CVE-2007-0774

NameCVE-2007-0774
DescriptionStack-based buffer overflow in the map_uri_to_worker function (native/common/jk_uri_worker_map.c) in mod_jk.so for Apache Tomcat JK Web Server Connector 1.2.19 and 1.2.20, as used in Tomcat 4.1.34 and 5.5.20, allows remote attackers to execute arbitrary code via a long URL that triggers the overflow in a URI worker map routine.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
libapache-mod-jk (PTS)buster1:1.2.46-1+deb10u1fixed
buster (security)1:1.2.46-1+deb10u2fixed
bullseye1:1.2.48-1+deb11u1fixed
bookworm1:1.2.48-2+deb12u1fixed
sid, trixie1:1.2.49-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
libapache-mod-jksourcesarge(not affected)
libapache-mod-jksourceetch(not affected)
libapache-mod-jksource(unstable)1:1.2.21-1medium

Notes

affects only 1.2.19 and 1.2.20

Search for package or bug name: Reporting problems