Описание
It was found that in icedtea-web up to and including 1.7.2 and 1.8.2 executable code could be injected in a JAR file without compromising the signature verification. An attacker could use this flaw to inject code in a trusted JAR. The code would be executed inside the sandbox.
Ссылки
- Third Party Advisory
- Third Party AdvisoryVDB Entry
- Issue TrackingThird Party Advisory
- Third Party Advisory
- PatchThird Party Advisory
- Third Party Advisory
- Mailing ListThird Party Advisory
- PatchThird Party Advisory
- Third Party Advisory
- Third Party AdvisoryVDB Entry
- Issue TrackingThird Party Advisory
- Third Party Advisory
- PatchThird Party Advisory
- Third Party Advisory
- Mailing ListThird Party Advisory
- PatchThird Party Advisory
Уязвимые конфигурации
Одно из
EPSS
6.3 Medium
CVSS3
8.1 High
CVSS3
6.8 Medium
CVSS2
Дефекты
Связанные уязвимости
It was found that in icedtea-web up to and including 1.7.2 and 1.8.2 executable code could be injected in a JAR file without compromising the signature verification. An attacker could use this flaw to inject code in a trusted JAR. The code would be executed inside the sandbox.
It was found that in icedtea-web up to and including 1.7.2 and 1.8.2 executable code could be injected in a JAR file without compromising the signature verification. An attacker could use this flaw to inject code in a trusted JAR. The code would be executed inside the sandbox.
It was found that in icedtea-web up to and including 1.7.2 and 1.8.2 e ...
It was found that in icedtea-web up to and including 1.7.2 and 1.8.2 executable code could be injected in a JAR file without compromising the signature verification. An attacker could use this flaw to inject code in a trusted JAR. The code would be executed inside the sandbox.
Уязвимость плагина IcedTea-Web, связанная с недостаточной проверкой подлинности данных, позволяющая нарушителю внедрить произвольный код в JAR-файл
EPSS
6.3 Medium
CVSS3
8.1 High
CVSS3
6.8 Medium
CVSS2