CVE-2010-3718

14

FAUCET Score

CVE-2010-3718 describes a directory traversal vulnerability in Apache Tomcat versions 7.0.0 through 7.0.3, 6.0.x, and 5.5.x, specifically when operating with a SecurityManager. This flaw allows local web applications to read or write files outside their designated working directory due to the ServletContext attribute not being read-only. The vulnerability has a low severity CVSS score (AV:L/AC:H/Au:N/C:N/I:P/A:N), indicating local access and high attack complexity are required for a partial impact on integrity. There is no evidence of active exploitation, public exploit code, or significant community discussion surrounding this CVE.

Impacted Technologies

Vendor	Product	Version(s)	CPE
		7.0.0CPE matchmatch criteria	cpe:2.3:a:apache:tomcat:7.0.0:::::::*
		7.0.1CPE matchmatch criteria	cpe:2.3:a:apache:tomcat:7.0.1:::::::*
		7.0.2CPE matchmatch criteria	cpe:2.3:a:apache:tomcat:7.0.2:::::::*
		7.0.3CPE matchmatch criteria	cpe:2.3:a:apache:tomcat:7.0.3:::::::*
		6.0CPE matchmatch criteria	cpe:2.3:a:apache:tomcat:6.0:::::::*

CVSS Data

CVSS version used by this source: 2.0

1.2LOW

AV:L/AC:H/Au:N/C:N/I:P/A:N

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

Access Vector

LOCAL

Access Complexity

HIGH

Authentication

NONE

Exploitability Score

1.9

Impact Score

2.9

CvssVersion

2.0

Exploit Intelligence

EPSS Score

1.35%

Probability of exploitation in next 30 days

EPSS Percentile

68.7%

Percentile rank of EPSS score among Peer Group

As of 2026-07-28

Model: v2026.06.15

This CVE's current EPSS score of 0.0135 is in the 97th percentile among its peer group of 747 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.0 Bluesky, 0.0 Mastodon, and 0.2 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (159)

mavenpatch availablevia ghsa

Product: org.apache.tomcat:tomcatFixed in: 7.0.4

mavenpatch availablevia ghsa

Product: org.apache.tomcat:tomcatFixed in: 6.0.30

mavenpatch availablevia ghsa

Product: org.apache.tomcat:tomcatFixed in: 5.5.30

redhatpatch availablevia redhat_api

Product: JBEWS 1.0 for RHEL 4Fixed in: ant-0:1.7.1-13.jdk6.ep5.el4

redhatpatch availablevia redhat_api

Product: JBEWS 1.0 for RHEL 4Fixed in: antlr-0:2.7.7-7.ep5.el4

redhatpatch availablevia redhat_api

Product: JBEWS 1.0 for RHEL 4Fixed in: bcel-0:5.2-8.1.ep5.el4

redhatpatch availablevia redhat_api

Product: JBEWS 1.0 for RHEL 4Fixed in: cglib-0:2.2-5.1.1.jdk6.ep5.el4

redhatpatch availablevia redhat_api

Product: JBEWS 1.0 for RHEL 4Fixed in: dom4j-0:1.6.1-11.ep5.el4

redhatpatch availablevia redhat_api

Product: JBEWS 1.0 for RHEL 4Fixed in: ecj-1:3.3.1.1-3.2.2.jdk6.ep5.el4

redhatpatch availablevia redhat_api

Product: JBEWS 1.0 for RHEL 4Fixed in: glassfish-jaf-0:1.1.0-6.1.1.jdk6.ep5.el4

redhatpatch availablevia redhat_api

Product: JBEWS 1.0 for RHEL 4Fixed in: glassfish-javamail-0:1.4.2-0.4.ep5.el4

redhatpatch availablevia redhat_api

Product: JBEWS 1.0 for RHEL 4Fixed in: glassfish-jsf-0:1.2_13-2.2.1.jdk6.ep5.el4

redhatpatch availablevia redhat_api

Product: JBEWS 1.0 for RHEL 4Fixed in: hibernate3-1:3.3.2-1.5.GA_CP04.ep5.el4

redhatpatch availablevia redhat_api

Product: JBEWS 1.0 for RHEL 4Fixed in: hibernate3-annotations-0:3.4.0-3.3.GA_CP04.ep5.el4

redhatpatch availablevia redhat_api

Product: JBEWS 1.0 for RHEL 4Fixed in: hibernate3-commons-annotations-0:3.1.0-1.8.ep5.el4

