CVE-2016-9775

    Dashboard / Vulnerabilities / CVE-2016-9775

    CVE-2016-9775

    Published: 23 Mar 2017Last Modified: 8 Jul 2026

    Summary:

    Details: The postrm script in the tomcat6 package before 6.0.45+dfsg-1~deb7u3 on Debian wheezy, before 6.0.45+dfsg-1~deb8u1 on Debian jessie, before 6.0.35-1ubuntu3.9 on Ubuntu 12.04 LTS and on Ubuntu 14.04 LTS; the tomcat7 package before 7.0.28-4+deb7u7 on Debian wheezy, before 7.0.56-3+deb8u6 on Debian jessie, before 7.0.52-1ubuntu0.8 on Ubuntu 14.04 LTS, and on Ubuntu 12.04 LTS, 16.04 LTS, and 16.10; and the tomcat8 package before 8.0.14-1+deb8u5 on Debian jessie, before 8.0.32-1ubuntu1.3 on Ubuntu 16.04 LTS, before 8.0.37-1ubuntu0.1 on Ubuntu 16.10, and before 8.0.38-2ubuntu1 on Ubuntu 17.04 might allow local users with access to the tomcat account to gain root privileges via a setgid program in the Catalina directory, as demonstrated by /etc/tomcat8/Catalina/attack.

    References: https://www.oracle.com/security-alerts/cpuApr2021.html, http://www.debian.org/security/2016/dsa-3738, http://www.debian.org/security/2016/dsa-3739, http://www.openwall.com/lists/oss-security/2016/12/02/10, http://www.openwall.com/lists/oss-security/2016/12/02/5, http://www.securityfocus.com/bid/94643, http://www.ubuntu.com/usn/USN-3177-1, http://www.ubuntu.com/usn/USN-3177-2, https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=845385, https://security.netapp.com/advisory/ntap-20180731-0002/

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- e498667bd7811e846771a852b16ce9f1e524b81b
    Fixed -None

    Affected versions

    7.0
    7.0.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High