NetSight
IP …
medium5.0

CVE-2011-2729

native/unix/native/jsvc-unix.c in jsvc in the Daemon component 1.0.3 through 1.0.6 in Apache Commons, as used in Apache Tomcat 5.5.32 through 5.5.33, 6.0.30 th…

Impact

native/unix/native/jsvc-unix.c in jsvc in the Daemon component 1.0.3 through 1.0.6 in Apache Commons, as used in Apache Tomcat 5.5.32 through 5.5.33, 6.0.30 through 6.0.32, and 7.0.x before 7.0.20 on Linux, does not drop capabilities, which allows remote attackers to bypass read permissions for files via a request to an application.

Affected products

VendorProductAffected versions
ApacheTomcat
Versions 5.5.32, 5.5.33, 6.0.30, 6.0.31, 6.0.32, 7.0.0
ApacheApache Commons Daemon
Versions 1.0.3, 1.0.4, 1.0.5, 1.0.6

Weakness classification

CWE-264

References