IcedTea-Web before 1.5.3 and 1.6.x before 1.6.1 does not properly sanitize applet URLs, which allows remote attackers to inject applets into the .appletTrustSettings configuration file and bypass user approval to execute the applet via a crafted web page, possibly related to line breaks.
| Version | Base score | Base severity | Vector |
|---|
| Hyperlink | Resource Type |
|---|
IcedTea-Web before 1.5.3 and 1.6.x before 1.6.1 does not properly sanitize applet URLs, which allows remote attackers to inject applets into the .appletTrustSettings configuration file and bypass user approval to execute the applet via a crafted web page, possibly related to line breaks.
| Type | CWE ID | Description |
|---|---|---|
| text | N/A | n/a |
| Version | Base score | Base severity | Vector |
|---|
| CAPEC ID | Description |
|---|
| Event | Date |
|---|
| Hyperlink | Resource |
|---|---|
| http://www.ubuntu.com/usn/USN-2817-1 | vendor-advisory x_refsource_UBUNTU |
| http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00019.html | vendor-advisory x_refsource_SUSE |
| http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html | x_refsource_CONFIRM |
| http://lists.fedoraproject.org/pipermail/package-announce/2015-September/167120.html | vendor-advisory x_refsource_FEDORA |
| http://www.securitytracker.com/id/1033780 | vdb-entry x_refsource_SECTRACK |
| http://mail.openjdk.java.net/pipermail/distro-pkg-dev/2015-September/033546.html | mailing-list x_refsource_MLIST |
| http://rhn.redhat.com/errata/RHSA-2016-0778.html | vendor-advisory x_refsource_REDHAT |
| http://lists.fedoraproject.org/pipermail/package-announce/2015-September/167130.html | vendor-advisory x_refsource_FEDORA |
| https://bugzilla.redhat.com/show_bug.cgi?id=1233667 | x_refsource_CONFIRM |
| Version | Base score | Base severity | Vector |
|---|
| CAPEC ID | Description |
|---|
| Event | Date |
|---|
| Hyperlink | Resource |
|---|---|
| http://www.ubuntu.com/usn/USN-2817-1 | vendor-advisory x_refsource_UBUNTU x_transferred |
| http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00019.html | vendor-advisory x_refsource_SUSE x_transferred |
| http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html | x_refsource_CONFIRM x_transferred |
| http://lists.fedoraproject.org/pipermail/package-announce/2015-September/167120.html | vendor-advisory x_refsource_FEDORA x_transferred |
| http://www.securitytracker.com/id/1033780 | vdb-entry x_refsource_SECTRACK x_transferred |
| http://mail.openjdk.java.net/pipermail/distro-pkg-dev/2015-September/033546.html | mailing-list x_refsource_MLIST x_transferred |
| http://rhn.redhat.com/errata/RHSA-2016-0778.html | vendor-advisory x_refsource_REDHAT x_transferred |
| http://lists.fedoraproject.org/pipermail/package-announce/2015-September/167130.html | vendor-advisory x_refsource_FEDORA x_transferred |
| https://bugzilla.redhat.com/show_bug.cgi?id=1233667 | x_refsource_CONFIRM x_transferred |
IcedTea-Web before 1.5.3 and 1.6.x before 1.6.1 does not properly sanitize applet URLs, which allows remote attackers to inject applets into the .appletTrustSettings configuration file and bypass user approval to execute the applet via a crafted web page, possibly related to line breaks.
| Date Added | Due Date | Vulnerability Name | Required Action |
|---|---|---|---|
| N/A |
| Type | Version | Base score | Base severity | Vector |
|---|---|---|---|---|
| Primary | 2.0 | 6.8 | MEDIUM | AV:N/AC:M/Au:N/C:P/I:P/A:P |