RHSA-2016:2045HighCVSS 8.8

Red Hat Security Advisory: tomcat6 security and bug fix update

Published
October 10, 2016
Last Modified
October 14, 2026

🔗 CVE IDs covered (6)

CVE-2015-5174 →CVE-2015-5345 →CVE-2016-0706 →CVE-2016-0714 →CVE-2016-5388 →CVE-2016-6325 →

📋 Description

CVE-2015-5174 — tomcat: URL Normalization issue CVE-2015-5345 — tomcat: directory disclosure CVE-2016-0706 — tomcat: security manager bypass via StatusManagerServlet CVE-2016-0714 — tomcat: Security Manager bypass via persistence mechanisms CVE-2016-5388 — Tomcat: CGI sets environmental variable based on user supplied Proxy request header CVE-2016-6325 — tomcat: tomcat writable config files allow privilege escalation

🎯 Affected products44

  • Red Hat Enterprise Linux Desktop (v. 6)
  • Red Hat Enterprise Linux HPC Node (v. 6)
  • Red Hat Enterprise Linux Server (v. 6)
  • Red Hat Enterprise Linux Workstation (v. 6)
  • tomcat6-0:6.0.24-98.el6_8.noarch as a component of Red Hat Enterprise Linux Desktop (v. 6)
  • tomcat6-0:6.0.24-98.el6_8.noarch as a component of Red Hat Enterprise Linux HPC Node (v. 6)
  • tomcat6-0:6.0.24-98.el6_8.noarch as a component of Red Hat Enterprise Linux Server (v. 6)
  • tomcat6-0:6.0.24-98.el6_8.noarch as a component of Red Hat Enterprise Linux Workstation (v. 6)
  • tomcat6-0:6.0.24-98.el6_8.src as a component of Red Hat Enterprise Linux Desktop (v. 6)
  • tomcat6-0:6.0.24-98.el6_8.src as a component of Red Hat Enterprise Linux HPC Node (v. 6)
  • tomcat6-0:6.0.24-98.el6_8.src as a component of Red Hat Enterprise Linux Server (v. 6)
  • tomcat6-0:6.0.24-98.el6_8.src as a component of Red Hat Enterprise Linux Workstation (v. 6)
  • tomcat6-admin-webapps-0:6.0.24-98.el6_8.noarch as a component of Red Hat Enterprise Linux Desktop (v. 6)
  • tomcat6-admin-webapps-0:6.0.24-98.el6_8.noarch as a component of Red Hat Enterprise Linux HPC Node (v. 6)
  • tomcat6-admin-webapps-0:6.0.24-98.el6_8.noarch as a component of Red Hat Enterprise Linux Server (v. 6)
  • tomcat6-admin-webapps-0:6.0.24-98.el6_8.noarch as a component of Red Hat Enterprise Linux Workstation (v. 6)
  • tomcat6-docs-webapp-0:6.0.24-98.el6_8.noarch as a component of Red Hat Enterprise Linux Desktop (v. 6)
  • tomcat6-docs-webapp-0:6.0.24-98.el6_8.noarch as a component of Red Hat Enterprise Linux HPC Node (v. 6)
  • tomcat6-docs-webapp-0:6.0.24-98.el6_8.noarch as a component of Red Hat Enterprise Linux Server (v. 6)
  • tomcat6-docs-webapp-0:6.0.24-98.el6_8.noarch as a component of Red Hat Enterprise Linux Workstation (v. 6)
  • tomcat6-el-2.1-api-0:6.0.24-98.el6_8.noarch as a component of Red Hat Enterprise Linux Desktop (v. 6)
  • tomcat6-el-2.1-api-0:6.0.24-98.el6_8.noarch as a component of Red Hat Enterprise Linux HPC Node (v. 6)
  • tomcat6-el-2.1-api-0:6.0.24-98.el6_8.noarch as a component of Red Hat Enterprise Linux Server (v. 6)
  • tomcat6-el-2.1-api-0:6.0.24-98.el6_8.noarch as a component of Red Hat Enterprise Linux Workstation (v. 6)
  • tomcat6-javadoc-0:6.0.24-98.el6_8.noarch as a component of Red Hat Enterprise Linux Desktop (v. 6)
  • tomcat6-javadoc-0:6.0.24-98.el6_8.noarch as a component of Red Hat Enterprise Linux HPC Node (v. 6)
  • tomcat6-javadoc-0:6.0.24-98.el6_8.noarch as a component of Red Hat Enterprise Linux Server (v. 6)
  • tomcat6-javadoc-0:6.0.24-98.el6_8.noarch as a component of Red Hat Enterprise Linux Workstation (v. 6)
  • tomcat6-jsp-2.1-api-0:6.0.24-98.el6_8.noarch as a component of Red Hat Enterprise Linux Desktop (v. 6)
  • tomcat6-jsp-2.1-api-0:6.0.24-98.el6_8.noarch as a component of Red Hat Enterprise Linux HPC Node (v. 6)
  • +14 more not shown

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

🔗 References (11)