Read the docs
TI-2016-01138 Aliases CVE-2016-1240GHSA-8c5c-v572-37xf

The Tomcat init script in the tomcat7 package before 7.0.56-3+deb8u4 and tomcat8 package…

Priority MEDIUM 46CWE-20Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 3 fixed, 3 without a fix

Attack profile from CVSS 3.0 · NVD. Fix status from CNA and Red Hat.

Summary

The Tomcat init script in the tomcat7 package before 7.0.56-3+deb8u4 and tomcat8 package before 8.0.14-1+deb8u3 on Debian jessie and the tomcat6 and libtomcat6-java packages before 6.0.35-1ubuntu3.8 on Ubuntu 12.04 LTS, the tomcat7 and libtomcat7-java packages before 7.0.52-1ubuntu0.7 on Ubuntu 14.04 LTS, and tomcat8 and libtomcat8-java packages before 8.0.32-1ubuntu1.2 on Ubuntu 16.04 LTS allows local users with access to the tomcat account to gain root privileges via a symlink attack on the Catalina log file, as demonstrated by /var/log/tomcat7/catalina.out.

Why it matters now

EPSS 0.09783 95th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix Partial Red Hat: 3 advisoriesRed Hat: 3 fixed, 3 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 7

CPEVersionsRoleVendor
cpe:2.3:a:apache:tomcat:6.0:*:*:*:*:*:*:*6.0VulnerableApache
cpe:2.3:a:apache:tomcat:7.0:*:*:*:*:*:*:*7.0VulnerableApache
cpe:2.3:a:apache:tomcat:8.0:*:*:*:*:*:*:*8.0VulnerableApache
cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:lts:*:*:*12.04Running onCanonical
cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*14.04Running onCanonical
cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*16.04Running onCanonical
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*8.0Running onDebian
  • cpe:2.3:a:apache:tomcat:6.0:*:*:*:*:*:*:* Versions 6.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Apache
  • cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:lts:*:*:* Versions 12.04 Running on ·Canonical
  • cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:* Versions 14.04 Running on ·Canonical
  • cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:* Versions 16.04 Running on ·Canonical
  • cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Running on ·Debian

Remediation

Red Hat 3 advisories

  • RHSA-2017:0455 Released 2017-03-07 · Red Hat rating Important
    Red Hat JBoss Web Server 3.1.0 security and enhancement update
    • Red Hat JBoss Web Server 3.1 for RHEL 6 hibernate4-c3p0-eap6-4.2.23-1.Final_redhat_1.1.ep6.el6, hibernate4-core-eap6-4.2.23-1.Final_redhat_1.1.ep6.el6, hibernate4-eap6-4.2.23-1.Final_redhat_1.1.ep6.el6 +34
  • RHSA-2017:0456 Released 2017-03-07 · Red Hat rating Important
    Red Hat JBoss Web Server 3.1.0 security and enhancement update
    • Red Hat JBoss Web Server 3.1 for RHEL 7 hibernate4-c3p0-eap6-4.2.23-1.Final_redhat_1.1.ep6.el7, hibernate4-core-eap6-4.2.23-1.Final_redhat_1.1.ep6.el7, hibernate4-eap6-4.2.23-1.Final_redhat_1.1.ep6.el7 +34
  • RHSA-2017:0457 Released 2017-03-07 · Red Hat rating Important
    Red Hat JBoss Web Server security and enhancement update
    • Red Hat JBoss Web Server 3.1

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat JBoss Enterprise Web Server 2AffectedNo fix planned: Will not fix
Red Hat JBoss Enterprise Web Server 3AffectedNo fix yet: Fix deferred
Red Hat JBoss Web Server 3AffectedNo fix yet
Red Hat JBoss Web Server 3.1Fixed RHSA-2017:0457
Red Hat JBoss Web Server 3.1 for RHEL 6Fixed RHSA-2017:0455
Red Hat JBoss Web Server 3.1 for RHEL 7Fixed RHSA-2017:0456
Not affected: 10 products
  • Red Hat Enterprise Linux 5
  • Red Hat Enterprise Linux 6
  • Red Hat Enterprise Linux 7
  • Red Hat JBoss Data Grid 6
  • Red Hat JBoss Data Virtualization 6
  • Red Hat JBoss Enterprise Application Platform 6
  • Red Hat JBoss Enterprise Application Platform 7
  • Red Hat JBoss Operations Network 3
  • Red Hat JBoss Portal 6
  • Red Hat Software Collections

Timeline

  1. 2026-10-02 Threatist record created from CVE-2016-1240
  2. 2026-10-03 Alias added: GHSA-8c5c-v572-37xf

References

Exploit 1

Advisory 7

Other 3

  • TI-2025-18529 Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT KEVCVSS 3.1CRITICAL 10.0
  • TI-2020-01862 Improper privilege management in Apache Tomcat KEVCVSS 3.1CRITICAL 9.8
  • TI-2016-07192 Improper access control in Apache Tomcat KEVCVSS 3.1CRITICAL 9.8
  • TI-2017-09342 Unrestricted file upload in Apache Tomcat KEVCVSS 3.1HIGH 8.1
  • TI-2017-09340 Unrestricted file upload in Apache Tomcat KEVCVSS 3.1HIGH 8.1
  • TI-2026-26741 Apache Tomcat: Fix for CVE-2026-29146 allowed bypass of EncryptInterceptor KEVCVSS 3.1HIGH 7.5
See all 273 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences