Skip to content
OpenAdvisories
Critical 1 exploited CVE USN-7242-1 1 CVE

tomcat6 vulnerability

Published Jan 30, 2025 · Updated Feb 10, 2026

Ecosystem: Ubuntu

Summary

Pierre Ernst discovered that the Tomcat JmxRemoteLifecycleListener did not
implement a recommended fix. A remote attacker could possibly use this
issue to execute arbitrary code.

Fixed packages 1

ReleasePackageFixed in
Ubuntu · Pro 14.04 LTS Pro:14.04:LTS tomcat6 6.0.39-1ubuntu0.1+esm2

Vulnerabilities 1

  • Critical 9.8
    CVE-2016-8735 Exploited EPSS 90%

    Apache Tomcat Improper Access Control vulnerability

    Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12 if JmxRemoteLifecycleListener is used and an attacker can reach JMX ports. The issue exists because this lis…

    Apache Software Foundation Apache Tomcat tomcat8 tomcat7 Ubuntu Maven
    KEV May 12, 2023

References

  • report
    https://ubuntu.com/security/CVE-2016-8735