Icedtea Security Vulnerabilities and Issues — Icedtea CVE List

Lucene search

RedhatIcedtea

3 matches found

CVE•added 2011/02/04 8:0 p.m.•64 views

CVE-2011-0025

IcedTea 1.7 before 1.7.8, 1.8 before 1.8.5, and 1.9 before 1.9.5 does not properly verify signatures for JAR files that (1) are "partially signed" or (2) signed by multiple entities, which allows remote attackers to trick users into executing code that appears to come from a trusted source.

6.8CVSS9AI score0.0255EPSS

CVE•added 2011/01/20 7:0 p.m.•61 views

CVE-2010-4351

The JNLP SecurityManager in IcedTea (IcedTea.so) 1.7 before 1.7.7, 1.8 before 1.8.4, and 1.9 before 1.9.4 for Java OpenJDK returns from the checkPermission method instead of throwing an exception in certain circumstances, which might allow context-dependent attackers to bypass the intended security...

6.8CVSS8.8AI score0.01585EPSS

CVE•added 2015/10/09 2:59 p.m.•58 views

CVE-2015-5234

IcedTea-Web before 1.5.3 and 1.6.x before 1.6.1 does not properly sanitize applet URLs, which allows remote attackers to inject applets into the .appletTrustSettings configuration file and bypass user approval to execute the applet via a crafted web page, possibly related to line breaks.

6.8CVSS6.8AI score0.0092EPSS