CVE-2011-2729
native/unix/native/jsvc-unix.c in jsvc in the Daemon component 1.0.3 through 1.0.6 in Apache...
native/unix/native/jsvc-unix.c in jsvc in the Daemon component 1.0.3 through 1.0.6 in Apache Commons, as used in Apache Tomcat 5.5.32 through 5.5.33, 6.0.30 through 6.0.32, and 7.0.x before 7.0.20 on Linux, does not drop capabilities, which allows remote attackers to bypass read permissions for files via a request to an application.
Exploit likelihood
What each source reports
NVD Score used
native/unix/native/jsvc-unix.c in jsvc in the Daemon component 1.0.3 through 1.0.6 in Apache Commons, as used in Apache Tomcat 5.5.32 through 5.5.33, 6.0.30 through 6.0.32, and 7.0.x before 7.0.20 on Linux, does not drop capabilities, which allows remote attackers to bypass read permissions for files via a request to an application.
- Record
CVE-2011-2729- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:P/I:N/A:N - Weakness
- CWE-264
- Updated
- 2026-11-02
CVE List No score
native/unix/native/jsvc-unix.c in jsvc in the Daemon component 1.0.3 through 1.0.6 in Apache Commons, as used in Apache Tomcat 5.5.32 through 5.5.33, 6.0.30 through 6.0.32, and 7.0.x before 7.0.20 on Linux, does not drop capabilities, which allows remote attackers to bypass read permissions for files via a request to an application.
- Record
CVE-2011-2729- Updated
- 2026-11-02
EUVDEUVD-2011-2707 No score
native/unix/native/jsvc-unix.c in jsvc in the Daemon component 1.0.3 through 1.0.6 in Apache Commons, as used in Apache Tomcat 5.5.32 through 5.5.33, 6.0.30 through 6.0.32, and 7.0.x before 7.0.20 on Linux, does not drop capabilities, which allows remote attackers to bypass read permissions for files via a request to an application.
- Record
EUVD-2011-2707- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-7mg3-pr99-8rh7 No score
native/unix/native/jsvc-unix.c in jsvc in the Daemon component 1.0.3 through 1.0.6 in Apache...
native/unix/native/jsvc-unix.c in jsvc in the Daemon component 1.0.3 through 1.0.6 in Apache Commons, as used in Apache Tomcat 5.5.32 through 5.5.33, 6.0.30 through 6.0.32, and 7.0.x before 7.0.20 on Linux, does not drop capabilities, which allows remote attackers to bypass read permissions for files via a request to an application.
- Record
GHSA-7mg3-pr99-8rh7- Updated
- 2026-11-02
OSV No score
native/unix/native/jsvc-unix.c in jsvc in the Daemon component 1.0.3 through 1.0.6 in Apache Commons, as used in Apache Tomcat 5.5.32 through 5.5.33, 6.0.30 through 6.0.32, and 7.0.x before 7.0.20 on Linux, does not drop capabilities, which allows remote attackers to bypass read permissions for files via a request to an application.
- Record
CVE-2011-2729- Updated
- 2026-11-02
OSVDEBIAN-CVE-2011-2729 No score
native/unix/native/jsvc-unix.c in jsvc in the Daemon component 1.0.3 through 1.0.6 in Apache Commons, as used in Apache Tomcat 5.5.32 through 5.5.33, 6.0.30 through 6.0.32, and 7.0.x before 7.0.20 on Linux, does not drop capabilities, which allows remote attackers to bypass read permissions for files via a request to an application.
- Record
DEBIAN-CVE-2011-2729- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10167-1 No score
apache-commons-daemon-1.0.15-7.7 on GA media
These are all security issues fixed in the apache-commons-daemon-1.0.15-7.7 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10167-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
commons-daemonDebian:12 |
before 1.0.7-1 | 1.0.7-1 |
commons-daemonDebian:13 |
before 1.0.7-1 | 1.0.7-1 |
commons-daemonDebian:14 |
before 1.0.7-1 | 1.0.7-1 |
jakarta-commons-daemon-jsvcRed Hat:jboss_enterprise_web_server:1::el4 |
before 1:1.0.5-1.5.patch01.ep5.el4 | 1:1.0.5-1.5.patch01.ep5.el4 |
jakarta-commons-daemon-jsvc-debuginfoRed Hat:jboss_enterprise_web_server:1::el4 |
before 1:1.0.5-1.5.patch01.ep5.el4 | 1:1.0.5-1.5.patch01.ep5.el4 |
apache-commons-daemonopenSUSE:Tumbleweed |
before 1.0.15-7.7 | 1.0.15-7.7 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2011-2729 is a medium vulnerability (CVSS 5.0) in Apache Tomcat, published August 15, 2011. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 7.24%, the 94th percentile. Fixed in commons-daemon 1.0.7-1.
References
exchange.xforce.ibmcloud.com/vulnerabilities/69161
lists.opensuse.org/opensuse-security-announce/2011-09/msg00024.html
svn.apache.org/viewvc?view=revision&revision=1153824
marc.info?l=bugtraq&m=136485229118404&w=2
securitytracker.com/id?1025925
people.apache.org/~markt/patches/2011-08-12-cve2011-2729-tc5.patch
Show 39 moreShow less
tomcat.apache.org/security-7.html
bugzilla.redhat.com/show_bug.cgi?id=730400
redhat.com/support/errata/RHSA-2011-1291.html
securityfocus.com/archive/1/519263/100/0/threaded
secunia.com/advisories/57126
mail-archives.apache.org/mod_mbox/commons-dev/201108.mbox/%3C4E451B2B.9090108%40apache.org%3E
issues.apache.org/jira/browse/DAEMON-214
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19450
lists.apache.org/thread.html/06cfb634bc7bf37af7d8f760f118018746ad8efbd519c4b789ac9c2e%40%3Cdev.tomcat.apache.org%3E
nvd.nist.gov/vuln/detail/CVE-2011-2729
github.com/advisories/GHSA-7mg3-pr99-8rh7
security-tracker.debian.org/tracker/CVE-2011-2729
access.redhat.com/errata/RHSA-2011:1292
security.access.redhat.com/data/csaf/v2/advisories/2011/rhsa-2011_1292.json
cve.org/CVERecord?id=CVE-2011-2729
suse.com/security/cve/CVE-2011-2729