TI-2019-07506 CVE-2019-10185 · GHSA-3q3x-68j9-f9vv
Path traversal in icedtea-web
Priority MEDIUM 44
It was found that icedtea-web up to and including 1.7.2 and 1.8.2 was vulnerable to a zip-slip attack during auto-extraction of a JAR file.
IcedTea
Records6All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical2CVSS 9.0–10.0
CVSS high4CVSS 7.0–8.9
Exploited now
IcedTea records in CISA KEVNo IcedTea vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
4 records in Icedtea-web · all components
TI-2019-07503 CVE-2019-10182 · GHSA-cqfc-r7qj-5fgq
Path traversal in icedtea-web
Priority MEDIUM 41
It was found that icedtea-web though 1.7.2 and 1.8.2 did not properly sanitize paths from <jar/> elements in JNLP files.
TI-2019-07502 CVE-2019-10181 · GHSA-xv8g-hcfj-ppcw
Insufficient verification of data authenticity in icedtea-web
Priority LOW 38
It was found that in icedtea-web up to and including 1.7.2 and 1.8.2 executable code could be injected in a JAR file without compromising the signature verification.
TI-2015-04397 CVE-2015-5236 · GHSA-f95f-r783-xxx3
Insufficient verification of data authenticity in Icedtea-web
Priority LOW 34
It was discovered that the IcedTea-Web used codebase attribute of the <applet> tag on the HTML page that hosts Java applet in the Same Origin Policy (SOP) checks.