PT-2014-2124 · Icedtea+1 · Icedtea6+2

Omair Majid · Published 2011-07-27 · Updated 2014-06-25 · CVE-2011-2514

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions IcedTea6 versions 1.9.x through 1.9.8 IcedTea6 versions 1.8.x through 1.8.8 IcedTea-Web versions 1.1.x through 1.1.0 IcedTea-Web versions 1.0.x through 1.0.3

Description The issue allows remote attackers to deceive victims into granting access to local files. This is achieved by modifying the content of the Java Web Start Security Warning dialog box, making it represent a different filename than the file for which access will be granted.

Recommendations For IcedTea6 versions 1.9.x through 1.9.8, update to version 1.9.9 or later. For IcedTea6 versions 1.8.x through 1.8.8, update to version 1.8.9 or later. For IcedTea-Web versions 1.1.x through 1.1.0, update to version 1.1.1 or later. For IcedTea-Web versions 1.0.x through 1.0.3, update to version 1.0.4 or later.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2011-2514

OPENSUSE-SU-2024:10316-1

RHSA-2011:1100

RHSA-2011_1100

Affected Products

Icedtea-Web

Icedtea6

Red Hat

References · 16

• http://mail.openjdk.java.net/pipermail/distro-pkg-dev/2011-July/015171.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2011-2514 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2011-2514 · Security Note
• http://rhn.redhat.com/errata/RHSA-2011-1100.html · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2011-2514 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2011-2514 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2011-1100.html · Vendor Advisory
• http://icedtea.classpath.org/hg/release/icedtea-web-1.1/rev/512de5d90388 · Note
• http://icedtea.classpath.org/hg/release/icedtea-web-1.0/rev/b99f9a9769e0 · Note
• https://access.redhat.com/security/cve/CVE-2011-2513 · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=718170 · Note
• http://securitytracker.com/id?1025854 · Note
• http://ubuntu.com/usn/usn-1178-1 · Patch, Vendor Advisory
• https://access.redhat.com/security/cve/CVE-2011-2514 · Note
• https://access.redhat.com/errata/RHSA-2011:1100 · Note