Information Disclosure

icedtea-web is vulnerable to information disclosure. The vulnerability exists as a flaw was discovered in the JNLP implementation in IcedTea-Web. An unsigned Java Web Start application or Java applet could use this flaw to determine the path to the cache directory used to store downloaded Java...

Information Disclosure

java is vulnerable to information disclosure. The vulnerability exists as a public static field declaration allowed untrusted JNLP Java Network Launching Protocol applications to read privileged data. A remote attacker could directly or indirectly read the values of restricted system properties,...

Arbitrary Code Execution

ibm java is vulnerable to arbitrary code execution. An attacker is able to execute arbitrary code by modifying certain JNLP file to point a URL to an untrusted application...

CentOS 7 : icedtea-web (CESA-2019:2003)

An update for icedtea-web is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability fr...

firefox security update

68.7.0-2.0.1.el81 - Rebuild to pickup Oracle default bookmarks Orabug: 30069264 - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat file - Remove upstream references Orabug: 30530527 68.7.0-2 - Update to 68.7.0 build3 68.6.1-1 - Update to 68.6.1 ESR Wed Mar 04 2020 Jan Hora...

The vulnerability of Firefox browsers, related to errors in processing executable content for JNLP-enabled applications, allows attackers to gain access to confidential data, compromise its integrity, and cause service failures.

The vulnerability of Firefox browsers is related to errors in the processing of executable content for applications with the .JNLP extension. Exploiting this vulnerability can allow a remote attacker to gain access to confidential data, compromise its integrity, and cause service failures...

Huawei EulerOS: Security Advisory for icedtea-web (EulerOS-SA-2019-1905)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2010-2783

IcedTea6 before 1.7.4 allow unsigned apps to read and write arbitrary files, related to Extended JNLP Services...

Code injection

IcedTea6 before 1.7.4 allow unsigned apps to read and write arbitrary files, related to Extended JNLP Services...

CVE-2010-2783

The CVE-2010-2783 entry concerns IcedTea6 prior to 1.7.4, where Extended JNLP Services allow unsigned applications to read and write arbitrary files. This is the core root cause described in multiple sources (IcedTea6

CVE-2010-2783: Exposure of Sensitive Information to an Unauthorized Actor

IcedTea6 before 1.7.4 allow unsigned apps to read and write arbitrary files, related to Extended JNLP Services...

EulerOS 2.0 SP5 : icedtea-web (EulerOS-SA-2019-1905)

According to the versions of the icedtea-web package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - It was found that executable code could be injected in a JAR file without compromising the signature verification. An attacker could use thi...

Debian DLA-1914-1 : icedtea-web security update

Several security vulnerabilities were found in icedtea-web, an implementation of the Java Network Launching Protocol JNLP. CVE-2019-10181 It was found that in icedtea-web executable code could be injected in a JAR file without compromising the signature verification. An attacker could use this fl...

MGASA-2019-0242 Updated icedtea-web packages fix security vulnerabilities

Updated icedtea-web packages fix security vulnerabilities: It was found that in icedtea-web up to and including 1.7.2 and 1.8.2 executable code could be injected in a JAR file without compromising the signature verification. An attacker could use this flaw to inject code in a trusted JAR. The cod...

Updated icedtea-web packages fix security vulnerabilities

Updated icedtea-web packages fix security vulnerabilities: It was found that in icedtea-web up to and including 1.7.2 and 1.8.2 executable code could be injected in a JAR file without compromising the signature verification. An attacker could use this flaw to inject code in a trusted JAR. The cod...

RHEL 7 : icedtea-web (RHSA-2019:2003)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:2003 advisory. The IcedTea-Web project provides a Java web browser plug-in and an implementation of Java Web Start, which is based on the Netx project. It...

Path Traversal

icedtea-web is vulnerable to path traversal.It is due to improper processing of elements of JNLP files, resulting in an arbitrary file overwrite...

CVE-2019-10182

It was found that icedtea-web though 1.7.2 and 1.8.2 did not properly sanitize paths from elements in JNLP files. An attacker could trick a victim into running a specially crafted application and use this flaw to upload arbitrary files to arbitrary locations in the context of the user...

CVE-2019-10182

It was found that icedtea-web though 1.7.2 and 1.8.2 did not properly sanitize paths from elements in JNLP files. An attacker could trick a victim into running a specially crafted application and use this flaw to upload arbitrary files to arbitrary locations in the context of the user...

Design/Logic Flaw

It was found that icedtea-web though 1.7.2 and 1.8.2 did not properly sanitize paths from elements in JNLP files. An attacker could trick a victim into running a specially crafted application and use this flaw to upload arbitrary files to arbitrary locations in the context of the user...