CVE-2013-1976
Fixed in a distro release EPSS <1%
The (1) tomcat5, (2) tomcat6, and (3) tomcat7 init scripts, as used in the RPM distribution of Tomcat for JBoss Enterprise Web Server 1.0.2 and 2.0.0, and Red Hat Enterprise Linux 5 and 6, allow local users to change the ownership of arbitrary files via a symlink attack on (a) tomcat5-initd.log, (b) tomcat6-initd.log, (c) catalina.out, or (d) tomcat7-initd.log.
Products: redhat jboss_enterprise_web_server, redhat enterprise_linux
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Red Hat Enterprise Linux 5 | tomcat5 | 0:5.5.23-0jpp.40.el5_9 |
| Red Hat Enterprise Linux 5 | tomcat5-admin-webapps | 0:5.5.23-0jpp.40.el5_9 |
| Red Hat Enterprise Linux 5 | tomcat5-common-lib | 0:5.5.23-0jpp.40.el5_9 |
| Red Hat Enterprise Linux 5 | tomcat5-debuginfo | 0:5.5.23-0jpp.40.el5_9 |
| Red Hat Enterprise Linux 5 | tomcat5-jasper | 0:5.5.23-0jpp.40.el5_9 |
| Red Hat Enterprise Linux 5 | tomcat5-jasper-javadoc | 0:5.5.23-0jpp.40.el5_9 |
| Red Hat Enterprise Linux 5 | tomcat5-jsp-2.0-api | 0:5.5.23-0jpp.40.el5_9 |
| Red Hat Enterprise Linux 5 | tomcat5-jsp-2.0-api-javadoc | 0:5.5.23-0jpp.40.el5_9 |
| Red Hat Enterprise Linux 5 | tomcat5-server-lib | 0:5.5.23-0jpp.40.el5_9 |
| Red Hat Enterprise Linux 5 | tomcat5-servlet-2.4-api | 0:5.5.23-0jpp.40.el5_9 |
| Red Hat Enterprise Linux 5 | tomcat5-servlet-2.4-api-javadoc | 0:5.5.23-0jpp.40.el5_9 |
| Red Hat Enterprise Linux 5 | tomcat5-webapps | 0:5.5.23-0jpp.40.el5_9 |
| Red Hat Enterprise Linux 6 | tomcat6 | 0:6.0.24-55.el6_4 |
| Red Hat Enterprise Linux 6 | tomcat6-admin-webapps | 0:6.0.24-55.el6_4 |
| Red Hat Enterprise Linux 6 | tomcat6-docs-webapp | 0:6.0.24-55.el6_4 |
| Red Hat Enterprise Linux 6 | tomcat6-el-2.1-api | 0:6.0.24-55.el6_4 |
| Red Hat Enterprise Linux 6 | tomcat6-javadoc | 0:6.0.24-55.el6_4 |
| Red Hat Enterprise Linux 6 | tomcat6-jsp-2.1-api | 0:6.0.24-55.el6_4 |
| Red Hat Enterprise Linux 6 | tomcat6-lib | 0:6.0.24-55.el6_4 |
| Red Hat Enterprise Linux 6 | tomcat6-servlet-2.5-api | 0:6.0.24-55.el6_4 |
| Red Hat Enterprise Linux 6 | tomcat6-webapps | 0:6.0.24-55.el6_4 |
| Red Hat jboss enterprise web server 1 | tomcat5 | 0:5.5.33-33_patch_09.ep5.el5 |
| Red Hat jboss enterprise web server 1 | tomcat5 | 0:5.5.33-36_patch_09.ep5.el6 |
| Red Hat jboss enterprise web server 1 | tomcat5-admin-webapps | 0:5.5.33-33_patch_09.ep5.el5 |
| Red Hat jboss enterprise web server 1 | tomcat5-admin-webapps | 0:5.5.33-36_patch_09.ep5.el6 |
| Red Hat jboss enterprise web server 1 | tomcat5-common-lib | 0:5.5.33-33_patch_09.ep5.el5 |
| Red Hat jboss enterprise web server 1 | tomcat5-common-lib | 0:5.5.33-36_patch_09.ep5.el6 |
| Red Hat jboss enterprise web server 1 | tomcat5-jasper | 0:5.5.33-33_patch_09.ep5.el5 |
| Red Hat jboss enterprise web server 1 | tomcat5-jasper | 0:5.5.33-36_patch_09.ep5.el6 |
| Red Hat jboss enterprise web server 1 | tomcat5-jasper-eclipse | 0:5.5.33-33_patch_09.ep5.el5 |
