Ubuntu 16.x — End of Life
EOL Actively exploited EOL: Jul 20, 20172 releases in this series93 CVEs
Ubuntu 16.x reached end of life on Jul 20, 2017, 3382 days ago, and no longer receives security fixes. The most recent release in this series is 16.10. 93 CVEs are tracked for this series, including 11 critical and 6 actively exploited according to CISA KEV. 7 of them were published after the end of life of the affected cycle and will not get an official patch. The next major version is Ubuntu 17. See Ubuntu 17 →
Ubuntu 16.x — All releases
| Version | Released | Active support | EOL date | Latest patch | Status | Alert me |
|---|---|---|---|---|---|---|
| 16.10 | Oct 13, 2016 | Jul 20, 2017 | Jul 20, 2017 | 16.10 | EOL | |
| 16.04LTS | Apr 21, 2016 | Apr 2, 2021 | Apr 2, 2021 | 16.04.7 | EOL |
CVEs affecting Ubuntu 16.x (94)
| CVE | Severity | CVSS | EPSS | KEV | Cycle | Description | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-31431 | HIGH | 7.8 | 3.43% | KEV | 16.10 | In the Linux kernel, the following vulnerability has been resolved: crypto: algif_aead - Revert to operating out-of-pla… | Apr 22, 2026 |
| CVE-2026-31431 | HIGH | 7.8 | 3.43% | KEV | 16.04 | In the Linux kernel, the following vulnerability has been resolved: crypto: algif_aead - Revert to operating out-of-pla… | Apr 22, 2026 |
| CVE-2026-3888 | HIGH | 7.8 | 0.47% | — | 16.04 | Local privilege escalation in snapd on Linux allows local attackers to get root privilege by re-creating snap's private … | Mar 17, 2026 |
| CVE-2022-2586 | MEDIUM | 5.3 | 10.20% | KEV | 16.04 | It was discovered that a nft object or expression could reference a nft set on a different nft table, leading to a use-a… | Jan 8, 2024 |
| CVE-2023-1380 | HIGH | 7.1 | 16.52% | — | 16.04 | A slab-out-of-bound read problem was found in brcmf_get_assoc_ies in drivers/net/wireless/broadcom/brcm80211/brcmfmac/cf… | Mar 27, 2023 |
| CVE-2022-1055 | HIGH | 7.8 | 0.50% | — | 16.04 | A use-after-free exists in the Linux Kernel in tc_new_tfilter that could allow a local attacker to gain privilege escala… | Mar 29, 2022 |
| CVE-2022-0492 | HIGH | 7.8 | 5.52% | KEV | 16.04 | A vulnerability was found in the Linux kernel’s cgroup_release_agent_write in the kernel/cgroup/cgroup-v1.c function. Th… | Mar 3, 2022 |
| CVE-2021-4034 | HIGH | 7.8 | 94.92% | KEV | 16.04 | A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool… | Jan 28, 2022 |
| CVE-2020-27171 | MEDIUM | 6.0 | 0.57% | — | 16.04 | An issue was discovered in the Linux kernel before 5.11.8. kernel/bpf/verifier.c has an off-by-one error (with a resulta… | Mar 20, 2021 |
| CVE-2020-27170 | MEDIUM | 4.7 | 0.56% | — | 16.04 | An issue was discovered in the Linux kernel before 5.11.8. kernel/bpf/verifier.c performs undesirable out-of-bounds spec… | Mar 20, 2021 |
| CVE-2021-27364 | HIGH | 7.1 | 0.96% | — | 16.04 | An issue was discovered in the Linux kernel through 5.11.3. drivers/scsi/scsi_transport_iscsi.c is adversely affected by… | Mar 7, 2021 |
| CVE-2020-29372 | MEDIUM | 4.7 | 0.40% | — | 16.04 | An issue was discovered in do_madvise in mm/madvise.c in the Linux kernel before 5.6.8. There is a race condition betwee… | Nov 28, 2020 |
| CVE-2020-26116 | HIGH | 7.2 | 6.35% | — | 16.04 | http.client in Python 3.x before 3.5.10, 3.6.x before 3.6.12, 3.7.x before 3.7.9, and 3.8.x before 3.8.5 allows CRLF inj… | Sep 27, 2020 |
