Search for vulnerabilities
Vulnerability details: VCID-4k6k-v1hy-aaap
Vulnerability ID VCID-4k6k-v1hy-aaap
Aliases CVE-2016-9775
Summary The postrm script in the tomcat6 package before 6.0.45+dfsg-1~deb7u3 on Debian wheezy, before 6.0.45+dfsg-1~deb8u1 on Debian jessie, before 6.0.35-1ubuntu3.9 on Ubuntu 12.04 LTS and on Ubuntu 14.04 LTS; the tomcat7 package before 7.0.28-4+deb7u7 on Debian wheezy, before 7.0.56-3+deb8u6 on Debian jessie, before 7.0.52-1ubuntu0.8 on Ubuntu 14.04 LTS, and on Ubuntu 12.04 LTS, 16.04 LTS, and 16.10; and the tomcat8 package before 8.0.14-1+deb8u5 on Debian jessie, before 8.0.32-1ubuntu1.3 on Ubuntu 16.04 LTS, before 8.0.37-1ubuntu0.1 on Ubuntu 16.10, and before 8.0.38-2ubuntu1 on Ubuntu 17.04 might allow local users with access to the tomcat account to gain root privileges via a setgid program in the Catalina directory, as demonstrated by /etc/tomcat8/Catalina/attack.
Status Published
Exploitability 0.5
Weighted Severity 7.0
Risk 3.5
Affected and Fixed Packages Package Details
Weaknesses (1)
CWE-264 Permissions, Privileges, and Access Controls
System Score Found at
generic_textual Medium http://people.canonical.com/~ubuntu-security/cve/2016/CVE-2016-9775.html
epss 0.00044 https://api.first.org/data/v1/epss?cve=CVE-2016-9775
epss 0.00044 https://api.first.org/data/v1/epss?cve=CVE-2016-9775
epss 0.00044 https://api.first.org/data/v1/epss?cve=CVE-2016-9775
epss 0.00044 https://api.first.org/data/v1/epss?cve=CVE-2016-9775
epss 0.00044 https://api.first.org/data/v1/epss?cve=CVE-2016-9775
epss 0.00044 https://api.first.org/data/v1/epss?cve=CVE-2016-9775
epss 0.00044 https://api.first.org/data/v1/epss?cve=CVE-2016-9775
epss 0.00044 https://api.first.org/data/v1/epss?cve=CVE-2016-9775
epss 0.00044 https://api.first.org/data/v1/epss?cve=CVE-2016-9775
epss 0.00044 https://api.first.org/data/v1/epss?cve=CVE-2016-9775
epss 0.00044 https://api.first.org/data/v1/epss?cve=CVE-2016-9775
epss 0.00044 https://api.first.org/data/v1/epss?cve=CVE-2016-9775
epss 0.00044 https://api.first.org/data/v1/epss?cve=CVE-2016-9775
epss 0.00044 https://api.first.org/data/v1/epss?cve=CVE-2016-9775
epss 0.00044 https://api.first.org/data/v1/epss?cve=CVE-2016-9775
epss 0.00044 https://api.first.org/data/v1/epss?cve=CVE-2016-9775
epss 0.00107 https://api.first.org/data/v1/epss?cve=CVE-2016-9775
epss 0.0011 https://api.first.org/data/v1/epss?cve=CVE-2016-9775
epss 0.0011 https://api.first.org/data/v1/epss?cve=CVE-2016-9775
epss 0.0011 https://api.first.org/data/v1/epss?cve=CVE-2016-9775
epss 0.0011 https://api.first.org/data/v1/epss?cve=CVE-2016-9775
epss 0.0011 https://api.first.org/data/v1/epss?cve=CVE-2016-9775
epss 0.0011 https://api.first.org/data/v1/epss?cve=CVE-2016-9775
epss 0.0011 https://api.first.org/data/v1/epss?cve=CVE-2016-9775
epss 0.0011 https://api.first.org/data/v1/epss?cve=CVE-2016-9775
epss 0.0011 https://api.first.org/data/v1/epss?cve=CVE-2016-9775
epss 0.0011 https://api.first.org/data/v1/epss?cve=CVE-2016-9775
epss 0.0011 https://api.first.org/data/v1/epss?cve=CVE-2016-9775
epss 0.0011 https://api.first.org/data/v1/epss?cve=CVE-2016-9775
epss 0.0011 https://api.first.org/data/v1/epss?cve=CVE-2016-9775
epss 0.0011 https://api.first.org/data/v1/epss?cve=CVE-2016-9775
epss 0.0011 https://api.first.org/data/v1/epss?cve=CVE-2016-9775
epss 0.0011 https://api.first.org/data/v1/epss?cve=CVE-2016-9775
epss 0.0011 https://api.first.org/data/v1/epss?cve=CVE-2016-9775
epss 0.0011 https://api.first.org/data/v1/epss?cve=CVE-2016-9775
epss 0.0011 https://api.first.org/data/v1/epss?cve=CVE-2016-9775
