What is RHSA-2016:2807?

RHSA-2016:2807 is a security advisory published by Red Hat Product Security with High severity. Red Hat Security Advisory: Red Hat JBoss Web Server 2.1.2 security update for Tomcat 7

Which CVE IDs does RHSA-2016:2807 cover?

RHSA-2016:2807 covers the following CVE IDs: CVE-2016-3092, CVE-2015-5346, CVE-2015-5351, CVE-2016-0706, CVE-2016-0714, CVE-2016-0763. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of RHSA-2016:2807?

RHSA-2016:2807 has a CVSS v3 base score of 8.8, published by Red Hat Product Security.

Which products are affected by RHSA-2016:2807?

RHSA-2016:2807 affects 26 products, including: Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server; Red Hat JBoss Enterprise Web Server 2 for RHEL 7 Server; tomcat7-0:7.0.54-23_patch_05.ep6.el6.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server; tomcat7-0:7.0.54-23_patch_05.ep6.el6.src as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server; tomcat7-0:7.0.54-23_patch_05.ep6.el7.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 7 Server; and others — see the full list on the advisory page.

RHSA-2016:2807HighCVSS 8.8

Red Hat Security Advisory: Red Hat JBoss Web Server 2.1.2 security update for Tomcat 7

Vendor

Red Hat Product Security

Published

November 17, 2016

Last Modified

November 5, 2026

🔗 CVE IDs covered (6)

CVE-2016-3092 →CVE-2015-5346 →CVE-2015-5351 →CVE-2016-0706 →CVE-2016-0714 →CVE-2016-0763 →

📋 Description

CVE-2015-5346 — tomcat: Session fixation CVE-2015-5351 — tomcat: CSRF token leak CVE-2016-0706 — tomcat: security manager bypass via StatusManagerServlet CVE-2016-0714 — tomcat: Security Manager bypass via persistence mechanisms CVE-2016-0763 — tomcat: security manager bypass via setGlobalContext() CVE-2016-3092 — tomcat: Usage of vulnerable FileUpload package can result in denial of service

🎯 Affected products26

Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server
Red Hat JBoss Enterprise Web Server 2 for RHEL 7 Server
tomcat7-0:7.0.54-23_patch_05.ep6.el6.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server
tomcat7-0:7.0.54-23_patch_05.ep6.el6.src as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server
tomcat7-0:7.0.54-23_patch_05.ep6.el7.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 7 Server
tomcat7-0:7.0.54-23_patch_05.ep6.el7.src as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 7 Server
tomcat7-admin-webapps-0:7.0.54-23_patch_05.ep6.el6.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server
tomcat7-admin-webapps-0:7.0.54-23_patch_05.ep6.el7.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 7 Server
tomcat7-docs-webapp-0:7.0.54-23_patch_05.ep6.el6.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server
tomcat7-docs-webapp-0:7.0.54-23_patch_05.ep6.el7.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 7 Server
tomcat7-el-2.2-api-0:7.0.54-23_patch_05.ep6.el6.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server
tomcat7-el-2.2-api-0:7.0.54-23_patch_05.ep6.el7.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 7 Server
tomcat7-javadoc-0:7.0.54-23_patch_05.ep6.el6.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server
tomcat7-javadoc-0:7.0.54-23_patch_05.ep6.el7.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 7 Server
tomcat7-jsp-2.2-api-0:7.0.54-23_patch_05.ep6.el6.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server
tomcat7-jsp-2.2-api-0:7.0.54-23_patch_05.ep6.el7.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 7 Server
tomcat7-lib-0:7.0.54-23_patch_05.ep6.el6.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server
tomcat7-lib-0:7.0.54-23_patch_05.ep6.el7.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 7 Server
tomcat7-log4j-0:7.0.54-23_patch_05.ep6.el6.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server
tomcat7-log4j-0:7.0.54-23_patch_05.ep6.el7.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 7 Server
tomcat7-maven-devel-0:7.0.54-23_patch_05.ep6.el6.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server
tomcat7-maven-devel-0:7.0.54-23_patch_05.ep6.el7.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 7 Server
tomcat7-servlet-3.0-api-0:7.0.54-23_patch_05.ep6.el6.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server
tomcat7-servlet-3.0-api-0:7.0.54-23_patch_05.ep6.el7.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 7 Server
tomcat7-webapps-0:7.0.54-23_patch_05.ep6.el6.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server
tomcat7-webapps-0:7.0.54-23_patch_05.ep6.el7.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 7 Server

✅ Remediation

Before applying the update, back up your existing Red Hat JBoss Web Server installation (including all applications and configuration files). For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

🔗 CVE IDs covered (6)

📋 Description

🎯 Affected products26

✅ Remediation

🔗 References (9)