EUVD-2019-2212

Malware in sbrugna...

CVE-2019-10185: Improper Limitation of a Pathname to a Restricted Directory

It was found that icedtea-web up to and including 1.7.2 and 1.8.2 was vulnerable to a zip-slip attack during auto-extraction of a JAR file. An attacker could use this flaw to write files to arbitrary locations. This could also be used to replace the main running application and, possibly, break o...