1. CVE-Search
  2. CVE-2010-3718
ID CVE-2010-3718
Summary Apache Tomcat 7.0.0 through 7.0.3, 6.0.x, and 5.5.x, when running within a SecurityManager, does not make the ServletContext attribute read-only, which allows local web applications to read or write files outside of the intended working directory, as demonstrated using a directory traversal attack.
References
Vulnerable Configurations
  • cpe:2.3:a:apache:tomcat:7.0.1:*:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:7.0.1:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:7.0.2:*:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:7.0.2:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:7.0.0:*:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:7.0.0:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:7.0.3:*:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:7.0.3:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:6.0.6:*:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:6.0.6:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:6.0.11:*:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:6.0.11:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:6.0.7:*:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:6.0.7:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:6.0.4:*:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:6.0.4:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:6.0.15:*:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:6.0.15:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:6.0.20:*:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:6.0.20:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:6.0.10:*:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:6.0.10:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:6.0.29:*:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:6.0.29:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:6.0.3:*:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:6.0.3:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:6.0.9:*:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:6.0.9:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:6.0.24:*:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:6.0.24:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:6.0.17:*:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:6.0.17:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:6.0:*:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:6.0:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:6.0.28:*:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:6.0.28:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:6.0.0:*:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:6.0.0:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:6.0.14:*:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:6.0.14:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:6.0.1:*:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:6.0.1:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:6.0.12:*:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:6.0.12:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:6.0.18:*:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:6.0.18:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:6.0.5:*:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:6.0.5:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:6.0.2:*:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:6.0.2:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:6.0.13:*:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:6.0.13:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:6.0.26:*:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:6.0.26:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:6.0.19:*:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:6.0.19:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:6.0.27:*:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:6.0.27:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:6.0.16:*:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:6.0.16:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:6.0.8:*:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:6.0.8:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:5.5.27:*:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:5.5.27:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:5.5.18:*:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:5.5.18:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:5.5.12:*:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:5.5.12:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:5.5.14:*:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:5.5.14:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:5.5.10:*:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:5.5.10:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:5.5.4:*:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:5.5.4:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:5.5.7:*:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:5.5.7:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:5.5.1:*:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:5.5.1:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:5.5.11:*:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:5.5.11:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:5.5.28:*:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:5.5.28:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:5.5.6:*:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:5.5.6:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:5.5.26:*:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:5.5.26:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:5.5.20:*:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:5.5.20:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:5.5.15:*:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:5.5.15:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:5.5.5:*:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:5.5.5:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:5.5.30:*:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:5.5.30:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:5.5.21:*:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:5.5.21:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:5.5.22:*:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:5.5.22:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:5.5.3:*:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:5.5.3:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:5.5.32:*:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:5.5.32:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:5.5.9:*:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:5.5.9:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:5.5.25:*:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:5.5.25:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:5.5.2:*:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:5.5.2:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:5.5.0:*:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:5.5.0:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:5.5.13:*:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:5.5.13:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:5.5.24:*:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:5.5.24:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:5.5.8:*:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:5.5.8:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:5.5.16:*:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:5.5.16:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:5.5.17:*:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:5.5.17:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:5.5.29:*:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:5.5.29:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:5.5.19:*:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:5.5.19:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:5.5.23:*:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:5.5.23:*:*:*:*:*:*:*
CVSS
Base: 1.2 (as of 13-02-2023 - 04:25)
Impact:
Exploitability:
CWE NVD-CWE-Other
CAPEC
Access
VectorComplexityAuthentication
LOCAL HIGH NONE
Impact
ConfidentialityIntegrityAvailability
NONE PARTIAL NONE
cvss-vector via4 AV:L/AC:H/Au:N/C:N/I:P/A:N
oval via4
  • accepted 2015-04-20T04:00:27.633-04:00
    class vulnerability
    contributors
    • name Yamini Mohan R
      organization Hewlett-Packard
    • name Sushant Kumar Singh
      organization Hewlett-Packard
    • name Sushant Kumar Singh
      organization Hewlett-Packard
    • name Prashant Kumar
      organization Hewlett-Packard
    • name Mike Cokus
      organization The MITRE Corporation
    description Apache Tomcat 7.0.0 through 7.0.3, 6.0.x, and 5.5.x, when running within a SecurityManager, does not make the ServletContext attribute read-only, which allows local web applications to read or write files outside of the intended working directory, as demonstrated using a directory traversal attack.
    family unix
    id oval:org.mitre.oval:def:12517
    status accepted
    submitted 2011-07-28T14:46:10.000-05:00
    title HP-UX Apache Web Server, Remote Information Disclosure, Cross-Site Scripting (XSS), Denial of Service (DoS)
    version 50
  • accepted 2015-04-20T04:00:36.807-04:00
    class vulnerability
    contributors
    • name Yamini Mohan R
      organization Hewlett-Packard
    • name Sushant Kumar Singh
      organization Hewlett-Packard
    • name Prashant Kumar
      organization Hewlett-Packard
    • name Mike Cokus
      organization The MITRE Corporation
    description Apache Tomcat 7.0.0 through 7.0.3, 6.0.x, and 5.5.x, when running within a SecurityManager, does not make the ServletContext attribute read-only, which allows local web applications to read or write files outside of the intended working directory, as demonstrated using a directory traversal attack.