epss 0.0011 https://api.first.org/data/v1/epss?cve=CVE-2016-9775
epss 0.0011 https://api.first.org/data/v1/epss?cve=CVE-2016-9775
epss 0.0011 https://api.first.org/data/v1/epss?cve=CVE-2016-9775
epss 0.0011 https://api.first.org/data/v1/epss?cve=CVE-2016-9775
epss 0.0011 https://api.first.org/data/v1/epss?cve=CVE-2016-9775
epss 0.0011 https://api.first.org/data/v1/epss?cve=CVE-2016-9775
epss 0.0011 https://api.first.org/data/v1/epss?cve=CVE-2016-9775
epss 0.0011 https://api.first.org/data/v1/epss?cve=CVE-2016-9775
epss 0.0011 https://api.first.org/data/v1/epss?cve=CVE-2016-9775
epss 0.0011 https://api.first.org/data/v1/epss?cve=CVE-2016-9775
epss 0.0011 https://api.first.org/data/v1/epss?cve=CVE-2016-9775
epss 0.0011 https://api.first.org/data/v1/epss?cve=CVE-2016-9775
epss 0.0011 https://api.first.org/data/v1/epss?cve=CVE-2016-9775
epss 0.0011 https://api.first.org/data/v1/epss?cve=CVE-2016-9775
epss 0.0011 https://api.first.org/data/v1/epss?cve=CVE-2016-9775
epss 0.0011 https://api.first.org/data/v1/epss?cve=CVE-2016-9775
epss 0.0011 https://api.first.org/data/v1/epss?cve=CVE-2016-9775
epss 0.0011 https://api.first.org/data/v1/epss?cve=CVE-2016-9775
epss 0.0011 https://api.first.org/data/v1/epss?cve=CVE-2016-9775
epss 0.0011 https://api.first.org/data/v1/epss?cve=CVE-2016-9775
epss 0.0011 https://api.first.org/data/v1/epss?cve=CVE-2016-9775
epss 0.0011 https://api.first.org/data/v1/epss?cve=CVE-2016-9775
epss 0.0011 https://api.first.org/data/v1/epss?cve=CVE-2016-9775
epss 0.0011 https://api.first.org/data/v1/epss?cve=CVE-2016-9775
epss 0.0011 https://api.first.org/data/v1/epss?cve=CVE-2016-9775
epss 0.0011 https://api.first.org/data/v1/epss?cve=CVE-2016-9775
epss 0.0011 https://api.first.org/data/v1/epss?cve=CVE-2016-9775
epss 0.0011 https://api.first.org/data/v1/epss?cve=CVE-2016-9775
epss 0.0011 https://api.first.org/data/v1/epss?cve=CVE-2016-9775
epss 0.0011 https://api.first.org/data/v1/epss?cve=CVE-2016-9775
epss 0.0011 https://api.first.org/data/v1/epss?cve=CVE-2016-9775
epss 0.0011 https://api.first.org/data/v1/epss?cve=CVE-2016-9775
epss 0.0011 https://api.first.org/data/v1/epss?cve=CVE-2016-9775
epss 0.0011 https://api.first.org/data/v1/epss?cve=CVE-2016-9775
epss 0.0011 https://api.first.org/data/v1/epss?cve=CVE-2016-9775
epss 0.0011 https://api.first.org/data/v1/epss?cve=CVE-2016-9775
epss 0.0011 https://api.first.org/data/v1/epss?cve=CVE-2016-9775
epss 0.0011 https://api.first.org/data/v1/epss?cve=CVE-2016-9775
epss 0.0011 https://api.first.org/data/v1/epss?cve=CVE-2016-9775
epss 0.0011 https://api.first.org/data/v1/epss?cve=CVE-2016-9775
epss 0.0011 https://api.first.org/data/v1/epss?cve=CVE-2016-9775
epss 0.0011 https://api.first.org/data/v1/epss?cve=CVE-2016-9775
epss 0.0011 https://api.first.org/data/v1/epss?cve=CVE-2016-9775
epss 0.0011 https://api.first.org/data/v1/epss?cve=CVE-2016-9775
epss 0.0011 https://api.first.org/data/v1/epss?cve=CVE-2016-9775
epss 0.0011 https://api.first.org/data/v1/epss?cve=CVE-2016-9775
epss 0.0011 https://api.first.org/data/v1/epss?cve=CVE-2016-9775
epss 0.0011 https://api.first.org/data/v1/epss?cve=CVE-2016-9775
epss 0.0011 https://api.first.org/data/v1/epss?cve=CVE-2016-9775
epss 0.0011 https://api.first.org/data/v1/epss?cve=CVE-2016-9775
epss 0.0011 https://api.first.org/data/v1/epss?cve=CVE-2016-9775
epss 0.0011 https://api.first.org/data/v1/epss?cve=CVE-2016-9775
epss 0.0011 https://api.first.org/data/v1/epss?cve=CVE-2016-9775
generic_textual Medium https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6816