| CVE-2020-13935 | HIGH | 7.5 | 86.60% | — | 16.04 | The payload length in a WebSocket frame was not correctly validated in Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M1 to… | Jul 14, 2020 |
| CVE-2019-20907 | HIGH | 7.5 | 2.98% | — | 16.04 | In Lib/tarfile.py in Python through 3.8.3, an attacker is able to craft a TAR archive leading to an infinite loop when o… | Jul 13, 2020 |
| CVE-2020-13632 | MEDIUM | 5.5 | 0.60% | — | 16.04 | ext/fts3/fts3_snippet.c in SQLite before 3.32.0 has a NULL pointer dereference via a crafted matchinfo() query. | May 27, 2020 |
| CVE-2020-13631 | MEDIUM | 5.5 | 0.65% | — | 16.04 | SQLite before 3.32.0 allows a virtual table to be renamed to the name of one of its shadow tables, related to alter.c an… | May 27, 2020 |
| CVE-2020-13630 | HIGH | 7.0 | 1.03% | — | 16.04 | ext/fts3/fts3.c in SQLite before 3.32.0 has a use-after-free in fts3EvalNextRow, related to the snippet feature. | May 27, 2020 |
| CVE-2020-9484 | HIGH | 7.0 | 55.52% | — | 16.04 | When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if a)… | May 20, 2020 |
| CVE-2020-12769 | MEDIUM | 5.5 | 0.65% | — | 16.04 | An issue was discovered in the Linux kernel before 5.4.17. drivers/spi/spi-dw.c allows attackers to cause a panic via co… | May 9, 2020 |
| CVE-2020-10683 | CRITICAL | 9.8 | 7.26% | — | 16.04 | dom4j before 2.0.3 and 2.1.x before 2.1.3 allows external DTDs and External Entities by default, which might enable XXE … | May 1, 2020 |
| CVE-2020-11609 | MEDIUM | 4.3 | 0.58% | — | 16.04 | An issue was discovered in the stv06xx subsystem in the Linux kernel before 5.6.1. drivers/media/usb/gspca/stv06xx/stv06… | Apr 7, 2020 |
| CVE-2020-11494 | MEDIUM | 4.4 | 0.72% | — | 16.04 | An issue was discovered in slc_bump in drivers/net/can/slcan.c in the Linux kernel 3.16 through 5.6.2. It allows attacke… | Apr 2, 2020 |
| CVE-2020-1935 | MEDIUM | 4.8 | 9.38% | — | 16.04 | In Apache Tomcat 9.0.0.M1 to 9.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99 the HTTP header parsing code used an approach t… | Feb 24, 2020 |
| CVE-2019-9674 | HIGH | 7.5 | 5.63% | — | 16.04 | Lib/zipfile.py in Python through 3.7.2 allows remote attackers to cause a denial of service (resource consumption) via a… | Feb 4, 2020 |
| CVE-2020-8492 | MEDIUM | 6.5 | 6.61% | — | 16.04 | Python 2.7 through 2.7.17, 3.5 through 3.5.9, 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1 allows an HTT… | Jan 30, 2020 |
| CVE-2019-19965 | MEDIUM | 4.7 | 0.65% | — | 16.04 | In the Linux kernel through 5.4.6, there is a NULL pointer dereference in drivers/scsi/libsas/sas_discover.c because of … | Dec 25, 2019 |
| CVE-2019-12418 | HIGH | 7.0 | 1.22% | — | 16.04 | When Apache Tomcat 9.0.0.M1 to 9.0.28, 8.5.0 to 8.5.47, 7.0.0 and 7.0.97 is configured with the JMX Remote Lifecycle Lis… | Dec 23, 2019 |
| CVE-2019-17563 | HIGH | 7.5 | 10.68% | — | 16.04 | When using FORM authentication with Apache Tomcat 9.0.0.M1 to 9.0.29, 8.5.0 to 8.5.49 and 7.0.0 to 7.0.98 there was a na… | Dec 23, 2019 |
| CVE-2019-11050 | MEDIUM | 4.8 | 7.62% | — | 16.04 | When PHP EXIF extension is parsing EXIF information from an image, e.g. via exif_read_data() function, in PHP versions 7… | Dec 23, 2019 |
| CVE-2019-11046 | LOW | 3.7 | 4.11% | — | 16.04 | In PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13 and 7.4.0, PHP bcmath extension functions on some systems, includ… | Dec 23, 2019 |
