{"api_version":"1","generated_at":"2026-07-23T06:31:54+00:00","cve":"CVE-2011-2729","urls":{"html":"https://cve.report/CVE-2011-2729","api":"https://cve.report/api/cve/CVE-2011-2729.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2011-2729","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2011-2729"},"summary":{"title":"CVE-2011-2729","description":"native/unix/native/jsvc-unix.c in jsvc in the Daemon component 1.0.3 through 1.0.6 in Apache Commons, as used in Apache Tomcat 5.5.32 through 5.5.33, 6.0.30 through 6.0.32, and 7.0.x before 7.0.20 on Linux, does not drop capabilities, which allows remote attackers to bypass read permissions for files via a request to an application.","state":"PUBLISHED","assigner":"redhat","published_at":"2011-08-15 21:55:02","updated_at":"2026-04-29 01:13:23"},"problem_types":["CWE-264","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"5","severity":"","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","data":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:N/A:N","baseScore":5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE"}}],"references":[{"url":"http://securitytracker.com/id?1025925","name":"http://securitytracker.com/id?1025925","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Apache Tomcat Commons Daemon jsvc Lets Local Users Gain Elevated Privileges - SecurityTracker","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://mail-archives.apache.org/mod_mbox/commons-dev/201108.mbox/%3C4E451B2B.9090108%40apache.org%3E","name":"http://mail-archives.apache.org/mod_mbox/commons-dev/201108.mbox/%3C4E451B2B.9090108%40apache.org%3E","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"[AANNOUNCE] Apache Commons Daemon 1.0.7 released","mime":"text/xml","httpstatus":"200","archivestatus":"200"},{"url":"http://svn.apache.org/viewvc?view=revision&revision=1153824","name":"http://svn.apache.org/viewvc?view=revision&revision=1153824","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"[Apache-SVN] Revision 1153824","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/69161","name":"https://exchange.xforce.ibmcloud.com/vulnerabilities/69161","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"IBM X-Force Exchange","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://lists.apache.org/thread.html/8dcaf7c3894d66cb717646ea1504ea6e300021c85bb4e677dc16b1aa%40%3Cdev.tomcat.apache.org%3E","name":"https://lists.apache.org/thread.html/8dcaf7c3894d66cb717646ea1504ea6e300021c85bb4e677dc16b1aa%40%3Cdev.tomcat.apache.org%3E","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Pony Mail!","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19450","name":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19450","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Repository  /  Oval Repository","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://marc.info/?l=bugtraq&m=136485229118404&w=2","name":"http://marc.info/?l=bugtraq&m=136485229118404&w=2","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"'[security bulletin] HPSBUX02860 SSRT101146 rev.1 - HP-UX Apache Running Tomcat Servlet Engine, Remot' - MARC","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securityfocus.com/bid/49143","name":"http://www.securityfocus.com/bid/49143","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Apache Commons Daemon 'jsvc' Information Disclosure Vulnerability","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"http://tomcat.apache.org/security-7.html","name":"http://tomcat.apache.org/security-7.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"Apache Tomcat® - Apache Tomcat 7 vulnerabilities","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.redhat.com/support/errata/RHSA-2011-1292.html","name":"http://www.redhat.com/support/errata/RHSA-2011-1292.