Vulmon Recent Vulnerabilities Research Posts Trends Blog About Contact

icedtea-web vulnerabilities and exploits

(subscribe to this query)
5
CVSSv2
CVE-2015-5236
It exists that the IcedTea-Web used codebase attribute of the <applet> tag on the HTML page that hosts Java applet in the Same Origin Policy (SOP) checks. As the specified codebase does not have to match the applet's actual origin, this allowed malicious site to bypass...
Icedtea-web Project Icedtea-web -
6.8
CVSSv2
CVE-2019-10181
It was found that in icedtea-web up to and including 1.7.2 and 1.8.2 executable code could be injected in a JAR file without compromising the signature verification. An attacker could use this flaw to inject code in a trusted JAR. The code would be executed inside the sandbox.
Icedtea-web Project Icedtea-webIcedtea-web Project Icedtea-web 1.8.2Debian Debian Linux 8.0Opensuse Leap 15.0
6.4
CVSSv2
CVE-2019-10185
It was found that icedtea-web up to and including 1.7.2 and 1.8.2 was vulnerable to a zip-slip attack during auto-extraction of a JAR file. An attacker could use this flaw to write files to arbitrary locations. This could also be used to replace the main running application and, ...
Icedtea-web Project Icedtea-webIcedtea-web Project Icedtea-web 1.8.2Debian Debian Linux 8.0Opensuse Leap 15.0
5.8
CVSSv2
CVE-2019-10182
It was found that icedtea-web though 1.7.2 and 1.8.2 did not properly sanitize paths from <jar/> elements in JNLP files. An attacker could trick a victim into running a specially crafted application and use this flaw to upload arbitrary files to arbitrary locations in the c...
Icedtea-web Project Icedtea-webIcedtea-web Project Icedtea-web 1.8.2Redhat Enterprise Linux Desktop 7.0Redhat Enterprise Linux Workstation 7.0Redhat Enterprise Linux Server 7.0Redhat Enterprise Linux Server Eus 7.6Redhat Enterprise Linux Server Aus 7.6
6.8
CVSSv2
CVE-2015-5234
IcedTea-Web prior to 1.5.3 and 1.6.x prior to 1.6.1 does not properly sanitize applet URLs, which allows remote malicious users to inject applets into the .appletTrustSettings configuration file and bypass user approval to execute the applet via a crafted web page, possibly relat...
Redhat Enterprise Linux Workstation 6.0Redhat Enterprise Linux Desktop 6.0Redhat Enterprise Linux Hpc Node 6.0Redhat Enterprise Linux Server 6.0Opensuse Opensuse 13.1Opensuse Opensuse 13.2Redhat IcedteaRedhat Icedtea 1.6Fedoraproject Fedora 22Fedoraproject Fedora 21
4.3
CVSSv2
CVE-2015-5235
IcedTea-Web prior to 1.5.3 and 1.6.x prior to 1.6.1 does not properly determine the origin of unsigned applets, which allows remote malicious users to bypass the approval process or trick users into approving applet execution via a crafted web page.
Fedoraproject Fedora 21Fedoraproject Fedora 22Redhat Enterprise Linux Server 6.0Redhat Enterprise Linux Desktop 6.0Redhat Enterprise Linux Hpc Node 6Redhat Enterprise Linux Workstation 6.0Opensuse Opensuse 13.2Opensuse Opensuse 13.1Redhat IcedteaRedhat Icedtea 1.6
6.8
CVSSv2
CVE-2011-2514
The Java Network Launching Protocol (JNLP) implementation in IcedTea6 1.9.x prior to 1.9.9 and prior to 1.8.9, and IcedTea-Web 1.1.x prior to 1.1.1 and prior to 1.0.4, allows remote malicious users to trick victims into granting access to local files by modifying the content of t...
Redhat Icedtea-webRedhat Icedtea-web 1.0.2Redhat Icedtea-web 1.0.1Redhat Icedtea-web 1.0Redhat Icedtea-web 1.1Redhat Icedtea6 1.9.5Redhat Icedtea6 1.9.6Redhat Icedtea6 1.9.7Redhat Icedtea6 1.9.8Redhat Icedtea6 1.8.4Redhat Icedtea6 1.8.3Redhat Icedtea6 1.8.2Redhat Icedtea6 1.8.1Redhat Icedtea6 1.9.2Redhat Icedtea6 1.9.4Redhat Icedtea6Redhat Icedtea6 1.8.6Redhat Icedtea6 1.9.1Redhat Icedtea6 1.9.3Redhat Icedtea6 1.8.7Redhat Icedtea6 1.8.5Redhat Icedtea6 1.8
5
CVSSv2
CVE-2011-2513
The Java Network Launching Protocol (JNLP) implementation in IcedTea6 1.9.x prior to 1.9.9 and prior to 1.8.9, and IcedTea-Web 1.1.x prior to 1.1.1 and prior to 1.0.4, allows remote malicious users to obtain the username and full path of the home and cache directories by accessin...
Redhat Icedtea-web 1.1Redhat Icedtea-webRedhat Icedtea-web 1.0.2Redhat Icedtea-web 1.0.1Redhat Icedtea-web 1.0Redhat Icedtea6 1.8.5Redhat Icedtea6 1.8.4Redhat Icedtea6 1.8.3Redhat Icedtea6 1.8.2Redhat Icedtea6 1.9.4Redhat Icedtea6 1.9.5Redhat Icedtea6 1.9.6Redhat Icedtea6 1.9.7Redhat Icedtea6 1.9.1Redhat Icedtea6 1.9.3Redhat Icedtea6 1.9.8Redhat Icedtea6 1.8.7Redhat Icedtea6 1.8Redhat Icedtea6 1.9.2Redhat Icedtea6Redhat Icedtea6 1.8.6Redhat Icedtea6 1.8.1
4.3
CVSSv2
CVE-2011-3377
The web browser plug-in in IcedTea-Web 1.0.x prior to 1.0.6 and 1.1.x prior to 1.1.4 allows remote malicious users to bypass the Same Origin Policy (SOP) and execute arbitrary script or establish network connections to unintended hosts via an applet whose origin has the same seco...
Redhat Icedtea-web 1.1Redhat Icedtea-web 1.1.1Redhat Icedtea-web 1.1.2Redhat Icedtea-web 1.1.3Redhat Icedtea-web 1.0Redhat Icedtea-web 1.0.5Redhat Icedtea-web 1.0.2Redhat Icedtea-web 1.0.4Redhat Icedtea-web 1.0.1Redhat Icedtea-web 1.0.3Canonical Ubuntu Linux 10.04Canonical Ubuntu Linux 10.10Canonical Ubuntu Linux 11.04Opensuse Opensuse 12.1Canonical Ubuntu Linux 11.10
NA
CVE-2013-4349
Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2012-4540. Reason: This candidate was MERGED into CVE-2012-4540, since it was later discovered that it affected an additional version, but it does not constitute a regression error. Notes: All CVE users should ref...
CVSSv2
CVSSv2
CVSSv3
VMScore
Recommendations:
CVE-2024-1183hard-codedCVE-2024-28254CVE-2023-43790buffer overflowbypassCVE-2024-32633CVE-2024-1874CVE-2024-23558
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started

Vulmon Search

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

About

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Products

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Connect

Twitter Reddit Linkedin Facebook