Icedtea-web Project

Icedtea-web

4 Schwachstellen gefunden.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
7.5

CVE-2015-5236

Exploit
  • EPSS 0.12%
  • Veröffentlicht 07.07.2022 16:15:08
  • Zuletzt bearbeitet 21.11.2024 02:32:37

It was discovered that the IcedTea-Web used codebase attribute of the <applet> tag on the HTML page that hosts Java applet in the Same Origin Policy (SOP) checks. As the specified codebase does not have to match the applet's actual origin, this allow...

8.1

CVE-2019-10181

  • EPSS 0.33%
  • Veröffentlicht 31.07.2019 23:15:10
  • Zuletzt bearbeitet 21.11.2024 04:18:35

It was found that in icedtea-web up to and including 1.7.2 and 1.8.2 executable code could be injected in a JAR file without compromising the signature verification. An attacker could use this flaw to inject code in a trusted JAR. The code would be e...

8.6

CVE-2019-10185

  • EPSS 1.56%
  • Veröffentlicht 31.07.2019 23:15:10
  • Zuletzt bearbeitet 21.11.2024 04:18:36

It was found that icedtea-web up to and including 1.7.2 and 1.8.2 was vulnerable to a zip-slip attack during auto-extraction of a JAR file. An attacker could use this flaw to write files to arbitrary locations. This could also be used to replace the ...

6.5

CVE-2019-10182

  • EPSS 1.43%
  • Veröffentlicht 31.07.2019 22:15:12
  • Zuletzt bearbeitet 21.11.2024 04:18:36

It was found that icedtea-web though 1.7.2 and 1.8.2 did not properly sanitize paths from <jar/> elements in JNLP files. An attacker could trick a victim into running a specially crafted application and use this flaw to upload arbitrary files to arbi...