CVE - CVE-2016-9774

CVE-ID
CVE-2016-9774	Learn more at National Vulnerability Database (NVD) • CVSS Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings • CPE Information
Description
The postinst script in the tomcat6 package before 6.0.45+dfsg-1~deb7u4 on Debian wheezy, before 6.0.35-1ubuntu3.9 on Ubuntu 12.04 LTS and on Ubuntu 14.04 LTS; the tomcat7 package before 7.0.28-4+deb7u8 on Debian wheezy, before 7.0.56-3+deb8u6 on Debian jessie, before 7.0.52-1ubuntu0.8 on Ubuntu 14.04 LTS, and on Ubuntu 12.04 LTS, 16.04 LTS, and 16.10; and the tomcat8 package before 8.0.14-1+deb8u5 on Debian jessie, before 8.0.32-1ubuntu1.3 on Ubuntu 16.04 LTS, before 8.0.37-1ubuntu0.1 on Ubuntu 16.10, and before 8.0.38-2ubuntu1 on Ubuntu 17.04 might allow local users with access to the tomcat account to obtain sensitive information or gain root privileges via a symlink attack on the Catalina localhost directory.
References
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
BID:94643 URL:http://www.securityfocus.com/bid/94643 CONFIRM:https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=845393 CONFIRM:https://security.netapp.com/advisory/ntap-20180731-0002/ DEBIAN:DSA-3738 URL:http://www.debian.org/security/2016/dsa-3738 DEBIAN:DSA-3739 URL:http://www.debian.org/security/2016/dsa-3739 MLIST:[oss-security] 20161202 CVE request: tomcat privilege escalations in Debian packaging URL:http://www.openwall.com/lists/oss-security/2016/12/02/5 MLIST:[oss-security] 20161202 Re: CVE request: tomcat privilege escalations in Debian packaging URL:http://www.openwall.com/lists/oss-security/2016/12/02/10 UBUNTU:USN-3177-1 URL:http://www.ubuntu.com/usn/USN-3177-1 UBUNTU:USN-3177-2 URL:http://www.ubuntu.com/usn/USN-3177-2
Assigning CNA
Red Hat, Inc.
Date Record Created
20161202	Disclaimer: The record creation date may reflect when the CVE ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.
Phase (Legacy)
Assigned (20161202)
Votes (Legacy)

Comments (Legacy)

Proposed (Legacy)
N/A
This is an record on the CVE List, which provides common identifiers for publicly known cybersecurity vulnerabilities.
Search CVE Using Keywords: You can also search by reference using the CVE Reference Maps.
For More Information: CVE Request Web Form (select "Other" from dropdown)