CVE - CVE-2016-9775

CVE-ID
CVE-2016-9775	Learn more at National Vulnerability Database (NVD) • CVSS Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings • CPE Information
Description
The postrm script in the tomcat6 package before 6.0.45+dfsg-1~deb7u3 on Debian wheezy, before 6.0.45+dfsg-1~deb8u1 on Debian jessie, before 6.0.35-1ubuntu3.9 on Ubuntu 12.04 LTS and on Ubuntu 14.04 LTS; the tomcat7 package before 7.0.28-4+deb7u7 on Debian wheezy, before 7.0.56-3+deb8u6 on Debian jessie, before 7.0.52-1ubuntu0.8 on Ubuntu 14.04 LTS, and on Ubuntu 12.04 LTS, 16.04 LTS, and 16.10; and the tomcat8 package before 8.0.14-1+deb8u5 on Debian jessie, before 8.0.32-1ubuntu1.3 on Ubuntu 16.04 LTS, before 8.0.37-1ubuntu0.1 on Ubuntu 16.10, and before 8.0.38-2ubuntu1 on Ubuntu 17.04 might allow local users with access to the tomcat account to gain root privileges via a setgid program in the Catalina directory, as demonstrated by /etc/tomcat8/Catalina/attack.
References
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
BID:94643 URL:http://www.securityfocus.com/bid/94643 CONFIRM:https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=845385 URL:https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=845385 CONFIRM:https://security.netapp.com/advisory/ntap-20180731-0002/ URL:https://security.netapp.com/advisory/ntap-20180731-0002/ DEBIAN:DSA-3738 URL:http://www.debian.org/security/2016/dsa-3738 DEBIAN:DSA-3739 URL:http://www.debian.org/security/2016/dsa-3739 MISC:https://www.oracle.com/security-alerts/cpuApr2021.html URL:https://www.oracle.com/security-alerts/cpuApr2021.html MLIST:[oss-security] 20161202 CVE request: tomcat privilege escalations in Debian packaging URL:http://www.openwall.com/lists/oss-security/2016/12/02/5 MLIST:[oss-security] 20161202 Re: CVE request: tomcat privilege escalations in Debian packaging URL:http://www.openwall.com/lists/oss-security/2016/12/02/10 UBUNTU:USN-3177-1 URL:http://www.ubuntu.com/usn/USN-3177-1 UBUNTU:USN-3177-2 URL:http://www.ubuntu.com/usn/USN-3177-2
Assigning CNA
Red Hat, Inc.
Date Record Created
20161202	Disclaimer: The record creation date may reflect when the CVE ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.
Phase (Legacy)
Assigned (20161202)
Votes (Legacy)

Comments (Legacy)

Proposed (Legacy)
N/A
This is an record on the CVE List, which provides common identifiers for publicly known cybersecurity vulnerabilities.
Search CVE Using Keywords: You can also search by reference using the CVE Reference Maps.
For More Information: CVE Request Web Form (select "Other" from dropdown)