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Support","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.redhat.com/support/errata/RHSA-2011-1291.html","name":"http://www.redhat.com/support/errata/RHSA-2011-1291.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Support","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://mail-archives.apache.org/mod_mbox/tomcat-announce/201108.mbox/%3C4E45221D.1020306%40apache.org%3E","name":"http://mail-archives.apache.org/mod_mbox/tomcat-announce/201108.mbox/%3C4E45221D.1020306%40apache.org%3E","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"[SECURITY] CVE-2011-2729: Commons Daemon fails to drop capabilities (Apache Tomcat)","mime":"text/xml","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securityfocus.com/archive/1/519263/100/0/threaded","name":"http://www.securityfocus.com/archive/1/519263/100/0/threaded","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"SecurityFocus","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2011-09/msg00024.html","name":"http://lists.opensuse.org/opensuse-security-announce/2011-09/msg00024.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"[security-announce] openSUSE-SU-2011:1062-1: important: jakarta-commons-","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://marc.info/?l=bugtraq&m=132215163318824&w=2","name":"http://marc.info/?l=bugtraq&m=132215163318824&w=2","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"'[security bulletin] HPSBUX02725 SSRT100627 rev.1 - HP-UX Apache Running Tomcat Servlet Engine, Remot' - MARC","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=730400","name":"https://bugzilla.redhat.com/show_bug.cgi?id=730400","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Bug 730400 – CVE-2011-2729 jakarta-commons-daemon: jsvc does not drop capabilities allowing access to files and directories owned by the superuser","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://tomcat.apache.org/security-5.html","name":"http://tomcat.apache.org/security-5.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"Apache Tomcat - Apache Tomcat 5 vulnerabilities","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://lists.apache.org/thread.html/r584a714f141eff7b1c358d4679288177bd4ca4558e9999d15867d4b5%40%3Cdev.tomcat.apache.org%3E","name":"https://lists.apache.org/thread.html/r584a714f141eff7b1c358d4679288177bd4ca4558e9999d15867d4b5%40%3Cdev.tomcat.apache.org%3E","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Pony Mail!","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://people.apache.org/~markt/patches/2011-08-12-cve2011-2729-tc5.patch","name":"http://people.apache.org/~markt/patches/2011-08-12-cve2011-2729-tc5.patch","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"404 Not Found","mime":"text/html","httpstatus":"404","archivestatus":"404"},{"url":"http://tomcat.apache.org/security-6.html","name":"http://tomcat.apache.org/security-6.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"Apache Tomcat® - Apache Tomcat 6 vulnerabilities","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://secunia.com/advisories/46030","name":"http://secunia.com/advisories/46030","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Red Hat update for JBoss Enterprise Web Server - Secunia.com","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://secunia.com/advisories/57126","name":"http://secunia.com/advisories/57126","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"About Secunia Research | Flexera","mime":"text/plain","httpstatus":"200","archivestatus":"200"},{"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14743","name":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14743","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Repository  /  Oval Repository","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://svn.apache.org/viewvc?view=revision&revision=1153379","name":"http://svn.apache.org/viewvc?view=revision&revision=1153379","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"[Apache-SVN] Revision 