PT-2015-6810 · Icedtea+4 · Icedtea-Web+4

Andrea Palazzo · Publicado 2015-09-15 · Atualizado 2018-10-30 · CVE-2015-5235

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions IcedTea-Web versions prior to 1.5.3 IcedTea-Web versions 1.6.x prior to 1.6.1

Description The issue allows remote attackers to bypass the approval process or trick users into approving applet execution via a crafted web page, due to improper determination of the origin of unsigned applets.

Recommendations For versions prior to 1.5.3, update to version 1.5.3 or later. For versions 1.6.x prior to 1.6.1, update to version 1.6.1 or later.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CESA-2016_0778

CVE-2015-5235

MGASA-2015-0376

OPENSUSE-SU-2015_1595-1

OPENSUSE-SU-2024:10316-1

RHSA-2016:0778

RHSA-2016_0778

SUSE-SU-2015:1682-1

SUSE-SU-2015:1689-1

USN-2817-1

Produtos afetados

Centos

Icedtea-Web

Red Hat

Suse

Ubuntu

Referências · 48

• https://suse.com/security/cve/CVE-2015-5234 · Nota
• https://suse.com/support/update/announcement/2015/suse-su-20151682-1 · Nota
• http://ubuntu.com/usn/USN-2817-1 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2015-5234.html · Nota
• https://lists.centos.org/pipermail/centos-cr-announce/2016-May/022414.html · Nota
• https://ubuntu.com/security/CVE-2015-5234 · Aviso do Fabricante
• https://ubuntu.com/security/notices/USN-2817-1 · Aviso do Fabricante
• https://osv.dev/vulnerability/MGASA-2015-0376 · Aviso do Fabricante
• https://bugzilla.redhat.com/show_bug.cgi?id=1233697 · Nota
• https://lists.centos.org/pipermail/centos-cr-announce/2016-May/029104.html · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2015-5235 · Nota de Segurança
• https://rhn.redhat.com/errata/RHSA-2016-0778.html · Nota
• https://advisories.mageia.org/MGASA-2015-0376.html · Nota de Segurança
• https://suse.com/security/cve/CVE-2015-5235.html · Nota
• http://securitytracker.com/id/1033780 · Nota