PT-2015-2513

Name of the Vulnerable Software and Affected Versions Java SE versions 6u101, 7u85, and 8u60 Java SE Embedded version 8u51 Description The issue is related to errors in the code of the Java Platform's RMI subcomponent. Exploitation of this issue may allow a remote attacker to execute arbitrary co...

PT-2015-2526

Name of the Vulnerable Software and Affected Versions Java SE versions 6u101, 7u85, and 8u60 Java SE Embedded version 8u51 Description The issue is related to errors in the code of the Java Platform's Libraries component. It may allow a remote attacker to execute arbitrary code using Java Web Sta...

PT-2015-2525

Name of the Vulnerable Software and Affected Versions Oracle Java SE versions 6u101, 7u85, and 8u60 Java SE Embedded version 8u51 Description The issue is related to errors in the 2D subcomponent code of the Java Platform. It allows remote attackers to affect confidentiality, integrity, and...

PT-2015-2527

Name of the Vulnerable Software and Affected Versions Oracle Java SE versions 6u101, 7u85, and 8u60 Java SE Embedded version 8u51 Description The issue allows remote attackers to affect confidentiality via vectors related to JAXP. It is associated with errors in the code of the JAXP subcomponent ...

PT-2015-2529

Name of the Vulnerable Software and Affected Versions Oracle Java SE versions 7u85 through 8u60 Java SE Embedded version 8u51 Description The issue is related to errors in the code of the 2D subcomponent of the Java Platform. It allows remote attackers to affect confidentiality via unknown vector...

PT-2015-2551

Name of the Vulnerable Software and Affected Versions Oracle Java SE versions 7u85 through 8u60 Description The issue is related to errors in the code of the Deployment subcomponent of the Java Platform. It may allow a local attacker to execute arbitrary code using a Java Web Start application or...

PT-2015-2555

Name of the Vulnerable Software and Affected Versions Oracle Java SE versions 6u101, 7u85, and 8u60 Java SE Embedded version 8u51 Description The issue is related to errors in the code of the Java Platform's Serialization component. It may allow a remote attacker to execute arbitrary code using...

PT-2015-2569

Name of the Vulnerable Software and Affected Versions Oracle Java SE versions 6u101 through 8u60 Java SE Embedded version 8u51 Description The issue allows remote attackers to affect confidentiality via vectors related to JGSS. It is related to errors in the code of the JGSS subcomponent of the...

PT-2015-2473

Name of the Vulnerable Software and Affected Versions Java Platform affected versions not specified Description The issue is related to errors in the code of the Java Platform. It allows a remote attacker to gain read access to protected information using a Java Web Start application or a Java...

PT-2015-2554

Name of the Vulnerable Software and Affected Versions Oracle Java SE versions 6u101, 7u85, and 8u60 Java SE Embedded version 8u51 Description The issue is related to errors in the code of the Libraries subcomponent of the Java Platform. It allows remote attackers to affect confidentiality and...

IcedTea-Web Incorrect Applet URL Validation Vulnerability

IcedTea with an open source implementation to replace those non-open source parts of the OpenJDK , and for the current lack of platform portability OpenJDK to provide portability . IcedTea-Web fails to properly validate applet URLs, allowing remote attackers to build malicious HTML, trick users...

IcedTea-Web Incorrectly Validates Unsigned Applet Vulnerability

IcedTea with an open source implementation to replace those non-open source parts of the OpenJDK , and for the current lack of platform portability OpenJDK to provide portability . IcedTea-Web fails to properly verify the origin of an unsigned applet, allowing remote attackers to build malicious...

CVE-2015-5235

IcedTea-Web before 1.5.3 and 1.6.x before 1.6.1 does not properly determine the origin of unsigned applets, which allows remote attackers to bypass the approval process or trick users into approving applet execution via a crafted web page...

CVE-2015-5235

IcedTea-Web before 1.5.3 and 1.6.x before 1.6.1 does not properly determine the origin of unsigned applets, which allows remote attackers to bypass the approval process or trick users into approving applet execution via a crafted web page...

DEBIAN-CVE-2015-5234

IcedTea-Web before 1.5.3 and 1.6.x before 1.6.1 does not properly sanitize applet URLs, which allows remote attackers to inject applets into the .appletTrustSettings configuration file and bypass user approval to execute the applet via a crafted web page, possibly related to line breaks...

CVE-2015-5234

IcedTea-Web before 1.5.3 and 1.6.x before 1.6.1 does not properly sanitize applet URLs, which allows remote attackers to inject applets into the .appletTrustSettings configuration file and bypass user approval to execute the applet via a crafted web page, possibly related to line breaks...

Privilege escalation

IcedTea-Web before 1.5.3 and 1.6.x before 1.6.1 does not properly sanitize applet URLs, which allows remote attackers to inject applets into the .appletTrustSettings configuration file and bypass user approval to execute the applet via a crafted web page, possibly related to line breaks...

Authentication flaw

IcedTea-Web before 1.5.3 and 1.6.x before 1.6.1 does not properly determine the origin of unsigned applets, which allows remote attackers to bypass the approval process or trick users into approving applet execution via a crafted web page...

CVE-2015-5234

IcedTea-Web before 1.5.3 and 1.6.x before 1.6.1 does not properly sanitize applet URLs, which allows remote attackers to inject applets into the .appletTrustSettings configuration file and bypass user approval to execute the applet via a crafted web page, possibly related to line breaks...

CVE-2015-5234

CVE-2015-5234 affects IcedTea-Web before 1.5.3 and 1.6.x before 1.6.1. The root cause is improper sanitization of applet URLs stored in the .appletTrustSettings configuration, which could allow a crafted page to inject applets and bypass user approval to execute the applet. The vulnerability enab...