Skip to content
Fencer Vulns
high 7.8

CVE-2016-1240 json

The Tomcat init script in the tomcat7 package before 7.0.56-3+deb8u4 and tomcat8 package before 8.0.14-1+deb8u3 on Debian jessie and the to…

published 2016-10-03 10 y ago modified 2026-06-17 4 mo ago also EUVD-2016-2341

cvss
7.8
version 3.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
9.8%
EPSS 9.8% chance of exploitation in 30 days, percentile 95%
public exploits
2
Metasploit, Exploit-DB

Summary

The Tomcat init script in the tomcat7 package before 7.0.56-3+deb8u4 and tomcat8 package before 8.0.14-1+deb8u3 on Debian jessie and the tomcat6 and libtomcat6-java packages before 6.0.35-1ubuntu3.8 on Ubuntu 12.04 LTS, the tomcat7 and libtomcat7-java packages before 7.0.52-1ubuntu0.7 on Ubuntu 14.04 LTS, and tomcat8 and libtomcat8-java packages before 8.0.32-1ubuntu1.2 on Ubuntu 16.04 LTS allows local users with access to the tomcat account to gain root privileges via a symlink attack on the Catalina log file, as demonstrated by /var/log/tomcat7/catalina.out.

Patch / fix

  • tomcat6 Ubuntu 14.04 LTS 6.0.39-1ubuntu0.1
  • tomcat6 Ubuntu 16.04 LTS 6.0.45+dfsg-1ubuntu0.2
  • tomcat7 Ubuntu 14.04 LTS 7.0.52-1ubuntu0.7
  • tomcat7 Ubuntu 16.04 LTS 7.0.68-1ubuntu0.3
  • tomcat8 Ubuntu 16.04 LTS 8.0.32-1ubuntu1.2

ubuntu advisories UBUNTU-CVE-2016-1240

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • tomcat7 jboss enterprise web server 3.1 7.0.70-16.ep7.el7
  • tomcat8 jboss enterprise web server 3.1 8.0.36-17.ep7.el7
  • mod_cluster jboss enterprise web server 3.1 1.3.5-2.Final_redhat_2.1.ep7.el7
  • tomcat7-lib jboss enterprise web server 3.1 7.0.70-16.ep7.el7
  • tomcat8-lib jboss enterprise web server 3.1 8.0.36-17.ep7.el7
  • tomcat-vault jboss enterprise web server 3.1 1.0.8-9.Final_redhat_2.1.ep7.el7
  • tomcat7-jsvc jboss enterprise web server 3.1 7.0.70-16.ep7.el7
  • tomcat8-jsvc jboss enterprise web server 3.1 8.0.36-17.ep7.el7

red hat advisories RHSA-2017:0456RHSA-2017:0455

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2016-1240 updated cvss 7.0

tomcat: unsafe chown of catalina.log in tomcat init script allows privilege escalation

  • Red Hat JBoss Enterprise Web Server 2 tomcat6, tomcat6-lib, tomcat6-log4j, tomcat6-javadoc, tomcat6-webapps, tomcat7 tomcat7, +6 more
    affected: no fix planned “Will not fix”
  • Red Hat JBoss Enterprise Web Server 3 tomcat7 tomcat7
    affected: no fix available “Fix deferred”
  • Red Hat JBoss Web Server 3 tomcat8 tomcat8
    affected: no fix available
  • Red Hat JBoss Web Server 3.1
    fixed: vendor fix RHSA-2017:0457
  • Red Hat JBoss Web Server 3.1 for RHEL 6 tomcat7 7.0.70-16.ep7.el6, tomcat8 8.0.36-17.ep7.el6, tomcat7-lib 7.0.70-16.ep7.el6, tomcat8-lib 8.0.36-17.ep7.el6, tomcat7-jsvc 7.0.70-16.ep7.el6, tomcat8-jsvc 8.0.36-17.ep7.el6, +31 more
    fixed: vendor fix RHSA-2017:0455
  • Red Hat JBoss Web Server 3.1 for RHEL 7 tomcat7 7.0.70-16.ep7.el7, tomcat8 8.0.36-17.ep7.el7, tomcat7-lib 7.0.70-16.ep7.el7, tomcat8-lib 8.0.36-17.ep7.el7, tomcat7-jsvc 7.0.70-16.ep7.el7, tomcat8-jsvc 8.0.36-17.ep7.el7, +31 more
    fixed: vendor fix RHSA-2017:0456
  • Red Hat Enterprise Linux 5 tomcat5 Red Hat Enterprise Linux 6 tomcat6, tomcat6-lib, tomcat6-log4j, tomcat6-javadoc, tomcat6-webapps, tomcat6-el-2.1-api, +4 more Red Hat Enterprise Linux 7 tomcat, tomcat-lib, tomcat-jsvc, tomcat-javadoc, tomcat-webapps, tomcat-el-2.2-api, +4 more Red Hat JBoss Data Grid 6 jbossweb jbossweb Red Hat JBoss Data Virtualization 6 jbossweb jbossweb Red Hat JBoss Enterprise Application Platform 6 jbossweb jbossweb
    +4 more products
    Red Hat JBoss Enterprise Application Platform 7 tomcat-catalina Red Hat JBoss Operations Network 3 jbossweb jbossweb Red Hat JBoss Portal 6 jbossweb jbossweb Red Hat Software Collections rh-java-common-tomcat-lib, rh-java-common-tomcat-javadoc, rh-java-common-tomcat-el-2.2-api, rh-java-common-tomcat-jsp-2.2-api, rh-java-common-tomcat-servlet-3.0-api
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Timeline

  1. First public exploit (Metasploit exploit/linux/local/tomcat_ubuntu_log_init_priv_esc)
  2. Published

Exploit prediction

9.78% chance of exploitation in the next 30 days, higher than 95% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

CVSS scores

assigned by version score vector
NVD 3.0 7.8 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD 2.0 7.2 AV:L/AC:L/Au:N/C:C/I:C/A:C

Classification

Weakness
  • CWE-20 Improper Input Validation

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.