| CVE-2019-11045 | LOW | 3.7 | 8.81% | — | 16.04 | In PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13 and 7.4.0, PHP DirectoryIterator class accepts filenames with emb… | Dec 23, 2019 |
| CVE-2019-1551 | MEDIUM | 5.3 | 14.29% | — | 16.04 | There is an overflow bug in the x64_64 Montgomery squaring procedure used in exponentiation with 512-bit moduli. No EC a… | Dec 6, 2019 |
| CVE-2019-19462 | MEDIUM | 5.5 | 0.46% | — | 16.04 | relay_open in kernel/relay.c in the Linux kernel through 5.4.1 allows local users to cause a denial of service (such as … | Nov 30, 2019 |
| CVE-2019-19083 | MEDIUM | 4.7 | 0.50% | — | 16.04 | Memory leaks in *clock_source_create() functions under drivers/gpu/drm/amd/display/dc in the Linux kernel before 5.3.8 a… | Nov 18, 2019 |
| CVE-2019-19082 | MEDIUM | 4.7 | 0.37% | — | 16.04 | Memory leaks in *create_resource_pool() functions under drivers/gpu/drm/amd/display/dc in the Linux kernel through 5.3.1… | Nov 18, 2019 |
| CVE-2019-19066 | MEDIUM | 4.7 | 0.45% | — | 16.04 | A memory leak in the bfad_im_get_stats() function in drivers/scsi/bfa/bfad_attr.c in the Linux kernel through 5.3.11 all… | Nov 18, 2019 |
| CVE-2019-19054 | MEDIUM | 4.7 | 0.44% | — | 16.04 | A memory leak in the cx23888_ir_probe() function in drivers/media/pci/cx23885/cx23888-ir.c in the Linux kernel through 5… | Nov 18, 2019 |
| CVE-2019-18197 | HIGH | 7.5 | 4.36% | — | 16.04 | In xsltCopyText in transform.c in libxslt 1.1.33, a pointer variable isn't reset under certain circumstances. If the rel… | Oct 18, 2019 |
| CVE-2019-16935 | MEDIUM | 6.1 | 4.65% | — | 16.04 | The documentation XML-RPC server in Python through 2.7.16, 3.x through 3.6.9, and 3.7.x through 3.7.4 has XSS via the se… | Sep 28, 2019 |
| CVE-2019-16168 | MEDIUM | 6.5 | 4.25% | — | 16.04 | In SQLite through 3.29.0, whereLoopAddBtreeIndex in sqlite3.c can crash a browser or other application because of missin… | Sep 9, 2019 |
| CVE-2019-16056 | HIGH | 7.5 | 5.12% | — | 16.04 | An issue was discovered in Python through 2.7.16, 3.x through 3.5.7, 3.6.x through 3.6.9, and 3.7.x through 3.7.4. The e… | Sep 6, 2019 |
| CVE-2019-15219 | MEDIUM | 4.6 | 0.71% | — | 16.04 | An issue was discovered in the Linux kernel before 5.1.8. There is a NULL pointer dereference caused by a malicious USB … | Aug 19, 2019 |
| CVE-2019-15218 | MEDIUM | 4.6 | 0.83% | — | 16.04 | An issue was discovered in the Linux kernel before 5.1.8. There is a NULL pointer dereference caused by a malicious USB … | Aug 19, 2019 |
| CVE-2019-15217 | MEDIUM | 4.6 | 0.68% | — | 16.04 | An issue was discovered in the Linux kernel before 5.2.3. There is a NULL pointer dereference caused by a malicious USB … | Aug 19, 2019 |
| CVE-2019-14250 | MEDIUM | 5.5 | 2.30% | — | 16.04 | An issue was discovered in GNU libiberty, as distributed in GNU Binutils 2.32. simple_object_elf_match in simple-object-… | Jul 24, 2019 |
| CVE-2019-13118 | MEDIUM | 5.3 | 5.05% | — | 16.04 | In numbers.c in libxslt 1.1.33, a type holding grouping characters of an xsl:number instruction was too narrow and an in… | Jul 1, 2019 |
| CVE-2019-13117 | MEDIUM | 5.3 | 6.28% | — | 16.04 | In numbers.c in libxslt 1.1.33, an xsl:number with certain format strings could lead to a uninitialized read in xsltNumb… | Jul 1, 2019 |
| CVE-2019-10160 | CRITICAL | 9.8 | 5.22% | — | 16.04 | A security regression of CVE-2019-9636 was discovered in python since commit d537ab0ff9767ef024f26246899728f0116b1ec3 af… | Jun 7, 2019 |
