Security update for icedtea-web (important)

An update that fixes three vulnerabilities is now available.

Description:

This update for icedtea-web fixes the following issues:

• CVE-2019-10181: Fixed an issue where an attacker could inject unsigned
  code in a signed JAR file (bsc#1142835).
• CVE-2019-10182: Fixed a path traversal issue where an attacker could
  upload arbritrary files by tricking a victim into running a specially
  crafted application(bsc#1142825).
• CVE-2019-10185: Fixed an issue where an attacker could write files to
  arbitrary locations during JAR auto-extraction (bsc#1142832).

Patch Instructions:

To install this SUSE Security Update use the SUSE recommended installation methods
like YaST online_update or “zypper patch”.

Alternatively you can run the command listed for your product:

• openSUSE Leap 15.4:

  zypper in -t patch openSUSE-SLE-15.4-2022-1259=1

• openSUSE Leap 15.3:

  zypper in -t patch openSUSE-SLE-15.3-2022-1259=1

• SUSE Linux Enterprise Workstation Extension 15-SP4:

  zypper in -t patch SUSE-SLE-Product-WE-15-SP4-2022-1259=1

• SUSE Linux Enterprise Workstation Extension 15-SP3:

  zypper in -t patch SUSE-SLE-Product-WE-15-SP3-2022-1259=1

• SUSE Linux Enterprise Module for Packagehub Subpackages 15-SP4:

  zypper in -t patch SUSE-SLE-Module-Packagehub-Subpackages-15-SP4-2022-1259=1

• SUSE Linux Enterprise Module for Packagehub Subpackages 15-SP3:

  zypper in -t patch SUSE-SLE-Module-Packagehub-Subpackages-15-SP3-2022-1259=1