CVE-2011-2526

Severity

5.5

Description

Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.19, when sendfile is enabled for the HTTP APR or HTTP NIO connector, does not validate certain request attributes, which allows local users to bypass intended file access restrictions or cause a denial of service (infinite loop or JVM crash) by leveraging an untrusted web application.

Related links:

http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-2526

http://www.securityfocus.com/archive/1/archive/1/518889/100/0/threaded

Project

Apache Tomcat

Category

n/a

Tags

data

functional

other

Date Disclosed

2011-07-14

Date Discovered

2011-06-15

Apache Tomcat 7.0.x

First release:

2011-01-14

First release:

2021-03-31

0

Support Lifecycle:

Maintenance Support

Namespace:

javax

7.0.6 7.0.8 7.0.11 7.0.12 7.0.14 7.0.16

Apache Tomcat 6.0.x

First release:

2007-02-28

First release:

2016-12-31

0

Support Lifecycle:

Namespace:

javax

6.0.13 6.0.14 6.0.16 6.0.18 6.0.20 6.0.24 6.0.26 6.0.28 6.0.29 6.0.30 6.0.32

Feel Vulnerable?

Contact us so we can help you.

First name ^*
Last name ^*
Email ^*
Company ^*
Product ^*
Heard about us from: ^*
Tell us more ^*

Send me a confirmation email

^* These fields are required.