CVEvulnerability
CVE-2015-5234
6.8 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2015-10-09
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 6.8 MEDIUM — AV:N/AC:M/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-20
Description
IcedTea-Web before 1.5.3 and 1.6.x before 1.6.1 does not properly sanitize applet URLs, which allows remote attackers to inject applets into the .appletTrustSettings configuration file and bypass user approval to execute the applet via a crafted web page, possibly related to line breaks.
Affected configurations
• redhat enterprise linux desktop 6.0
• redhat enterprise linux hpc node 6.0
• redhat enterprise linux server 6.0
• redhat enterprise linux workstation 6.0
• opensuse opensuse 13.1
• opensuse opensuse 13.2
• redhat icedtea (<= 1.5.2)
• redhat icedtea 1.6
• fedoraproject fedora 21
• fedoraproject fedora 22
Related
Weakness · CWE (1)
- CWE-20 Improper Input Validation weakness
References
- http://lists.fedoraproject.org/pipermail/package-announce/2015-September/167120.html Third Party Advisory
- http://lists.fedoraproject.org/pipermail/package-announce/2015-September/167130.html Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00019.html Third Party Advisory
- http://mail.openjdk.java.net/pipermail/distro-pkg-dev/2015-September/033546.html Patch
- http://rhn.redhat.com/errata/RHSA-2016-0778.html Third Party Advisory
- http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html www.oracle.com
- http://www.securitytracker.com/id/1033780 www.securitytracker.com
- http://www.ubuntu.com/usn/USN-2817-1 www.ubuntu.com
- https://bugzilla.redhat.com/show_bug.cgi?id=1233667 Issue Tracking
- http://lists.fedoraproject.org/pipermail/package-announce/2015-September/167120.html Third Party Advisory
- http://lists.fedoraproject.org/pipermail/package-announce/2015-September/167130.html Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00019.html Third Party Advisory
- http://mail.openjdk.java.net/pipermail/distro-pkg-dev/2015-September/033546.html Patch
- http://rhn.redhat.com/errata/RHSA-2016-0778.html Third Party Advisory
- http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html www.oracle.com
- http://www.securitytracker.com/id/1033780 www.securitytracker.com
- http://www.ubuntu.com/usn/USN-2817-1 www.ubuntu.com
- https://bugzilla.redhat.com/show_bug.cgi?id=1233667 Issue Tracking