CVE-2016-9774: High severity Debian Debian Linux vulnerability

Q: What is the severity of CVE-2016-9774?

CVE-2016-9774 is classified as a moderate severity vulnerability.

Q: How do I fix CVE-2016-9774?

To remediate CVE-2016-9774, upgrade the affected tomcat packages to a version that is 8.0.14-1+deb8u5 or higher.

Q: Which versions are affected by CVE-2016-9774?

CVE-2016-9774 affects Tomcat versions 6.0 and 7.0, specifically on older Debian and Ubuntu releases.

Q: Is CVE-2016-9774 present in more recent Tomcat versions?

CVE-2016-9774 does not affect Tomcat versions 8.5.8-2 and later.

Q: What are the potential impacts of CVE-2016-9774?

Exploitation of CVE-2016-9774 may allow unauthorized access to sensitive information or compromise server integrity.

Published Nov 22, 2016

Updated

Last updated 24 July 2024

Other sources

The postinst script in the tomcat6 package before 6.0.45+dfsg-1~deb7u4 on Debian wheezy, before 6.0.35-1ubuntu3.9 on Ubuntu 12.04 LTS and on Ubuntu 14.04 LTS; the tomcat7 package before 7.0.28-4+deb7u8 on Debian wheezy, before 7.0.56-3+deb8u6 on Debian jessie, before 7.0.52-1ubuntu0.8 on Ubuntu 14.04 LTS, and on Ubuntu 12.04 LTS, 16.04 LTS, and 16.10; and the tomcat8 package before 8.0.14-1+deb8u5 on Debian jessie, before 8.0.32-1ubuntu1.3 on Ubuntu 16.04 LTS, before 8.0.37-1ubuntu0.1 on Ubuntu 16.10, and before 8.0.38-2ubuntu1 on Ubuntu 17.04 might allow local users with access to the tomcat account to obtain sensitive information or gain root privileges via a symlink attack on the Catalina localhost directory.

Affected Software

11 affected componentsFixes available

debian/tomcat8<=8.0.14-1, <=8.0.14-1+deb8u4

8.5.8-28.0.14-1+deb8u5

debian/tomcat6

Debian Debian Linux=7.0

Debian Debian Linux=8.0

Canonical Ubuntu Linux=12.04

Canonical Ubuntu Linux=14.04

Canonical Ubuntu Linux=16.04

Canonical Ubuntu Linux=16.10

Apache Tomcat=6.0

Apache Tomcat=7.0

Apache Tomcat=8.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/tomcat8 to a version that resolves this vulnerability.
Fixed in 8.5.8-2Fixed in 8.0.14-1+deb8u5
Upgrade
Upgrade tomcat6 to a version that resolves this vulnerability.
Fixed in 6.0.45+dfsg-1~deb7u4
Upgrade
Upgrade tomcat6 to a version that resolves this vulnerability.
Fixed in 6.0.35-1ubuntu3.9
Upgrade
Upgrade tomcat7 to a version that resolves this vulnerability.
Fixed in 7.0.28-4+deb7u8
Upgrade
Upgrade tomcat7 to a version that resolves this vulnerability.
Fixed in 7.0.56-3+deb8u6
Upgrade
Upgrade tomcat7 to a version that resolves this vulnerability.
Fixed in 7.0.52-1ubuntu0.8
Upgrade
Upgrade tomcat8 to a version that resolves this vulnerability.
Fixed in 8.0.14-1+deb8u5
Upgrade
Upgrade tomcat8 to a version that resolves this vulnerability.
Fixed in 8.0.32-1ubuntu1.3
Upgrade
Upgrade tomcat8 to a version that resolves this vulnerability.
Fixed in 8.0.37-1ubuntu0.1
Upgrade
Upgrade tomcat8 to a version that resolves this vulnerability.
Fixed in 8.0.38-2ubuntu1

Event History

Mar 23, 2017

CVE Published

via MITRE·04:00 PM

Data Sourced

via MITRE·04:00 PM

Description

Parent advisories

This vulnerability appears in the following advisories.

Peer vulnerabilities

Found alongside the following vulnerabilities.

Frequently Asked Questions

What is the severity of CVE-2016-9774?