CVEvulnerability

CVE-2011-0025

6.8 MEDIUM Published 2011-02-04 Modified 2026-06-16 Official page ↗
Status
Modified
Published
2011-02-04
Last modified
2026-06-16
Assigner
[email protected]
CVSS 2.0 ([email protected])
6.8 MEDIUM — AV:N/AC:M/Au:N/C:P/I:P/A:P
Weaknesses
CWE-20

Description

IcedTea 1.7 before 1.7.8, 1.8 before 1.8.5, and 1.9 before 1.9.5 does not properly verify signatures for JAR files that (1) are "partially signed" or (2) signed by multiple entities, which allows remote attackers to trick users into executing code that appears to come from a trusted source.

Affected configurations

• redhat icedtea 1.7 • redhat icedtea 1.7.1 • redhat icedtea 1.7.2 • redhat icedtea 1.7.3 • redhat icedtea 1.7.4 • redhat icedtea 1.7.5 • redhat icedtea 1.7.6 • redhat icedtea 1.7.7 • redhat icedtea 1.8 • redhat icedtea 1.8.1 • redhat icedtea 1.8.2 • redhat icedtea 1.8.3 • redhat icedtea 1.8.4 • redhat icedtea 1.9 • redhat icedtea 1.9.1 • redhat icedtea 1.9.2 • redhat icedtea 1.9.3 • redhat icedtea 1.9.4

Related

Weakness · CWE (1)

  • CWE-20 Improper Input Validation weakness

References