Skip to content
OpenAdvisories
High RHSA-2016:2045 6 CVEs

Red Hat Security Advisory: tomcat6 security and bug fix update

Published Sep 15, 2024 · Updated Oct 15, 2026

Ecosystem: Red Hat

Fixed packages 36

ReleasePackageFixed in
Red Hat · RHEL 6 enterprise_linux:6::client tomcat6 0:6.0.24-98.el6_8
Red Hat · RHEL 6 enterprise_linux:6::client tomcat6-admin-webapps 0:6.0.24-98.el6_8
Red Hat · RHEL 6 enterprise_linux:6::client tomcat6-docs-webapp 0:6.0.24-98.el6_8
Red Hat · RHEL 6 enterprise_linux:6::client tomcat6-el-2.1-api 0:6.0.24-98.el6_8
Red Hat · RHEL 6 enterprise_linux:6::client tomcat6-javadoc 0:6.0.24-98.el6_8
Red Hat · RHEL 6 enterprise_linux:6::client tomcat6-jsp-2.1-api 0:6.0.24-98.el6_8
Red Hat · RHEL 6 enterprise_linux:6::client tomcat6-lib 0:6.0.24-98.el6_8
Red Hat · RHEL 6 enterprise_linux:6::client tomcat6-servlet-2.5-api 0:6.0.24-98.el6_8
Red Hat · RHEL 6 enterprise_linux:6::client tomcat6-webapps 0:6.0.24-98.el6_8
Red Hat · RHEL 6 enterprise_linux:6::computenode tomcat6 0:6.0.24-98.el6_8
Red Hat · RHEL 6 enterprise_linux:6::computenode tomcat6-admin-webapps 0:6.0.24-98.el6_8
Red Hat · RHEL 6 enterprise_linux:6::computenode tomcat6-docs-webapp 0:6.0.24-98.el6_8
Red Hat · RHEL 6 enterprise_linux:6::computenode tomcat6-el-2.1-api 0:6.0.24-98.el6_8
Red Hat · RHEL 6 enterprise_linux:6::computenode tomcat6-javadoc 0:6.0.24-98.el6_8
Red Hat · RHEL 6 enterprise_linux:6::computenode tomcat6-jsp-2.1-api 0:6.0.24-98.el6_8
Red Hat · RHEL 6 enterprise_linux:6::computenode tomcat6-lib 0:6.0.24-98.el6_8
Red Hat · RHEL 6 enterprise_linux:6::computenode tomcat6-servlet-2.5-api 0:6.0.24-98.el6_8
Red Hat · RHEL 6 enterprise_linux:6::computenode tomcat6-webapps 0:6.0.24-98.el6_8
Red Hat · RHEL 6 enterprise_linux:6::server tomcat6 0:6.0.24-98.el6_8
Red Hat · RHEL 6 enterprise_linux:6::server tomcat6-admin-webapps 0:6.0.24-98.el6_8
Red Hat · RHEL 6 enterprise_linux:6::server tomcat6-docs-webapp 0:6.0.24-98.el6_8
Red Hat · RHEL 6 enterprise_linux:6::server tomcat6-el-2.1-api 0:6.0.24-98.el6_8
Red Hat · RHEL 6 enterprise_linux:6::server tomcat6-javadoc 0:6.0.24-98.el6_8
Red Hat · RHEL 6 enterprise_linux:6::server tomcat6-jsp-2.1-api 0:6.0.24-98.el6_8
Red Hat · RHEL 6 enterprise_linux:6::server tomcat6-lib 0:6.0.24-98.el6_8
Red Hat · RHEL 6 enterprise_linux:6::server tomcat6-servlet-2.5-api 0:6.0.24-98.el6_8
Red Hat · RHEL 6 enterprise_linux:6::server tomcat6-webapps 0:6.0.24-98.el6_8
Red Hat · RHEL 6 enterprise_linux:6::workstation tomcat6 0:6.0.24-98.el6_8
Red Hat · RHEL 6 enterprise_linux:6::workstation tomcat6-admin-webapps 0:6.0.24-98.el6_8
Red Hat · RHEL 6 enterprise_linux:6::workstation tomcat6-docs-webapp 0:6.0.24-98.el6_8
Red Hat · RHEL 6 enterprise_linux:6::workstation tomcat6-el-2.1-api 0:6.0.24-98.el6_8
Red Hat · RHEL 6 enterprise_linux:6::workstation tomcat6-javadoc 0:6.0.24-98.el6_8
Red Hat · RHEL 6 enterprise_linux:6::workstation tomcat6-jsp-2.1-api 0:6.0.24-98.el6_8
Red Hat · RHEL 6 enterprise_linux:6::workstation tomcat6-lib 0:6.0.24-98.el6_8
Red Hat · RHEL 6 enterprise_linux:6::workstation tomcat6-servlet-2.5-api 0:6.0.24-98.el6_8
Red Hat · RHEL 6 enterprise_linux:6::workstation tomcat6-webapps 0:6.0.24-98.el6_8

