QwikSec

Security Database

CVE

CWE

Training

CVE Database
/

CVE-2011-2526

Back to search

CVE-2011-2526

Published: Jul 14, 2011

Modified: Aug 6, 2024

PUBLISHED

Description

Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.19, when sendfile is enabled for the HTTP APR or HTTP NIO connector, does not validate certain request attributes, which allows local users to bypass intended file access restrictions or cause a denial of service (infinite loop or JVM crash) by leveraging an untrusted web application.

VendorProductVersions

n/a

n/a

affected
n/a

References

45232
third-party-advisory
x_refsource_SECUNIA
oval:org.mitre.oval:def:19514
vdb-entry
signature
x_refsource_OVAL
MDVSA-2011:156
vendor-advisory
x_refsource_MANDRIVA
DSA-2401
vendor-advisory
x_refsource_DEBIAN
RHSA-2012:0325
vendor-advisory
x_refsource_REDHAT
48308
third-party-advisory
x_refsource_SECUNIA
HPSBUX02860
vendor-advisory
x_refsource_HP
RHSA-2012:0078
vendor-advisory
x_refsource_REDHAT
RHSA-2012:0075
vendor-advisory
x_refsource_REDHAT
RHSA-2012:0074
vendor-advisory
x_refsource_REDHAT
HPSBOV02762
vendor-advisory
x_refsource_HP
SSRT100627
vendor-advisory
x_refsource_HP
57126
third-party-advisory
x_refsource_SECUNIA
SSRT100825
vendor-advisory
x_refsource_HP
73797
vdb-entry
x_refsource_OSVDB
HPSBUX02725
vendor-advisory
x_refsource_HP
SSRT101146
vendor-advisory
x_refsource_HP
oval:org.mitre.oval:def:14573
vdb-entry
signature
x_refsource_OVAL
73798
vdb-entry
x_refsource_OSVDB
RHSA-2012:0076
vendor-advisory
x_refsource_REDHAT
1025788
vdb-entry
x_refsource_SECTRACK
HPSBST02955
vendor-advisory
x_refsource_HP
RHSA-2012:0077
vendor-advisory
x_refsource_REDHAT
48667
vdb-entry
x_refsource_BID

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Start Training

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.

Scan Now