Skip to content
OpenAdvisories
Critical 1 exploited CVE USN-4557-1 7 CVEs

tomcat6 vulnerabilities

Published Sep 30, 2020 · Updated Apr 27, 2026

Ecosystem: Ubuntu

Summary

It was discovered that the Tomcat realm implementations incorrectly handled
passwords when a username didn't exist. A remote attacker could possibly
use this issue to enumerate usernames. (CVE-2016-0762)

Alvaro Munoz and Alexander Mirosh discovered that Tomcat incorrectly
limited use of a certain utility method. A malicious application could
possibly use this to bypass Security Manager restrictions. (CVE-2016-5018)

It was discovered that Tomcat incorrectly controlled reading system
properties. A malicious application could possibly use this to bypass
Security Manager restrictions. (CVE-2016-6794)

It was discovered that Tomcat incorrectly controlled certain configuration
parameters. A malicious application could possibly use this to bypass
Security Manager restrictions. (CVE-2016-6796)

It was discovered that Tomcat incorrectly limited access to global JNDI
resources. A malicious application could use this to access any global JNDI
resource without an explicit ResourceLink. (CVE-2016-6797)

Regis Leroy discovered that Tomcat incorrectly filtered certain invalid
characters from the HTTP request line. A remote attacker could possibly
use this issue to inject data into HTTP responses. (CVE-2016-6816)

Pierre Ernst discovered that the Tomcat JmxRemoteLifecycleListener did not
implement a recommended fix. A remote attacker could possibly use this
issue to execute arbitrary code. (CVE-2016-8735)

Fixed packages 1

ReleasePackageFixed in
Ubuntu · 16.04 LTS 16.04:LTS tomcat6 6.0.45+dfsg-1ubuntu0.1

Vulnerabilities 7

  • Critical 9.8
    CVE-2016-8735 Exploited EPSS 90%

    Apache Tomcat Improper Access Control vulnerability

    Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12 if JmxRemoteLifecycleListener is used and an attacker can reach JMX ports. The issue exists because this lis…

    Apache Software Foundation Apache Tomcat tomcat8 tomcat7 Ubuntu Maven
    KEV May 12, 2023
  • Critical 9.1
    CVE-2016-5018 EPSS 10%

    Authentication Bypass Using an Alternate Path or Channel in Apache Tomcat

    In Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 a malicious web application was able to bypass a configured SecurityManager via a Tomcat utility method that was accessible to web applications.

    Apache Software Foundation Apache Tomcat tomcat8 tomcat7 Ubuntu Maven
  • High 7.5
    CVE-2016-6796

    Apache Tomcat vulnerable to SecurityManager bypass

    A malicious web application running on Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 was able to bypass a configured SecurityManager via manipulation of the configuration parameters for the JSP Se…

    Apache Software Foundation Apache Tomcat org.apache.tomcat:tomcat tomcat8 Ubuntu Maven
  • High 7.5
    CVE-2016-6797

    Incorrect Authorization in Apache Tomcat

    The ResourceLinkFactory implementation in Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 did not limit web application access to global JNDI resources to those resources explicitly linked to the we…

    Apache Software Foundation Apache Tomcat org.apache.tomcat:tomcat tomcat8 Ubuntu Maven
  • High 7.1
    CVE-2016-6816 Public exploit EPSS 40%

    Improper Input Validation in Apache Tomcat

    The code in Apache Tomcat 9.0.0.M1 to 9.0.0.M11, 8.5.0 to 8.5.6, 8.0.0.RC1 to 8.0.38, 7.0.0 to 7.0.72, and 6.0.0 to 6.0.47 that parsed the HTTP request line permitted invalid characters. This could be exploited, in conjunction with a proxy that also permitted…

    Apache Software Foundation Apache Tomcat tomcat8 tomcat7 Ubuntu Maven
  • Medium 5.9
    CVE-2016-0762

    Observable Discrepancy in Apache Tomcat

    The Realm implementations in Apache Tomcat versions 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 did not process the supplied password if the supplied user name did not exist. This made a timing attack possibl…

    Apache Software Foundation Apache Tomcat org.apache.tomcat:tomcat tomcat8 Ubuntu Maven
  • Medium 5.3
    CVE-2016-6794

    System Property Disclosure in Apache Tomcat

    When a SecurityManager is configured, a web application's ability to read system properties should be controlled by the SecurityManager. In Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70, 6.0.0 to 6.0.45 the system pr…

    Apache Software Foundation Apache Tomcat org.apache.tomcat:tomcat tomcat8 Ubuntu Maven

References

  • report
    https://ubuntu.com/security/CVE-2016-0762
  • report
    https://ubuntu.com/security/CVE-2016-5018
  • report
    https://ubuntu.com/security/CVE-2016-6794
  • report
    https://ubuntu.com/security/CVE-2016-6796
  • report
    https://ubuntu.com/security/CVE-2016-6797
  • report
    https://ubuntu.com/security/CVE-2016-6816
  • report
    https://ubuntu.com/security/CVE-2016-8735