CVE-2015-5234
Medium
Description
IcedTea-Web before 1.5.3 and 1.6.x before 1.6.1 does not properly sanitize applet URLs, which allows remote attackers to inject applets into the .appletTrustSettings configuration file and bypass user approval to execute the applet via a crafted web page, possibly related to line breaks.
SeverityMedium
CVSS6.8
Exploit probability—
Product
Redhat Icedtea
PublishedOct 9, 2015
First seenOct 9, 2015
How to fix
Sources list no fixed version or patch link for this vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| redhat icedtea | v ≤ 1.5.2, 1.6 | — |
| redhat enterprise_linux_desktop | 6.0 | — |
| redhat enterprise_linux_hpc_node | 6.0 | — |
| redhat enterprise_linux_server | 6.0 | — |
| redhat enterprise_linux_workstation | 6.0 | — |
| opensuse opensuse | 13.1, 13.2 | — |
| fedoraproject fedora | 21, 22 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.