PT-2015-2525

Name of the Vulnerable Software and Affected Versions Oracle Java SE versions 6u101, 7u85, and 8u60 Java SE Embedded version 8u51 Description The issue is related to errors in the 2D subcomponent code of the Java Platform. It allows remote attackers to affect confidentiality, integrity, and...

PT-2015-2526

Name of the Vulnerable Software and Affected Versions Java SE versions 6u101, 7u85, and 8u60 Java SE Embedded version 8u51 Description The issue is related to errors in the code of the Java Platform's Libraries component. It may allow a remote attacker to execute arbitrary code using Java Web Sta...

PT-2015-2529

Name of the Vulnerable Software and Affected Versions Oracle Java SE versions 7u85 through 8u60 Java SE Embedded version 8u51 Description The issue is related to errors in the code of the 2D subcomponent of the Java Platform. It allows remote attackers to affect confidentiality via unknown vector...

PT-2015-2513

Name of the Vulnerable Software and Affected Versions Java SE versions 6u101, 7u85, and 8u60 Java SE Embedded version 8u51 Description The issue is related to errors in the code of the Java Platform's RMI subcomponent. Exploitation of this issue may allow a remote attacker to execute arbitrary co...

PT-2015-2476

Name of the Vulnerable Software and Affected Versions Oracle Java SE versions 6u101 through 8u60 Java SE Embedded version 8u51 Description The issue allows remote attackers to affect confidentiality through vectors related to RMI. It is related to errors in the code of the Java Platform, which ca...

PT-2015-2491

Name of the Vulnerable Software and Affected Versions Oracle Java SE versions 6u101 through 6u101 Oracle Java SE versions 7u85 through 7u85 Oracle Java SE versions 8u60 through 8u60 Java SE Embedded version 8u51 Description The issue is related to errors in the code of the Java Platform's RMI...

PT-2015-2478

Name of the Vulnerable Software and Affected Versions Oracle Java SE version 8u60 Description The issue is related to an unspecified vulnerability in the Java Platform, which is caused by errors in the code. This vulnerability can be exploited by a remote attacker to affect confidentiality,...

PT-2015-2471

Name of the Vulnerable Software and Affected Versions Java Platform affected versions not specified Description The issue is related to errors in the code of the Java Platform. It may allow a remote attacker to gain read access to protected information using a Java Web Start application or a Java...

IcedTea-Web Incorrectly Validates Unsigned Applet Vulnerability

IcedTea with an open source implementation to replace those non-open source parts of the OpenJDK , and for the current lack of platform portability OpenJDK to provide portability . IcedTea-Web fails to properly verify the origin of an unsigned applet, allowing remote attackers to build malicious...

IcedTea-Web Incorrect Applet URL Validation Vulnerability

IcedTea with an open source implementation to replace those non-open source parts of the OpenJDK , and for the current lack of platform portability OpenJDK to provide portability . IcedTea-Web fails to properly validate applet URLs, allowing remote attackers to build malicious HTML, trick users...

CVE-2015-5235

IcedTea-Web before 1.5.3 and 1.6.x before 1.6.1 does not properly determine the origin of unsigned applets, which allows remote attackers to bypass the approval process or trick users into approving applet execution via a crafted web page...

CVE-2015-5235

IcedTea-Web before 1.5.3 and 1.6.x before 1.6.1 does not properly determine the origin of unsigned applets, which allows remote attackers to bypass the approval process or trick users into approving applet execution via a crafted web page...

DEBIAN-CVE-2015-5234

IcedTea-Web before 1.5.3 and 1.6.x before 1.6.1 does not properly sanitize applet URLs, which allows remote attackers to inject applets into the .appletTrustSettings configuration file and bypass user approval to execute the applet via a crafted web page, possibly related to line breaks...

CVE-2015-5234

IcedTea-Web before 1.5.3 and 1.6.x before 1.6.1 does not properly sanitize applet URLs, which allows remote attackers to inject applets into the .appletTrustSettings configuration file and bypass user approval to execute the applet via a crafted web page, possibly related to line breaks...

Authentication flaw

IcedTea-Web before 1.5.3 and 1.6.x before 1.6.1 does not properly determine the origin of unsigned applets, which allows remote attackers to bypass the approval process or trick users into approving applet execution via a crafted web page...

Privilege escalation

IcedTea-Web before 1.5.3 and 1.6.x before 1.6.1 does not properly sanitize applet URLs, which allows remote attackers to inject applets into the .appletTrustSettings configuration file and bypass user approval to execute the applet via a crafted web page, possibly related to line breaks...

CVE-2015-5235

IcedTea-Web before 1.5.3 and 1.6.x before 1.6.1 does not properly determine the origin of unsigned applets, which allows remote attackers to bypass the approval process or trick users into approving applet execution via a crafted web page...

CVE-2015-5234

IcedTea-Web before 1.5.3 and 1.6.x before 1.6.1 does not properly sanitize applet URLs, which allows remote attackers to inject applets into the .appletTrustSettings configuration file and bypass user approval to execute the applet via a crafted web page, possibly related to line breaks...

CVE-2015-5234

IcedTea-Web before 1.5.3 and 1.6.x before 1.6.1 does not properly sanitize applet URLs, which allows remote attackers to inject applets into the .appletTrustSettings configuration file and bypass user approval to execute the applet via a crafted web page, possibly related to line breaks...

CVE-2015-5234

CVE-2015-5234 affects IcedTea-Web before 1.5.3 and 1.6.x before 1.6.1. The root cause is improper sanitization of applet URLs stored in the .appletTrustSettings configuration, which could allow a crafted page to inject applets and bypass user approval to execute the applet. The vulnerability enab...