| CVE-2019-11068 | CRITICAL | 9.8 | 5.23% | — | 16.04 | libxslt through 1.1.33 allows bypass of a protection mechanism because callers of xsltCheckRead and xsltCheckWrite permi… | Apr 10, 2019 |
| CVE-2019-9948 | CRITICAL | 9.1 | 11.84% | — | 16.04 | urllib in Python 2.x through 2.7.16 supports the local_file: scheme, which makes it easier for remote attackers to bypas… | Mar 23, 2019 |
| CVE-2019-9636 | CRITICAL | 9.8 | 7.67% | — | 16.04 | Python 2.7.x through 2.7.16 and 3.x through 3.7.2 is affected by: Improper Handling of Unicode Encoding (with an incorre… | Mar 8, 2019 |
| CVE-2019-8906 | MEDIUM | 4.4 | 0.49% | — | 16.04 | do_core_note in readelf.c in libmagic.a in file 5.35 has an out-of-bounds read because memcpy is misused. | Feb 18, 2019 |
| CVE-2019-7317 | MEDIUM | 5.3 | 9.39% | — | 16.04 | png_image_free in png.c in libpng 1.6.x before 1.6.37 has a use-after-free because png_image_free_function is called und… | Feb 4, 2019 |
| CVE-2019-6109 | MEDIUM | 6.8 | 3.80% | — | 16.04 | An issue was discovered in OpenSSH 7.9. Due to missing character encoding in the progress display, a malicious server (o… | Jan 31, 2019 |
| CVE-2018-1000880 | MEDIUM | 6.5 | 4.05% | — | 16.04 | libarchive version commit 9693801580c0cf7c70e862d305270a16b52826a7 onwards (release v3.2.0 onwards) contains a CWE-20: I… | Dec 20, 2018 |
| CVE-2018-19543 | HIGH | 7.8 | 1.55% | — | 16.04 | An issue was discovered in JasPer 2.0.14. There is a heap-based buffer over-read of size 8 in the function jp2_decode in… | Nov 26, 2018 |
| CVE-2018-19542 | MEDIUM | 6.5 | 1.94% | — | 16.04 | An issue was discovered in JasPer 2.0.14. There is a NULL pointer dereference in the function jp2_decode in libjasper/jp… | Nov 26, 2018 |
| CVE-2018-19541 | HIGH | 8.8 | 2.80% | — | 16.04 | An issue was discovered in JasPer 1.900.8, 1.900.9, 1.900.10, 1.900.11, 1.900.12, 1.900.13, 1.900.14, 1.900.15, 1.900.16… | Nov 26, 2018 |
| CVE-2018-5407 | MEDIUM | 4.7 | 3.41% | — | 16.04 | Simultaneous Multi-threading (SMT) in processors can enable local users to exploit software vulnerable to timing attacks… | Nov 15, 2018 |
| CVE-2018-0734 | MEDIUM | 5.9 | 12.15% | — | 16.04 | The OpenSSL DSA signature algorithm has been shown to be vulnerable to a timing side channel attack. An attacker could u… | Oct 30, 2018 |
| CVE-2018-0735 | MEDIUM | 5.9 | 4.72% | — | 16.04 | The OpenSSL ECDSA signature algorithm has been shown to be vulnerable to a timing side channel attack. An attacker could… | Oct 29, 2018 |
| CVE-2018-11784 | MEDIUM | 4.3 | 97.68% | — | 16.04 | When the default servlet in Apache Tomcat versions 9.0.0.M1 to 9.0.11, 8.5.0 to 8.5.33 and 7.0.23 to 7.0.90 returned a r… | Oct 4, 2018 |
| CVE-2018-14647 | HIGH | 7.5 | 10.91% | — | 16.04 | Python's elementtree C accelerator failed to initialise Expat's hash salt during initialization. This could make it easy… | Sep 25, 2018 |
| CVE-2018-1000802 | CRITICAL | 9.8 | 20.12% | — | 16.04 | Python Software Foundation Python (CPython) version 2.7 contains a CWE-77: Improper Neutralization of Special Elements u… | Sep 18, 2018 |
| CVE-2018-10902 | HIGH | 7.8 | 0.52% | — | 16.04 | It was found that the raw midi kernel driver does not protect against concurrent access which leads to a double realloc … | Aug 21, 2018 |