| Red Hat jboss enterprise web server 1 | tomcat5-jasper-eclipse | 0:5.5.33-36_patch_09.ep5.el6 |
| Red Hat jboss enterprise web server 1 | tomcat5-jasper-javadoc | 0:5.5.33-33_patch_09.ep5.el5 |
| Red Hat jboss enterprise web server 1 | tomcat5-jasper-javadoc | 0:5.5.33-36_patch_09.ep5.el6 |
| Red Hat jboss enterprise web server 1 | tomcat5-jsp-2.0-api | 0:5.5.33-33_patch_09.ep5.el5 |
| Red Hat jboss enterprise web server 1 | tomcat5-jsp-2.0-api | 0:5.5.33-36_patch_09.ep5.el6 |
| Red Hat jboss enterprise web server 1 | tomcat5-jsp-2.0-api-javadoc | 0:5.5.33-33_patch_09.ep5.el5 |
| Red Hat jboss enterprise web server 1 | tomcat5-jsp-2.0-api-javadoc | 0:5.5.33-36_patch_09.ep5.el6 |
| Red Hat jboss enterprise web server 1 | tomcat5-parent | 0:5.5.33-33_patch_09.ep5.el5 |
| Red Hat jboss enterprise web server 1 | tomcat5-parent | 0:5.5.33-36_patch_09.ep5.el6 |
| Red Hat jboss enterprise web server 1 | tomcat5-server-lib | 0:5.5.33-36_patch_09.ep5.el6 |
| Red Hat jboss enterprise web server 1 | tomcat5-server-lib | 0:5.5.33-33_patch_09.ep5.el5 |
| Red Hat jboss enterprise web server 1 | tomcat5-servlet-2.4-api | 0:5.5.33-33_patch_09.ep5.el5 |
| Red Hat jboss enterprise web server 1 | tomcat5-servlet-2.4-api | 0:5.5.33-36_patch_09.ep5.el6 |
| Red Hat jboss enterprise web server 1 | tomcat5-servlet-2.4-api-javadoc | 0:5.5.33-33_patch_09.ep5.el5 |
| Red Hat jboss enterprise web server 1 | tomcat5-servlet-2.4-api-javadoc | 0:5.5.33-36_patch_09.ep5.el6 |
| Red Hat jboss enterprise web server 1 | tomcat5-webapps | 0:5.5.33-33_patch_09.ep5.el5 |
| Red Hat jboss enterprise web server 1 | tomcat5-webapps | 0:5.5.33-36_patch_09.ep5.el6 |
| Red Hat jboss enterprise web server 1 | tomcat6 | 0:6.0.32-32_patch_09.ep5.el5 |
| Red Hat jboss enterprise web server 1 | tomcat6 | 0:6.0.32-35_patch_09.ep5.el6 |
| Red Hat jboss enterprise web server 1 | tomcat6-admin-webapps | 0:6.0.32-32_patch_09.ep5.el5 |
| Red Hat jboss enterprise web server 1 | tomcat6-admin-webapps | 0:6.0.32-35_patch_09.ep5.el6 |
| Red Hat jboss enterprise web server 1 | tomcat6-docs-webapp | 0:6.0.32-35_patch_09.ep5.el6 |
| Red Hat jboss enterprise web server 1 | tomcat6-docs-webapp | 0:6.0.32-32_patch_09.ep5.el5 |
| Red Hat jboss enterprise web server 1 | tomcat6-el-1.0-api | 0:6.0.32-32_patch_09.ep5.el5 |
| Red Hat jboss enterprise web server 1 | tomcat6-el-1.0-api | 0:6.0.32-35_patch_09.ep5.el6 |
| Red Hat jboss enterprise web server 1 | tomcat6-javadoc | 0:6.0.32-32_patch_09.ep5.el5 |
| Red Hat jboss enterprise web server 1 | tomcat6-javadoc | 0:6.0.32-35_patch_09.ep5.el6 |
| Red Hat jboss enterprise web server 1 | tomcat6-jsp-2.1-api | 0:6.0.32-32_patch_09.ep5.el5 |
| Red Hat jboss enterprise web server 1 | tomcat6-jsp-2.1-api | 0:6.0.32-35_patch_09.ep5.el6 |
| Red Hat jboss enterprise web server 1 | tomcat6-lib | 0:6.0.32-32_patch_09.ep5.el5 |
| Red Hat jboss enterprise web server 1 | tomcat6-lib | 0:6.0.32-35_patch_09.ep5.el6 |
