Published: 20/01/2011 Updated: 13/02/2023

CVSS v2 Base Score: 6.8 | Impact Score: 6.4 | Exploitability Score: 8.6

VMScore: 605

Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P

The JNLP SecurityManager in IcedTea (IcedTea.so) 1.7 prior to 1.7.7, 1.8 prior to 1.8.4, and 1.9 prior to 1.9.4 for Java OpenJDK returns from the checkPermission method instead of throwing an exception in certain circumstances, which might allow context-dependent malicious users to bypass the intended security policy by creating instances of ClassLoader.

Vulnerable Product	Search on Vulmon	Subscribe to Product
redhat icedtea 1.7
redhat icedtea 1.7.1
redhat icedtea 1.7.2
redhat icedtea 1.7.3
redhat icedtea 1.7.4
redhat icedtea 1.7.5
redhat icedtea 1.7.6
redhat icedtea 1.8
redhat icedtea 1.8.1
redhat icedtea 1.8.2
redhat icedtea 1.8.3
redhat icedtea 1.9
redhat icedtea 1.9.1
redhat icedtea 1.9.2
redhat icedtea 1.9.3

It was discovered that the JNLP SecurityManager in IcedTea for Java OpenJDK in some instances failed to properly apply the intended scurity policy in its checkPermission method This could allow an attacker execute code with privileges that should have been prevented (CVE-2010-4351) ...

It was discovered that IcedTea for Java did not properly verify signatures when handling multiply signed or partially signed JAR files, allowing an attacker to cause code to execute that appeared to come from a verified source (CVE-2011-0025) ...

Several security vulnerabilities were discovered in OpenJDK, an implementation of the Java platform CVE-2010-4351 The JNLP SecurityManager returns from the checkPermission method instead of throwing an exception in certain circumstances, which might allow context-dependent attackers to bypass the intended security policy by creati ...

CWE-264 https://bugzilla.redhat.com/show_bug.cgi?id=663680 http://www.zerodayinitiative.com/advisories/ZDI-11-014/http://www.securityfocus.com/bid/45894 http://blog.fuseyism.com/index.php/2011/01/18/security-icedtea6-177-184-194-released/http://www.vupen.com/english/advisories/2011/0166 http://lists.fedoraproject.org/pipermail/package-announce/2011-January/053276.html http://www.vupen.com/english/advisories/2011/0165 http://osvdb.org/70605 http://secunia.com/advisories/43002 http://lists.fedoraproject.org/pipermail/package-announce/2011-January/053288.html http://www.redhat.com/support/errata/RHSA-2011-0176.html http://www.vupen.com/english/advisories/2011/0215 http://secunia.com/advisories/43085 http://www.ubuntu.com/usn/USN-1052-1 http://secunia.com/advisories/43078 http://www.vupen.com/english/advisories/2011/0239 http://www.ubuntu.com/usn/USN-1055-1 http://secunia.com/advisories/43135 http://www.debian.org/security/2011/dsa-2224 http://www.mandriva.com/security/advisories?name=MDVSA-2011:054 http://security.gentoo.org/glsa/glsa-201406-32.xml https://exchange.xforce.ibmcloud.com/vulnerabilities/64893 https://nvd.nist.gov https://usn.ubuntu.com/1052-1/

CVE-2010-4351

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect