Unscored severity · published Feb 4, 2011
CVE-2011-0025
IcedTea 1.7 before 1.7.8, 1.8 before 1.8.5, and 1.9 before 1.9.5 does not properly verify signatures for JAR files that (1) are "partially signed" or (2) signed by multiple…
–
CVSS
2.6%
EPSS
No
On KEV
Description
IcedTea 1.7 before 1.7.8, 1.8 before 1.8.5, and 1.9 before 1.9.5 does not properly verify signatures for JAR files that (1) are "partially signed" or (2) signed by multiple entities, which allows remote attackers to trick users into executing code that appears to come from a trusted source.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.6% · higher than 85% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IC
Icedtea · Redhat
1.7; 1.7.1; 1.7.2; 1.7.3; 1.7.4; 1.7.5; +12 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2011-0025
CVE.org
https://www.cve.org/CVERecord?id=CVE-2011-0025
Patch
http://blog.fuseyism.com/index.php/2011/02/01/security-icedtea6-178-185-195-released/
icedtea.classpath.org
http://icedtea.classpath.org/hg/release/icedtea-web-1.0?cmd=changeset%3Bnode=3bd328e4b515
Vendor Advisory
http://secunia.com/advisories/43135
security.gentoo.org
http://security.gentoo.org/glsa/glsa-201406-32.xml
www.debian.org
http://www.debian.org/security/2011/dsa-2224
www.mandriva.com
http://www.mandriva.com/security/advisories?name=MDVSA-2011:054
More from Icedtea
8.3
CVE-2017-3512
Vulnerability in the Java SE component of Oracle Java SE (subcomponent: AWT)
3.7
CVE-2017-3544
Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Networking)
3.7
CVE-2017-3533
Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Networking)
3.1
CVE-2017-3539
Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Security)
–
CVE-2015-5235
IcedTea-Web before 1.5.3 and 1.6.x before 1.6.1 does not properly determine the origin of unsigned applets, which allows remote attackers to bypass the approval process or trick…