Security Advisories
CVEs affecting projects tracked on Release Alert, from NVD & OSV.
CVE-2011-2526
4.4
MEDIUMCVSS v2
Published
July 14, 2011
Affected
1 project
Assigned by
Red Hat
Severity scale
010
Description
Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.19, when sendfile is enabled for the HTTP APR or HTTP NIO connector, does not validate certain request attributes, which allows local users to bypass intended file access restrictions or cause a denial of service (infinite loop or JVM crash) by leveraging an untrusted web application.
apache/tomcat
GitHubApache Tomcat
GitHubApache Tomcat= 5.5.27, = 5.5.18, = 5.5.12, = 5.5.14, = 5.5.10, = 5.5.4, = 5.5.7, = 5.5.1, = 5.5.11, = 5.5.30, = 5.5.9, = 5.5.3, = 5.5.2, = 5.5.0, = 5.5.25, = 5.5.33, = 5.5.15, = 5.5.22, = 5.5.28, = 5.5.31, = 5.5.20, = 5.5.21, = 5.5.6, = 5.5.5, = 5.5.13, = 5.5.26, = 5.5.32, = 5.5.8, = 5.5.17, = 5.5.24, = 5.5.19, = 5.5.16, = 5.5.23, = 5.5.29, = 6.0.6, = 6.0.11, = 6.0.7, = 6.0.4, = 6.0.15, = 6.0.20, = 6.0.10, = 6.0.31, = 6.0.29, = 6.0.30, = 6.0.28, = 6.0.3, = 6.0.1, = 6.0.0, = 6.0.32, = 6.0.24, = 6.0.9, = 6.0.5, = 6.0.13, = 6.0.12, = 6.0, = 6.0.14, = 6.0.17, = 6.0.18, = 6.0.26, = 6.0.2, = 6.0.19, = 6.0.27, = 6.0.16, = 6.0.8, = 7.0.12, = 7.0.8, = 7.0.1, = 7.0.2, = 7.0.5, = 7.0.0, = 7.0.6, = 7.0.14, = 7.0.11, = 7.0.4, = 7.0.17, = 7.0.10, = 7.0.7, = 7.0.3, = 7.0.9NVD