CVE-2016-6325

CVE-2016-6325 affects Red Hat Enterprise Linux (RHEL) 5–7, JBoss Web Server 3.0, and JBoss EWS 2, where insecure permissions on /etc/sysconfig/tomcat and /etc/tomcat/tomcat.conf allow local privilege escalation through tomcat group membership. Affected entries describe the root cause as insecure ...

CVE-2016-5425

CVE-2016-5425 describes a local privilege escalation in Tomcat packages on RHEL7, Fedora, CentOS, Oracle Linux, and similar distros due to weak permissions on /usr/lib/tmpfiles.d/tomcat.conf. Local users in the tomcat group can exploit this to gain root privileges via systemd-tmpfiles handling. T...