UBUNTU-CVE-2016-6816

See a problem?
Source
https://ubuntu.com/security/notices/UBUNTU-CVE-2016-6816
Import Source
https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2016/UBUNTU-CVE-2016-6816.json
JSON Data
https://api.osv.dev/v1/vulns/UBUNTU-CVE-2016-6816
Related
Published
2016-11-23T00:00:00Z
Modified
2016-11-23T00:00:00Z
Severity
  • 7.1 (High) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L CVSS Calculator
Summary
[none]
Details

The code in Apache Tomcat 9.0.0.M1 to 9.0.0.M11, 8.5.0 to 8.5.6, 8.0.0.RC1 to 8.0.38, 7.0.0 to 7.0.72, and 6.0.0 to 6.0.47 that parsed the HTTP request line permitted invalid characters. This could be exploited, in conjunction with a proxy that also permitted the invalid characters but with a different interpretation, to inject data into the HTTP response. By manipulating the HTTP response the attacker could poison a web-cache, perform an XSS attack and/or obtain sensitive information from requests other then their own.

References

Affected packages

Ubuntu:14.04:LTS / tomcat7

Package

Name
tomcat7
Purl
pkg:deb/ubuntu/tomcat7@7.0.52-1ubuntu0.8?arch=src?distro=trusty

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
7.0.52-1ubuntu0.8

Affected versions

7.*

7.0.42-1
7.0.47-1
7.0.50-1
7.0.52-1
7.0.52-1ubuntu0.1
7.0.52-1ubuntu0.3
7.0.52-1ubuntu0.6
7.0.52-1ubuntu0.7

Ecosystem specific 

{
    "availability": "No subscription required",
    "ubuntu_priority": "medium",
    "binaries": [
        {
            "tomcat7-examples": "7.0.52-1ubuntu0.8",
            "tomcat7-admin": "7.0.52-1ubuntu0.8",
            "tomcat7-user": "7.0.52-1ubuntu0.8",
            "libservlet3.0-java": "7.0.52-1ubuntu0.8",
            "libservlet3.0-java-doc": "7.0.52-1ubuntu0.8",
            "libtomcat7-java": "7.0.52-1ubuntu0.8",
            "tomcat7-docs": "7.0.52-1ubuntu0.8",
            "tomcat7": "7.0.52-1ubuntu0.8",
            "tomcat7-common": "7.0.52-1ubuntu0.8"
        }
    ]
}

Ubuntu:Pro:14.04:LTS / tomcat6

Package

Name
tomcat6

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

6.*

6.0.37-1
6.0.39-1
6.0.39-1ubuntu0.1
6.0.39-1ubuntu0.1+esm1

Ecosystem specific 

{
    "ubuntu_priority": "medium"
}

Ubuntu:16.04:LTS / tomcat6

Package

Name
tomcat6
Purl
pkg:deb/ubuntu/tomcat6@6.0.45+dfsg-1ubuntu0.1?arch=src?distro=xenial

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
6.0.45+dfsg-1ubuntu0.1

Affected versions

6.*

6.0.41-4
6.0.45+dfsg-1

Ecosystem specific 

{
    "availability": "No subscription required",
    "ubuntu_priority": "medium",
    "binaries": [
        {
            "libservlet2.5-java-doc": "6.0.45+dfsg-1ubuntu0.1",
            "libservlet2.5-java": "6.0.45+dfsg-1ubuntu0.1"
        }
    ]
}

Ubuntu:16.04:LTS / tomcat7

Package

Name
tomcat7
Purl
pkg:deb/ubuntu/tomcat7@7.0.68-1ubuntu0.3?arch=src?distro=xenial

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
7.0.68-1ubuntu0.3

Affected versions

7.*

7.0.64-1
7.0.68-1
7.0.68-1ubuntu0.1

Ecosystem specific 

{
    "availability": "No subscription required",
    "ubuntu_priority": "medium",
    "binaries": [
        {
            "tomcat7-examples": "7.0.68-1ubuntu0.3",
            "tomcat7-admin": "7.0.68-1ubuntu0.3",
            "tomcat7-user": "7.0.68-1ubuntu0.3",
            "libservlet3.0-java": "7.0.68-1ubuntu0.3",
            "libservlet3.0-java-doc": "7.0.68-1ubuntu0.3",
            "libtomcat7-java": "7.0.68-1ubuntu0.3",
            "tomcat7-docs": "7.0.68-1ubuntu0.3",
            "tomcat7": "7.0.68-1ubuntu0.3",
            "tomcat7-common": "7.0.68-1ubuntu0.3"
        }
    ]
}

Ubuntu:16.04:LTS / tomcat8

Package

Name
tomcat8
Purl
pkg:deb/ubuntu/tomcat8@8.0.32-1ubuntu1.3?arch=src?distro=xenial

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
8.0.32-1ubuntu1.3

Affected versions

8.*

8.0.26-1
8.0.28-1
8.0.30-1
8.0.32-1
8.0.32-1ubuntu1
8.0.32-1ubuntu1.1
8.0.32-1ubuntu1.2

Ecosystem specific 

{
    "availability": "No subscription required",
    "ubuntu_priority": "medium",
    "binaries": [
        {
            "tomcat8-common": "8.0.32-1ubuntu1.3",
            "tomcat8-admin": "8.0.32-1ubuntu1.3",
            "tomcat8-user": "8.0.32-1ubuntu1.3",
            "libtomcat8-java": "8.0.32-1ubuntu1.3",
            "tomcat8": "8.0.32-1ubuntu1.3",
            "tomcat8-examples": "8.0.32-1ubuntu1.3",
            "libservlet3.1-java-doc": "8.0.32-1ubuntu1.3",
            "libservlet3.1-java": "8.0.32-1ubuntu1.3",
            "tomcat8-docs": "8.0.32-1ubuntu1.3"
        }
    ]
}