    family unix
    id oval:org.mitre.oval:def:13969
    status accepted
    submitted 2012-01-30T11:36:29.000-05:00
    title HP-UX Apache Running Tomcat Servlet Engine, Remote Information Disclosure, Authentication Bypass, Cross-Site Scripting (XSS), Unauthorized Access, Denial of Service (DoS)
    version 48
  • accepted 2015-04-20T04:01:12.394-04:00
    class vulnerability
    contributors
    • name Ganesh Manal
      organization Hewlett-Packard
    • name Sushant Kumar Singh
      organization Hewlett-Packard
    • name Prashant Kumar
      organization Hewlett-Packard
    • name Mike Cokus
      organization The MITRE Corporation
    description Apache Tomcat 7.0.0 through 7.0.3, 6.0.x, and 5.5.x, when running within a SecurityManager, does not make the ServletContext attribute read-only, which allows local web applications to read or write files outside of the intended working directory, as demonstrated using a directory traversal attack.
    family unix
    id oval:org.mitre.oval:def:19379
    status accepted
    submitted 2013-11-22T11:43:28.000-05:00
    title HP-UX Apache Running Tomcat Servlet Engine, Remote Denial of Service (DoS), Access Restriction Bypass, Unauthorized Modification and Other Vulnerabilities
    version 48
redhat via4
advisories
  • rhsa
    id RHSA-2011:0791
  • rhsa
    id RHSA-2011:0896
  • rhsa
    id RHSA-2011:0897
  • rhsa
    id RHSA-2011:1845
rpms
  • tomcat6-0:6.0.24-33.el6
  • tomcat6-admin-webapps-0:6.0.24-33.el6
  • tomcat6-docs-webapp-0:6.0.24-33.el6
  • tomcat6-el-2.1-api-0:6.0.24-33.el6
  • tomcat6-javadoc-0:6.0.24-33.el6
  • tomcat6-jsp-2.1-api-0:6.0.24-33.el6
  • tomcat6-lib-0:6.0.24-33.el6
  • tomcat6-servlet-2.5-api-0:6.0.24-33.el6
  • tomcat6-webapps-0:6.0.24-33.el6
  • ant-0:1.7.1-13.jdk6.ep5.el4
  • ant-0:1.7.1-13.jdk6.ep5.el5
  • ant-0:1.7.1-14.ep5.el6
  • ant-antlr-0:1.7.1-13.jdk6.ep5.el5
  • ant-antlr-0:1.7.1-14.ep5.el6
  • ant-apache-bcel-0:1.7.1-13.jdk6.ep5.el5
  • ant-apache-bcel-0:1.7.1-14.ep5.el6
  • ant-apache-bsf-0:1.7.1-13.jdk6.ep5.el5
  • ant-apache-bsf-0:1.7.1-14.ep5.el6
  • ant-apache-log4j-0:1.7.1-13.jdk6.ep5.el5
  • ant-apache-log4j-0:1.7.1-14.ep5.el6
  • ant-apache-oro-0:1.7.1-13.jdk6.ep5.el5
  • ant-apache-oro-0:1.7.1-14.ep5.el6
  • ant-apache-regexp-0:1.7.1-13.jdk6.ep5.el5
  • ant-apache-regexp-0:1.7.1-14.ep5.el6
  • ant-apache-resolver-0:1.7.1-13.jdk6.ep5.el5
  • ant-apache-resolver-0:1.7.1-14.ep5.el6
  • ant-commons-logging-0:1.7.1-13.jdk6.ep5.el5
  • ant-commons-logging-0:1.7.1-14.ep5.el6
  • ant-commons-net-0:1.7.1-14.ep5.el6
  • ant-javamail-0:1.7.1-13.jdk6.ep5.el5
  • ant-javamail-0:1.7.1-14.ep5.el6
  • ant-jdepend-0:1.7.1-13.jdk6.ep5.el5
  • ant-jdepend-0:1.7.1-14.ep5.el6
  • ant-jmf-0:1.7.1-13.jdk6.ep5.el5
  • ant-jmf-0:1.7.1-14.ep5.el6