redhatpatch availablevia redhat_api

Product: JBEWS 1.0 for RHEL 4Fixed in: hibernate3-ejb-persistence-3.0-api-1:1.0.2-3.jdk6.ep5.el4

redhatpatch availablevia redhat_api

Product: JBEWS 1.0 for RHEL 4Fixed in: hibernate3-entitymanager-0:3.4.0-4.3.GA_CP04.ep5.el4

redhatpatch availablevia redhat_api

Product: JBEWS 1.0 for RHEL 4Fixed in: httpd22-0:2.2.17-14.ep5.el4

redhatpatch availablevia redhat_api

Product: JBEWS 1.0 for RHEL 4Fixed in: jakarta-commons-beanutils-0:1.8.0-4.1.1.jdk6.ep5.el4

redhatpatch availablevia redhat_api

Product: JBEWS 1.0 for RHEL 4Fixed in: jakarta-commons-chain-0:1.2-2.2.ep5.el4

redhatpatch availablevia redhat_api

Product: JBEWS 1.0 for RHEL 4Fixed in: jakarta-commons-codec-0:1.3-9.1.1.jdk6.ep5.el4

redhatpatch availablevia redhat_api

Product: JBEWS 1.0 for RHEL 4Fixed in: jakarta-commons-collections-0:3.2.1-4.ep5.el4

redhatpatch availablevia redhat_api

Product: JBEWS 1.0 for RHEL 4Fixed in: jakarta-commons-daemon-1:1.0.5-1.ep5.el4

redhatpatch availablevia redhat_api

Product: JBEWS 1.0 for RHEL 4Fixed in: jakarta-commons-daemon-jsvc-1:1.0.5-1.4.ep5.el4

redhatpatch availablevia redhat_api

Product: JBEWS 1.0 for RHEL 4Fixed in: jakarta-commons-dbcp-0:1.2.1-16.4.ep5.el4

redhatpatch availablevia redhat_api

Product: JBEWS 1.0 for RHEL 4Fixed in: jakarta-commons-digester-0:1.8.1-8.1.jdk6.ep5.el4

redhatpatch availablevia redhat_api

Product: JBEWS 1.0 for RHEL 4Fixed in: jakarta-commons-el-0:1.0-19.2.jdk6.ep5.el4

redhatpatch availablevia redhat_api

Product: JBEWS 1.0 for RHEL 4Fixed in: jakarta-commons-fileupload-1:1.1.1-7.4.ep5.el4

redhatpatch availablevia redhat_api

Product: JBEWS 1.0 for RHEL 4Fixed in: jakarta-commons-httpclient-1:3.1-1.1.1.jdk6.ep5.el4

redhatpatch availablevia redhat_api

Product: JBEWS 1.0 for RHEL 4Fixed in: jakarta-commons-io-0:1.4-1.3.1.jdk6.ep5.el4

redhatpatch availablevia redhat_api

Product: JBEWS 1.0 for RHEL 4Fixed in: jakarta-commons-launcher-0:1.1-4.6.1.ep5.el4

redhatpatch availablevia redhat_api

Product: JBEWS 1.0 for RHEL 4Fixed in: jakarta-commons-logging-0:1.1.1-0.4.1.jdk6.ep5.el4

redhatpatch availablevia redhat_api

Product: JBEWS 1.0 for RHEL 4Fixed in: jakarta-commons-logging-jboss-0:1.1-10.2.1.jdk6.ep5.el4

redhatpatch availablevia redhat_api

Product: JBEWS 1.0 for RHEL 4Fixed in: jakarta-commons-modeler-0:2.0-4.ep5.el4

redhatpatch availablevia redhat_api

Product: JBEWS 1.0 for RHEL 4Fixed in: jakarta-commons-pool-0:1.3-11.2.1.jdk6.ep5.el4

redhatpatch availablevia redhat_api

Product: JBEWS 1.0 for RHEL 4Fixed in: jakarta-commons-validator-0:1.3.1-7.5.1.ep5.el4

redhatpatch availablevia redhat_api

Product: JBEWS 1.0 for RHEL 4Fixed in: jakarta-oro-0:2.0.8-3.3.2.1.jdk6.ep5.el4

redhatpatch availablevia redhat_api

Product: JBEWS 1.0 for RHEL 4Fixed in: jakarta-taglibs-standard-0:1.1.1-9.ep5.el4