1153379","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://marc.info/?l=bugtraq&m=133469267822771&w=2","name":"http://marc.info/?l=bugtraq&m=133469267822771&w=2","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"'[security bulletin] HPSBOV02762 SSRT100825 rev.1 - HP Secure Web Server (SWS) for OpenVMS running CS' - MARC","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://marc.info/?l=bugtraq&m=139344343412337&w=2","name":"http://marc.info/?l=bugtraq&m=139344343412337&w=2","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"'[security bulletin] HPSBST02955 rev.1 - HP XP P9000 Performance Advisor Software, 3rd party Software' - MARC","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://svn.apache.org/viewvc?view=revision&revision=1152701","name":"http://svn.apache.org/viewvc?view=revision&revision=1152701","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"[Apache-SVN] Revision 1152701","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://lists.apache.org/thread.html/06cfb634bc7bf37af7d8f760f118018746ad8efbd519c4b789ac9c2e%40%3Cdev.tomcat.apache.org%3E","name":"https://lists.apache.org/thread.html/06cfb634bc7bf37af7d8f760f118018746ad8efbd519c4b789ac9c2e%40%3Cdev.tomcat.apache.org%3E","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Pony Mail!","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://issues.apache.org/jira/browse/DAEMON-214","name":"https://issues.apache.org/jira/browse/DAEMON-214","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"[DAEMON-214] CVE-2011-2729: jsvc fails to drop capabilities on Linux - ASF JIRA","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://lists.apache.org/thread.html/r3aacc40356defc3f248aa504b1e48e819dd0471a0a83349080c6bcbf%40%3Cdev.tomcat.apache.org%3E","name":"https://lists.apache.org/thread.html/r3aacc40356defc3f248aa504b1e48e819dd0471a0a83349080c6bcbf%40%3Cdev.tomcat.apache.org%3E","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Pony Mail!","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://mail-archives.apache.org/mod_mbox/commons-dev/201108.mbox/%3C4E451B2B.9090108@apache.org%3E","name":"MLIST:[commons-dev] 20110812 [AANNOUNCE] Apache Commons Daemon 1.0.7 released","refsource":"MITRE","tags":[],"title":"[AANNOUNCE] Apache Commons Daemon 1.0.7 released","mime":"text/xml","httpstatus":"200","archivestatus":"200"},{"url":"http://mail-archives.apache.org/mod_mbox/tomcat-announce/201108.mbox/%3C4E45221D.1020306@apache.org%3E","name":"MLIST:[tomcat-announce] 20110812 [SECURITY] CVE-2011-2729: Commons Daemon fails to drop capabilities (Apache Tomcat)","refsource":"MITRE","tags":[],"title":"[SECURITY] CVE-2011-2729: Commons Daemon fails to drop capabilities (Apache Tomcat)","mime":"text/xml","httpstatus":"200","archivestatus":"200"},{"url":"https://lists.apache.org/thread.html/06cfb634bc7bf37af7d8f760f118018746ad8efbd519c4b789ac9c2e@%3Cdev.tomcat.apache.org%3E","name":"MLIST:[tomcat-dev] 20190319 svn commit: r1855831 [22/30] - in /tomcat/site/trunk: ./ docs/ xdocs/","refsource":"MITRE","tags":[],"title":"Pony Mail!","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://lists.apache.org/thread.html/8dcaf7c3894d66cb717646ea1504ea6e300021c85bb4e677dc16b1aa@%3Cdev.tomcat.apache.org%3E","name":"MLIST:[tomcat-dev] 20190325 svn commit: r1856174 [20/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/","refsource":"MITRE","tags":[],"title":"Pony Mail!","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://lists.apache.org/thread.html/r584a714f141eff7b1c358d4679288177bd4ca4558e9999d15867d4b5@%3Cdev.tomcat.apache.org%3E","name":"MLIST:[tomcat-dev] 20200203 svn commit: r1873527 [22/30] - /tomcat/site/trunk/docs/","refsource":"MITRE","tags":[],"title":"Pony Mail!","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://lists.apache.org/thread.html/r3aacc40356defc3f248aa504b1e48e819dd0471a0a83349080c6bcbf@%3Cdev.tomcat.apache.org%3E","name":"MLIST:[tomcat-dev] 20200213 svn commit: r1873980 [25/34] - /tomcat/site/trunk/docs/","refsource":"MITRE","tags":[],"title":"Pony Mail!","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2011-2729","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2011-2729","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2011","cve_id":"2729","vulnerable":"0","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"apache","cpe5":"apache_commons_daemon","cpe6":"1.0.3","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2011","cve_id":"2729","vulnerable":"0","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"apache","cpe5":"apache_commons_daemon","cpe6":"1.0.4","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2011","cve_id":"2729","vulnerable":"0","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"apache","cpe5":"apache_commons_daemon","cpe6":"1.0.5","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2011","cve_id":"2729","vulnerable":"0","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"apache","cpe5":"apache_commons_daemon","cpe6":"1.0.6","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2011","cve_id":"2729","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"apache","cpe5":"tomcat","cpe6":"5.5.32","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2011","cve_id":"2729","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"apache","cpe5":"tomcat","cpe6":"5.5.33","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2011","cve_id":"2729","vulnerable":"0","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"linux","cpe5":"linux_kernel","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-06T23:08:23.965Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"name":"tomcat-jsvc-info-disclosure(69161)","tags":["vdb-entry","x_refsource_XF","x_transferred"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/69161"},{"name":"openSUSE-SU-2011:1062","tags":["vendor-advisory","x_refsource_SUSE","x_transferred"],"url":"http://lists.opensuse.org/opensuse-security-announce/2011-09/msg00024.html"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"http://svn.apache.org/viewvc?view=revision&revision=1153824"},{"name":"HPSBUX02860","tags":["vendor-advisory","x_refsource_HP","x_transferred"],"url":"http://marc.info/?l=bugtraq&m=136485229118404&w=2"},{"name":"1025925","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"],"url":"http://securitytracker.com/id?1025925"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"http://people.apache.org/~markt/patches/2011-08-12-cve2011-2729-tc5.patch"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"http://tomcat.apache.org/security-7.html"},{"name":"HPSBOV02762","tags":["vendor-advisory","x_refsource_HP","x_transferred"],"url":"http://marc.info/?l=bugtraq&m=133469267822771&w=2"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=730400"},{"name":"RHSA-2011:1291","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"],"url":"http://www.redhat.com/support/errata/RHSA-2011-1291.html"},{"name":"SSRT100627","tags":["vendor-advisory","x_refsource_HP","x_transferred"],"url":"http://marc.info/?l=bugtraq&m=132215163318824&w=2"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"http://svn.apache.org/viewvc?view=revision&revision=1152701"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"http://svn.apache.org/viewvc?view=revision&revision=1153379"},{"name":"20110812 [SECURITY] CVE-2011-2729: Commons Daemon fails to drop capabilities (Apache Tomcat)","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred"],"url":"http://www.securityfocus.com/archive/1/519263/100/0/threaded"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"http://tomcat.apache.org/security-6.html"},{"name":"57126","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/57126"},{"name":"[commons-dev] 