  • ant-jsch-0:1.7.1-13.jdk6.ep5.el5
  • ant-jsch-0:1.7.1-14.ep5.el6
  • ant-junit-0:1.7.1-13.jdk6.ep5.el5
  • ant-junit-0:1.7.1-14.ep5.el6
  • ant-nodeps-0:1.7.1-13.jdk6.ep5.el5
  • ant-nodeps-0:1.7.1-14.ep5.el6
  • ant-scripts-0:1.7.1-13.jdk6.ep5.el5
  • ant-scripts-0:1.7.1-14.ep5.el6
  • ant-swing-0:1.7.1-13.jdk6.ep5.el5
  • ant-swing-0:1.7.1-14.ep5.el6
  • ant-trax-0:1.7.1-13.jdk6.ep5.el5
  • ant-trax-0:1.7.1-14.ep5.el6
  • antlr-0:2.7.7-7.ep5.el4
  • antlr-0:2.7.7-7.ep5.el5
  • antlr-0:2.7.7-7.ep5.el6
  • bcel-0:5.2-8.1.ep5.el4
  • cglib-0:2.2-5.1.1.1.jdk6.ep5.el5
  • cglib-0:2.2-5.1.1.jdk6.ep5.el4
  • cglib-0:2.2-5.4.ep5.el6
  • dom4j-0:1.6.1-11.1.ep5.el6
  • dom4j-0:1.6.1-11.ep5.el4
  • dom4j-0:1.6.1-11.ep5.el5
  • ecj-1:3.3.1.1-3.2.2.jdk6.ep5.el4
  • ecj3-1:3.3.1.1-3.1.1.1.jdk6.ep5.el5
  • ecj3-1:3.3.1.1-4.ep5.el6
  • glassfish-jaf-0:1.1.0-6.1.1.jdk6.ep5.el4
  • glassfish-javamail-0:1.4.2-0.4.ep5.el4
  • glassfish-jsf-0:1.2_13-2.2.1.jdk6.ep5.el4
  • glassfish-jsf-0:1.2_13-3.1.1.jdk6.ep5.el5
  • glassfish-jsf-0:1.2_13-3.1.4.ep5.el6
  • hibernate3-1:3.3.2-1.4.GA_CP04.ep5.el5
  • hibernate3-1:3.3.2-1.5.GA_CP04.ep5.el4
  • hibernate3-1:3.3.2-1.8.GA_CP04.ep5.el6
  • hibernate3-annotations-0:3.4.0-3.2.GA_CP04.ep5.el5
  • hibernate3-annotations-0:3.4.0-3.3.GA_CP04.ep5.el4
  • hibernate3-annotations-0:3.4.0-3.5.GA_CP04.ep5.el6
  • hibernate3-annotations-javadoc-0:3.4.0-3.2.GA_CP04.ep5.el5
  • hibernate3-annotations-javadoc-0:3.4.0-3.3.GA_CP04.ep5.el4
  • hibernate3-annotations-javadoc-0:3.4.0-3.5.GA_CP04.ep5.el6
  • hibernate3-commons-annotations-0:3.1.0-1.8.ep5.el4
  • hibernate3-commons-annotations-0:3.1.0-1.8.ep5.el5
  • hibernate3-commons-annotations-0:3.1.0-1.8.ep5.el6
  • hibernate3-commons-annotations-javadoc-0:3.1.0-1.8.ep5.el4
  • hibernate3-commons-annotations-javadoc-0:3.1.0-1.8.ep5.el5
  • hibernate3-commons-annotations-javadoc-0:3.1.0-1.8.ep5.el6
  • hibernate3-ejb-persistence-3.0-api-1:1.0.2-3.1.jdk6.ep5.el5
  • hibernate3-ejb-persistence-3.0-api-1:1.0.2-3.3.ep5.el6
  • hibernate3-ejb-persistence-3.0-api-1:1.0.2-3.jdk6.ep5.el4
  • hibernate3-ejb-persistence-3.0-api-javadoc-1:1.0.2-3.1.jdk6.ep5.el5
  • hibernate3-ejb-persistence-3.0-api-javadoc-1:1.0.2-3.3.ep5.el6
  • hibernate3-ejb-persistence-3.0-api-javadoc-1:1.0.2-3.jdk6.ep5.el4
  • hibernate3-entitymanager-0:3.4.0-4.3.GA_CP04.ep5.el4
  • hibernate3-entitymanager-0:3.4.0-4.3.GA_CP04.ep5.el5
  • hibernate3-entitymanager-0:3.4.0-4.4.GA_CP04.ep5.el6
  • hibernate3-entitymanager-javadoc-0:3.4.0-4.3.GA_CP04.ep5.el4
  • hibernate3-entitymanager-javadoc-0:3.4.0-4.3.GA_CP04.ep5.el5
  • hibernate3-entitymanager-javadoc-0:3.4.0-4.4.GA_CP04.ep5.el6
  • hibernate3-javadoc-1:3.3.2-1.4.GA_CP04.ep5.el5
  • hibernate3-javadoc-1:3.3.2-1.5.GA_CP04.ep5.el4