generic_textual Low https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-8735
generic_textual Medium https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9774
generic_textual Medium https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9775
cvssv2 7.2 https://nvd.nist.gov/vuln/detail/CVE-2016-9775
cvssv3 7.8 https://nvd.nist.gov/vuln/detail/CVE-2016-9775
generic_textual Medium https://ubuntu.com/security/notices/USN-3177-1
cvssv3.1 7.5 https://www.oracle.com/security-alerts/cpuApr2021.html
generic_textual HIGH https://www.oracle.com/security-alerts/cpuApr2021.html
cvssv3.1 9.8 http://www.debian.org/security/2016/dsa-3738
generic_textual CRITICAL http://www.debian.org/security/2016/dsa-3738
generic_textual Medium http://www.openwall.com/lists/oss-security/2016/12/02/10
generic_textual Medium http://www.openwall.com/lists/oss-security/2016/12/02/5
Reference id Reference type URL
http://people.canonical.com/~ubuntu-security/cve/2016/CVE-2016-9775.html
https://api.first.org/data/v1/epss?cve=CVE-2016-9775
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=845385
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6816
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-8735
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9774
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9775
https://security.netapp.com/advisory/ntap-20180731-0002/
https://ubuntu.com/security/notices/USN-3177-1
https://www.oracle.com/security-alerts/cpuApr2021.html
http://www.debian.org/security/2016/dsa-3738
http://www.debian.org/security/2016/dsa-3739
http://www.openwall.com/lists/oss-security/2016/12/02/10
http://www.openwall.com/lists/oss-security/2016/12/02/5
http://www.securityfocus.com/bid/94643
http://www.ubuntu.com/usn/USN-3177-1
http://www.ubuntu.com/usn/USN-3177-2
cpe:2.3:a:apache:tomcat:6.0:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:tomcat:6.0:*:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:7.0:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:tomcat:7.0:*:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:8.0:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:tomcat:8.0:*:*:*:*:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:lts:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:lts:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:16.10:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:canonical:ubuntu_linux:16.10:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
CVE-2016-9775 https://nvd.nist.gov/vuln/detail/CVE-2016-9775
USN-3177-1 https://usn.ubuntu.com/3177-1/
No exploits are available.
Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C Found at https://nvd.nist.gov/vuln/detail/CVE-2016-9775
Exploitability (E) Access Vector (AV) Access Complexity (AC) Authentication (Au) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

high

functional

unproven

proof_of_concept

not_defined

local

adjacent_network

network

high

medium

low

multiple

single

none

none

partial

complete

none

partial

complete

none

partial

complete
Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2016-9775
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N Found at https://www.oracle.com/security-alerts/cpuApr2021.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at http://www.debian.org/security/2016/dsa-3738
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.11217
EPSS Score 0.00044
Published At Nov. 1, 2024, midnight
Date Actor Action Source VulnerableCode Version
There are no relevant records.