CVE-2015-5235
Fixed in a distro release EPSS 3%
IcedTea-Web before 1.5.3 and 1.6.x before 1.6.1 does not properly determine the origin of unsigned applets, which allows remote attackers to bypass the approval process or trick users into approving applet execution via a crafted web page.
Products: fedoraproject fedora, redhat enterprise_linux_desktop, redhat enterprise_linux_hpc_node, redhat enterprise_linux_server, redhat enterprise_linux_workstation, opensuse, redhat icedtea
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | icedtea-web | 1.6.1-1 |
| Debian 13 | icedtea-web | 1.6.1-1 |
| Debian 14 | icedtea-web | 1.6.1-1 |
| Red Hat Enterprise Linux 6 | icedtea-web | 0:1.6.2-1.el6 |
| Red Hat Enterprise Linux 6 | icedtea-web-debuginfo | 0:1.6.2-1.el6 |
| Red Hat Enterprise Linux 6 | icedtea-web-javadoc | 0:1.6.2-1.el6 |
| Red Hat Enterprise Linux 7 | icedtea-web | 0:1.6.1-4.el7 |
| Red Hat Enterprise Linux 7 | icedtea-web-debuginfo | 0:1.6.1-4.el7 |
| Red Hat Enterprise Linux 7 | icedtea-web-javadoc | 0:1.6.1-4.el7 |
| SUSE Linux Enterprise Desktop 11 SP4 | icedtea-web | 1.5.3-0.9.1 |
| SUSE Linux Enterprise Desktop 12 | java-1_7_0-openjdk-plugin | 1.6.1-2.3.1 |
| SUSE Linux Enterprise Workstation Extension 12 | java-1_7_0-openjdk-plugin | 1.6.1-2.3.1 |
| Ubuntu 14.04 LTS | icedtea-web | 1.5.3-0ubuntu0.14.04.1 |