  • hibernate3-javadoc-1:3.3.2-1.8.GA_CP04.ep5.el6
  • httpd-0:2.2.17-11.1.ep5.el5
  • httpd-0:2.2.17-11.2.ep5.el6
  • httpd-debuginfo-0:2.2.17-11.1.ep5.el5
  • httpd-debuginfo-0:2.2.17-11.2.ep5.el6
  • httpd-devel-0:2.2.17-11.1.ep5.el5
  • httpd-devel-0:2.2.17-11.2.ep5.el6
  • httpd-manual-0:2.2.17-11.1.ep5.el5
  • httpd-manual-0:2.2.17-11.2.ep5.el6
  • httpd-tools-0:2.2.17-11.2.ep5.el6
  • httpd22-0:2.2.17-14.ep5.el4
  • httpd22-apr-0:2.2.17-14.ep5.el4
  • httpd22-apr-devel-0:2.2.17-14.ep5.el4
  • httpd22-apr-util-0:2.2.17-14.ep5.el4
  • httpd22-apr-util-devel-0:2.2.17-14.ep5.el4
  • httpd22-debuginfo-0:2.2.17-14.ep5.el4
  • httpd22-devel-0:2.2.17-14.ep5.el4
  • httpd22-manual-0:2.2.17-14.ep5.el4
  • jakarta-commons-beanutils-0:1.8.0-4.1.1.jdk6.ep5.el4
  • jakarta-commons-beanutils-0:1.8.0-4.1.2.1.jdk6.ep5.el5
  • jakarta-commons-beanutils-0:1.8.0-9.ep5.el6
  • jakarta-commons-chain-0:1.2-2.2.1.ep5.el5
  • jakarta-commons-chain-0:1.2-2.2.2.ep5.el6
  • jakarta-commons-chain-0:1.2-2.2.ep5.el4
  • jakarta-commons-codec-0:1.3-12.1.ep5.el6
  • jakarta-commons-codec-0:1.3-9.1.1.jdk6.ep5.el4
  • jakarta-commons-codec-0:1.3-9.2.1.1.jdk6.ep5.el5
  • jakarta-commons-collections-0:3.2.1-4.1.ep5.el5
  • jakarta-commons-collections-0:3.2.1-4.ep5.el4
  • jakarta-commons-collections-0:3.2.1-4.ep5.el6
  • jakarta-commons-collections-tomcat5-0:3.2.1-4.1.ep5.el5
  • jakarta-commons-collections-tomcat5-0:3.2.1-4.ep5.el4
  • jakarta-commons-collections-tomcat5-0:3.2.1-4.ep5.el6
  • jakarta-commons-daemon-1:1.0.5-1.1.ep5.el6
  • jakarta-commons-daemon-1:1.0.5-1.ep5.el4
  • jakarta-commons-daemon-1:1.0.5-1.ep5.el5
  • jakarta-commons-daemon-jsvc-1:1.0.5-1.4.ep5.el4
  • jakarta-commons-daemon-jsvc-1:1.0.5-1.4.ep5.el5
  • jakarta-commons-daemon-jsvc-1:1.0.5-1.4.ep5.el6
  • jakarta-commons-daemon-jsvc-debuginfo-1:1.0.5-1.4.ep5.el4
  • jakarta-commons-daemon-jsvc-debuginfo-1:1.0.5-1.4.ep5.el5
  • jakarta-commons-daemon-jsvc-debuginfo-1:1.0.5-1.4.ep5.el6
  • jakarta-commons-dbcp-0:1.2.1-16.2.ep5.el6
  • jakarta-commons-dbcp-0:1.2.1-16.4.ep5.el4
  • jakarta-commons-dbcp-0:1.2.1-16.4.ep5.el5
  • jakarta-commons-dbcp-tomcat5-0:1.2.1-16.2.ep5.el6
  • jakarta-commons-dbcp-tomcat5-0:1.2.1-16.4.ep5.el4
  • jakarta-commons-dbcp-tomcat5-0:1.2.1-16.4.ep5.el5
  • jakarta-commons-digester-0:1.8.1-8.1.1.1.ep5.el6
  • jakarta-commons-digester-0:1.8.1-8.1.jdk6.ep5.el4
  • jakarta-commons-digester-0:1.8.1-8.1.jdk6.ep5.el5
  • jakarta-commons-el-0:1.0-19.2.jdk6.ep5.el4
  • jakarta-commons-fileupload-1:1.1.1-7.4.ep5.el4
  • jakarta-commons-fileupload-1:1.1.1-7.4.ep5.el5
  • jakarta-commons-fileupload-1:1.1.1-7.5.ep5.el6
  • jakarta-commons-httpclient-1:3.1-1.1.1.jdk6.ep5.el4
  • jakarta-commons-httpclient-1:3.1-1.2.1.jdk6.ep5.el5
  • jakarta-commons-httpclient-1:3.1-1.2.2.ep5.el6
