CVE-2019-10182

CVE-2019-10182 affects icedtea-web up to 1.7.2 and 1.8.2, where improper sanitization of paths in elements within JNLP files enables a crafted app to upload arbitrary files in the user context. Multiple Nessus/openVAS advisories group this with related flaws (CVE-2019-10181, CVE-2019-10185); exp...

CVE-2019-10181

The CVE-2019-10181 entry relates to icedtea-web (versions up to 1.7.2 and 1.8.2) where executable code could be injected into a trusted JAR without triggering signature verification, enabling code execution inside the sandbox. The vulnerability is documented across multiple vendors (e.g., Red Hat...

CVE-2019-10185

The connected Nessus entries confirm CVE-2019-10185 affects icedtea-web up to and including 1.7.2 and 1.8.2, with a zip-slip vulnerability during auto-extraction of a JAR that can write files to arbitrary locations and potentially break out of the sandbox. This is tied to multiple advisories (e.g...

CVE-2015-5236

The CVE-2015-5236 entry concerns IcedTea-Web, where the codebase attribute of the HTML tag used in the SOP check is not required to match the applet’s actual origin. This could allow a malicious site to bypass Same Origin Policy by spoofing the codebase value. Public documentation provided refer...