IcedTea for Java OpenJDK protection bypass

Protection bypass in JNLP SecurityManage, JAR files digital signature spoofing...

Ubuntu 9.10 / 10.04 LTS / 10.10 : openjdk-6, openjdk-6b18 vulnerabilities (USN-1055-1)

It was discovered that IcedTea for Java did not properly verify signatures when handling multiply signed or partially signed JAR files, allowing an attacker to cause code to execute that appeared to come from a verified source. CVE-2011-0025 USN 1052-1 fixed a vulnerability in OpenJDK for Ubuntu...

USN-1055-1: OpenJDK vulnerabilities

It was discovered that IcedTea for Java did not properly verify signatures when handling multiply signed or partially signed JAR files, allowing an attacker to cause code to execute that appeared to come from a verified source. CVE-2011-0025 USN 1052-1 fixed a vulnerability in OpenJDK for Ubuntu...

CVE-2011-0025

IcedTea 1.7 before 1.7.8, 1.8 before 1.8.5, and 1.9 before 1.9.5 does not properly verify signatures for JAR files that 1 are "partially signed" or 2 signed by multiple entities, which allows remote attackers to trick users into executing code that appears to come from a trusted source...

Ubuntu: Security Advisory (USN-1052-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2011 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Ubuntu Update for openjdk-6, openjdk-6b18 vulnerability USN-1052-1

Ubuntu Update for Linux kernel vulnerabilities USN-1052-1 OpenVAS Vulnerability Test $Id: gbubuntuUSN10521.nasl 7964 2017-12-01 07:32:11Z santu $ Ubuntu Update for openjdk-6, openjdk-6b18 vulnerability USN-1052-1 Authors: System Generated Check Copyright: Copyright c 2011 Greenbone Networks GmbH,...

RHEL 5 : java-1.6.0-openjdk (RHSA-2011:0176)

The remote Redhat Enterprise Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2011:0176 advisory. - IcedTea System property information leak via public static CVE-2010-3860 - IcedTea jnlp security manager bypass CVE-2010-4351 Note that...

IcedTea jnlp security manager bypass

The JNLP SecurityManager in IcedTea IcedTea.so 1.7 before 1.7.7, 1.8 before 1.8.4, and 1.9 before 1.9.4 for Java OpenJDK returns from the checkPermission method instead of throwing an exception in certain circumstances, which might allow context-dependent attackers to bypass the intended security...

CVE-2010-4351

The JNLP SecurityManager in IcedTea IcedTea.so 1.7 before 1.7.7, 1.8 before 1.8.4, and 1.9 before 1.9.4 for Java OpenJDK returns from the checkPermission method instead of throwing an exception in certain circumstances, which might allow context-dependent attackers to bypass the intended security...

Design/Logic Flaw

The JNLP SecurityManager in IcedTea IcedTea.so 1.7 before 1.7.7, 1.8 before 1.8.4, and 1.9 before 1.9.4 for Java OpenJDK returns from the checkPermission method instead of throwing an exception in certain circumstances, which might allow context-dependent attackers to bypass the intended security...

CVE-2010-4351

The JNLP SecurityManager in IcedTea IcedTea.so 1.7 before 1.7.7, 1.8 before 1.8.4, and 1.9 before 1.9.4 for Java OpenJDK returns from the checkPermission method instead of throwing an exception in certain circumstances, which might allow context-dependent attackers to bypass the intended security...

CVE-2010-4351

The CVE-2010-4351 issue affects IcedTea JDK/OpenJDK (IcedTea.so) prior to versions 1.7.7, 1.8.4, and 1.9.4, where JNLP SecurityManager’s checkPermission could return instead of throwing an exception in certain circumstances. This can allow context-dependent attackers to bypass the intended securi...

CVE-2010-4351

The JNLP SecurityManager in IcedTea IcedTea.so 1.7 before 1.7.7, 1.8 before 1.8.4, and 1.9 before 1.9.4 for Java OpenJDK returns from the checkPermission method instead of throwing an exception in certain circumstances, which might allow context-dependent attackers to bypass the intended security...

Fedora 13 : java-1.6.0-openjdk-1.6.0.0-48.1.8.4.fc13 (2011-0500)

Wed Jan 5 2011 Jiri Vanek -1:1.6.0-47.1.8.4.48 - updated to icedtea 1.8.4 - Mon Nov 29 2010 Jiri Vanek -1:1.6.0-46.1.8.3.4 - Resolves: rhbz657491 - Removed Asian and Indic font dependencies. - Fri Nov 19 2010 Jiri Vanek -1:1.6.0-45.1.8.3 - updated to iced tea 1.8.3 - added fonts dependencies -...

Fedora 14 : java-1.6.0-openjdk-1.6.0.0-50.1.9.4.fc14 (2011-0521)

Wed Jan 5 2011 Jiri Vanek - 1:1.6.0.0-50.1.9.4 - Updated to IcedTea 1.9.4 - Wed Dec 1 2010 Deepak Bhole - 1:1.6.0.0-49.1.9.3 - Updated to IcedTea 1.9.3 - Re-enable Compressed Oops by default as upstream bug 7002666 is fixed - Tue Nov 30 2010 Deepak Bhole - 1:1.6.0.0-49.1.9.2 - Update to IcedTea...

PT-2011-1514 · Oracle +1 · Icedtea +1

Name of the Vulnerable Software and Affected Versions: IcedTea versions 1.7 through 1.7.6 IcedTea versions 1.8 through 1.8.3 IcedTea versions 1.9 through 1.9.3 Description: The issue allows context-dependent attackers to bypass the intended security policy by creating instances of ClassLoader. Th...

Ubuntu Update for openjdk-6 vulnerability USN-1024-1

Ubuntu Update for Linux kernel vulnerabilities USN-1024-1 OpenVAS Vulnerability Test $Id: gbubuntuUSN10241.nasl 7965 2017-12-01 07:38:25Z santu $ Ubuntu Update for openjdk-6 vulnerability USN-1024-1 Authors: System Generated Check Copyright: Copyright c 2010 Greenbone Networks GmbH,...

CVE-2010-3860

IcedTea 1.7.x before 1.7.6, 1.8.x before 1.8.3, and 1.9.x before 1.9.2, as based on OpenJDK 6, declares multiple sensitive variables as public, which allows remote attackers to obtain sensitive information including 1 user.name, 2 user.home, and 3 java.home system properties, and other sensitive...

Information disclosure

IcedTea 1.7.x before 1.7.6, 1.8.x before 1.8.3, and 1.9.x before 1.9.2, as based on OpenJDK 6, declares multiple sensitive variables as public, which allows remote attackers to obtain sensitive information including 1 user.name, 2 user.home, and 3 java.home system properties, and other sensitive...

CVE-2010-3860

The CVE-2010-3860 issue affects IcedTea JDK (based on OpenJDK 6): IcedTea 1.7.x before 1.7.6, 1.8.x before 1.8.3, and 1.9.x before 1.9.2 declare multiple sensitive variables as public, enabling remote disclosure of information such as user.name, user.home, and java.home properties. Root cause: pu...