| Red Hat jboss enterprise web server 1 | tomcat6-log4j | 0:6.0.32-32_patch_09.ep5.el5 |
| Red Hat jboss enterprise web server 1 | tomcat6-log4j | 0:6.0.32-35_patch_09.ep5.el6 |
| Red Hat jboss enterprise web server 1 | tomcat6-servlet-2.5-api | 0:6.0.32-32_patch_09.ep5.el5 |
| Red Hat jboss enterprise web server 1 | tomcat6-servlet-2.5-api | 0:6.0.32-35_patch_09.ep5.el6 |
| Red Hat jboss enterprise web server 1 | tomcat6-webapps | 0:6.0.32-32_patch_09.ep5.el5 |
| Red Hat jboss enterprise web server 1 | tomcat6-webapps | 0:6.0.32-35_patch_09.ep5.el6 |
| Red Hat jboss enterprise web server 2 | tomcat6 | 0:6.0.35-33_patch_07.ep6.el6 |
| Red Hat jboss enterprise web server 2 | tomcat6 | 0:6.0.35-12_patch_07.ep6.el5 |
| Red Hat jboss enterprise web server 2 | tomcat6-admin-webapps | 0:6.0.35-12_patch_07.ep6.el5 |
| Red Hat jboss enterprise web server 2 | tomcat6-admin-webapps | 0:6.0.35-33_patch_07.ep6.el6 |
| Red Hat jboss enterprise web server 2 | tomcat6-docs-webapp | 0:6.0.35-12_patch_07.ep6.el5 |
| Red Hat jboss enterprise web server 2 | tomcat6-docs-webapp | 0:6.0.35-33_patch_07.ep6.el6 |
| Red Hat jboss enterprise web server 2 | tomcat6-el-1.0-api | 0:6.0.35-33_patch_07.ep6.el6 |
| Red Hat jboss enterprise web server 2 | tomcat6-el-1.0-api | 0:6.0.35-12_patch_07.ep6.el5 |
| Red Hat jboss enterprise web server 2 | tomcat6-javadoc | 0:6.0.35-12_patch_07.ep6.el5 |
| Red Hat jboss enterprise web server 2 | tomcat6-javadoc | 0:6.0.35-33_patch_07.ep6.el6 |
| Red Hat jboss enterprise web server 2 | tomcat6-jsp-2.1-api | 0:6.0.35-12_patch_07.ep6.el5 |
| Red Hat jboss enterprise web server 2 | tomcat6-jsp-2.1-api | 0:6.0.35-33_patch_07.ep6.el6 |
| Red Hat jboss enterprise web server 2 | tomcat6-lib | 0:6.0.35-12_patch_07.ep6.el5 |
| Red Hat jboss enterprise web server 2 | tomcat6-lib | 0:6.0.35-33_patch_07.ep6.el6 |
| Red Hat jboss enterprise web server 2 | tomcat6-log4j | 0:6.0.35-12_patch_07.ep6.el5 |
| Red Hat jboss enterprise web server 2 | tomcat6-log4j | 0:6.0.35-33_patch_07.ep6.el6 |
| Red Hat jboss enterprise web server 2 | tomcat6-servlet-2.5-api | 0:6.0.35-12_patch_07.ep6.el5 |
| Red Hat jboss enterprise web server 2 | tomcat6-servlet-2.5-api | 0:6.0.35-33_patch_07.ep6.el6 |
| Red Hat jboss enterprise web server 2 | tomcat6-webapps | 0:6.0.35-12_patch_07.ep6.el5 |
| Red Hat jboss enterprise web server 2 | tomcat6-webapps | 0:6.0.35-33_patch_07.ep6.el6 |
| Red Hat jboss enterprise web server 2 | tomcat7 | 0:7.0.30-7_patch_03.ep6.el6 |
| Red Hat jboss enterprise web server 2 | tomcat7 | 0:7.0.30-5_patch_03.ep6.el5 |
| Red Hat jboss enterprise web server 2 | tomcat7-admin-webapps | 0:7.0.30-7_patch_03.ep6.el6 |
| Red Hat jboss enterprise web server 2 | tomcat7-admin-webapps | 0:7.0.30-5_patch_03.ep6.el5 |
| Red Hat jboss enterprise web server 2 | tomcat7-docs-webapp | 0:7.0.30-7_patch_03.ep6.el6 |
| Red Hat jboss enterprise web server 2 | tomcat7-docs-webapp | 0:7.0.30-5_patch_03.ep6.el5 |