redhatpatch availablevia redhat_api

Product: JBEWS 1.0 for RHEL 4Fixed in: javassist-0:3.12.0-1.jdk6.ep5.el4

redhatpatch availablevia redhat_api

Product: JBEWS 1.0 for RHEL 4Fixed in: jboss-common-core-0:2.2.17-1.ep5.el4

redhatpatch availablevia redhat_api

Product: JBEWS 1.0 for RHEL 4Fixed in: jboss-common-logging-jdk-0:2.1.2-1.ep5.el4

redhatpatch availablevia redhat_api

Product: JBEWS 1.0 for RHEL 4Fixed in: jboss-common-logging-spi-0:2.1.2-1.ep5.el4

redhatpatch availablevia redhat_api

Product: JBEWS 1.0 for RHEL 4Fixed in: jboss-javaee-0:5.0.1-2.9.ep5.el4

redhatpatch availablevia redhat_api

Product: JBEWS 1.0 for RHEL 4Fixed in: jcommon-0:1.0.16-1.2.1.jdk6.ep5.el4

redhatpatch availablevia redhat_api

Product: JBEWS 1.0 for RHEL 4Fixed in: jfreechart-0:1.0.13-2.3.2.1.jdk6.ep5.el4

redhatpatch availablevia redhat_api

Product: JBEWS 1.0 for RHEL 4Fixed in: log4j-0:1.2.14-18.1.jdk6.ep5.el4

redhatpatch availablevia redhat_api

Product: JBEWS 1.0 for RHEL 4Fixed in: mod_cluster-0:1.0.10-2.GA_CP01.ep5.el4

redhatpatch availablevia redhat_api

Product: JBEWS 1.0 for RHEL 4Fixed in: mod_cluster-native-0:1.0.10-2.GA_CP01.ep5.el4

redhatpatch availablevia redhat_api

Product: JBEWS 1.0 for RHEL 4Fixed in: mod_jk-0:1.2.31-1.ep5.el4

redhatpatch availablevia redhat_api

Product: JBEWS 1.0 for RHEL 4Fixed in: mx4j-1:3.0.1-9.3.4.ep5.el4

redhatpatch availablevia redhat_api

Product: JBEWS 1.0 for RHEL 4Fixed in: objectweb-asm-0:3.1-5.3.1.jdk6.ep5.el4

redhatpatch availablevia redhat_api

Product: JBEWS 1.0 for RHEL 4Fixed in: regexp-0:1.5-1.2.1.jdk6.ep5.el4

redhatpatch availablevia redhat_api

Product: JBEWS 1.0 for RHEL 4Fixed in: struts12-0:1.2.9-3.ep5.el4

redhatpatch availablevia redhat_api

Product: JBEWS 1.0 for RHEL 4Fixed in: tomcat5-0:5.5.33-14_patch_04.ep5.el4

redhatpatch availablevia redhat_api

Product: JBEWS 1.0 for RHEL 4Fixed in: tomcat6-0:6.0.32-15_patch_03.ep5.el4

redhatpatch availablevia redhat_api

Product: JBEWS 1.0 for RHEL 4Fixed in: tomcat-jkstatus-ant-0:1.2.31-2.ep5.el4

redhatpatch availablevia redhat_api

Product: JBEWS 1.0 for RHEL 4Fixed in: tomcat-native-0:1.1.20-2.0.ep5.el4

redhatpatch availablevia redhat_api

Product: JBEWS 1.0 for RHEL 4Fixed in: xalan-j2-0:2.7.1-5.3_patch_04.ep5.el4

redhatpatch availablevia redhat_api

Product: JBEWS 1.0 for RHEL 4Fixed in: xerces-j2-0:2.9.1-3.patch01.1.ep5.el4

redhatpatch availablevia redhat_api

Product: JBEWS 1.0 for RHEL 4Fixed in: xml-commons-1:1.3.04-7.12.ep5.el4

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 5Fixed in: tomcat5-0:5.5.23-0jpp.22.el5_7

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 6Fixed in: tomcat6-0:6.0.24-33.el6

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 1 for RHEL 5Fixed in: ant-0:1.7.1-13.jdk6.ep5.el5

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 1 for RHEL 5Fixed in: antlr-0:2.7.7-7.ep5.el5

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 1 for RHEL 5Fixed in: cglib-0:2.2-5.1.1.1.jdk6.ep5.el5

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 1 for RHEL 5Fixed in: dom4j-0:1.6.1-11.ep5.el5

