USN-2817-1 icedtea-web vulnerabilities

It was discovered that IcedTea Web incorrectly handled applet URLs. A remote attacker could possibly use this issue to inject applets into the .appletTrustSettings configuration file and bypass user approval. CVE-2015-5234 Andrea Palazzo discovered that IcedTea Web incorrectly determined the orig...

icedtea-web: applet origin spoofing

It was discovered that IcedTea-Web did not properly determine an applet's origin when asking the user if the applet should be run. A malicious page could use this flaw to cause IcedTea-Web to execute the applet without user approval, or confuse the user into approving applet execution based on an...

Mozilla Firefox and Firefox Java applet code injection vulnerability

Mozilla Firefox is an open source web browser.Firefox ESR is an extended support version of Firefox. A security vulnerability exists in Mozilla Firefox when using the Java plugin, which can be exploited by remote attackers to redistribute a specially crafted Java applet from the in-use JavaScript...

CVE-2015-7196

Mozilla Firefox before 42.0 and Firefox ESR 38.x before 38.4, when a Java plugin is enabled, allow remote attackers to cause a denial of service incorrect garbage collection and application crash or possibly execute arbitrary code via a crafted Java applet that deallocates an in-use JavaScript...

Code injection

Mozilla Firefox before 42.0 and Firefox ESR 38.x before 38.4, when a Java plugin is enabled, allow remote attackers to cause a denial of service incorrect garbage collection and application crash or possibly execute arbitrary code via a crafted Java applet that deallocates an in-use JavaScript...

Java Platform Data Modification

The vulnerability of the Java Platform is related to errors in the code. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain access to protected information through the use of the Java Web Start application or Java applet...

Java Platform Data Modification

The vulnerability of the Java Platform software platform’s sub-component is related to errors in the code. Exploiting this vulnerability allows a malicious actor to modify data remotely through an Java Web Start application or Java applet...

Java Platform Code Execution

The vulnerability of the Java Platform is related to errors in the code. Exploiting this vulnerability allows a malicious actor to execute arbitrary code via the Java Web Start application or Java applet, from a remote location...

Java Platform Code Execution

The vulnerability of the Java Platform’s CORBA subsystem is related to errors in the code. Exploiting this vulnerability allows a malicious actor to execute arbitrary code via a Java Web Start application or Java applet, from a remote location...

Java Platform Access Information Disclosure

The vulnerability of the 2D software platform of Java Platform is related to errors in the code. Exploiting this vulnerability can allow an attacker, operating remotely, to gain access to protected information through a Java Web Start application or Java applet...

Java Platform Code Execution

The vulnerability of the Java Platform’s sub-component, Serialization, is related to errors in the code. Exploiting this vulnerability allows a malicious actor to execute arbitrary code via a Java Web Start application or Java applet, from a remote location...

Java Platform Code Execution

The vulnerability of the RMI subsystem of the Java Platform is related to errors in the code. Exploiting this vulnerability allows a malicious actor to execute arbitrary code via a Java Web Start application or Java applet, from a remote location...

Java Platform Code Execution

The vulnerability of the 2D software platform of Java Platform is related to errors in the code. Exploiting this vulnerability allows a malicious actor to execute arbitrary code via an Java Web Start application or Java applet, operating remotely...

Java Platform Code Execution

The vulnerability of the Java Platform software platform’s sub-component is related to errors in the code. Exploiting this vulnerability allows a malicious actor, operating locally, to execute arbitrary code using a Java Web Start application or Java applet...

Mozilla: JavaScript garbage collection crash with Java applet (MFSA 2015-130)

Mozilla Firefox before 42.0 and Firefox ESR 38.x before 38.4, when a Java plugin is enabled, allow remote attackers to cause a denial of service incorrect garbage collection and application crash or possibly execute arbitrary code via a crafted Java applet that deallocates an in-use JavaScript...

Slack: File upload XSS (Java applet) on http://slackatwork.com/

The web application supports file uploads and I was able to upload a Java Applet .class/.jar file. If a web browser loads a Java applet from a trusted site, the browser provides no security warning. If an attacker can upload a CLASS/JAR file with an applet, the file is executed even if the web...

UBUNTU-CVE-2015-7196

Mozilla Firefox before 42.0 and Firefox ESR 38.x before 38.4, when a Java plugin is enabled, allow remote attackers to cause a denial of service incorrect garbage collection and application crash or possibly execute arbitrary code via a crafted Java applet that deallocates an in-use JavaScript...

CVE-2015-7196

Mozilla Firefox before 42.0 and Firefox ESR 38.x before 38.4, when a Java plugin is enabled, allow remote attackers to cause a denial of service incorrect garbage collection and application crash or possibly execute arbitrary code via a crafted Java applet that deallocates an in-use JavaScript...

JavaScript garbage collection crash with Java applet — Mozilla

Mozilla community member Vytautas Staraitis reported an issue with the interaction of Java applets and JavaScript. The Java plugin can deallocate a JavaScript wrapper when it is still in use, which leads to a JavaScript garbage collection crash. This crash is potentially exploitable...

PT-2015-2471

Name of the Vulnerable Software and Affected Versions Java Platform affected versions not specified Description The issue is related to errors in the code of the Java Platform. It may allow a remote attacker to gain read access to protected information using a Java Web Start application or a Java...