CVE-2015-5235

2015-10-0914:59:05

Debian Security Bug Tracker

security-tracker.debian.org

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

0.004 Low

EPSS

Percentile

74.5%

JSON

IcedTea-Web before 1.5.3 and 1.6.x before 1.6.1 does not properly determine the origin of unsigned applets, which allows remote attackers to bypass the approval process or trick users into approving applet execution via a crafted web page.

OSVersionArchitecturePackageVersionFilename
Debian12allicedtea-web< 1.6.1-1icedtea-web_1.6.1-1_all.deb
Debian11allicedtea-web< 1.6.1-1icedtea-web_1.6.1-1_all.deb
Debian10allicedtea-web< 1.6.1-1icedtea-web_1.6.1-1_all.deb
Debian999allicedtea-web< 1.6.1-1icedtea-web_1.6.1-1_all.deb
Debian13allicedtea-web< 1.6.1-1icedtea-web_1.6.1-1_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	12	all	icedtea-web	< 1.6.1-1	icedtea-web_1.6.1-1_all.deb
Debian	11	all	icedtea-web	< 1.6.1-1	icedtea-web_1.6.1-1_all.deb
Debian	10	all	icedtea-web	< 1.6.1-1	icedtea-web_1.6.1-1_all.deb
Debian	999	all	icedtea-web	< 1.6.1-1	icedtea-web_1.6.1-1_all.deb
Debian	13	all	icedtea-web	< 1.6.1-1	icedtea-web_1.6.1-1_all.deb