc-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.0.15-17.redhat_2.jbcs.el7"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el7","package":"jbcs-httpd24-runtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1-3.jbcs.el7"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el7","package":"mod_cluster","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.5-2.Final_redhat_2.1.ep7.el7"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el7","package":"mod_cluster-tomcat7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.5-2.Final_redhat_2.1.ep7.el7"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el7","package":"mod_cluster-tomcat8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.5-2.Final_redhat_2.1.ep7.el7"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el7","package":"tomcat-native","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.8-9.redhat_9.ep7.el7"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el7","package":"tomcat-native-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.8-9.redhat_9.ep7.el7"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el7","package":"tomcat-vault","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.8-9.Final_redhat_2.1.ep7.el7"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el7","package":"tomcat7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.70-16.ep7.el7"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el7","package":"tomcat7-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.70-16.ep7.el7"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el7","package":"tomcat7-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.70-16.ep7.el7"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el7","package":"tomcat7-el-2.2-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.70-16.ep7.el7"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el7","package":"tomcat7-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.70-16.ep7.el7"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el7","package":"tomcat7-jsp-2.2-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.70-16.ep7.el7"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el7","package":"tomcat7-jsvc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.70-16.ep7.el7"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el7","package":"tomcat7-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.70-16.ep7.el7"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el7","package":"tomcat7-log4j","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.70-16.ep7.el7"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el7","package":"tomcat7-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.70-16.ep7.el7"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el7","package":"tomcat7-servlet-3.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.70-16.ep7.el7"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el7","package":"tomcat7-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.70-16.ep7.el7"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el7","package":"tomcat8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.36-17.ep7.el7"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el7","package":"tomcat8-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.36-17.ep7.el7"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el7","package":"tomcat8-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.36-17.ep7.el7"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el7","package":"tomcat8-el-2.2-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.36-17.ep7.el7"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el7","package":"tomcat8-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.36-17.ep7.el7"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el7","package":"tomcat8-jsp-2.3-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.36-17.ep7.el7"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el7","package":"tomcat8-jsvc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.36-17.ep7.el7"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el7","package":"tomcat8-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.36-17.ep7.el7"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el7","package":"tomcat8-log4j","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.36-17.ep7.el7"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el7","package":"tomcat8-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.36-17.ep7.el7"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el7","package":"tomcat8-servlet-3.1-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.36-17.ep7.el7"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el7","package":"tomcat8-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.36-17.ep7.el7"}]}],"bundled":11}],"products":[{"vendor":"apache","product":"tomcat"}],"references":[{"url":"http://www.securityfocus.com/bid/93478","tags":["vdb-entry","x_refsource_BID","x_transferred"]},{"url":"http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"http://rhn.redhat.com/errata/RHSA-2016-2045.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Vendor Advisory"]},{"url":"http://rhn.redhat.com/errata/RHSA-2016-2046.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Vendor Advisory"]},{"url":"http://rhn.redhat.com/errata/RHSA-2017-0457.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2017:0455","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1367447","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","VDB Entry","Vendor Advisory","report"]},{"url":"https://access.redhat.com/errata/RHSA-2017:0456","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-6325","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2016:2045","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2016:2046","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2017:0457"},{"url":"https://access.redhat.com/security/cve/CVE-2016-6325","tags":["report"]},{"url":"https://github.com/advisories/GHSA-398j-w8vh-r865"},{"url":"https://advisories.mageia.org/MGASA-2016-0367.