CVE-2011-2526

Apache Tomcat 5.5.x < 5.5.34, 6.x < 6.0.33, 7.x < 7.0.19 - Denial of Service via Unvalidated Request Attributes

Title source: llm
STIX 2.1

Description

Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.19, when sendfile is enabled for the HTTP APR or HTTP NIO connector, does not validate certain request attributes, which allows local users to bypass intended file access restrictions or cause a denial of service (infinite loop or JVM crash) by leveraging an untrusted web application.

References (35)

Core 35
Core References
Vendor Advisory vendor-advisory x_refsource_redhat
http://rhn.redhat.com/errata/RHSA-2012-0325.html
Vendor Advisory vendor-advisory x_refsource_redhat
http://rhn.redhat.com/errata/RHSA-2012-0078.html
Vendor Advisory vendor-advisory x_refsource_redhat
http://rhn.redhat.com/errata/RHSA-2012-0075.html
Vendor Advisory vendor-advisory x_refsource_redhat
http://rhn.redhat.com/errata/RHSA-2012-0076.html
Vendor Advisory vendor-advisory x_refsource_redhat
http://rhn.redhat.com/errata/RHSA-2012-0077.html
Third Party Advisory, VDB Entry vdb-entry signature x_refsource_oval
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14573
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/45232
Third Party Advisory, VDB Entry vdb-entry signature x_refsource_oval
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19514
Vendor Advisory vendor-advisory x_refsource_mandriva
http://www.mandriva.com/security/advisories?name=MDVSA-2011:156
Third Party Advisory vendor-advisory x_refsource_debian
http://www.debian.org/security/2012/dsa-2401
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/48308
Mailing List vendor-advisory x_refsource_hp
http://marc.info/?l=bugtraq&m=136485229118404&w=2
Vendor Advisory vendor-advisory x_refsource_redhat
http://rhn.redhat.com/errata/RHSA-2012-0074.html
Various Sources x_refsource_confirm
http://tomcat.apache.org/security-7.html
Mailing List vendor-advisory x_refsource_hp
http://marc.info/?l=bugtraq&m=133469267822771&w=2
Mailing List vendor-advisory x_refsource_hp
http://marc.info/?l=bugtraq&m=132215163318824&w=2
Various Sources x_refsource_confirm
http://tomcat.apache.org/security-6.html
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/57126
Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq
http://www.securityfocus.com/archive/1/518889/100/0/threaded
Various Sources x_refsource_confirm
http://tomcat.apache.org/security-5.html
Third Party Advisory, VDB Entry vdb-entry x_refsource_osvdb
http://osvdb.org/73797
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/68541
Third Party Advisory, VDB Entry vdb-entry x_refsource_osvdb
http://osvdb.org/73798
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id?1025788
Mailing List vendor-advisory x_refsource_hp
http://marc.info/?l=bugtraq&m=139344343412337&w=2
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/48667

Scores

EPSS 0.0070
EPSS Percentile 48.8%

Details

CWE
CWE-20
Status published
Products (50)
apache/tomcat 5.5.0
apache/tomcat 5.5.1
apache/tomcat 5.5.2
apache/tomcat 5.5.3
apache/tomcat 5.5.4
apache/tomcat 5.5.5
apache/tomcat 5.5.6
apache/tomcat 5.5.7
apache/tomcat 5.5.8
apache/tomcat 5.5.9
... and 40 more
Published Jul 14, 2011
Tracked Since Feb 18, 2026