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 1 for RHEL 5Fixed in: ecj3-1:3.3.1.1-3.1.1.1.jdk6.ep5.el5

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 1 for RHEL 5Fixed in: glassfish-jsf-0:1.2_13-3.1.1.jdk6.ep5.el5

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 1 for RHEL 5Fixed in: hibernate3-1:3.3.2-1.4.GA_CP04.ep5.el5

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 1 for RHEL 5Fixed in: hibernate3-annotations-0:3.4.0-3.2.GA_CP04.ep5.el5

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 1 for RHEL 5Fixed in: hibernate3-commons-annotations-0:3.1.0-1.8.ep5.el5

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 1 for RHEL 5Fixed in: hibernate3-ejb-persistence-3.0-api-1:1.0.2-3.1.jdk6.ep5.el5

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 1 for RHEL 5Fixed in: hibernate3-entitymanager-0:3.4.0-4.3.GA_CP04.ep5.el5

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 1 for RHEL 5Fixed in: httpd-0:2.2.17-11.1.ep5.el5

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 1 for RHEL 5Fixed in: jakarta-commons-beanutils-0:1.8.0-4.1.2.1.jdk6.ep5.el5

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 1 for RHEL 5Fixed in: jakarta-commons-chain-0:1.2-2.2.1.ep5.el5

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 1 for RHEL 5Fixed in: jakarta-commons-codec-0:1.3-9.2.1.1.jdk6.ep5.el5

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 1 for RHEL 5Fixed in: jakarta-commons-collections-0:3.2.1-4.1.ep5.el5

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 1 for RHEL 5Fixed in: jakarta-commons-daemon-1:1.0.5-1.ep5.el5

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 1 for RHEL 5Fixed in: jakarta-commons-daemon-jsvc-1:1.0.5-1.4.ep5.el5

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 1 for RHEL 5Fixed in: jakarta-commons-dbcp-0:1.2.1-16.4.ep5.el5

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 1 for RHEL 5Fixed in: jakarta-commons-digester-0:1.8.1-8.1.jdk6.ep5.el5

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 1 for RHEL 5Fixed in: jakarta-commons-fileupload-1:1.1.1-7.4.ep5.el5

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 1 for RHEL 5Fixed in: jakarta-commons-httpclient-1:3.1-1.2.1.jdk6.ep5.el5

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 1 for RHEL 5Fixed in: jakarta-commons-io-0:1.4-1.3.1.jdk6.ep5.el5

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 1 for RHEL 5Fixed in: jakarta-commons-logging-0:1.1.1-0.4.1.jdk6.ep5.el5

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 1 for RHEL 5Fixed in: jakarta-commons-logging-jboss-0:1.1-10.2.1.jdk6.ep5.el5

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 1 for RHEL 5Fixed in: jakarta-commons-pool-0:1.3-11.2.1.jdk6.ep5.el5

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 1 for RHEL 5Fixed in: jakarta-commons-validator-0:1.3.1-7.5.2.ep5.el5

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 1 for RHEL 5Fixed in: jakarta-oro-0:2.0.8-3.3.2.1.1.1.jdk6.ep5.el5

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 1 for RHEL 5Fixed in: jakarta-taglibs-standard-0:1.1.1-9.1.ep5.el5

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 1 for RHEL 5Fixed in: javassist-0:3.12.0-1.jdk6.ep5.el5

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 1 for RHEL 5Fixed in: jboss-common-core-0:2.2.17-1.ep5.el5

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 1 for RHEL 5Fixed in: jboss-common-logging-jdk-0:2.1.2-1.ep5.el5

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 1 for RHEL 5Fixed in: jboss-common-logging-spi-0:2.1.2-1.ep5.el5

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 1 for RHEL 5Fixed in: jboss-javaee-0:5.0.1-2.9.ep5.el5

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 1 for RHEL 5Fixed in: jcommon-0:1.0.16-1.2.1.jdk6.ep5.el5

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 1 for RHEL 5Fixed in: jfreechart-0:1.0.13-2.3.2.1.jdk6.ep5.el5

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 1 for RHEL 5Fixed in: mod_cluster-0:1.0.10-2.1.GA_CP01.ep5.el5

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 1 for RHEL 5Fixed in: mod_cluster-native-0:1.0.10-2.1.GA_CP01.ep5.el5

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 1 for RHEL 5Fixed in: mod_jk-0:1.2.31-1.1.ep5.el5

