| Name | CVE-2016-9775 |
| Description | The postrm script in the tomcat6 package before 6.0.45+dfsg-1~deb7u3 on Debian wheezy, before 6.0.45+dfsg-1~deb8u1 on Debian jessie, before 6.0.35-1ubuntu3.9 on Ubuntu 12.04 LTS and on Ubuntu 14.04 LTS; the tomcat7 package before 7.0.28-4+deb7u7 on Debian wheezy, before 7.0.56-3+deb8u6 on Debian jessie, before 7.0.52-1ubuntu0.8 on Ubuntu 14.04 LTS, and on Ubuntu 12.04 LTS, 16.04 LTS, and 16.10; and the tomcat8 package before 8.0.14-1+deb8u5 on Debian jessie, before 8.0.32-1ubuntu1.3 on Ubuntu 16.04 LTS, before 8.0.37-1ubuntu0.1 on Ubuntu 16.10, and before 8.0.38-2ubuntu1 on Ubuntu 17.04 might allow local users with access to the tomcat account to gain root privileges via a setgid program in the Catalina directory, as demonstrated by /etc/tomcat8/Catalina/attack. |
| Source | CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more) |
| References | DLA-728-1, DLA-729-1, DSA-3738-1, DSA-3739-1 |
| Debian Bugs | 845385 |
The table below lists information on source packages.
| Source Package | Release | Version | Status |
|---|---|---|---|
| tomcat6 (PTS) | jessie, jessie (lts) | 6.0.45+dfsg-1~deb8u1 | fixed |
| tomcat7 (PTS) | jessie, jessie (lts) | 7.0.56-3+really7.0.109-1+deb8u6 | fixed |
| stretch | 7.0.75-1 | fixed | |
| tomcat8 (PTS) | jessie, jessie (lts) | 8.0.14-1+deb8u28 | fixed |
| stretch (security) | 8.5.54-0+deb9u8 | fixed | |
| stretch (lts), stretch | 8.5.54-0+deb9u15 | fixed |
The information below is based on the following data on fixed versions.
| Package | Type | Release | Fixed Version | Urgency | Origin | Debian Bugs |
|---|---|---|---|---|---|---|
| tomcat6 | source | wheezy | 6.0.45+dfsg-1~deb7u3 | DLA-728-1 | ||
| tomcat6 | source | (unstable) | 6.0.41-3 | |||
| tomcat7 | source | wheezy | 7.0.28-4+deb7u7 | DLA-729-1 | ||
| tomcat7 | source | jessie | 7.0.56-3+deb8u6 | DSA-3738-1 | ||
| tomcat7 | source | (unstable) | 7.0.72-3 | |||
| tomcat8 | source | jessie | 8.0.14-1+deb8u5 | DSA-3739-1 | ||
| tomcat8 | source | (unstable) | 8.5.8-2 | 845385 |
Since 7.0.72-3, src:tomcat7 only builds the Servlet API
Since 6.0.41-3, src:tomcat6 only builds a servlet and docs in Jessie
https://www.openwall.com/lists/oss-security/2016/12/02/5