20110812 [AANNOUNCE] Apache Commons Daemon 1.0.7 released","tags":["mailing-list","x_refsource_MLIST","x_transferred"],"url":"http://mail-archives.apache.org/mod_mbox/commons-dev/201108.mbox/%3C4E451B2B.9090108%40apache.org%3E"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"https://issues.apache.org/jira/browse/DAEMON-214"},{"name":"49143","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/49143"},{"name":"oval:org.mitre.oval:def:19450","tags":["vdb-entry","signature","x_refsource_OVAL","x_transferred"],"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19450"},{"name":"SSRT100825","tags":["vendor-advisory","x_refsource_HP","x_transferred"],"url":"http://marc.info/?l=bugtraq&m=133469267822771&w=2"},{"name":"46030","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/46030"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"http://tomcat.apache.org/security-5.html"},{"name":"HPSBUX02725","tags":["vendor-advisory","x_refsource_HP","x_transferred"],"url":"http://marc.info/?l=bugtraq&m=132215163318824&w=2"},{"name":"RHSA-2011:1292","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"],"url":"http://www.redhat.com/support/errata/RHSA-2011-1292.html"},{"name":"SSRT101146","tags":["vendor-advisory","x_refsource_HP","x_transferred"],"url":"http://marc.info/?l=bugtraq&m=136485229118404&w=2"},{"name":"[tomcat-announce] 20110812 [SECURITY] CVE-2011-2729: Commons Daemon fails to drop capabilities (Apache Tomcat)","tags":["mailing-list","x_refsource_MLIST","x_transferred"],"url":"http://mail-archives.apache.org/mod_mbox/tomcat-announce/201108.mbox/%3C4E45221D.1020306%40apache.org%3E"},{"name":"HPSBST02955","tags":["vendor-advisory","x_refsource_HP","x_transferred"],"url":"http://marc.info/?l=bugtraq&m=139344343412337&w=2"},{"name":"oval:org.mitre.oval:def:14743","tags":["vdb-entry","signature","x_refsource_OVAL","x_transferred"],"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14743"},{"name":"[tomcat-dev] 20190319 svn commit: r1855831 [22/30] - in /tomcat/site/trunk: ./ docs/ xdocs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"],"url":"https://lists.apache.org/thread.html/06cfb634bc7bf37af7d8f760f118018746ad8efbd519c4b789ac9c2e%40%3Cdev.tomcat.apache.org%3E"},{"name":"[tomcat-dev] 20190325 svn commit: r1856174 [20/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/","tags":["mailing-list","x_refsource_MLIST","x_transferred"],"url":"https://lists.apache.org/thread.html/8dcaf7c3894d66cb717646ea1504ea6e300021c85bb4e677dc16b1aa%40%3Cdev.tomcat.apache.org%3E"},{"name":"[tomcat-dev] 20200203 svn commit: r1873527 [22/30] - /tomcat/site/trunk/docs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"],"url":"https://lists.apache.org/thread.html/r584a714f141eff7b1c358d4679288177bd4ca4558e9999d15867d4b5%40%3Cdev.tomcat.apache.org%3E"},{"name":"[tomcat-dev] 20200213 svn commit: r1873980 [25/34] - /tomcat/site/trunk/docs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"],"url":"https://lists.apache.org/thread.html/r3aacc40356defc3f248aa504b1e48e819dd0471a0a83349080c6bcbf%40%3Cdev.tomcat.apache.org%3E"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2011-08-12T00:00:00.000Z","descriptions":[{"lang":"en","value":"native/unix/native/jsvc-unix.c in jsvc in the Daemon component 1.0.3 through 1.0.6 in Apache Commons, as used in Apache Tomcat 5.5.32 through 5.5.33, 6.0.30 through 6.0.32, and 7.0.x before 7.0.20 on Linux, does not drop capabilities, which allows remote attackers to bypass read permissions for files via a request to an application."