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=19672","tags":["report"]},{"url":"http://openwall.com/lists/oss-security/2016/10/27/7","tags":["web"]},{"url":"http://openwall.com/lists/oss-security/2016/10/27/8","tags":["web"]},{"url":"http://openwall.com/lists/oss-security/2016/10/27/9","tags":["web"]},{"url":"http://openwall.com/lists/oss-security/2016/10/27/10","tags":["web"]},{"url":"http://openwall.com/lists/oss-security/2016/10/27/11","tags":["web"]},{"url":"https://rhn.redhat.com/errata/RHSA-2016-2046.html","tags":["web"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://tomcat.apache.org/security-6.html#Fixed_in_Apache_Tomcat_6.0.45","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1265698","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1311082","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1311087","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1311089","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1353809","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1357123","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_2045.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2015-5174","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-5174","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-5174","tags":["advisory"]},{"url":"http://seclists.org/bugtraq/2016/Feb/149","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2015-5345","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-5345","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-5345","tags":["advisory"]},{"url":"http://seclists.org/bugtraq/2016/Feb/146","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-0706","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-0706","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-0706","tags":["advisory"]},{"url":"http://seclists.org/bugtraq/2016/Feb/144","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-0714","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-0714","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-0714","tags":["advisory"]},{"url":"http://seclists.org/bugtraq/2016/Feb/145","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-5388","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-5388","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-5388","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-6325","tags":["advisory"]},{"url":"https://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.59","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1222573","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1311085","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1362545","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_2046.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-7810","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-7810","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-7810","tags":["advisory"]},{"url":"http://tomcat.apache.org/security-6.html#Fixed_in_Apache_Tomcat_6.0.44","tags":["article"]},{"url":"http://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.59","tags":["article"]},{"url":"http://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.0.17","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2015-5346","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-5346","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-5346","tags":["advisory"]},{"url":"http://seclists.org/bugtraq/2016/Feb/143","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-5425","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-5425","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-5425","tags":["advisory"]},{"url":"http://legalhackers.com/advisories/Tomcat-RedHat-based-Root-Privilege-Escalation-Exploit.txt","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1349468","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1376712","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1390493","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1390515","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1390520","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1390525","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1390526","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1397484","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1397485","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1403824","tags":["report"]},{"url":"https://issues.redhat.com/browse/JWS-267","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_0455.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-0762","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-0762","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-0762","tags":["advisory"]},{"url":"https://tomcat.apache.org/security-6.html#Fixed_in_Apache_Tomcat_6.0.47","tags":["article"]},{"url":"https://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.72","tags":["article"]},{"url":"https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.5_and_8.0.37","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-1240","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-1240","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-1240","tags":["advisory"]},{"url":"http://legalhackers.com/advisories/Tomcat-DebPkgs-Root-Privilege-Escalation-Exploit-CVE-2016-1240.txt","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-3092","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-3092","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-3092","tags":["advisory"]},{"url":"http://tomcat.apache.org/security-7.html","tags":["article"]},{"url":"http://tomcat.apache.org/security-8.html","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-5018","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-5018","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-5018","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-6794","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-6794","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-6794","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-6796","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-6796","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-6796","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-6797","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-6797","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-6797","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-6816","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-6816","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-6816","tags":["advisory"]},{"url":"https://access.redhat.com/articles/2991951","tags":["article"]},{"url":"https://access.redhat.com/solutions/2891171","tags":["article"]},{"url":"https://tomcat.apache.org/security-6.html#Fixed_in_Apache_Tomcat_6.0.48","tags":["article"]},{"url":"https://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