Unscored severity · published Jan 20, 2011
CVE-2010-4351
The JNLP SecurityManager in IcedTea (IcedTea.so) 1.7 before 1.7.7, 1.8 before 1.8.4, and 1.9 before 1.9.4 for Java OpenJDK returns from the checkPermission method instead of…
–
CVSS
2.5%
EPSS
No
On KEV
Description
The JNLP SecurityManager in IcedTea (IcedTea.so) 1.7 before 1.7.7, 1.8 before 1.8.4, and 1.9 before 1.9.4 for Java OpenJDK returns from the checkPermission method instead of throwing an exception in certain circumstances, which might allow context-dependent attackers to bypass the intended security policy by creating instances of ClassLoader.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.5% · higher than 85% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IC
Icedtea · Redhat
1.7; 1.7.1; 1.7.2; 1.7.3; 1.7.4; 1.7.5; +9 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2010-4351
CVE.org
https://www.cve.org/CVERecord?id=CVE-2010-4351
blog.fuseyism.com
http://blog.fuseyism.com/index.php/2011/01/18/security-icedtea6-177-184-194-released/
lists.fedoraproject.org
http://lists.fedoraproject.org/pipermail/package-announce/2011-January/053276.html
lists.fedoraproject.org
http://lists.fedoraproject.org/pipermail/package-announce/2011-January/053288.html
osvdb.org
http://osvdb.org/70605
Vendor Advisory
http://secunia.com/advisories/43002
secunia.com
http://secunia.com/advisories/43078
More from Icedtea
8.3
CVE-2017-3512
Vulnerability in the Java SE component of Oracle Java SE (subcomponent: AWT)
3.7
CVE-2017-3544
Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Networking)
3.7
CVE-2017-3533
Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Networking)
3.1
CVE-2017-3539
Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Security)
–
CVE-2015-5235
IcedTea-Web before 1.5.3 and 1.6.x before 1.6.1 does not properly determine the origin of unsigned applets, which allows remote attackers to bypass the approval process or trick…