PT-2011-2572 · Icedtea+1 · Icedtea-Web+1

Marc Schoenefeld · Published 2011-02-18 · Updated 2023-02-13 · CVE-2011-0706

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions IcedTea-Web versions prior to 1.0.1 OpenJDK Runtime Environment version 1.6.0

Description The issue allows remote attackers to gain privileges via unknown vectors related to multiple signers and the assignment of an inappropriate security descriptor in the JNLPClassLoader class.

Recommendations For IcedTea-Web versions prior to 1.0.1, update to version 1.0.1 or later. For OpenJDK Runtime Environment version 1.6.0, consider upgrading to a newer version that incorporates the fix for this issue.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2011-0706

DSA-2224-1

Affected Products

Icedtea-Web

Openjdk Runtime Environment

References · 13

• http://lists.fedoraproject.org/pipermail/package-announce/2011-February/054115.html · Vendor Advisory
• http://secunia.com/advisories/43350 · Vendor Advisory
• http://security.gentoo.org/glsa/glsa-201406-32.xml · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2011-0706 · Security Note
• http://mandriva.com/security/advisories?name=MDVSA-2011:054 · Vendor Advisory
• http://dbhole.wordpress.com/2011/02/15/icedtea-web-1-0-1-released · Patch
• http://lists.fedoraproject.org/pipermail/package-announce/2011-February/054134.html · Vendor Advisory
• http://debian.org/security/2011/dsa-2224 · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0706 · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=677332 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14117 · Note
• http://securityfocus.com/bid/46439 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/65534 · Note