TI-2019-07506 CVE-2019-10185 · GHSA-3q3x-68j9-f9vv
Path traversal in icedtea-web
Priority MEDIUM 44
It was found that icedtea-web up to and including 1.7.2 and 1.8.2 was vulnerable to a zip-slip attack during auto-extraction of a JAR file.
IcedTea
Records6All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical2CVSS 9.0–10.0
CVSS high4CVSS 7.0–8.9
Exploited now
IcedTea records in CISA KEVNo IcedTea vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
6 records
TI-2010-02660 CVE-2010-2783 · GHSA-3g68-hg24-4xxq
IcedTea6 before 1.7.4 allow unsigned apps to read and write arbitrary files, related to Extended JNLP Services.
Priority MEDIUM 43
IcedTea6 before 1.7.4 allow unsigned apps to read and write arbitrary files, related to Extended JNLP Services.
TI-2010-02446 CVE-2010-2548 · GHSA-w978-mmpv-hphg
Incorrect authorization in IcedTea6
Priority MEDIUM 43
IcedTea6 before 1.7.4 does not properly check property access, which allows unsigned apps to read and write arbitrary files.
TI-2019-07503 CVE-2019-10182 · GHSA-cqfc-r7qj-5fgq
Path traversal in icedtea-web
Priority MEDIUM 41
It was found that icedtea-web though 1.7.2 and 1.8.2 did not properly sanitize paths from <jar/> elements in JNLP files.
TI-2019-07502 CVE-2019-10181 · GHSA-xv8g-hcfj-ppcw
Insufficient verification of data authenticity in icedtea-web
Priority LOW 38
It was found that in icedtea-web up to and including 1.7.2 and 1.8.2 executable code could be injected in a JAR file without compromising the signature verification.
TI-2015-04397 CVE-2015-5236 · GHSA-f95f-r783-xxx3
Insufficient verification of data authenticity in Icedtea-web
Priority LOW 34
It was discovered that the IcedTea-Web used codebase attribute of the <applet> tag on the HTML page that hosts Java applet in the Same Origin Policy (SOP) checks.