  • jakarta-commons-io-0:1.4-1.3.1.jdk6.ep5.el4
  • jakarta-commons-io-0:1.4-1.3.1.jdk6.ep5.el5
  • jakarta-commons-io-0:1.4-4.ep5.el6
  • jakarta-commons-launcher-0:1.1-4.6.1.ep5.el4
  • jakarta-commons-logging-0:1.1.1-0.4.1.jdk6.ep5.el4
  • jakarta-commons-logging-0:1.1.1-0.4.1.jdk6.ep5.el5
  • jakarta-commons-logging-0:1.1.1-1.ep5.el6
  • jakarta-commons-logging-jboss-0:1.1-10.2.1.jdk6.ep5.el4
  • jakarta-commons-logging-jboss-0:1.1-10.2.1.jdk6.ep5.el5
  • jakarta-commons-logging-jboss-0:1.1-10.2.2.1.ep5.el6
  • jakarta-commons-logging-tomcat6-0:1.1.1-0.4.1.jdk6.ep5.el4
  • jakarta-commons-logging-tomcat6-0:1.1.1-0.4.1.jdk6.ep5.el5
  • jakarta-commons-logging-tomcat6-0:1.1.1-1.ep5.el6
  • jakarta-commons-modeler-0:2.0-4.ep5.el4
  • jakarta-commons-pool-0:1.3-11.2.1.jdk6.ep5.el4
  • jakarta-commons-pool-0:1.3-11.2.1.jdk6.ep5.el5
  • jakarta-commons-pool-0:1.3-15.ep5.el6
  • jakarta-commons-pool-tomcat5-0:1.3-11.2.1.jdk6.ep5.el4
  • jakarta-commons-pool-tomcat5-0:1.3-11.2.1.jdk6.ep5.el5
  • jakarta-commons-pool-tomcat5-0:1.3-15.ep5.el6
  • jakarta-commons-validator-0:1.3.1-7.5.1.ep5.el4
  • jakarta-commons-validator-0:1.3.1-7.5.2.ep5.el5
  • jakarta-commons-validator-0:1.3.1-7.5.2.ep5.el6
  • jakarta-oro-0:2.0.8-3.3.2.1.1.1.jdk6.ep5.el5
  • jakarta-oro-0:2.0.8-3.3.2.1.jdk6.ep5.el4
  • jakarta-oro-0:2.0.8-7.ep5.el6
  • jakarta-taglibs-standard-0:1.1.1-12.ep5.el6
  • jakarta-taglibs-standard-0:1.1.1-9.1.ep5.el5
  • jakarta-taglibs-standard-0:1.1.1-9.ep5.el4
  • javassist-0:3.12.0-1.jdk6.ep5.el4
  • javassist-0:3.12.0-1.jdk6.ep5.el5
  • javassist-0:3.12.0-3.ep5.el6
  • jboss-common-core-0:2.2.17-1.2.ep5.el6
  • jboss-common-core-0:2.2.17-1.ep5.el4
  • jboss-common-core-0:2.2.17-1.ep5.el5
  • jboss-common-logging-jdk-0:2.1.2-1.2.ep5.el6
  • jboss-common-logging-jdk-0:2.1.2-1.ep5.el4
  • jboss-common-logging-jdk-0:2.1.2-1.ep5.el5
  • jboss-common-logging-spi-0:2.1.2-1.ep5.el4
  • jboss-common-logging-spi-0:2.1.2-1.ep5.el5
  • jboss-common-logging-spi-0:2.1.2-1.ep5.el6
  • jboss-javaee-0:5.0.1-2.9.ep5.el5
  • jboss-javaee-0:5.0.1-2.9.ep5.el6
  • jboss-javaee-poms-0:5.0.1-2.9.ep5.el4
  • jboss-javaee-poms-0:5.0.1-2.9.ep5.el5
  • jboss-javaee-poms-0:5.0.1-2.9.ep5.el6
  • jboss-jms-1.1-api-0:5.0.1-2.9.ep5.el4
  • jboss-jms-1.1-api-0:5.0.1-2.9.ep5.el5
  • jboss-jms-1.1-api-0:5.0.1-2.9.ep5.el6
  • jboss-transaction-1.0.1-api-0:5.0.1-2.9.ep5.el4
  • jboss-transaction-1.0.1-api-0:5.0.1-2.9.ep5.el5
  • jboss-transaction-1.0.1-api-0:5.0.1-2.9.ep5.el6
  • jcommon-0:1.0.16-1.2.1.jdk6.ep5.el4
  • jcommon-0:1.0.16-1.2.1.jdk6.ep5.el5
  • jcommon-0:1.0.16-1.2.2.ep5.el6
  • jfreechart-0:1.0.13-2.3.2.1.2.ep5.el6
  • jfreechart-0:1.0.13-2.3.2.1.jdk6.ep5.el4
  • jfreechart-0:1.0.13-2.3.2.1.jdk6.ep5.el5
  • log4j-0:1.2.14-18.1.jdk6.ep5.el4
