CVE-2016-9774

Related Files

Ubuntu Security Notice USN-3177-1

Posted Jan 24, 2017

Authored by Ubuntu | Site security.ubuntu.com

Ubuntu Security Notice 3177-1 - It was discovered that the Tomcat realm implementations incorrectly handled passwords when a username didn't exist. A remote attacker could possibly use this issue to enumerate usernames. This issue only applied to Ubuntu 12.04 LTS, Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. Alvaro Munoz and Alexander Mirosh discovered that Tomcat incorrectly limited use of a certain utility method. A malicious application could possibly use this to bypass Security Manager restrictions. This issue only applied to Ubuntu 12.04 LTS, Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. Various other issues were also addressed.

tags | advisory, remote

systems | linux, ubuntu

advisories | CVE-2016-0762, CVE-2016-5018, CVE-2016-5388, CVE-2016-6794, CVE-2016-6796, CVE-2016-6797, CVE-2016-6816, CVE-2016-8735, CVE-2016-8745, CVE-2016-9774, CVE-2016-9775

SHA-256 | 2713577ab03cb9b5c070b7a23a9b0c6daedc179f766b08f40cfeaa05ec2a47d5

Download | Favorite | View

Debian Security Advisory 3738-1

Posted Dec 18, 2016

Authored by Debian | Site debian.org

Debian Linux Security Advisory 3738-1 - Multiple security vulnerabilities were discovered in the Tomcat servlet and JSP engine, as well as in its Debian-specific maintainer scripts. Those flaws allowed for privilege escalation, information disclosure, and remote code execution.

tags | advisory, remote, vulnerability, code execution, info disclosure

systems | linux, debian

advisories | CVE-2016-6816, CVE-2016-8735, CVE-2016-9774, CVE-2016-9775

SHA-256 | 8028bec437fa228aa9afd33369c757ee09d5b8098a5f487ad4cc3e28b24b9e87

Download | Favorite | View