CVE

Id
87059  
CVE No.
CVE-2016-0763  
Status
Candidate  
Description
The setGlobalContext method in org/apache/naming/factory/ResourceLinkFactory.java in Apache Tomcat 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M3 does not consider whether ResourceLinkFactory.setGlobalContext callers are authorized, which allows remote authenticated users to bypass intended SecurityManager restrictions and read or write to arbitrary application data, or cause a denial of service (application disruption), via a web application that sets a crafted global context.  
Phase
Assigned (20151216)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
762060 87059 CVE-2016-0763 BUGTRAQ:20160222 [SECURITY] CVE-2016-0763 Apache Tomcat Security Manager Bypass  View
762061 87059 CVE-2016-0763 URL:http://seclists.org/bugtraq/2016/Feb/147  View
762062 87059 CVE-2016-0763 CONFIRM:http://svn.apache.org/viewvc?view=revision&revision=1725926  View
762063 87059 CVE-2016-0763 CONFIRM:http://svn.apache.org/viewvc?view=revision&revision=1725929  View
762064 87059 CVE-2016-0763 CONFIRM:http://svn.apache.org/viewvc?view=revision&revision=1725931  View
762065 87059 CVE-2016-0763 CONFIRM:http://tomcat.apache.org/security-7.html  View
762066 87059 CVE-2016-0763 CONFIRM:http://tomcat.apache.org/security-8.html  View
762067 87059 CVE-2016-0763 CONFIRM:http://tomcat.apache.org/security-9.html  View
762068 87059 CVE-2016-0763 CONFIRM:https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05150442  View
762069 87059 CVE-2016-0763 CONFIRM:https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05158626  View
762070 87059 CVE-2016-0763 CONFIRM:http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html  View
762071 87059 CVE-2016-0763 CONFIRM:https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05324755  View
762072 87059 CVE-2016-0763 CONFIRM:https://bto.bluecoat.com/security-advisory/sa118  View
762073 87059 CVE-2016-0763 DEBIAN:DSA-3530  View
762074 87059 CVE-2016-0763 URL:http://www.debian.org/security/2016/dsa-3530  View
762075 87059 CVE-2016-0763 DEBIAN:DSA-3609  View
762076 87059 CVE-2016-0763 URL:http://www.debian.org/security/2016/dsa-3609  View
762077 87059 CVE-2016-0763 DEBIAN:DSA-3552  View
762078 87059 CVE-2016-0763 URL:http://www.debian.org/security/2016/dsa-3552  View
762079 87059 CVE-2016-0763 FEDORA:FEDORA-2016-e6651efbaf  View
762080 87059 CVE-2016-0763 URL:http://lists.fedoraproject.org/pipermail/package-announce/2016-March/179356.html  View
762081 87059 CVE-2016-0763 REDHAT:RHSA-2016:1087  View
762082 87059 CVE-2016-0763 URL:https://access.redhat.com/errata/RHSA-2016:1087  View
762083 87059 CVE-2016-0763 REDHAT:RHSA-2016:1088  View
762084 87059 CVE-2016-0763 URL:https://access.redhat.com/errata/RHSA-2016:1088  View
762085 87059 CVE-2016-0763 REDHAT:RHSA-2016:1089  View
762086 87059 CVE-2016-0763 URL:http://rhn.redhat.com/errata/RHSA-2016-1089.html  View
762087 87059 CVE-2016-0763 SUSE:SUSE-SU-2016:0769  View
762088 87059 CVE-2016-0763 URL:http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00047.html  View
762089 87059 CVE-2016-0763 SUSE:SUSE-SU-2016:0822  View
762090 87059 CVE-2016-0763 URL:http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00069.html  View
762091 87059 CVE-2016-0763 SUSE:openSUSE-SU-2016:0865  View
762092 87059 CVE-2016-0763 URL:http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00085.html  View
762093 87059 CVE-2016-0763 UBUNTU:USN-3024-1  View
762094 87059 CVE-2016-0763 URL:http://www.ubuntu.com/usn/USN-3024-1  View
762095 87059 CVE-2016-0763 BID:83326  View
762096 87059 CVE-2016-0763 URL:http://www.securityfocus.com/bid/83326  View
762097 87059 CVE-2016-0763 SECTRACK:1035069  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
512 JVNDB-2016-001285 Advantech WebAccess におけるディレクトリトラバーサルの脆弱性 Advantech WebAccess には、ディレクトリトラバーサルの脆弱性が存在します。 CVE-2016-0855 87059 5 http://jvndb.jvn.jp/ja/contents/2016/JVNDB-2016-001285.html  View