| Red Hat jboss enterprise web server 2 | tomcat7-el-1.0-api | 0:7.0.30-7_patch_03.ep6.el6 |
| Red Hat jboss enterprise web server 2 | tomcat7-el-1.0-api | 0:7.0.30-5_patch_03.ep6.el5 |
| Red Hat jboss enterprise web server 2 | tomcat7-javadoc | 0:7.0.30-7_patch_03.ep6.el6 |
| Red Hat jboss enterprise web server 2 | tomcat7-javadoc | 0:7.0.30-5_patch_03.ep6.el5 |
| Red Hat jboss enterprise web server 2 | tomcat7-jsp-2.2-api | 0:7.0.30-7_patch_03.ep6.el6 |
| Red Hat jboss enterprise web server 2 | tomcat7-jsp-2.2-api | 0:7.0.30-5_patch_03.ep6.el5 |
| Red Hat jboss enterprise web server 2 | tomcat7-lib | 0:7.0.30-5_patch_03.ep6.el5 |
| Red Hat jboss enterprise web server 2 | tomcat7-lib | 0:7.0.30-7_patch_03.ep6.el6 |
| Red Hat jboss enterprise web server 2 | tomcat7-log4j | 0:7.0.30-7_patch_03.ep6.el6 |
| Red Hat jboss enterprise web server 2 | tomcat7-log4j | 0:7.0.30-5_patch_03.ep6.el5 |
| Red Hat jboss enterprise web server 2 | tomcat7-servlet-3.0-api | 0:7.0.30-7_patch_03.ep6.el6 |
| Red Hat jboss enterprise web server 2 | tomcat7-servlet-3.0-api | 0:7.0.30-5_patch_03.ep6.el5 |
| Red Hat jboss enterprise web server 2 | tomcat7-webapps | 0:7.0.30-7_patch_03.ep6.el6 |
| Red Hat jboss enterprise web server 2 | tomcat7-webapps | 0:7.0.30-5_patch_03.ep6.el5 |
| SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS | mariadb104 | 10.4.30-150100.3.5.10 |
| SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS | python-mysqlclient | 1.4.6-150100.3.3.7 |
| SUSE Linux Enterprise Server 12 SP5 | lz4 | 1.8.0-3.5.2 |
| SUSE Linux Enterprise Server 12 SP5 | mariadb-connector-c | 3.1.22-2.35.1 |
| SUSE Linux Enterprise Server 12 SP5 | mariadb104 | 10.4.30-8.5.46 |
| SUSE Linux Enterprise Server 12 SP5 | python-mysqlclient | 1.3.14-8.9.2 |
| SUSE Linux Enterprise Server 15 SP1-LTSS | mariadb104 | 10.4.30-150100.3.5.10 |
| SUSE Linux Enterprise Server 15 SP1-LTSS | python-mysqlclient | 1.4.6-150100.3.3.7 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP5 | lz4 | 1.8.0-3.5.2 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP5 | mariadb-connector-c | 3.1.22-2.35.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP5 | mariadb104 | 10.4.30-8.5.46 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP5 | python-mysqlclient | 1.3.14-8.9.2 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP1 | mariadb104 | 10.4.30-150100.3.5.10 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP1 | python-mysqlclient | 1.4.6-150100.3.3.7 |
| SUSE Linux Enterprise Software Development Kit 12 SP5 | lz4 | 1.8.0-3.5.2 |
| SUSE Linux Enterprise Software Development Kit 12 SP5 | mariadb-connector-c | 3.1.22-2.35.1 |
| SUSE Linux Enterprise Software Development Kit 12 SP5 | mariadb104 | 10.4.30-8.5.46 |
| SUSE Linux Enterprise Software Development Kit 12 SP5 | python-mysqlclient | 1.3.14-8.9.2 |
| openSUSE Tumbleweed | mariadb | 10.0.22-3.8 |
| openSUSE Tumbleweed | tomcat | 8.0.36-3.3 |
| openSUSE Tumbleweed | tomcat10 | 10.1.14-1.1 |