Fixed in Apache Tomcat 6.0.33

Moderate: Multiple weaknesses in HTTP DIGEST authentication CVE-2011-1184 Note: Mitre elected to break this issue down into multiple issues and have allocated the following additional references to parts of this issue: CVE-2011-5062, CVE-2011-5063 and CVE-2011-5064. The Apache Tomcat security tea...

Apache APR apr_fnmatch Stack Overflow Denial of Service (CVE-2011-0419)

A stack overflow vulnerability has been reported in Apache Portable Runtime APR library. Apache is a popular HTTP web server. The vulnerability is due to an error in the way the APR parses certain requests with a user specified filter. A remote attacker could exploit this vulnerability by sending...

CentOS Update for apr CESA-2009:1204 centos5 i386

Check for the Version of apr OpenVAS Vulnerability Test CentOS Update for apr CESA-2009:1204 centos5 i386 Authors: System Generated Check Copyright: Copyright c 2011 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under the...

CentOS Update for apr-util CESA-2009:1107 centos5 i386

Check for the Version of apr-util OpenVAS Vulnerability Test CentOS Update for apr-util CESA-2009:1107 centos5 i386 Authors: System Generated Check Copyright: Copyright c 2011 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it...

CentOS Update for apr CESA-2011:0844 centos5 i386

The remote host is missing an update for the SPDX-FileCopyrightText: 2011 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptxrefname:"URL",...

CentOS Update for apr CESA-2011:0507 centos4 i386

Check for the Version of apr OpenVAS Vulnerability Test CentOS Update for apr CESA-2011:0507 centos4 i386 Authors: System Generated Check Copyright: Copyright c 2011 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under the...

CentOS Update for apr CESA-2009:1204 centos5 i386

The remote host is missing an update for the SPDX-FileCopyrightText: 2011 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptxrefname:"URL",...

CentOS Update for apr CESA-2011:0507 centos4 i386

The remote host is missing an update for the SPDX-FileCopyrightText: 2011 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptxrefname:"URL",...

CentOS Update for apr-util CESA-2009:1107 centos5 i386

The remote host is missing an update for the SPDX-FileCopyrightText: 2011 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptxrefname:"URL",...

CentOS Update for apr CESA-2011:0507 centos5 i386

The remote host is missing an update for the SPDX-FileCopyrightText: 2011 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptxrefname:"URL",...

Debian: Security Advisory (DSA-2237-2)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2011 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian Security Advisory DSA 2237-1 (apr)

The remote host is missing an update to apr announced via advisory DSA 2237-1. This VT has been deprecated and merged into the VT SPDX-FileCopyrightText: 2011 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

Debian Security Advisory DSA 2237-1 (apr)

The remote host is missing an update to apr announced via advisory DSA 2237-1. OpenVAS Vulnerability Test $Id: deb22371.nasl 6613 2017-07-07 12:08:40Z cfischer $ Description: Auto-generated from advisory DSA 2237-1 apr Authors: Thomas Reinke Copyright: Copyright c 2011 E-Soft Inc...

Debian Security Advisory DSA 2237-2 (apr)

The remote host is missing an update to apr announced via advisory DSA 2237-2. OpenVAS Vulnerability Test $Id: deb22372.nasl 6613 2017-07-07 12:08:40Z cfischer $ Description: Auto-generated from advisory DSA 2237-2 apr Authors: Thomas Reinke Copyright: Copyright c 2011 E-Soft Inc...

Apache Tomcat 7.0.x < 7.0.17 Multiple Vulnerabilities

Binary data 5996.pasl...

Fixed in Apache Tomcat 7.0.19

Low: Information disclosure CVE-2011-2526 Tomcat provides support for sendfile with the HTTP NIO and HTTP APR connectors. sendfile is used automatically for content served via the DefaultServlet and deployed web applications may use it directly via setting request attributes. These request...

[SECURITY] CVE-2011-2526 Apache Tomcat Information disclosure and availability vulnerabilities

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 CVE-2011-2526: Apache Tomcat Information disclosure and availability vulnerabilities Severity: low Vendor: The Apache Software Foundation Versions Affected: Tomcat 7.0.0 to 7.0.18 Tomcat 6.0.0 to 6.0.32 Tomcat 5.5.0 to 5.0.33 Previous, unsupported...

Apache APR apr_fnmatch Stack Overflow Denial of Service

A stack overflow vulnerability exists in Apache's APR library. The vulnerability is due to an error in directory file listing function, while parsing requests from a user...

Design/Logic Flaw

Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.19, when sendfile is enabled for the HTTP APR or HTTP NIO connector, does not validate certain request attributes, which allows local users to bypass intended file access restrictions or cause a denial of service infinite lo...

CVE-2011-2526

Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.19, when sendfile is enabled for the HTTP APR or HTTP NIO connector, does not validate certain request attributes, which allows local users to bypass intended file access restrictions or cause a denial of service infinite lo...