Read the docs
TI-2010-03667 Aliases CVE-2010-3860GHSA-pqr4-2v59-c8vx

IcedTea 1.7.x before 1.7.6, 1.8.x before 1.8.3, and 1.9.x before 1.9.2, as based on…

Priority LOW 28CWE-200Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
Partial · None · None
Fix status
Partial Red Hat: 1 fixed, 1 without a fix

Attack profile from CVSS 2.0 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-200.

Summary

IcedTea 1.7.x before 1.7.6, 1.8.x before 1.8.3, and 1.9.x before 1.9.2, as based on OpenJDK 6, declares multiple sensitive variables as public, which allows remote attackers to obtain sensitive information including (1) user.name, (2) user.home, and (3) java.home system properties, and other sensitive information such as installation directories.

Why it matters now

EPSS 0.02999 87th percentileScored 2026-11-07
Fix Partial Red Hat: 1 advisoryRed Hat: 1 fixed, 1 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 10

CPEVersionsRoleVendor
cpe:2.3:a:redhat:icedtea:*:*:*:*:*:*:*:*up to 1.9.1VulnerableRed Hat
cpe:2.3:a:redhat:icedtea:1.5:rc1:*:*:*:*:*:*1.5 rc1VulnerableRed Hat
cpe:2.3:a:redhat:icedtea:1.5:rc2:*:*:*:*:*:*1.5 rc2VulnerableRed Hat
cpe:2.3:a:redhat:icedtea:1.5:rc3:*:*:*:*:*:*1.5 rc3VulnerableRed Hat
cpe:2.3:a:redhat:icedtea:1.6:*:*:*:*:*:*:*1.6VulnerableRed Hat
cpe:2.3:a:redhat:icedtea:1.7:*:*:*:*:*:*:*1.7VulnerableRed Hat
cpe:2.3:a:redhat:icedtea:1.8:*:*:*:*:*:*:*1.8VulnerableRed Hat
cpe:2.3:a:redhat:icedtea:1.8.1:*:*:*:*:*:*:*1.8.1VulnerableRed Hat
cpe:2.3:a:redhat:icedtea:1.8.2:*:*:*:*:*:*:*1.8.2VulnerableRed Hat
cpe:2.3:a:redhat:icedtea:1.9:*:*:*:*:*:*:*1.9VulnerableRed Hat
  • cpe:2.3:a:redhat:icedtea:*:*:*:*:*:*:*:* Versions up to 1.9.1 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:icedtea:1.5:rc1:*:*:*:*:*:* Versions 1.5 rc1 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:icedtea:1.5:rc2:*:*:*:*:*:* Versions 1.5 rc2 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:icedtea:1.5:rc3:*:*:*:*:*:* Versions 1.5 rc3 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:icedtea:1.6:*:*:*:*:*:*:* Versions 1.6 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:icedtea:1.7:*:*:*:*:*:*:* Versions 1.7 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:icedtea:1.8:*:*:*:*:*:*:* Versions 1.8 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:icedtea:1.8.1:*:*:*:*:*:*:* Versions 1.8.1 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:icedtea:1.8.2:*:*:*:*:*:*:* Versions 1.8.2 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:icedtea:1.9:*:*:*:*:*:*:* Versions 1.9 Vulnerable ·Red Hat

Remediation

Red Hat 1 advisory

  • RHSA-2011:0176 Released 2011-01-25 · Red Hat rating Moderate
    java-1.6.0-openjdk security update
    • Red Hat Enterprise Linux (v. 5.6.z server) java-1.6.0-openjdk-1:1.6.0.0-1.17.b17.el5, java-1.6.0-openjdk-1:1.6.0.0-1.17.b17.el5.i386, java-1.6.0-openjdk-demo-1:1.6.0.0-1.17.b17.el5 +7

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 6AffectedNo fix yet
Red Hat Enterprise Linux (v. 5.6.z server)Fixed RHSA-2011:0176

Timeline

  1. 2026-10-02 Threatist record created from CVE-2010-3860
  2. 2026-10-03 Alias added: GHSA-pqr4-2v59-c8vx

References

Patch 2

Advisory 7

Other 2

  • TI-2017-02708 Vulnerability in the Java SE component of Oracle Java SE (subcomponent: AWT). CVSS 3.0HIGH 8.3
  • TI-2011-00024 IcedTea 1.7 before 1.7.8, 1.8 before 1.8.5, and 1.9 before 1.9.5 does not properly verify… CVSS 2.0MEDIUM 6.8
  • TI-2010-04084 The JNLP SecurityManager in IcedTea (IcedTea.so) 1.7 before 1.7.7, 1.8 before 1.8.4, and… CVSS 2.0MEDIUM 6.8
  • TI-2015-04395 IcedTea-Web before 1.5.3 and 1.6.x before 1.6.1 does not properly sanitize applet URLs… CVSS 2.0MEDIUM 6.8
  • TI-2015-04396 IcedTea-Web before 1.5.3 and 1.6.x before 1.6.1 does not properly determine the origin of… CVSS 2.0MEDIUM 4.3
  • TI-2017-02729 Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE… CVSS 3.0LOW 3.7
See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences