p PatchFirst

CVE-2016-6794

CVE-2016-6794

This page contains facts from public vulnerability sources. Check the original advisory before updating.

This page shows selected source facts. See the linked advisories for the complete description and affected versions.

When a SecurityManager is configured, a web application's ability to read system properties should be controlled by the SecurityManager. In Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70, 6.0.0 to 6.0.45 the system property replacement feature for configuration files could be used by a malicious web application to bypass the SecurityManager and read system properties that should not be visible.

CVSS 5.3 · Medium · EPSS 7.2% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • apache tomcat

    Versions
    • 9.0.0.M1 to 9.0.0.M9: Affected
    • 8.5.0 to 8.5.4: Affected
    • 8.0.0.RC1 to 8.0.36: Affected
    • 7.0.0 to 7.0.70: Affected
    • 6.0.0 to 6.0.45: Affected

    No fix published

  • tomcat7 Ubuntu:14.04:LTS

    Versions
    • 7.0.42-1
    • 7.0.47-1
    • 7.0.50-1
    • 7.0.52-1
    • 7.0.52-1ubuntu0.1
    • 7.0.52-1ubuntu0.3
    • 7.0.52-1ubuntu0.6
    • 7.0.52-1ubuntu0.7
    Affected ranges
    • ECOSYSTEM: < 7.0.52-1ubuntu0.8

    Update to 7.0.52-1ubuntu0.8

  • tomcat6 Ubuntu:Pro:14.04:LTS

    Versions
    • 6.0.37-1
    • 6.0.39-1
    • 6.0.39-1ubuntu0.1
    • 6.0.39-1ubuntu0.1+esm1
    • 6.0.39-1ubuntu0.1+esm2
    • 6.0.39-1ubuntu0.1+esm3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • tomcat6 Ubuntu:16.04:LTS

    Versions
    • 6.0.41-4
    • 6.0.45+dfsg-1
    Affected ranges
    • ECOSYSTEM: < 6.0.45+dfsg-1ubuntu0.1

    Update to 6.0.45+dfsg-1ubuntu0.1

  • tomcat7 Ubuntu:16.04:LTS

    Versions
    • 7.0.64-1
    • 7.0.68-1
    • 7.0.68-1ubuntu0.1
    Affected ranges
    • ECOSYSTEM: < 7.0.68-1ubuntu0.3

    Update to 7.0.68-1ubuntu0.3

  • tomcat8 Ubuntu:16.04:LTS

    Versions
    • 8.0.26-1
    • 8.0.28-1
    • 8.0.30-1
    • 8.0.32-1
    • 8.0.32-1ubuntu1
    • 8.0.32-1ubuntu1.1
    • 8.0.32-1ubuntu1.2
    Affected ranges
    • ECOSYSTEM: < 8.0.32-1ubuntu1.3

    Update to 8.0.32-1ubuntu1.3

Original sources

Check your server →