PT-2019-2938 · Icedtea+4 · Icedtea-Web+4
Imre Rad
·
Publicado
2019-07-31
·
Atualizado
2025-05-22
·
CVE-2019-10181
CVSS v3.1
8.1
Alta
| Vetor | AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
icedtea-web versions 1.7.2 and earlier
icedtea-web versions 1.8.2 and earlier
Description
The issue is related to insufficient authentication of data, allowing an attacker to inject executable code into a JAR file without compromising signature verification. This flaw can be exploited by a remote attacker to inject arbitrary code into a trusted JAR, which would be executed inside the sandbox.
Recommendations
For icedtea-web versions 1.7.2 and earlier, update to a version later than 1.7.2 to resolve the issue.
For icedtea-web versions 1.8.2 and earlier, update to a version later than 1.8.2 to resolve the issue.
As a temporary workaround, consider restricting the execution of code inside the sandbox to minimize the risk of exploitation.
Correção
Insufficient Verification of Data Authenticity
Race Condition
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Alt Linux
Centos
Red Hat
Suse
Icedtea-Web