| CVE-2018-13785 | MEDIUM | 6.5 | 4.41% | — | 16.04 | In libpng 1.6.34, a wrong calculation of row_factor in the png_check_chunk_length function (pngrutil.c) may trigger an i… | Jul 9, 2018 |
| CVE-2018-1061 | MEDIUM | 6.5 | 4.91% | — | 16.04 | python before versions 2.7.15, 3.4.9, 3.5.6rc1, 3.6.5rc1 and 3.7.0 is vulnerable to catastrophic backtracking in the dif… | Jun 19, 2018 |
| CVE-2018-1060 | HIGH | 7.5 | 5.03% | — | 16.04 | python before versions 2.7.15, 3.4.9, 3.5.6rc1, 3.6.5rc1 and 3.7.0 is vulnerable to catastrophic backtracking in pop3lib… | Jun 18, 2018 |
| CVE-2018-0732 | HIGH | 7.5 | 48.83% | — | 16.04 | During key agreement in a TLS handshake using a DH(E) based ciphersuite a malicious server can send a very large prime v… | Jun 12, 2018 |
| CVE-2018-3639 | MEDIUM | 5.5 | 60.63% | — | 16.04 | Systems with microprocessors utilizing speculative execution and speculative execution of memory reads before the addres… | May 22, 2018 |
| CVE-2018-11212 | MEDIUM | 6.5 | 4.83% | — | 16.04 | An issue was discovered in libjpeg 9a and 9d. The alloc_sarray function in jmemmgr.c allows remote attackers to cause a … | May 16, 2018 |
| CVE-2018-8014 | CRITICAL | 9.8 | 21.31% | — | 16.04 | The defaults settings for the CORS filter provided in Apache Tomcat 9.0.0.M1 to 9.0.8, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0… | May 16, 2018 |
| CVE-2018-0737 | MEDIUM | 5.9 | 11.59% | — | 16.04 | The OpenSSL RSA Key generation algorithm has been shown to be vulnerable to a cache timing side channel attack. An attac… | Apr 16, 2018 |
| CVE-2018-1304 | MEDIUM | 5.9 | 17.07% | — | 16.04 | The URL pattern of "" (the empty string) which exactly maps to the context root was not correctly handled in Apache Tomc… | Feb 28, 2018 |
| CVE-2018-1305 | MEDIUM | 6.5 | 14.47% | — | 16.04 | Security constraints defined by annotations of Servlets in Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27, 8.0.0.RC1 t… | Feb 23, 2018 |
| CVE-2018-1000030 | LOW | 3.6 | 1.18% | — | 16.04 | Python 2.7.14 is vulnerable to a Heap-Buffer-Overflow as well as a Heap-Use-After-Free. Python versions prior to 2.7.14 … | Feb 8, 2018 |
| CVE-2017-5753 | MEDIUM | 5.6 | 93.83% | — | 16.04 | Systems with microprocessors utilizing speculative execution and branch prediction may allow unauthorized disclosure of … | Jan 4, 2018 |
| CVE-2017-12617 | HIGH | 8.1 | 99.96% | KEV | 16.04 | When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTT… | Oct 4, 2017 |
| CVE-2016-6796 | HIGH | 7.5 | 8.32% | — | 16.04 | A malicious web application running on Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to… | Aug 11, 2017 |
| CVE-2016-6797 | HIGH | 7.5 | 8.06% | — | 16.04 | The ResourceLinkFactory implementation in Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0… | Aug 10, 2017 |
| CVE-2016-6794 | MEDIUM | 5.3 | 7.15% | — | 16.04 | When a SecurityManager is configured, a web application's ability to read system properties should be controlled by the … | Aug 10, 2017 |
| CVE-2016-5018 | CRITICAL | 9.1 | 10.30% | — | 16.04 | In Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 a malici… | Aug 10, 2017 |
| CVE-2016-0762 | MEDIUM | 5.9 | 7.99% | — | 16.04 | The Realm implementations in Apache Tomcat versions 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to … | Aug 10, 2017 |
| CVE-2016-9842 | HIGH | 8.8 | 5.20% | — | 16.04 | The inflateMark function in inflate.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact v… | May 23, 2017 |
