CVE

Id
87010  
CVE No.
CVE-2016-0714  
Status
Candidate  
Description
The session-persistence implementation in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 mishandles session attributes, which allows remote authenticated users to bypass intended SecurityManager restrictions and execute arbitrary code in a privileged context via a web application that places a crafted object in a session.  
Phase
Assigned (20151216)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
761535 87010 CVE-2016-0714 BUGTRAQ:20160222 [SECURITY] CVE-2016-0714 Apache Tomcat Security Manager Bypass  View
761536 87010 CVE-2016-0714 URL:http://seclists.org/bugtraq/2016/Feb/145  View
761537 87010 CVE-2016-0714 CONFIRM:http://svn.apache.org/viewvc?view=revision&revision=1725263  View
761538 87010 CVE-2016-0714 CONFIRM:http://svn.apache.org/viewvc?view=revision&revision=1725914  View
761539 87010 CVE-2016-0714 CONFIRM:http://svn.apache.org/viewvc?view=revision&revision=1726196  View
761540 87010 CVE-2016-0714 CONFIRM:http://svn.apache.org/viewvc?view=revision&revision=1726203  View
761541 87010 CVE-2016-0714 CONFIRM:http://svn.apache.org/viewvc?view=revision&revision=1726923  View
761542 87010 CVE-2016-0714 CONFIRM:http://svn.apache.org/viewvc?view=revision&revision=1727034  View
761543 87010 CVE-2016-0714 CONFIRM:http://svn.apache.org/viewvc?view=revision&revision=1727166  View
761544 87010 CVE-2016-0714 CONFIRM:http://svn.apache.org/viewvc?view=revision&revision=1727182  View
761545 87010 CVE-2016-0714 CONFIRM:http://tomcat.apache.org/security-6.html  View
761546 87010 CVE-2016-0714 CONFIRM:http://tomcat.apache.org/security-7.html  View
761547 87010 CVE-2016-0714 CONFIRM:http://tomcat.apache.org/security-8.html  View
761548 87010 CVE-2016-0714 CONFIRM:http://tomcat.apache.org/security-9.html  View
761549 87010 CVE-2016-0714 CONFIRM:https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05150442  View
761550 87010 CVE-2016-0714 CONFIRM:https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05158626  View
761551 87010 CVE-2016-0714 CONFIRM:https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05054964  View
761552 87010 CVE-2016-0714 CONFIRM:http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html  View
761553 87010 CVE-2016-0714 CONFIRM:http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html  View
761554 87010 CVE-2016-0714 CONFIRM:http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html  View
761555 87010 CVE-2016-0714 CONFIRM:https://bto.bluecoat.com/security-advisory/sa118  View
761556 87010 CVE-2016-0714 DEBIAN:DSA-3530  View
761557 87010 CVE-2016-0714 URL:http://www.debian.org/security/2016/dsa-3530  View
761558 87010 CVE-2016-0714 DEBIAN:DSA-3609  View
761559 87010 CVE-2016-0714 URL:http://www.debian.org/security/2016/dsa-3609  View
761560 87010 CVE-2016-0714 DEBIAN:DSA-3552  View
761561 87010 CVE-2016-0714 URL:http://www.debian.org/security/2016/dsa-3552  View
761562 87010 CVE-2016-0714 HP:HPSBUX03561  View
761563 87010 CVE-2016-0714 URL:http://marc.info/?l=bugtraq&m=145974991225029&w=2  View
761564 87010 CVE-2016-0714 REDHAT:RHSA-2016:2045  View
761565 87010 CVE-2016-0714 URL:http://rhn.redhat.com/errata/RHSA-2016-2045.html  View
761566 87010 CVE-2016-0714 REDHAT:RHSA-2016:1087  View
761567 87010 CVE-2016-0714 URL:https://access.redhat.com/errata/RHSA-2016:1087  View
761568 87010 CVE-2016-0714 REDHAT:RHSA-2016:1088  View
761569 87010 CVE-2016-0714 URL:https://access.redhat.com/errata/RHSA-2016:1088  View
761570 87010 CVE-2016-0714 REDHAT:RHSA-2016:1089  View
761571 87010 CVE-2016-0714 URL:http://rhn.redhat.com/errata/RHSA-2016-1089.html  View
761572 87010 CVE-2016-0714 SUSE:SUSE-SU-2016:0769  View
761573 87010 CVE-2016-0714 URL:http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00047.html  View
761574 87010 CVE-2016-0714 SUSE:SUSE-SU-2016:0822  View
761575 87010 CVE-2016-0714 URL:http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00069.html  View
761576 87010 CVE-2016-0714 SUSE:SUSE-SU-2016:0839  View
761577 87010 CVE-2016-0714 URL:http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00082.html  View
761578 87010 CVE-2016-0714 SUSE:openSUSE-SU-2016:0865  View
761579 87010 CVE-2016-0714 URL:http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00085.html  View
761580 87010 CVE-2016-0714 UBUNTU:USN-3024-1  View
761581 87010 CVE-2016-0714 URL:http://www.ubuntu.com/usn/USN-3024-1  View
761582 87010 CVE-2016-0714 BID:83327  View
761583 87010 CVE-2016-0714 URL:http://www.securityfocus.com/bid/83327  View
761584 87010 CVE-2016-0714 SECTRACK:1035069  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
825 JVNDB-2016-001598 Android のカーネルの Qualcomm Wi-Fi ドライバにおける権限を取得される脆弱性 Android のカーネルの Qualcomm Wi-Fi ドライバには、権限を取得される脆弱性が存在します。 CVE-2016-0806 87010 7.2 http://jvndb.jvn.jp/ja/contents/2016/JVNDB-2016-001598.html  View