VulnerabilityModified
CVE-2011-0025
IcedTea 1.7 before 1.7.8, 1.8 before 1.8.5, and 1.9 before 1.9.5 does not properly verify signatures for JAR files that (1) are "partially signed" or (2) signed by multiple entities, which allows remote attackers to trick users into executing code that…
MEDIUM 6.8EPSS 2.58%
Does this matter?
Lower severity and a low EPSS score (2.58%). Track it; it rarely justifies an emergency change on its own.
Description
IcedTea 1.7 before 1.7.8, 1.8 before 1.8.5, and 1.9 before 1.9.5 does not properly verify signatures for JAR files that (1) are "partially signed" or (2) signed by multiple entities, which allows remote attackers to trick users into executing code that appears to come from a trusted source.
- CVSS 2.0
- 6.8 MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
- EPSS
- 2.58% probability · 84th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-20
- Affected
- redhat/icedtea
- Source
- secalert@redhat.com
References
- http://blog.fuseyism.com/index.php/2011/02/01/security-icedtea6-178-185-195-released/Patch
- http://icedtea.classpath.org/hg/release/icedtea-web-1.0?cmd=changeset%3Bnode=3bd328e4b515
- http://secunia.com/advisories/43135Vendor Advisory
- http://security.gentoo.org/glsa/glsa-201406-32.xml
- http://www.debian.org/security/2011/dsa-2224
- http://www.mandriva.com/security/advisories?name=MDVSA-2011:054
- http://www.securityfocus.com/bid/46110
- http://www.ubuntu.com/usn/USN-1055-1
- https://exchange.xforce.ibmcloud.com/vulnerabilities/65151
- http://blog.fuseyism.com/index.php/2011/02/01/security-icedtea6-178-185-195-released/Patch
- http://icedtea.classpath.org/hg/release/icedtea-web-1.0?cmd=changeset%3Bnode=3bd328e4b515
- http://secunia.com/advisories/43135Vendor Advisory
- http://security.gentoo.org/glsa/glsa-201406-32.xml
- http://www.debian.org/security/2011/dsa-2224
- http://www.mandriva.com/security/advisories?name=MDVSA-2011:054
- http://www.securityfocus.com/bid/46110
- http://www.ubuntu.com/usn/USN-1055-1
- https://exchange.xforce.ibmcloud.com/vulnerabilities/65151
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.