  • mod_cluster-demo-0:1.0.10-2.1.GA_CP01.ep5.el5
  • mod_cluster-demo-0:1.0.10-2.2.GA_CP01.ep5.el6
  • mod_cluster-demo-0:1.0.10-2.GA_CP01.ep5.el4
  • mod_cluster-jbossas-0:1.0.10-2.1.GA_CP01.ep5.el5
  • mod_cluster-jbossas-0:1.0.10-2.2.GA_CP01.ep5.el6
  • mod_cluster-jbossas-0:1.0.10-2.GA_CP01.ep5.el4
  • mod_cluster-jbossweb2-0:1.0.10-2.1.GA_CP01.ep5.el5
  • mod_cluster-jbossweb2-0:1.0.10-2.2.GA_CP01.ep5.el6
  • mod_cluster-jbossweb2-0:1.0.10-2.GA_CP01.ep5.el4
  • mod_cluster-native-0:1.0.10-2.1.1.GA_CP01.ep5.el6
  • mod_cluster-native-0:1.0.10-2.1.GA_CP01.ep5.el5
  • mod_cluster-native-0:1.0.10-2.GA_CP01.ep5.el4
  • mod_cluster-native-debuginfo-0:1.0.10-2.1.1.GA_CP01.ep5.el6
  • mod_cluster-native-debuginfo-0:1.0.10-2.1.GA_CP01.ep5.el5
  • mod_cluster-native-debuginfo-0:1.0.10-2.GA_CP01.ep5.el4
  • mod_cluster-tomcat6-0:1.0.10-2.1.GA_CP01.ep5.el5
  • mod_cluster-tomcat6-0:1.0.10-2.2.GA_CP01.ep5.el6
  • mod_cluster-tomcat6-0:1.0.10-2.GA_CP01.ep5.el4
  • mod_jk-ap20-0:1.2.31-1.1.2.ep5.el6
  • mod_jk-ap20-0:1.2.31-1.1.ep5.el5
  • mod_jk-ap20-0:1.2.31-1.ep5.el4
  • mod_jk-debuginfo-0:1.2.31-1.1.2.ep5.el6
  • mod_jk-debuginfo-0:1.2.31-1.1.ep5.el5
  • mod_jk-debuginfo-0:1.2.31-1.ep5.el4
  • mod_jk-manual-0:1.2.31-1.1.2.ep5.el6
  • mod_jk-manual-0:1.2.31-1.1.ep5.el5
  • mod_jk-manual-0:1.2.31-1.ep5.el4
  • mod_ssl-1:2.2.17-11.1.ep5.el5
  • mod_ssl-1:2.2.17-11.2.ep5.el6
  • mod_ssl22-1:2.2.17-14.ep5.el4
  • mx4j-1:3.0.1-9.3.4.ep5.el4
  • objectweb-asm-0:3.1-5.3.1.jdk6.ep5.el4
  • objectweb-asm-0:3.1-5.3.1.jdk6.ep5.el5
  • objectweb-asm31-0:3.1-12.1.ep5.el6
  • regexp-0:1.5-1.2.1.jdk6.ep5.el4
  • struts12-0:1.2.9-3.1.ep5.el5
  • struts12-0:1.2.9-3.1.ep5.el6
  • struts12-0:1.2.9-3.ep5.el4
  • tomcat-jkstatus-ant-0:1.2.31-2.1.ep5.el6
  • tomcat-jkstatus-ant-0:1.2.31-2.ep5.el4
  • tomcat-jkstatus-ant-0:1.2.31-2.ep5.el5
  • tomcat-native-0:1.1.20-2.0.ep5.el4
  • tomcat-native-0:1.1.20-2.1.2.ep5.el6
  • tomcat-native-0:1.1.20-2.1.ep5.el5
  • tomcat-native-debuginfo-0:1.1.20-2.0.ep5.el4
  • tomcat-native-debuginfo-0:1.1.20-2.1.2.ep5.el6
  • tomcat-native-debuginfo-0:1.1.20-2.1.ep5.el5
  • tomcat5-0:5.5.33-14_patch_04.ep5.el4
  • tomcat5-0:5.5.33-15_patch_04.ep5.el6
  • tomcat5-0:5.5.33-16_patch_04.ep5.el5
  • tomcat5-admin-webapps-0:5.5.33-14_patch_04.ep5.el4
  • tomcat5-admin-webapps-0:5.5.33-15_patch_04.ep5.el6
  • tomcat5-admin-webapps-0:5.5.33-16_patch_04.ep5.el5
  • tomcat5-common-lib-0:5.5.33-14_patch_04.ep5.el4
  • tomcat5-common-lib-0:5.5.33-15_patch_04.ep5.el6
  • tomcat5-common-lib-0:5.5.33-16_patch_04.ep5.el5
  • tomcat5-jasper-0:5.5.33-14_patch_04.ep5.el4
  • tomcat5-jasper-0:5.5.33-15_patch_04.ep5.el6
  • tomcat5-jasper-0:5.5.33-16_patch_04.ep5.el5
  • tomcat5-jasper-eclipse-0:5.5.33-14_patch_04.ep5.el4
