CVE-2015-5234
Fixed in a distro release EPSS 2%
IcedTea-Web before 1.5.3 and 1.6.x before 1.6.1 does not properly sanitize applet URLs, which allows remote attackers to inject applets into the .appletTrustSettings configuration file and bypass user approval to execute the applet via a crafted web page, possibly related to line breaks.
Products: redhat enterprise_linux_desktop, redhat enterprise_linux_hpc_node, redhat enterprise_linux_server, redhat enterprise_linux_workstation, opensuse, redhat icedtea, fedoraproject fedora
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | icedtea-web | 1.6.1-1 |
| Debian 13 | icedtea-web | 1.6.1-1 |
| Debian 14 | icedtea-web | 1.6.1-1 |
| Red Hat Enterprise Linux 6 | icedtea-web | 0:1.6.2-1.el6 |
| Red Hat Enterprise Linux 6 | icedtea-web-debuginfo | 0:1.6.2-1.el6 |
| Red Hat Enterprise Linux 6 | icedtea-web-javadoc | 0:1.6.2-1.el6 |
| Red Hat Enterprise Linux 7 | icedtea-web | 0:1.6.1-4.el7 |
| Red Hat Enterprise Linux 7 | icedtea-web-debuginfo | 0:1.6.1-4.el7 |
| Red Hat Enterprise Linux 7 | icedtea-web-javadoc | 0:1.6.1-4.el7 |
| SUSE Linux Enterprise Desktop 11 SP4 | icedtea-web | 1.5.3-0.9.1 |
| SUSE Linux Enterprise Desktop 12 | java-1_7_0-openjdk-plugin | 1.6.1-2.3.1 |
| SUSE Linux Enterprise Workstation Extension 12 | java-1_7_0-openjdk-plugin | 1.6.1-2.3.1 |
| Ubuntu 14.04 LTS | icedtea-web | 1.5.3-0ubuntu0.14.04.1 |