Back to Database
Status published
Medium
CVE-2019-10181
It was found that in icedtea-web up to and including...
Vulnerability Description
It was found that in icedtea-web up to and including 1.7.2 and 1.8.2 executable code could be injected in a JAR file without compromising the signature verification. An attacker could use this flaw to inject code in a trusted JAR. The code would be executed inside the sandbox.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2019-10181
Credits & Attribution
No credits recorded in the NVD database.
References
- https://github.com/AdoptOpenJDK/IcedTea-Web/pull/344
- https://github.com/AdoptOpenJDK/IcedTea-Web/issues/327
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10181
- http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00045.html
- https://lists.debian.org/debian-lts-announce/2019/09/msg00008.html
- https://seclists.org/bugtraq/2019/Oct/5
- http://packetstormsecurity.com/files/154748/IcedTeaWeb-Validation-Bypass-Directory-Traversal-Code-Execution.html
- https://security.gentoo.org/glsa/202107-51
More from IcedTea
View All →CVE-2019-10185
It was found that icedtea-web up to and including 1.7.2...
High
8.2
CVE-2019-10182
It was found that icedtea-web though 1.7.2 and 1.8.2 did...
High
8.2
CVE-2010-2783
IcedTea6 before 1.7.4 allow unsigned apps to read and write...
Critical
9.1
CVE-2010-2548
IcedTea6 before 1.7.4 does not properly check property access, which...
Critical
9.1
Affected Vendor
IcedTea
View all reports →Affected Software
icedtea-web
Vulnerable Versions:
affects up to and including 1.7.2 and 1.8.2
Timeline
Official Publish:
July 31st, 2019
Last Modified:
August 4th, 2024
Added to House:
July 20th, 2026
CVSS Vectors
V3:
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L