Unscored severity · published Dec 8, 2010
CVE-2010-3860
IcedTea 1.7.x before 1.7.6, 1.8.x before 1.8.3, and 1.9.x before 1.9.2, as based on OpenJDK 6, declares multiple sensitive variables as public, which allows remote attackers to…
–
CVSS
3%
EPSS
No
On KEV
Description
IcedTea 1.7.x before 1.7.6, 1.8.x before 1.8.3, and 1.9.x before 1.9.2, as based on OpenJDK 6, declares multiple sensitive variables as public, which allows remote attackers to obtain sensitive information including (1) user.name, (2) user.home, and (3) java.home system properties, and other sensitive information such as installation directories.
Exploitation
Is it being used?
Exploit prediction (EPSS)3.0% · higher than 87% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IC
Icedtea · Redhat
through 1.9.1; 1.5; 1.5; 1.5; 1.6; 1.7; +4 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2010-3860
CVE.org
https://www.cve.org/CVERecord?id=CVE-2010-3860
blog.fuseyism.com
http://blog.fuseyism.com/index.php/2010/11/24/icedtea6-176-183-and-192-released/
Patch
http://icedtea.classpath.org/hg/release/icedtea6-1.9/rev/9aa0018d8c28
lists.fedoraproject.org
http://lists.fedoraproject.org/pipermail/package-announce/2010-December/051711.html
lists.opensuse.org
http://lists.opensuse.org/opensuse-security-announce/2010-12/msg00000.html
Vendor Advisory
http://secunia.com/advisories/42412
Vendor Advisory
http://secunia.com/advisories/42417
More from Icedtea
8.3
CVE-2017-3512
Vulnerability in the Java SE component of Oracle Java SE (subcomponent: AWT)
3.7
CVE-2017-3544
Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Networking)
3.7
CVE-2017-3533
Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Networking)
3.1
CVE-2017-3539
Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Security)
–
CVE-2015-5235
IcedTea-Web before 1.5.3 and 1.6.x before 1.6.1 does not properly determine the origin of unsigned applets, which allows remote attackers to bypass the approval process or trick…