.73","tags":["article"]},{"url":"https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.0.39","tags":["article"]},{"url":"https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.8","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-8735","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-8735","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-8735","tags":["advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-8745","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-8745","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-8745","tags":["advisory"]},{"url":"https://tomcat.apache.org/security-6.html#Fixed_in_Apache_Tomcat_6.0.49","tags":["article"]},{"url":"https://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.74","tags":["article"]},{"url":"https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.0.40","tags":["article"]},{"url":"https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.9","tags":["article"]},{"url":"https://issues.redhat.com/browse/JWS-268","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_0456.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2016-6325","description":"The Tomcat package on Red Hat Enterprise Linux (RHEL) 5 through 7, JBoss Web Server 3.0, and JBoss EWS 2 uses weak permissions for (1) /etc/sysconfig/tomcat and (2) /etc/tomcat/tomcat.conf, which allows local users to gain privileges by leveraging membership in the tomcat group.","status":"published","published":"2016-10-13T14:00:00Z","modified":"2024-08-06T01:29:18.293Z","updated_at":"2026-11-02T14:33:34.443637Z"}],"euvd":[{"id":"EUVD-2016-7252","description":"The Tomcat package on Red Hat Enterprise Linux (RHEL) 5 through 7, JBoss Web Server 3.0, and JBoss EWS 2 uses weak permissions for (1) /etc/sysconfig/tomcat and (2) /etc/tomcat/tomcat.conf, which allows local users to gain privileges by leveraging membership in the tomcat group.","status":"published","published":"2016-10-13T14:00:00Z","modified":"2024-08-06T01:29:18Z","updated_at":"2026-11-03T02:22:39.91691Z"}],"ghsa":[{"id":"GHSA-398j-w8vh-r865","title":"The Tomcat package on Red Hat Enterprise Linux (RHEL) 5 through 7, JBoss Web Server 3.0, and...","description":"The Tomcat package on Red Hat Enterprise Linux (RHEL) 5 through 7, JBoss Web Server 3.0, and JBoss EWS 2 uses weak permissions for (1) /etc/sysconfig/tomcat and (2) /etc/tomcat/tomcat.conf, which allows local users to gain privileges by leveraging membership in the tomcat group.","status":"published","published":"2022-05-14T03:56:16Z","modified":"2023-02-02T21:33:52Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T14:52:47.451891Z"}],"nvd":[{"id":"CVE-2016-6325","description":"The Tomcat package on Red Hat Enterprise Linux (RHEL) 5 through 7, JBoss Web Server 3.0, and JBoss EWS 2 uses weak permissions for (1) /etc/sysconfig/tomcat and (2) /etc/tomcat/tomcat.conf, which allows local users to gain privileges by leveraging membership in the tomcat group.","status":"published","published":"2016-10-13T14:59:09.127Z","modified":"2026-06-17T00:50:49.953Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":7.2,"vector":"AV:L/AC:L/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-264"],"updated_at":"2026-11-02T14:03:31.485755Z"}],"osv":[{"id":"RHSA-2016:2045","title":"Red Hat Security Advisory: tomcat6 security and bug fix update","status":"published","published":"2024-09-15T23:31:51Z","modified":"2026-10-15T10:01:25Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:03.734507Z"},{"id":"RHSA-2016:2046","title":"Red Hat Security Advisory: tomcat security update","status":"published","published":"2024-09-15T23:31:33Z","modified":"2026-08-05T10:04:07Z","cvss":[{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:03.734507Z"},{"id":"RHSA-2017:0455","title":"Red Hat Security Advisory: Red Hat JBoss Web Server 3.1.0 security and enhancement update","status":"published","published":"2024-09-29T17:09:22Z","modified":"2026-10-08T10:01:22Z","cvss":[{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:04.262457Z"},{"id":"RHSA-2017:0456","title":"Red Hat Security Advisory: Red Hat JBoss Web Server 3.1.0 security and enhancement update","status":"published","published":"2024-09-29T17:09:27Z","modified":"2026-10-08T10:01:23Z","cvss":[{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:04.262457Z"},{"id":"MGASA-2016-0367","title":"Updated tomcat packages fix security vulnerability","description":"The Realm implementations did not process the supplied password if the\nsupplied user name did not exist. This made a timing attack possible to\ndetermine valid user names. Note that the default configuration includes\nthe LockOutRealm which makes exploitation of this vulnerability harder\n(CVE-2016-0762).\n\nA malicious web application was able to bypass a configured\nSecurityManager via a Tomcat utility method that was accessible to web\napplications (CVE-2016-5018).\n\nIt was discovered that the Tomcat packages installed configuration file\n/usr/lib/tmpfiles.d/tomcat.conf writeable to the tomcat group. A member\nof the group or a malicious web application deployed on Tomcat could use\nthis flaw to escalate their privileges (CVE-2016-5425).\n\nIt was discovered that the Tomcat packages installed certain\nconfiguration files read by the Tomcat initialization script as\nwriteable to the tomcat group. A member of the group or a malicious web\napplication deployed on Tomcat could use this flaw to escalate their\nprivileges (CVE-2016-6325).\n\nWhen a SecurityManager is configured, a web application's ability to\nread system properties should be controlled by the SecurityManager.\nTomcat's system property replacement feature for configuration files\ncould be used by a malicious web application to bypass the\nSecurityManager and read system properties that should not be visible\n(CVE-2016-6794).\n\nA malicious web application was able to bypass a configured\nSecurityManager via manipulation of the configuration parameters for the\nJSP Servlet (CVE-2016-6796).\n\nThe ResourceLinkFactory did not limit web application access to global\nJNDI resources to those resources explicitly linked to the web\napplication. Therefore, it was possible for a web application to access\nany global JNDI resource whether an explicit ResourceLink had been\nconfigured or not (CVE-2016-6797).\n","status":"published","published":"2016-11-04T22:29:35Z","modified":"2026-04-16T06:25:55.342143706Z","updated_at":"2026-11-02T15:49:40.103088Z"}]}}