[SECURITY] [DLA 746-1] tomcat6 security update

2016-12-1619:29:10

lists.debian.org

CVSS2

7.2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

CVSS3

9.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

AI Score

9.3

Confidence

High

EPSS

0.002

Percentile

55.1%

JSON

Package : tomcat6
Version : 6.0.45+dfsg-1~deb7u4
CVE ID : CVE-2016-9774
Debian Bug : 845393 845425 846298

Paul Szabo discovered a potential privilege escalation that could be
exploited in the situation envisaged in DLA-622-1. This update also
addresses two regressions which were introduced by the fixes for
CVE-2016-5018 (when running Jasper with SecurityManager enabled) and
CVE-2016-6797.

For Debian 7 "Wheezy", these problems have been fixed in version
6.0.45+dfsg-1~deb7u4.

We recommend that you upgrade your tomcat6 packages.

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS

OSVersionArchitecturePackageVersionFilename
Debian8alltomcat8-common< 8.0.14-1+deb8u5tomcat8-common_8.0.14-1+deb8u5_all.deb
Debian7alllibservlet2.5-java< 6.0.45+dfsg-1~deb7u4libservlet2.5-java_6.0.45+dfsg-1~deb7u4_all.deb
Debian7alltomcat7-user< 7.0.28-4+deb7u8tomcat7-user_7.0.28-4+deb7u8_all.deb
Debian8alltomcat8-examples< 8.0.14-1+deb8u5tomcat8-examples_8.0.14-1+deb8u5_all.deb
Debian8alltomcat8-user< 8.0.14-1+deb8u5tomcat8-user_8.0.14-1+deb8u5_all.deb
Debian8alltomcat7-user< 7.0.56-3+deb8u6tomcat7-user_7.0.56-3+deb8u6_all.deb
Debian8alltomcat8-admin< 8.0.14-1+deb8u5tomcat8-admin_8.0.14-1+deb8u5_all.deb
Debian7alltomcat6-common< 6.0.45+dfsg-1~deb7u4tomcat6-common_6.0.45+dfsg-1~deb7u4_all.deb
Debian8alltomcat8< 8.0.14-1+deb8u5tomcat8_8.0.14-1+deb8u5_all.deb
Debian7alltomcat6-user< 6.0.45+dfsg-1~deb7u4tomcat6-user_6.0.45+dfsg-1~deb7u4_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	8	all	tomcat8-common	< 8.0.14-1+deb8u5	tomcat8-common_8.0.14-1+deb8u5_all.deb
Debian	7	all	libservlet2.5-java	< 6.0.45+dfsg-1~deb7u4	libservlet2.5-java_6.0.45+dfsg-1~deb7u4_all.deb
Debian	7	all	tomcat7-user	< 7.0.28-4+deb7u8	tomcat7-user_7.0.28-4+deb7u8_all.deb
Debian	8	all	tomcat8-examples	< 8.0.14-1+deb8u5	tomcat8-examples_8.0.14-1+deb8u5_all.deb
Debian	8	all	tomcat8-user	< 8.0.14-1+deb8u5	tomcat8-user_8.0.14-1+deb8u5_all.deb
Debian	8	all	tomcat7-user	< 7.0.56-3+deb8u6	tomcat7-user_7.0.56-3+deb8u6_all.deb
Debian	8	all	tomcat8-admin	< 8.0.14-1+deb8u5	tomcat8-admin_8.0.14-1+deb8u5_all.deb
Debian	7	all	tomcat6-common	< 6.0.45+dfsg-1~deb7u4	tomcat6-common_6.0.45+dfsg-1~deb7u4_all.deb
Debian	8	all	tomcat8	< 8.0.14-1+deb8u5	tomcat8_8.0.14-1+deb8u5_all.deb
Debian	7	all	tomcat6-user	< 6.0.45+dfsg-1~deb7u4	tomcat6-user_6.0.45+dfsg-1~deb7u4_all.deb