Vulnerabilities 6

  • High 8.8
    CVE-2016-0714 Public exploit EPSS 13%

    Improper Access Control in Apache Tomcat

    The session-persistence implementation in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 mishandles session attributes, which allows remote authenticated users to bypass intended SecurityManager restrictions and…

    org.apache.tomcat:tomcat tomcat7 tomcat6 Ubuntu Maven
  • High 8.1
    CVE-2016-5388 EPSS 51%

    Improper Access Control in Apache Tomcat

    Apache Tomcat 7.x through 7.0.70 and 8.x through 8.5.4, when the CGI Servlet is enabled, follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might…

    tomcat8 tomcat7 tomcat6 org.apache.tomcat:tomcat-catalina Ubuntu Maven
  • Medium 5.3
    CVE-2015-5345 EPSS 18%

    Improper Limitation of a Pathname to a Restricted Directory in Apache Tomcat

    The Mapper component in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.30, and 9.x before 9.0.0.M2 processes redirects before considering security constraints and Filters, which allows remote attackers to determine the existence of a direc…

    org.apache.tomcat:tomcat tomcat9 tomcat7 tomcat6 Ubuntu Maven
  • Medium 4.3
    CVE-2015-5174 EPSS 13%

    Improper Limitation of a Pathname to a Restricted Directory in Apache Tomcat

    Directory traversal vulnerability in RequestUtil.java in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.65, and 8.x before 8.0.27 allows remote authenticated users to bypass intended SecurityManager restrictions and list a parent directory via a /.. (slash d…

    org.apache.tomcat:tomcat tomcat7 tomcat6 Ubuntu Maven
  • Medium 4.3
    CVE-2016-0706

    Exposure of Sensitive Information to an Unauthorized Actor in Apache Tomcat

    Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 does not place org.apache.catalina.manager.StatusManagerServlet on the org/apache/catalina/core/RestrictedServlets.properties list, which allows remote authenticate…

    org.apache.tomcat:tomcat tomcat7 tomcat6 Ubuntu Maven
  • Unscored —
    CVE-2016-6325

    The Tomcat package on Red Hat Enterprise Linux (RHEL) 5 through 7, JBoss Web Server 3.0, and JBoss EWS 2 uses weak perm…

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • article
    https://tomcat.apache.org/security-6.html#Fixed_in_Apache_Tomcat_6.0.45
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1265698
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1311082
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1311087
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1311089
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1353809
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1357123
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1367447
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_2045.json
  • report
    https://access.redhat.com/security/cve/CVE-2015-5174
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2015-5174
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2015-5174
  • article
    http://seclists.org/bugtraq/2016/Feb/149
  • report
    https://access.redhat.com/security/cve/CVE-2015-5345
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2015-5345
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2015-5345
  • article
    http://seclists.org/bugtraq/2016/Feb/146
  • report
    https://access.redhat.com/security/cve/CVE-2016-0706
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2016-0706
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2016-0706
  • article
    http://seclists.org/bugtraq/2016/Feb/144
  • report
    https://access.redhat.com/security/cve/CVE-2016-0714
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2016-0714
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2016-0714
  • article
    http://seclists.org/bugtraq/2016/Feb/145
  • report
    https://access.redhat.com/security/cve/CVE-2016-5388
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2016-5388
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2016-5388
  • report
    https://access.redhat.com/security/cve/CVE-2016-6325
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2016-6325
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2016-6325