CVE

Id
50438  
CVE No.
CVE-2011-2526  
Status
Candidate  
Description
Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.19, when sendfile is enabled for the HTTP APR or HTTP NIO connector, does not validate certain request attributes, which allows local users to bypass intended file access restrictions or cause a denial of service (infinite loop or JVM crash) by leveraging an untrusted web application.  
Phase
Assigned (20110615)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
545330 50438 CVE-2011-2526 BUGTRAQ:20110713 [SECURITY] CVE-2011-2526 Apache Tomcat Information disclosure and availability vulnerabilities  View
545331 50438 CVE-2011-2526 URL:http://www.securityfocus.com/archive/1/archive/1/518889/100/0/threaded  View
545332 50438 CVE-2011-2526 CONFIRM:http://svn.apache.org/viewvc?view=revision&revision=1145383  View
545333 50438 CVE-2011-2526 CONFIRM:http://svn.apache.org/viewvc?view=revision&revision=1145571  View
545334 50438 CVE-2011-2526 CONFIRM:http://svn.apache.org/viewvc?view=revision&revision=1145694  View
545335 50438 CVE-2011-2526 CONFIRM:http://svn.apache.org/viewvc?view=revision&revision=1146005  View
545336 50438 CVE-2011-2526 CONFIRM:http://tomcat.apache.org/security-5.html  View
545337 50438 CVE-2011-2526 CONFIRM:http://tomcat.apache.org/security-6.html  View
545338 50438 CVE-2011-2526 CONFIRM:http://tomcat.apache.org/security-7.html  View
545339 50438 CVE-2011-2526 CONFIRM:https://bugzilla.redhat.com/show_bug.cgi?id=720948  View
545340 50438 CVE-2011-2526 DEBIAN:DSA-2401  View
545341 50438 CVE-2011-2526 URL:http://www.debian.org/security/2012/dsa-2401  View
545342 50438 CVE-2011-2526 HP:HPSBUX02725  View
545343 50438 CVE-2011-2526 URL:http://marc.info/?l=bugtraq&m=132215163318824&w=2  View
545344 50438 CVE-2011-2526 HP:SSRT100627  View
545345 50438 CVE-2011-2526 URL:http://marc.info/?l=bugtraq&m=132215163318824&w=2  View
545346 50438 CVE-2011-2526 HP:HPSBUX02860  View
545347 50438 CVE-2011-2526 URL:http://marc.info/?l=bugtraq&m=136485229118404&w=2  View
545348 50438 CVE-2011-2526 HP:SSRT101146  View
545349 50438 CVE-2011-2526 URL:http://marc.info/?l=bugtraq&m=136485229118404&w=2  View
545350 50438 CVE-2011-2526 HP:HPSBST02955  View
545351 50438 CVE-2011-2526 URL:http://marc.info/?l=bugtraq&m=139344343412337&w=2  View
545352 50438 CVE-2011-2526 HP:HPSBOV02762  View
545353 50438 CVE-2011-2526 URL:http://marc.info/?l=bugtraq&m=133469267822771&w=2  View
545354 50438 CVE-2011-2526 HP:SSRT100825  View
545355 50438 CVE-2011-2526 URL:http://marc.info/?l=bugtraq&m=133469267822771&w=2  View
545356 50438 CVE-2011-2526 MANDRIVA:MDVSA-2011:156  View
545357 50438 CVE-2011-2526 URL:http://www.mandriva.com/security/advisories?name=MDVSA-2011:156  View
545358 50438 CVE-2011-2526 REDHAT:RHSA-2012:0074  View
545359 50438 CVE-2011-2526 URL:http://rhn.redhat.com/errata/RHSA-2012-0074.html  View
545360 50438 CVE-2011-2526 REDHAT:RHSA-2012:0075  View
545361 50438 CVE-2011-2526 URL:http://rhn.redhat.com/errata/RHSA-2012-0075.html  View
545362 50438 CVE-2011-2526 REDHAT:RHSA-2012:0076  View
545363 50438 CVE-2011-2526 URL:http://rhn.redhat.com/errata/RHSA-2012-0076.html  View
545364 50438 CVE-2011-2526 REDHAT:RHSA-2012:0077  View
545365 50438 CVE-2011-2526 URL:http://rhn.redhat.com/errata/RHSA-2012-0077.html  View
545366 50438 CVE-2011-2526 REDHAT:RHSA-2012:0078  View
545367 50438 CVE-2011-2526 URL:http://rhn.redhat.com/errata/RHSA-2012-0078.html  View
545368 50438 CVE-2011-2526 REDHAT:RHSA-2012:0325  View
545369 50438 CVE-2011-2526 URL:http://rhn.redhat.com/errata/RHSA-2012-0325.html  View
545370 50438 CVE-2011-2526 BID:48667  View
545371 50438 CVE-2011-2526 URL:http://www.securityfocus.com/bid/48667  View
545372 50438 CVE-2011-2526 OSVDB:73797  View
545373 50438 CVE-2011-2526 URL:http://osvdb.org/73797  View
545374 50438 CVE-2011-2526 OSVDB:73798  View
545375 50438 CVE-2011-2526 URL:http://osvdb.org/73798  View
545376 50438 CVE-2011-2526 OVAL:oval:org.mitre.oval:def:14573  View
545377 50438 CVE-2011-2526 URL:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:14573  View
545378 50438 CVE-2011-2526 OVAL:oval:org.mitre.oval:def:19514  View
545379 50438 CVE-2011-2526 URL:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:19514  View
545380 50438 CVE-2011-2526 SECTRACK:1025788  View
545381 50438 CVE-2011-2526 URL:http://www.securitytracker.com/id?1025788  View
545382 50438 CVE-2011-2526 SECUNIA:45232  View
545383 50438 CVE-2011-2526 URL:http://secunia.com/advisories/45232  View
545384 50438 CVE-2011-2526 SECUNIA:57126  View
545385 50438 CVE-2011-2526 URL:http://secunia.com/advisories/57126  View
545386 50438 CVE-2011-2526 XF:tomcat-sendfile-info-disclosure(68541)  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
34488 JVNDB-2011-004730 Prosody におけるサービス運用妨害 (DoS) の脆弱性 Prosody は、MySQL を使用している際、特定のテーブル内の値の列に不正なデータタイプを割り当てるため、サービス運用妨害 (データ切り捨て) 状態となる脆弱性が存在します。 CVE-2011-2531 50438 4.3 http://jvndb.jvn.jp/ja/contents/2011/JVNDB-2011-004730.html  View