7.8

CVE-2016-1240

The Tomcat init script in the tomcat7 package before 7.0.56-3+deb8u4 and tomcat8 package before 8.0.14-1+deb8u3 on Debian jessie and the tomcat6 and libtomcat6-java packages before 6.0.35-1ubuntu3.8 on Ubuntu 12.04 LTS, the tomcat7 and libtomcat7-java packages before 7.0.52-1ubuntu0.7 on Ubuntu 14.04 LTS, and tomcat8 and libtomcat8-java packages before 8.0.32-1ubuntu1.2 on Ubuntu 16.04 LTS allows local users with access to the tomcat account to gain root privileges via a symlink attack on the Catalina log file, as demonstrated by /var/log/tomcat7/catalina.out.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Apache ≫ Tomcat Version6.0
   Canonical ≫ Ubuntu Linux Version12.04 SwEditionlts
   Canonical ≫ Ubuntu Linux Version14.04 SwEditionlts
   Canonical ≫ Ubuntu Linux Version16.04 SwEditionlts
Apache ≫ Tomcat Version7.0
   Canonical ≫ Ubuntu Linux Version12.04 SwEditionlts
   Canonical ≫ Ubuntu Linux Version14.04 SwEditionlts
   Canonical ≫ Ubuntu Linux Version16.04 SwEditionlts
Apache ≫ Tomcat Version8.0
   Canonical ≫ Ubuntu Linux Version12.04 SwEditionlts
   Canonical ≫ Ubuntu Linux Version14.04 SwEditionlts
   Canonical ≫ Ubuntu Linux Version16.04 SwEditionlts
Apache ≫ Tomcat Version7.0
   Debian ≫ Debian Linux Version8.0
Apache ≫ Tomcat Version8.0
   Debian ≫ Debian Linux Version8.0
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 18.61% 0.95
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 7.8 1.8 5.9
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvd@nist.gov 7.2 3.9 10
AV:L/AC:L/Au:N/C:C/I:C/A:C
CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

http://www.securitytracker.com/id/1036845
Third Party Advisory
VDB Entry