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2020-02-13T16:08:29.000Z","orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","shortName":"redhat"},"references":[{"name":"tomcat-jsvc-info-disclosure(69161)","tags":["vdb-entry","x_refsource_XF"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/69161"},{"name":"openSUSE-SU-2011:1062","tags":["vendor-advisory","x_refsource_SUSE"],"url":"http://lists.opensuse.org/opensuse-security-announce/2011-09/msg00024.html"},{"tags":["x_refsource_CONFIRM"],"url":"http://svn.apache.org/viewvc?view=revision&revision=1153824"},{"name":"HPSBUX02860","tags":["vendor-advisory","x_refsource_HP"],"url":"http://marc.info/?l=bugtraq&m=136485229118404&w=2"},{"name":"1025925","tags":["vdb-entry","x_refsource_SECTRACK"],"url":"http://securitytracker.com/id?1025925"},{"tags":["x_refsource_CONFIRM"],"url":"http://people.apache.org/~markt/patches/2011-08-12-cve2011-2729-tc5.patch"},{"tags":["x_refsource_CONFIRM"],"url":"http://tomcat.apache.org/security-7.html"},{"name":"HPSBOV02762","tags":["vendor-advisory","x_refsource_HP"],"url":"http://marc.info/?l=bugtraq&m=133469267822771&w=2"},{"tags":["x_refsource_CONFIRM"],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=730400"},{"name":"RHSA-2011:1291","tags":["vendor-advisory","x_refsource_REDHAT"],"url":"http://www.redhat.com/support/errata/RHSA-2011-1291.html"},{"name":"SSRT100627","tags":["vendor-advisory","x_refsource_HP"],"url":"http://marc.info/?l=bugtraq&m=132215163318824&w=2"},{"tags":["x_refsource_CONFIRM"],"url":"http://svn.apache.org/viewvc?view=revision&revision=1152701"},{"tags":["x_refsource_CONFIRM"],"url":"http://svn.apache.org/viewvc?view=revision&revision=1153379"},{"name":"20110812 [SECURITY] CVE-2011-2729: Commons Daemon fails to drop capabilities (Apache Tomcat)","tags":["mailing-list","x_refsource_BUGTRAQ"],"url":"http://www.securityfocus.com/archive/1/519263/100/0/threaded"},{"tags":["x_refsource_CONFIRM"],"url":"http://tomcat.apache.org/security-6.html"},{"name":"57126","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/57126"},{"name":"[commons-dev] 20110812 [AANNOUNCE] Apache Commons Daemon 1.0.7 released","tags":["mailing-list","x_refsource_MLIST"],"url":"http://mail-archives.apache.org/mod_mbox/commons-dev/201108.mbox/%3C4E451B2B.9090108%40apache.org%3E"},{"tags":["x_refsource_CONFIRM"],"url":"https://issues.apache.org/jira/browse/DAEMON-214"},{"name":"49143","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/49143"},{"name":"oval:org.mitre.oval:def:19450","tags":["vdb-entry","signature","x_refsource_OVAL"],"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19450"},{"name":"SSRT100825","tags":["vendor-advisory","x_refsource_HP"],"url":"http://marc.info/?l=bugtraq&m=133469267822771&w=2"},{"name":"46030","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/46030"},{"tags":["x_refsource_CONFIRM"],"url":"http://tomcat.apache.org/security-5.html"},{"name":"HPSBUX02725","tags":["vendor-advisory","x_refsource_HP"],"url":"http://marc.info/?l=bugtraq&m=132215163318824&w=2"},{"name":"RHSA-2011:1292","tags":["vendor-advisory","x_refsource_REDHAT"],"url":"http://www.redhat.com/support/errata/RHSA-2011-1292.html"},{"name":"SSRT101146","tags":["vendor-advisory","x_refsource_HP"],"url":"http://marc.info/?l=bugtraq&m=136485229118404&w=2"},{"name":"[tomcat-announce] 20110812 [SECURITY] CVE-2011-2729: Commons Daemon fails to drop capabilities (Apache Tomcat)","tags":["mailing-list","x_refsource_MLIST"],"url":"http://mail-archives.apache.org/mod_mbox/tomcat-announce/201108.mbox/%3C4E45221D.1020306%40apache.org%3E"},{"name":"HPSBST02955","tags":["vendor-advisory","x_refsource_HP"],"url":"http://marc.info/?l=bugtraq&m=139344343412337&w=2"},{"name":"oval:org.mitre.oval:def:14743","tags":["vdb-entry","signature","x_refsource_OVAL"],"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14743"},{"name":"[tomcat-dev] 20190319 svn commit: r1855831 [22/30] - in /tomcat/site/trunk: ./ docs/ xdocs/","tags":["mailing-list","x_refsource_MLIST"],"url":"https://lists.apache.org/thread.html/06cfb634bc7bf37af7d8f760f118018746ad8efbd519c4b789ac9c2e%40%3Cdev.tomcat.apache.org%3E"},{"name":"[tomcat-dev] 20190325 svn commit: r1856174 [20/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/","tags":["mailing-list","x_refsource_MLIST"],"url":"https://lists.apache.org/thread.html/8dcaf7c3894d66cb717646ea1504ea6e300021c85bb4e677dc16b1aa%40%3Cdev.tomcat.apache.org%3E"},{"name":"[tomcat-dev] 20200203 svn commit: r1873527 [22/30] - /tomcat/site/trunk/docs/","tags":["mailing-list","x_refsource_MLIST"],"url":"https://lists.apache.org/thread.html/r584a714f141eff7b1c358d4679288177bd4ca4558e9999d15867d4b5%40%3Cdev.tomcat.apache.org%3E"},{"name":"[tomcat-dev] 20200213 svn commit: r1873980 [25/34] - /tomcat/site/trunk/docs/","tags":["mailing-list","x_refsource_MLIST"],"url":"https://lists.apache.org/thread.html/r3aacc40356defc3f248aa504b1e48e819dd0471a0a83349080c6bcbf%40%3Cdev.tomcat.apache.org%3E"}]}},"cveMetadata":{"assignerOrgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","assignerShortName":"redhat","cveId":"CVE-2011-2729","datePublished":"2011-08-15T21:00:00.000Z","dateReserved":"2011-07-11T00:00:00.000Z","dateUpdated":"2024-08-06T23:08:23.965Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2011-08-15 21:55:02","lastModifiedDate":"2026-04-29 01:13:23","problem_types":["CWE-264","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:N/A:N","baseScore":5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":10,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:a:apache:apache_commons_daemon:1.0.3:*:*:*:*:*:*:*","matchCriteriaId":"6AB9C8A4-9E4F-4B5E-B20E-01B0C6DA623E"},{"vulnerable":false,"criteria":"cpe:2.3:a:apache:apache_commons_daemon:1.0.4:*:*:*:*:*:*:*","matchCriteriaId":"EC41DBC3-1DA3-4C63-A360-253937FE2409"},{"vulnerable":false,"criteria":"cpe:2.3:a:apache:apache_commons_daemon:1.0.5:*:*:*:*:*:*:*","matchCriteriaId":"175FC97E-F4C2-43BA-BEF8-66DA0BC627C1"},{"vulnerable":false,"criteria":"cpe:2.3:a:apache:apache_commons_daemon:1.0.6:*:*:*:*:*:*:*","matchCriteriaId":"B69A27DD-4056-4644-AA16-70B16642FAA7"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:tomcat:5.5.32:*:*:*:*:*:*:*","matchCriteriaId":"7B980C39-A4D8-483A-B48C-36CA4F5CEAA1"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:tomcat:5.5.33:*:*:*:*:*:*:*","matchCriteriaId":"DFF7178D-DC9B-45F7-BEA4-701B1EAEC2CC"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"155AD4FB-E527-4103-BCEF-801B653DEA37"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:a:apache:apache_commons_daemon:1.0.3:*:*:*:*:*:*:*","matchCriteriaId":"6AB9C8A4-9E4F-4B5E-B20E-01B0C6DA623E"},{"vulnerable":false,"criteria":"cpe:2.3:a:apache:apache_commons_daemon:1.0.4:*:*:*:*:*:*:*","matchCriteriaId":"EC41DBC3-1DA3-4C63-A360-253937FE2409"},{"vulnerable":false,"criteria":"cpe:2.3:a:apache:apache_commons_daemon:1.0.5:*:*:*:*:*:*:*","matchCriteriaId":"175FC97E-F4C2-43BA-BEF8-66DA0BC627C1"},{"vulnerable":false,"criteria":"cpe:2.3:a:apache:apache_commons_daemon:1.0.6:*:*:*:*:*:*:*","matchCriteriaId":"B69A27DD-4056-4644-AA16-70B16642FAA7"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:tomcat:6.0.30:*:*:*:*:*:*:*","matchCriteriaId":"A9E03BE3-60CC-4415-B993-D0BB00F87A30"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:tomcat:6.0.31:*:*:*:*:*:*:*","matchCriteriaId":"CE92E59A-FF0D-4D1A-8B12-CC41A7E1FD3C"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:tomcat:6.0.32:*:*:*:*:*:*:*","matchCriteriaId":"BFD64FE7-ABAF-49F3-B8D0-91C37C822F4B"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"155AD4FB-E527-4103-BCEF-801B653DEA37"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:apache:apache_commons_daemon:1.0.3:*:*:*:*:*:*:*","matchCriteriaId":"6AB9C8A4-9E4F-4B5E-B20E-01B0C6DA623E"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:apache_commons_daemon:1.0.4:*:*:*:*:*:*:*","matchCriteriaId":"EC41DBC3-1DA3-4C63-A360-253937