Skip to content
Fencer Intel
high 7.8

CVE-2016-5425 json

The Tomcat package on Red Hat Enterprise Linux (RHEL) 7, Fedora, CentOS, Oracle Linux, and possibly other Linux distributions uses weak per…

published 2016-10-13 10 y ago modified 2026-06-17 4 mo ago also EUVD-2016-6370

cvss
7.8
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
3.8%
EPSS 3.8% chance of exploitation in 30 days, percentile 90%
public exploits
2
Metasploit, Exploit-DB

Summary

The Tomcat package on Red Hat Enterprise Linux (RHEL) 7, Fedora, CentOS, Oracle Linux, and possibly other Linux distributions uses weak permissions for /usr/lib/tmpfiles.d/tomcat.conf, which allows local users to gain root privileges by leveraging membership in the tomcat group.

Patch / fix

  • tomcat RHEL 7 7.0.54-8.el7_2
  • tomcat-lib RHEL 7 7.0.54-8.el7_2
  • tomcat-jsvc RHEL 7 7.0.54-8.el7_2
  • tomcat-javadoc RHEL 7 7.0.54-8.el7_2
  • tomcat-webapps RHEL 7 7.0.54-8.el7_2
  • tomcat-el-2.2-api RHEL 7 7.0.54-8.el7_2
  • tomcat-docs-webapp RHEL 7 7.0.54-8.el7_2
  • tomcat-jsp-2.2-api RHEL 7 7.0.54-8.el7_2

red hat advisories RHSA-2016:2046

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2016-5425 updated cvss 7.0

tomcat: Local privilege escalation via systemd-tmpfiles service

  • Red Hat Enterprise Linux Client (v. 7) tomcat 7.0.54-8.el7_2, tomcat-servlet-3.0-api 7.0.54-8.el7_2 Red Hat Enterprise Linux Client Optional (v. 7) tomcat 7.0.54-8.el7_2, tomcat-lib 7.0.54-8.el7_2, tomcat-jsvc 7.0.54-8.el7_2, tomcat-javadoc 7.0.54-8.el7_2, tomcat-webapps 7.0.54-8.el7_2, tomcat-el-2.2-api 7.0.54-8.el7_2, +3 more Red Hat Enterprise Linux ComputeNode (v. 7) tomcat 7.0.54-8.el7_2, tomcat-servlet-3.0-api 7.0.54-8.el7_2 Red Hat Enterprise Linux ComputeNode Optional (v. 7) tomcat 7.0.54-8.el7_2, tomcat-lib 7.0.54-8.el7_2, tomcat-jsvc 7.0.54-8.el7_2, tomcat-javadoc 7.0.54-8.el7_2, tomcat-webapps 7.0.54-8.el7_2, tomcat-el-2.2-api 7.0.54-8.el7_2, +3 more Red Hat Enterprise Linux Server (v. 7) tomcat 7.0.54-8.el7_2, tomcat-lib 7.0.54-8.el7_2, tomcat-webapps 7.0.54-8.el7_2, tomcat-el-2.2-api 7.0.54-8.el7_2, tomcat-jsp-2.2-api 7.0.54-8.el7_2, tomcat-admin-webapps 7.0.54-8.el7_2, +1 more Red Hat Enterprise Linux Server Optional (v. 7) tomcat 7.0.54-8.el7_2, tomcat-lib 7.0.54-8.el7_2, tomcat-jsvc 7.0.54-8.el7_2, tomcat-javadoc 7.0.54-8.el7_2, tomcat-webapps 7.0.54-8.el7_2, tomcat-el-2.2-api 7.0.54-8.el7_2, +3 more
    +2 more products
    Red Hat Enterprise Linux Workstation (v. 7) tomcat 7.0.54-8.el7_2, tomcat-lib 7.0.54-8.el7_2, tomcat-webapps 7.0.54-8.el7_2, tomcat-el-2.2-api 7.0.54-8.el7_2, tomcat-jsp-2.2-api 7.0.54-8.el7_2, tomcat-admin-webapps 7.0.54-8.el7_2, +1 more Red Hat Enterprise Linux Workstation Optional (v. 7) tomcat-jsvc 7.0.54-8.el7_2, tomcat-javadoc 7.0.54-8.el7_2, tomcat-docs-webapp 7.0.54-8.el7_2
    fixed: vendor fix RHSA-2016:2046
  • Red Hat Enterprise Linux 5 tomcat5 Red Hat Enterprise Linux 6 tomcat6, tomcat6-lib, tomcat6-log4j, tomcat6-javadoc, tomcat6-webapps, tomcat6-el-2.1-api, +4 more Red Hat JBoss Data Grid 6 jbossweb jbossweb Red Hat JBoss Data Virtualization 6 jbossweb jbossweb Red Hat JBoss Enterprise Application Platform 6 tomcat7 tomcat7, jbossweb jbossweb Red Hat JBoss Enterprise Application Platform 7 tomcat
    +6 more products
    Red Hat JBoss Enterprise Web Server 2 tomcat6, tomcat6-lib, tomcat6-log4j, tomcat6-javadoc, tomcat6-webapps, tomcat7 tomcat7, +6 more Red Hat JBoss Enterprise Web Server 3 tomcat7 tomcat7, tomcat8 tomcat8 Red Hat JBoss Fuse Service Works 6 jbossweb jbossweb Red Hat JBoss Operations Network 3 jbossweb jbossweb Red Hat JBoss Portal 6 jbossweb jbossweb Red Hat Software Collections rh-java-common-tomcat-lib, rh-java-common-tomcat-javadoc, rh-java-common-tomcat-el-2.2-api, rh-java-common-tomcat-jsp-2.2-api, rh-java-common-tomcat-servlet-3.0-api
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Timeline

  1. First public exploit (Metasploit exploit/linux/local/tomcat_rhel_based_temp_priv_esc)
  2. Published

Exploit prediction

3.78% chance of exploitation in the next 30 days, higher than 90% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

  • Metasploit exploit/linux/local/tomcat_rhel_based_temp_priv_esc Apache Tomcat on RedHat Based Systems Insecure Temp Config Privilege Escalation metasploit exploit, manual rank, 2016-10-10
  • EDB-40488 Apache Tomcat 8/7/6 (RedHat Based Distros) - Local Privilege Escalation local, 2016-10-10
  • packetstormsecurity.com http://packetstormsecurity.com/files/139041/Apache-Tomcat-8-7-6-Privilege-Escalation.html referenced PoC, tagged "exploit" by a source, unverified
  • legalhackers.com http://legalhackers.com/advisories/Tomcat-RedHat-Pkgs-Root-PrivEsc-Exploit-CVE-2016-5425.html referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
NVD 3.1 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD 2.0 7.2 AV:L/AC:L/Au:N/C:C/I:C/A:C

Classification

Weakness
  • CWE-276 Incorrect Default Permissions

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.