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 1 for RHEL 5Fixed in: objectweb-asm-0:3.1-5.3.1.jdk6.ep5.el5

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 1 for RHEL 5Fixed in: struts12-0:1.2.9-3.1.ep5.el5

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 1 for RHEL 5Fixed in: tomcat5-0:5.5.33-16_patch_04.ep5.el5

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 1 for RHEL 5Fixed in: tomcat6-0:6.0.32-15.1_patch_03.ep5.el5

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 1 for RHEL 5Fixed in: tomcat-jkstatus-ant-0:1.2.31-2.ep5.el5

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 1 for RHEL 5Fixed in: tomcat-native-0:1.1.20-2.1.ep5.el5

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 1 for RHEL 5Fixed in: xalan-j2-0:2.7.1-5.3_patch_04.ep5.el5

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 1 for RHEL 5Fixed in: xerces-j2-0:2.9.1-3.patch01.1.ep5.el5

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 1 for RHEL 5Fixed in: xml-commons-0:1.3.04-7.10.jdk6.ep5.el5

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 1 for RHEL 6Fixed in: ant-0:1.7.1-14.ep5.el6

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 1 for RHEL 6Fixed in: antlr-0:2.7.7-7.ep5.el6

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 1 for RHEL 6Fixed in: cglib-0:2.2-5.4.ep5.el6

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 1 for RHEL 6Fixed in: dom4j-0:1.6.1-11.1.ep5.el6

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 1 for RHEL 6Fixed in: ecj3-1:3.3.1.1-4.ep5.el6

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 1 for RHEL 6Fixed in: glassfish-jsf-0:1.2_13-3.1.4.ep5.el6

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 1 for RHEL 6Fixed in: hibernate3-1:3.3.2-1.8.GA_CP04.ep5.el6

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 1 for RHEL 6Fixed in: hibernate3-annotations-0:3.4.0-3.5.GA_CP04.ep5.el6

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 1 for RHEL 6Fixed in: hibernate3-commons-annotations-0:3.1.0-1.8.ep5.el6

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 1 for RHEL 6Fixed in: hibernate3-ejb-persistence-3.0-api-1:1.0.2-3.3.ep5.el6

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 1 for RHEL 6Fixed in: hibernate3-entitymanager-0:3.4.0-4.4.GA_CP04.ep5.el6

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 1 for RHEL 6Fixed in: httpd-0:2.2.17-11.2.ep5.el6

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 1 for RHEL 6Fixed in: jakarta-commons-beanutils-0:1.8.0-9.ep5.el6

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 1 for RHEL 6Fixed in: jakarta-commons-chain-0:1.2-2.2.2.ep5.el6

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 1 for RHEL 6Fixed in: jakarta-commons-codec-0:1.3-12.1.ep5.el6

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 1 for RHEL 6Fixed in: jakarta-commons-collections-0:3.2.1-4.ep5.el6

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 1 for RHEL 6Fixed in: jakarta-commons-daemon-1:1.0.5-1.1.ep5.el6

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 1 for RHEL 6Fixed in: jakarta-commons-daemon-jsvc-1:1.0.5-1.4.ep5.el6

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 1 for RHEL 6Fixed in: jakarta-commons-dbcp-0:1.2.1-16.2.ep5.el6

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 1 for RHEL 6Fixed in: jakarta-commons-digester-0:1.8.1-8.1.1.1.ep5.el6

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 1 for RHEL 6Fixed in: jakarta-commons-fileupload-1:1.1.1-7.5.ep5.el6

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 1 for RHEL 6Fixed in: jakarta-commons-httpclient-1:3.1-1.2.2.ep5.el6

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 1 for RHEL 6Fixed in: jakarta-commons-io-0:1.4-4.ep5.el6

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 1 for RHEL 6Fixed in: jakarta-commons-logging-0:1.1.1-1.ep5.el6

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 1 for RHEL 6Fixed in: jakarta-commons-logging-jboss-0:1.1-10.2.2.1.ep5.el6

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 1 for RHEL 6Fixed in: jakarta-commons-pool-0:1.3-15.ep5.el6

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 1 for RHEL 6Fixed in: jakarta-commons-validator-0:1.3.1-7.5.2.ep5.el6

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 1 for RHEL 6Fixed in: jakarta-oro-0:2.0.8-7.ep5.el6

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 1 for RHEL 6Fixed in: jakarta-taglibs-standard-0:1.1.1-12.ep5.el6

