CVE-2010-2227

Published: Jul 13, 2010Modified: Apr 29, 2026

6.4

Vector

AV:N/AC:L/Au:N/C:P/I:N/A:P

Exploitability: 10.0 / Impact: 4.9

Source: NVD

Description

Apache Tomcat 5.5.0 through 5.5.29, 6.0.0 through 6.0.27, and 7.0.0 beta does not properly handle an invalid Transfer-Encoding header, which allows remote attackers to cause a denial of service (application outage) or obtain sensitive information via a crafted header that interferes with "recycling of a buffer."

Affected (55)

Products: Apache: Tomcat

Apache

1 product

Tomcat

Configuration A

30 vulnerable

Vulnerable Software	Affected Versions
Apache Tomcat	Version 5.5.0
Apache Tomcat	Version 5.5.10
Apache Tomcat	Version 5.5.11
Apache Tomcat	Version 5.5.12
Apache Tomcat	Version 5.5.13
Apache Tomcat	Version 5.5.14
Apache Tomcat	Version 5.5.15
Apache Tomcat	Version 5.5.16
Apache Tomcat	Version 5.5.17
Apache Tomcat	Version 5.5.18
Apache Tomcat	Version 5.5.19
Apache Tomcat	Version 5.5.1
Apache Tomcat	Version 5.5.20
Apache Tomcat	Version 5.5.21
Apache Tomcat	Version 5.5.22
Apache Tomcat	Version 5.5.23
Apache Tomcat	Version 5.5.24
Apache Tomcat	Version 5.5.25
Apache Tomcat	Version 5.5.26
Apache Tomcat	Version 5.5.27
Apache Tomcat	Version 5.5.28
Apache Tomcat	Version 5.5.29
Apache Tomcat	Version 5.5.2
Apache Tomcat	Version 5.5.3
Apache Tomcat	Version 5.5.4
Apache Tomcat	Version 5.5.5
Apache Tomcat	Version 5.5.6
Apache Tomcat	Version 5.5.7
Apache Tomcat	Version 5.5.8
Apache Tomcat	Version 5.5.9

Configuration B

24 vulnerable

Vulnerable Software	Affected Versions
Apache Tomcat	Version 6.0.0
Apache Tomcat	Version 6.0.10
Apache Tomcat	Version 6.0.11
Apache Tomcat	Version 6.0.12
Apache Tomcat	Version 6.0.13
Apache Tomcat	Version 6.0.14
Apache Tomcat	Version 6.0.15
Apache Tomcat	Version 6.0.16
Apache Tomcat	Version 6.0.17
Apache Tomcat	Version 6.0.18
Apache Tomcat	Version 6.0.19
Apache Tomcat	Version 6.0.1
Apache Tomcat	Version 6.0.20
Apache Tomcat	Version 6.0.24
Apache Tomcat	Version 6.0.26
Apache Tomcat	Version 6.0.27
Apache Tomcat	Version 6.0.2
Apache Tomcat	Version 6.0.3
Apache Tomcat	Version 6.0.4
Apache Tomcat	Version 6.0.5
Apache Tomcat	Version 6.0.6
Apache Tomcat	Version 6.0.7
Apache Tomcat	Version 6.0.8
Apache Tomcat	Version 6.0.9

Configuration C

1 vulnerable

Vulnerable Software	Affected Versions
Apache Tomcat	Version 7.0.0 beta

Related CWEs

CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

References (96)

http://geronimo.apache.org/21x-security-report.html

Source: secalert@redhat.com

http://geronimo.apache.org/22x-security-report.html

Source: secalert@redhat.com

http://lists.apple.com/archives/Security-announce/2011//Oct/msg00003.html

Source: secalert@redhat.com

http://lists.fedoraproject.org/pipermail/package-announce/2010-November/050207.html

Source: secalert@redhat.com

http://lists.fedoraproject.org/pipermail/package-announce/2010-November/050214.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2010-09/msg00006.html

Source: secalert@redhat.com

http://marc.info/?l=bugtraq&m=129070310906557&w=2

Source: secalert@redhat.com

http://marc.info/?l=bugtraq&m=136485229118404&w=2

Source: secalert@redhat.com

http://marc.info/?l=bugtraq&m=139344343412337&w=2

Source: secalert@redhat.com

http://secunia.com/advisories/40813

Source: secalert@redhat.com

http://secunia.com/advisories/41025

Source: secalert@redhat.com

http://secunia.com/advisories/42079

Source: secalert@redhat.com

http://secunia.com/advisories/42368

Source: secalert@redhat.com

http://secunia.com/advisories/42454

Source: secalert@redhat.com

http://secunia.com/advisories/43310

Source: secalert@redhat.com

http://secunia.com/advisories/44183

Source: secalert@redhat.com

http://secunia.com/advisories/57126

Source: secalert@redhat.com

http://securitytracker.com/id?1024180

Source: secalert@redhat.com

http://support.apple.com/kb/HT5002

Source: secalert@redhat.com

http://svn.apache.org/viewvc?view=revision&revision=958911

Source: secalert@redhat.com

Patch

http://svn.apache.org/viewvc?view=revision&revision=958977

Source: secalert@redhat.com

Patch

http://svn.apache.org/viewvc?view=revision&revision=959428

Source: secalert@redhat.com

Patch

http://tomcat.apache.org/security-5.html

Source: secalert@redhat.com

Vendor Advisory

http://tomcat.apache.org/security-6.html

Source: secalert@redhat.com

Vendor Advisory

http://tomcat.apache.org/security-7.html

Source: secalert@redhat.com

Vendor Advisory

http://www.debian.org/security/2011/dsa-2207

Source: secalert@redhat.com

http://www.mandriva.com/security/advisories?name=MDVSA-2010:176

Source: secalert@redhat.com

http://www.mandriva.com/security/advisories?name=MDVSA-2010:177

Source: secalert@redhat.com

http://www.novell.com/support/viewContent.do?externalId=7007274

Source: secalert@redhat.com

http://www.novell.com/support/viewContent.do?externalId=7007275

Source: secalert@redhat.com

http://www.redhat.com/support/errata/RHSA-2010-0580.html

Source: secalert@redhat.com

http://www.redhat.com/support/errata/RHSA-2010-0581.html

Source: secalert@redhat.com

http://www.redhat.com/support/errata/RHSA-2010-0582.html

Source: secalert@redhat.com

http://www.redhat.com/support/errata/RHSA-2010-0583.html

Source: secalert@redhat.com

http://www.securityfocus.com/archive/1/512272/100/0/threaded

Source: secalert@redhat.com

http://www.securityfocus.com/archive/1/516397/100/0/threaded

Source: secalert@redhat.com

http://www.securityfocus.com/bid/41544

Source: secalert@redhat.com

http://www.vmware.com/security/advisories/VMSA-2011-0003.html

Source: secalert@redhat.com

http://www.vmware.com/support/vsphere4/doc/vsp_vc41_u1_rel_notes.html

Source: secalert@redhat.com

http://www.vupen.com/english/advisories/2010/1986

Source: secalert@redhat.com

http://www.vupen.com/english/advisories/2010/2868

Source: secalert@redhat.com

http://www.vupen.com/english/advisories/2010/3056

Source: secalert@redhat.com

https://exchange.xforce.ibmcloud.com/vulnerabilities/60264

Source: secalert@redhat.com

https://lists.apache.org/thread.html/06cfb634bc7bf37af7d8f760f118018746ad8efbd519c4b789ac9c2e%40%3Cdev.tomcat.apache.org%3E

Source: secalert@redhat.com

https://lists.apache.org/thread.html/8dcaf7c3894d66cb717646ea1504ea6e300021c85bb4e677dc16b1aa%40%3Cdev.tomcat.apache.org%3E

Source: secalert@redhat.com

https://lists.apache.org/thread.html/r3aacc40356defc3f248aa504b1e48e819dd0471a0a83349080c6bcbf%40%3Cdev.tomcat.apache.org%3E

Source: secalert@redhat.com

https://lists.apache.org/thread.html/r584a714f141eff7b1c358d4679288177bd4ca4558e9999d15867d4b5%40%3Cdev.tomcat.apache.org%3E

Source: secalert@redhat.com

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18532

Source: secalert@redhat.com

http://geronimo.apache.org/21x-security-report.html