CVEvulnerability
CVE-2019-10185
8.6 HIGH
Official page ↗
- Status
- Modified
- Published
- 2019-07-31
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 8.6 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N
- CVSS 3.0 ([email protected])
- 8.2 HIGH — CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:L
- CVSS 2.0 ([email protected])
- 6.4 MEDIUM — AV:N/AC:L/Au:N/C:N/I:P/A:P
- Weaknesses
- CWE-22
Description
It was found that icedtea-web up to and including 1.7.2 and 1.8.2 was vulnerable to a zip-slip attack during auto-extraction of a JAR file. An attacker could use this flaw to write files to arbitrary locations. This could also be used to replace the main running application and, possibly, break out of the sandbox.
Affected configurations
• icedtea-web project icedtea-web (<= 1.7.2)
• icedtea-web project icedtea-web 1.8.2
• debian debian linux 8.0
• opensuse leap 15.0
Related
Weakness · CWE (1)
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness
References
- http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00045.html Third Party Advisory
- http://packetstormsecurity.com/files/154748/IcedTeaWeb-Validation-Bypass-Directory-Traversal-Code-Execution.html Third Party Advisory, VDB Entry
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10185 Issue Tracking, Third Party Advisory
- https://github.com/AdoptOpenJDK/IcedTea-Web/issues/327 Third Party Advisory
- https://github.com/AdoptOpenJDK/IcedTea-Web/pull/344 Patch, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2019/09/msg00008.html Third Party Advisory
- https://seclists.org/bugtraq/2019/Oct/5 Mailing List, Third Party Advisory
- https://security.gentoo.org/glsa/202107-51 Patch, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00045.html Third Party Advisory
- http://packetstormsecurity.com/files/154748/IcedTeaWeb-Validation-Bypass-Directory-Traversal-Code-Execution.html Third Party Advisory, VDB Entry
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10185 Issue Tracking, Third Party Advisory
- https://github.com/AdoptOpenJDK/IcedTea-Web/issues/327 Third Party Advisory
- https://github.com/AdoptOpenJDK/IcedTea-Web/pull/344 Patch, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2019/09/msg00008.html Third Party Advisory
- https://seclists.org/bugtraq/2019/Oct/5 Mailing List, Third Party Advisory
- https://security.gentoo.org/glsa/202107-51 Patch, Third Party Advisory