CVE-2016-5425

The Tomcat package on Red Hat Enterprise Linux (RHEL) 7, Fedora, CentOS, Oracle Linux, and possibly other Linux distributions uses weak permissions for /usr/lib/tmpfiles.d/tomcat.conf, which allows local users to gain root privileges by leveraging membership in the tomcat group.

• CWE-276

• http://legalhackers.com/advisories/Tomcat-RedHat-Pkgs-Root-PrivEsc-Exploit-CVE-2016-5425.htmlExploit, Third Party Advisory
• http://packetstormsecurity.com/files/139041/Apache-Tomcat-8-7-6-Privilege-Escalation.htmlExploit, Third Party Advisory, VDB Entry
• http://rhn.redhat.com/errata/RHSA-2016-2046.htmlThird Party Advisory
• http://www.openwall.com/lists/oss-security/2016/10/10/2Mailing List, Third Party Advisory
• http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.htmlThird Party Advisory
• http://www.securityfocus.com/bid/93472Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1036979Third Party Advisory, VDB Entry
• https://lists.apache.org/thread.html/6b414817c2b0bf351138911c8c922ec5dd577ebc0b9a7f42d705752d%40%3Cissues.activemq.apache.org%3E
• https://www.exploit-db.com/exploits/40488/Third Party Advisory, VDB Entry
• https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.htmlThird Party Advisory
• http://legalhackers.com/advisories/Tomcat-RedHat-Pkgs-Root-PrivEsc-Exploit-CVE-2016-5425.htmlExploit, Third Party Advisory
• http://packetstormsecurity.com/files/139041/Apache-Tomcat-8-7-6-Privilege-Escalation.htmlExploit, Third Party Advisory, VDB Entry
• http://rhn.redhat.com/errata/RHSA-2016-2046.htmlThird Party Advisory
• http://www.openwall.com/lists/oss-security/2016/10/10/2Mailing List, Third Party Advisory
• http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.htmlThird Party Advisory
• http://www.securityfocus.com/bid/93472Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1036979Third Party Advisory, VDB Entry
• https://lists.apache.org/thread.html/6b414817c2b0bf351138911c8c922ec5dd577ebc0b9a7f42d705752d%40%3Cissues.activemq.apache.org%3E
• https://www.exploit-db.com/exploits/40488/Third Party Advisory, VDB Entry
• https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.htmlThird Party Advisory

Published

Oct 13, 2016

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2016-5419curl and libcurl before 7.50.1 do not prevent TLS session re…
• CVE-2016-5420curl and libcurl before 7.50.1 do not check the client certi…
• CVE-2016-5421Use-after-free vulnerability in libcurl before 7.50.1 allows…8.1
• CVE-2016-5422The web console in Red Hat JBoss Operations Network (JON) be…
• CVE-2016-5423PostgreSQL before 9.1.23, 9.2.x before 9.2.18, 9.3.x before …
• CVE-2016-5424PostgreSQL before 9.1.23, 9.2.x before 9.2.18, 9.3.x before …
• CVE-2016-5426PowerDNS (aka pdns) Authoritative Server before 3.4.10 allow…
• CVE-2016-5427PowerDNS (aka pdns) Authoritative Server before 3.4.10 does …
• CVE-2016-5428Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2016-5429jose-php before 2.2.1 does not use constant-time operations …3.7
• CVE-2016-5430The RSA 1.5 algorithm implementation in the JOSE_JWE class i…5.3
• CVE-2016-5431The PHP JOSE Library by Gree Inc. before version 2.2.1 is vu…7.5