  • tomcat5-jasper-eclipse-0:5.5.33-15_patch_04.ep5.el6
  • tomcat5-jasper-eclipse-0:5.5.33-16_patch_04.ep5.el5
  • tomcat5-jasper-javadoc-0:5.5.33-14_patch_04.ep5.el4
  • tomcat5-jasper-javadoc-0:5.5.33-15_patch_04.ep5.el6
  • tomcat5-jasper-javadoc-0:5.5.33-16_patch_04.ep5.el5
  • tomcat5-jsp-2.0-api-0:5.5.33-14_patch_04.ep5.el4
  • tomcat5-jsp-2.0-api-0:5.5.33-15_patch_04.ep5.el6
  • tomcat5-jsp-2.0-api-0:5.5.33-16_patch_04.ep5.el5
  • tomcat5-jsp-2.0-api-javadoc-0:5.5.33-14_patch_04.ep5.el4
  • tomcat5-jsp-2.0-api-javadoc-0:5.5.33-15_patch_04.ep5.el6
  • tomcat5-jsp-2.0-api-javadoc-0:5.5.33-16_patch_04.ep5.el5
  • tomcat5-parent-0:5.5.33-14_patch_04.ep5.el4
  • tomcat5-parent-0:5.5.33-15_patch_04.ep5.el6
  • tomcat5-parent-0:5.5.33-16_patch_04.ep5.el5
  • tomcat5-server-lib-0:5.5.33-14_patch_04.ep5.el4
  • tomcat5-server-lib-0:5.5.33-15_patch_04.ep5.el6
  • tomcat5-server-lib-0:5.5.33-16_patch_04.ep5.el5
  • tomcat5-servlet-2.4-api-0:5.5.33-14_patch_04.ep5.el4
  • tomcat5-servlet-2.4-api-0:5.5.33-15_patch_04.ep5.el6
  • tomcat5-servlet-2.4-api-0:5.5.33-16_patch_04.ep5.el5
  • tomcat5-servlet-2.4-api-javadoc-0:5.5.33-14_patch_04.ep5.el4
  • tomcat5-servlet-2.4-api-javadoc-0:5.5.33-15_patch_04.ep5.el6
  • tomcat5-servlet-2.4-api-javadoc-0:5.5.33-16_patch_04.ep5.el5
  • tomcat5-webapps-0:5.5.33-14_patch_04.ep5.el4
  • tomcat5-webapps-0:5.5.33-15_patch_04.ep5.el6
  • tomcat5-webapps-0:5.5.33-16_patch_04.ep5.el5
  • tomcat6-0:6.0.32-14_patch_03.ep5.el6
  • tomcat6-0:6.0.32-15.1_patch_03.ep5.el5
  • tomcat6-0:6.0.32-15_patch_03.ep5.el4
  • tomcat6-admin-webapps-0:6.0.32-14_patch_03.ep5.el6
  • tomcat6-admin-webapps-0:6.0.32-15.1_patch_03.ep5.el5
  • tomcat6-admin-webapps-0:6.0.32-15_patch_03.ep5.el4
  • tomcat6-docs-webapp-0:6.0.32-14_patch_03.ep5.el6
  • tomcat6-docs-webapp-0:6.0.32-15.1_patch_03.ep5.el5
  • tomcat6-docs-webapp-0:6.0.32-15_patch_03.ep5.el4
  • tomcat6-el-1.0-api-0:6.0.32-14_patch_03.ep5.el6
  • tomcat6-el-1.0-api-0:6.0.32-15.1_patch_03.ep5.el5
  • tomcat6-el-1.0-api-0:6.0.32-15_patch_03.ep5.el4
  • tomcat6-javadoc-0:6.0.32-14_patch_03.ep5.el6
  • tomcat6-javadoc-0:6.0.32-15.1_patch_03.ep5.el5
  • tomcat6-javadoc-0:6.0.32-15_patch_03.ep5.el4
  • tomcat6-jsp-2.1-api-0:6.0.32-14_patch_03.ep5.el6
  • tomcat6-jsp-2.1-api-0:6.0.32-15.1_patch_03.ep5.el5
  • tomcat6-jsp-2.1-api-0:6.0.32-15_patch_03.ep5.el4
  • tomcat6-lib-0:6.0.32-14_patch_03.ep5.el6
  • tomcat6-lib-0:6.0.32-15.1_patch_03.ep5.el5
  • tomcat6-lib-0:6.0.32-15_patch_03.ep5.el4
  • tomcat6-log4j-0:6.0.32-14_patch_03.ep5.el6
  • tomcat6-log4j-0:6.0.32-15.1_patch_03.ep5.el5
  • tomcat6-log4j-0:6.0.32-15_patch_03.ep5.el4
  • tomcat6-servlet-2.5-api-0:6.0.32-14_patch_03.ep5.el6
  • tomcat6-servlet-2.5-api-0:6.0.32-15.1_patch_03.ep5.el5
