Red Hat Security AdvisoryRHSA-2016:0778
icedtea-web security, bug fix, and enhancement update
Released 2016-05-10 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux Desktop (v. 6) icedtea-web-1.6.2-1.el6
- Red Hat Enterprise Linux Desktop Optional (v. 6) icedtea-web-javadoc-1.6.2-1.el6
- Red Hat Enterprise Linux HPC Node (v. 6) icedtea-web-1.6.2-1.el6
- Red Hat Enterprise Linux HPC Node Optional (v. 6) icedtea-web-javadoc-1.6.2-1.el6
- Red Hat Enterprise Linux Server (v. 6) icedtea-web-1.6.2-1.el6
- Red Hat Enterprise Linux Server Optional (v. 6) icedtea-web-javadoc-1.6.2-1.el6
- Red Hat Enterprise Linux Workstation (v. 6) icedtea-web-1.6.2-1.el6
- Red Hat Enterprise Linux Workstation Optional (v. 6) icedtea-web-javadoc-1.6.2-1.el6
Fixes 2 records
Priority LOW 34
IcedTea-Web before 1.5.3 and 1.6.x before 1.6.1 does not properly sanitize applet URLs, which allows remote attackers to inject applets into the .appletTrustSettings configuration file and bypass user approval to execute…
CVSS 2.0MEDIUM 6.8· Network · No auth · Interaction — · EPSS 0.02127 · Published 2015-10-09 · Fixed CWE-20
Priority LOW 26
IcedTea-Web before 1.5.3 and 1.6.x before 1.6.1 does not properly determine the origin of unsigned applets, which allows remote attackers to bypass the approval process or trick users into approving applet execution via…
CVSS 2.0MEDIUM 4.3· Network · No auth · Interaction — · EPSS 0.03025 · Published 2015-10-09 · Fixed CWE-20
