CVE-2011-2729: Apache Commons Daemon

Medium severity, CVSS 5.0. EPSS: 7.2% chance of exploitation in the next 30 days.

native/unix/native/jsvc-unix.c in jsvc in the Daemon component 1.0.3 through 1.0.6 in Apache Commons, as used in Apache Tomcat 5.5.32 through 5.5.33, 6.0.30 through 6.0.32, and 7.0.x before 7.0.20 on Linux, does not drop capabilities, which allows remote attackers to bypass read permissions for files via a request to an application.

Affected products

• Apache Apache Commons Daemon: version 1.0.3 only; version 1.0.4 only; version 1.0.5 only; version 1.0.6 only
• Apache Tomcat: version 5.5.32 only; version 5.5.33 only; version 6.0.30 only; version 6.0.31 only; version 6.0.32 only; version 7.0.0 only; …

Published 2011-08-15. Last modified 2026-06-16.