  • tomcat6-servlet-2.5-api-0:6.0.32-15_patch_03.ep5.el4
  • tomcat6-webapps-0:6.0.32-14_patch_03.ep5.el6
  • tomcat6-webapps-0:6.0.32-15.1_patch_03.ep5.el5
  • tomcat6-webapps-0:6.0.32-15_patch_03.ep5.el4
  • xalan-j2-0:2.7.1-5.3_patch_04.ep5.el4
  • xalan-j2-0:2.7.1-5.3_patch_04.ep5.el5
  • xalan-j2-0:2.7.1-5.3_patch_04.ep5.el6
  • xerces-j2-0:2.9.1-3.patch01.1.ep5.el4
  • xerces-j2-0:2.9.1-3.patch01.1.ep5.el5
  • xerces-j2-0:2.9.1-8.patch01.1.ep5.el6
  • xml-commons-0:1.3.04-7.10.jdk6.ep5.el5
  • xml-commons-0:1.3.04-7.14.ep5.el6
  • xml-commons-1:1.3.04-7.12.ep5.el4
  • xml-commons-jaxp-1.1-apis-0:1.3.04-7.14.ep5.el6
  • xml-commons-jaxp-1.2-apis-0:1.3.04-7.10.jdk6.ep5.el5
  • xml-commons-jaxp-1.2-apis-0:1.3.04-7.14.ep5.el6
  • xml-commons-jaxp-1.2-apis-1:1.3.04-7.12.ep5.el4
  • xml-commons-jaxp-1.3-apis-0:1.3.04-7.10.jdk6.ep5.el5
  • xml-commons-jaxp-1.3-apis-0:1.3.04-7.14.ep5.el6
  • xml-commons-jaxp-1.3-apis-1:1.3.04-7.12.ep5.el4
  • xml-commons-resolver10-0:1.3.04-7.14.ep5.el6
  • xml-commons-resolver11-0:1.3.04-7.14.ep5.el6
  • xml-commons-resolver12-0:1.3.04-7.10.jdk6.ep5.el5
  • xml-commons-resolver12-0:1.3.04-7.14.ep5.el6
  • xml-commons-resolver12-1:1.3.04-7.12.ep5.el4
  • xml-commons-which10-0:1.3.04-7.14.ep5.el6
  • xml-commons-which11-0:1.3.04-7.14.ep5.el6
  • tomcat5-0:5.5.23-0jpp.22.el5_7
  • tomcat5-admin-webapps-0:5.5.23-0jpp.22.el5_7
  • tomcat5-common-lib-0:5.5.23-0jpp.22.el5_7
  • tomcat5-debuginfo-0:5.5.23-0jpp.22.el5_7
  • tomcat5-jasper-0:5.5.23-0jpp.22.el5_7
  • tomcat5-jasper-javadoc-0:5.5.23-0jpp.22.el5_7
  • tomcat5-jsp-2.0-api-0:5.5.23-0jpp.22.el5_7
  • tomcat5-jsp-2.0-api-javadoc-0:5.5.23-0jpp.22.el5_7
  • tomcat5-server-lib-0:5.5.23-0jpp.22.el5_7
  • tomcat5-servlet-2.4-api-0:5.5.23-0jpp.22.el5_7
  • tomcat5-servlet-2.4-api-javadoc-0:5.5.23-0jpp.22.el5_7
  • tomcat5-webapps-0:5.5.23-0jpp.22.el5_7
refmap via4
apple APPLE-SA-2011-10-12-3
bid 46177
bugtraq 20110205 [SECURITY] CVE-2010-3718 Apache Tomcat Local bypass of security manger file permissions
confirm
debian DSA-2160
hp
  • HPSBST02955
  • HPSBUX02645
  • HPSBUX02725
  • HPSBUX02860
  • SSRT100627
  • SSRT101146
mandriva MDVSA-2011:030
misc
mlist
  • [tomcat-dev] 20190319 svn commit: r1855831 [22/30] - in /tomcat/site/trunk: ./ docs/ xdocs/
  • [tomcat-dev] 20190325 svn commit: r1856174 [20/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/
  • [tomcat-dev] 20200203 svn commit: r1873527 [22/30] - /tomcat/site/trunk/docs/
  • [tomcat-dev] 20200213 svn commit: r1873980 [25/34] - /tomcat/site/trunk/docs/
sectrack 1025025
secunia
  • 43192
  • 45022
  • 57126
sreason 8072
suse SUSE-SR:2011:005
xf tomcat-servletcontect-sec-bypass(65159)
Last major update 13-02-2023 - 04:25
Published 10-02-2011 - 18:00
Last modified 13-02-2023 - 04:25
Back to Top