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 1 for RHEL 6Fixed in: javassist-0:3.12.0-3.ep5.el6

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 1 for RHEL 6Fixed in: jboss-common-core-0:2.2.17-1.2.ep5.el6

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 1 for RHEL 6Fixed in: jboss-common-logging-jdk-0:2.1.2-1.2.ep5.el6

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 1 for RHEL 6Fixed in: jboss-common-logging-spi-0:2.1.2-1.ep5.el6

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 1 for RHEL 6Fixed in: jboss-javaee-0:5.0.1-2.9.ep5.el6

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 1 for RHEL 6Fixed in: jcommon-0:1.0.16-1.2.2.ep5.el6

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 1 for RHEL 6Fixed in: jfreechart-0:1.0.13-2.3.2.1.2.ep5.el6

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 1 for RHEL 6Fixed in: mod_cluster-0:1.0.10-2.2.GA_CP01.ep5.el6

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 1 for RHEL 6Fixed in: mod_cluster-native-0:1.0.10-2.1.1.GA_CP01.ep5.el6

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 1 for RHEL 6Fixed in: mod_jk-0:1.2.31-1.1.2.ep5.el6

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 1 for RHEL 6Fixed in: objectweb-asm31-0:3.1-12.1.ep5.el6

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 1 for RHEL 6Fixed in: struts12-0:1.2.9-3.1.ep5.el6

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 1 for RHEL 6Fixed in: tomcat5-0:5.5.33-15_patch_04.ep5.el6

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 1 for RHEL 6Fixed in: tomcat6-0:6.0.32-14_patch_03.ep5.el6

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 1 for RHEL 6Fixed in: tomcat-jkstatus-ant-0:1.2.31-2.1.ep5.el6

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 1 for RHEL 6Fixed in: tomcat-native-0:1.1.20-2.1.2.ep5.el6

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 1 for RHEL 6Fixed in: xalan-j2-0:2.7.1-5.3_patch_04.ep5.el6

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 1 for RHEL 6Fixed in: xerces-j2-0:2.9.1-8.patch01.1.ep5.el6

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 1 for RHEL 6Fixed in: xml-commons-0:1.3.04-7.14.ep5.el6

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Web Server 1.0

Vendor Advisories (2)

mavenGHSA-fj6c-prgj-gr3rlow

Improper Limitation of a Pathname to a Restricted Directory in Apache Tomcat

redhatCVE-2010-3718Moderate

tomcat: file permission bypass flaw

References

lists.apple.com / archives/Security-announce/2011//Oct/msg00003.html

lists.opensuse.org / opensuse-security-announce/2011-04/msg00000.html

secunia.com / advisories/43192

Vendor Advisory

secunia.com / advisories/45022

secunia.com / advisories/57126

securityreason.com / securityalert/8072

exchange.xforce.ibmcloud.com / vulnerabilities/65159

lists.apache.org / thread.html/06cfb634bc7bf37af7d8f760f118018746ad8efbd519c4b789ac9c2e%40%3Cdev.tomcat.apache.org%3E

lists.apache.org / thread.html/8dcaf7c3894d66cb717646ea1504ea6e300021c85bb4e677dc16b1aa%40%3Cdev.tomcat.apache.org%3E

lists.apache.org / thread.html/r3aacc40356defc3f248aa504b1e48e819dd0471a0a83349080c6bcbf%40%3Cdev.tomcat.apache.org%3E

lists.apache.org / thread.html/r584a714f141eff7b1c358d4679288177bd4ca4558e9999d15867d4b5%40%3Cdev.tomcat.apache.org%3E

oval.cisecurity.org / repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12517

oval.cisecurity.org / repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A13969

oval.cisecurity.org / repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19379

support.apple.com / kb/HT5002

support.novell.com / docs/Readmes/InfoDocument/patchbuilder/readme_5098550.html

tomcat.apache.org / security-5.html

Vendor Advisory

tomcat.apache.org / security-6.html

Vendor Advisory

tomcat.apache.org / security-7.html

Vendor Advisory

debian.org / security/2011/dsa-2160

mandriva.com / security/advisories

redhat.com / support/errata/RHSA-2011-0791.html

redhat.com / support/errata/RHSA-2011-0896.html

redhat.com / support/errata/RHSA-2011-0897.html

redhat.com / support/errata/RHSA-2011-1845.html

securityfocus.com / archive/1/516211/100/0/threaded

securityfocus.com / bid/46177

securitytracker.com / id