Critical severity · published Oct 31, 2019
CVE-2010-2783
IcedTea6 before 1.7.4 allow unsigned apps to read and write arbitrary files, related to Extended JNLP Services
9.1
CVSS
1.9%
EPSS
No
On KEV
Description
IcedTea6 before 1.7.4 allow unsigned apps to read and write arbitrary files, related to Extended JNLP Services.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.9% · higher than 80% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IC
Icedtea6 · Redhat
before 1.7.4 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2010-2783
CVE.org
https://www.cve.org/CVERecord?id=CVE-2010-2783
Patch
http://blog.fuseyism.com/index.php/2010/07/28/icedtea6-174-released/
Third Party Advisory
http://security.gentoo.org/glsa/glsa-201406-32.xml
Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2010-2783
Third Party Advisory
https://security-tracker.debian.org/tracker/CVE-2010-2783
More from Icedtea6
9.8
CVE-2012-1723
Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability
9.1
CVE-2010-2548
IcedTea6 before 1.7.4 does not properly check property access, which allows unsigned apps to read and write arbitrary files
–
CVE-2011-2514
The Java Network Launching Protocol (JNLP) implementation in IcedTea6 1.9.x before 1.9.9 and before 1.8.9, and IcedTea-Web 1.1.x before 1.1.1 and before 1.0.4, allows remote…
–
CVE-2011-2513
The Java Network Launching Protocol (JNLP) implementation in IcedTea6 1.9.x before 1.9.9 and before 1.8.9, and IcedTea-Web 1.1.x before 1.1.1 and before 1.0.4, allows remote…
–
CVE-2012-1717
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 update 32 and earlier, 5 update 35 and earlier, and 1.4.2_37…