| CVE-2016-9841 | CRITICAL | 9.8 | 7.55% | — | 16.04 | inffast.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging improper pointe… | May 23, 2017 |
| CVE-2016-9840 | HIGH | 8.8 | 4.87% | — | 16.04 | inftrees.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging improper point… | May 23, 2017 |
| CVE-2016-8735 | CRITICAL | 9.8 | 90.33% | KEV | 16.04 | Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8… | Apr 6, 2017 |
| CVE-2016-10165 | HIGH | 7.1 | 2.76% | — | 16.04 | The Type_MLU_Read function in cmstypes.c in Little CMS (aka lcms2) allows remote attackers to obtain sensitive informati… | Feb 3, 2017 |
| CVE-2016-3092 | HIGH | 7.5 | 37.17% | — | 16.04 | The MultipartStream class in Apache Commons Fileupload before 1.3.2, as used in Apache Tomcat 7.x before 7.0.70, 8.x bef… | Jul 4, 2016 |
| CVE-2016-0718 | CRITICAL | 9.8 | 13.33% | — | 16.04 | Expat allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via a m… | May 26, 2016 |
| CVE-2016-0763 | MEDIUM | 6.3 | 11.29% | — | 16.04 | The setGlobalContext method in org/apache/naming/factory/ResourceLinkFactory.java in Apache Tomcat 7.x before 7.0.68, 8.… | Feb 25, 2016 |
| CVE-2016-0714 | HIGH | 8.8 | 13.07% | — | 16.04 | The session-persistence implementation in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.31, and 9.x… | Feb 25, 2016 |
| CVE-2016-0706 | MEDIUM | 4.3 | 6.23% | — | 16.04 | Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 does not place org.apache… | Feb 25, 2016 |
Ubuntu 16.x is EOL — migrate to Ubuntu 17.x
Ubuntu 17.x is the next major release. Plan your upgrade before Ubuntu 16.x stops receiving security patches.
Add a Ubuntu 16 EOL badge to your README
Show your users which Ubuntu version your project runs and whether it is still supported. The badge updates automatically. More formats and options →
[](https://eolcanary.com/explore/ubuntu/16)Frequently asked questions
Is Ubuntu 16 end of life?
Yes. All Ubuntu 16.x releases have reached end of life and no longer receive security patches. There are 93 known CVEs affecting Ubuntu 16.x, including 11 critical. Migrate to Ubuntu 17.x as soon as possible.
What CVEs affect Ubuntu 16?
There are 93 CVEs tracked for Ubuntu 16.x, including 11 critical severity issues and 6 listed in the CISA Known Exploited Vulnerabilities catalog. See the full list above with CVSS and EPSS scores.
What is the latest Ubuntu 16 version?
The latest Ubuntu 16.x patch release is 16.10, released on October 13, 2016. Always run the latest patch to benefit from all security fixes.
How to migrate from Ubuntu 16 to Ubuntu 17?
To migrate from Ubuntu 16 to Ubuntu 17: (1) review the official Ubuntu 17 migration guide for breaking changes, (2) update dependencies and configuration accordingly, (3) test thoroughly in a staging environment, (4) deploy with a rollback plan. Starting early gives you time to resolve compatibility issues before your current version reaches end of life.
Is it safe to run Ubuntu 16 in production?
No. Ubuntu 16 has reached end of life and security vulnerabilities are no longer patched. Critically, 6 CVEs affecting Ubuntu 16.x are in the CISA KEV catalog — meaning they are actively exploited in the wild. Upgrade to a supported version immediately.
Data sourced from endoflife.date · CVE data from NVD · EPSS from FIRST.org · KEV from CISA