Summary
Dawid Golunski discovered that the Tomcat init script incorrectly handled
creating log files. A remote attacker could possibly use this issue to
obtain root privileges. (CVE-2016-1240)
This update also reverts a change in behaviour introduced in USN-3024-1 by
setting mapperContextRootRedirectEnabled to True by default.
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 14.04 LTS 14.04:LTS | tomcat7 | 7.0.52-1ubuntu0.7 |
| Ubuntu · 16.04 LTS 16.04:LTS | tomcat8 | 8.0.32-1ubuntu1.2 |
Vulnerabilities 1
-
Unscored —CVE-2016-1240 Public exploit
The Tomcat init script in the tomcat7 package before 7.0.56-3+deb8u4 and tomcat8 package before 8.0.14-1+deb8u3 on Debi…