FE2409"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:apache_commons_daemon:1.0.5:*:*:*:*:*:*:*","matchCriteriaId":"175FC97E-F4C2-43BA-BEF8-66DA0BC627C1"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:apache_commons_daemon:1.0.6:*:*:*:*:*:*:*","matchCriteriaId":"B69A27DD-4056-4644-AA16-70B16642FAA7"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:tomcat:7.0.0:*:*:*:*:*:*:*","matchCriteriaId":"0F8C62EF-1B67-456A-9C66-755439CF8556"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:tomcat:7.0.0:beta:*:*:*:*:*:*","matchCriteriaId":"33E9607B-4D28-460D-896B-E4B7FA22441E"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:tomcat:7.0.1:*:*:*:*:*:*:*","matchCriteriaId":"A819E245-D641-4F19-9139-6C940504F6E7"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:tomcat:7.0.2:*:*:*:*:*:*:*","matchCriteriaId":"8C381275-10C5-4939-BCE3-0D1F3B3CB2EE"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:tomcat:7.0.3:*:*:*:*:*:*:*","matchCriteriaId":"7205475A-6D04-4042-B24E-1DA5A57029B7"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:tomcat:7.0.4:*:*:*:*:*:*:*","matchCriteriaId":"08022987-B36B-4F63-88A5-A8F59195DF4A"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:tomcat:7.0.5:*:*:*:*:*:*:*","matchCriteriaId":"FF4B7557-EF35-451E-B55D-3296966695AC"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:tomcat:7.0.6:*:*:*:*:*:*:*","matchCriteriaId":"8980E61E-27BE-4858-82B3-C0E8128AF521"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:tomcat:7.0.7:*:*:*:*:*:*:*","matchCriteriaId":"8756BF9B-3E24-4677-87AE-31CE776541F0"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:tomcat:7.0.8:*:*:*:*:*:*:*","matchCriteriaId":"88CE057E-2092-4C98-8D0C-75CF439D0A9C"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:tomcat:7.0.9:*:*:*:*:*:*:*","matchCriteriaId":"8F194580-EE6D-4E38-87F3-F0661262256B"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:tomcat:7.0.10:*:*:*:*:*:*:*","matchCriteriaId":"A9731BAA-4C6C-4259-B786-F577D8A90FA1"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:tomcat:7.0.11:*:*:*:*:*:*:*","matchCriteriaId":"1F74A421-D019-4248-84B8-C70D4D9A8A95"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:tomcat:7.0.12:*:*:*:*:*:*:*","matchCriteriaId":"2BA27FF9-4C66-4E17-95C0-1CB2DAA6AFC8"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:tomcat:7.0.13:*:*:*:*:*:*:*","matchCriteriaId":"05346F5A-FB52-4376-AAC7-9A5308216545"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:tomcat:7.0.14:*:*:*:*:*:*:*","matchCriteriaId":"305688F2-50A6-41FB-8614-BC589DB9A789"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:tomcat:7.0.16:*:*:*:*:*:*:*","matchCriteriaId":"25966344-15D5-4101-9346-B06BFD2DFFF5"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:tomcat:7.0.17:*:*:*:*:*:*:*","matchCriteriaId":"11F4CBAC-27B1-4EFF-955A-A63B457D0578"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:tomcat:7.0.19:*:*:*:*:*:*:*","matchCriteriaId":"0D4F710E-06EA-48F4-AC6A-6F143950F015"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"155AD4FB-E527-4103-BCEF-801B653DEA37"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2011","CveId":"2729","Ordinal":"1","Title":"CVE-2011-2729","CVE":"CVE-2011-2729","Year":"2011"},"notes":[{"CveYear":"2011","CveId":"2729","Ordinal":"1","NoteData":"native/unix/native/jsvc-unix.c in jsvc in the Daemon component 1.0.3 through 1.0.6 in Apache Commons, as used in Apache Tomcat 5.5.32 through 5.5.33, 6.0.30 through 6.0.32, and 7.0.x before 7.0.20 on Linux, does not drop capabilities, which allows remote attackers to bypass read permissions for files via a request to an application.","Type":"Description","Title":"CVE-2011-2729"},{"CveYear":"2011","CveId":"2729","Ordinal":"2","NoteData":"2011-08-15","Type":"Other","Title":"Published"},{"CveYear":"2011","CveId":"2729","Ordinal":"3","NoteData":"2020-02-13","Type":"Other","Title":"Modified"}]}}}