Login Request a demo
Unscored severity · published Feb 18, 2011
CVE-2011-0706
The JNLPClassLoader class in IcedTea-Web before 1.0.1, as used in OpenJDK Runtime Environment 1.6.0, allows remote attackers to gain privileges via unknown vectors related to…
–
CVSS
3.1%
EPSS
No
On KEV
Description
The JNLPClassLoader class in IcedTea-Web before 1.0.1, as used in OpenJDK Runtime Environment 1.6.0, allows remote attackers to gain privileges via unknown vectors related to multiple signers and the assignment of "an inappropriate security descriptor."
Exploitation
Is it being used?
Exploit prediction (EPSS)3.1% · higher than 88% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IC
Icedtea-web · Redhat
1.0; 1.0; 1.0.1 · source: NVD
JD
Jdk · Sun
1.6.0 · source: NVD
Affected product
IC
Icedtea-web
Redhat
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2011-0706
CVE.org
https://www.cve.org/CVERecord?id=CVE-2011-0706
Patch
http://dbhole.wordpress.com/2011/02/15/icedtea-web-1-0-1-released/
lists.fedoraproject.org
http://lists.fedoraproject.org/pipermail/package-announce/2011-February/054115.html
lists.fedoraproject.org
http://lists.fedoraproject.org/pipermail/package-announce/2011-February/054134.html
Vendor Advisory
http://secunia.com/advisories/43350
security.gentoo.org
http://security.gentoo.org/glsa/glsa-201406-32.xml
www.debian.org
http://www.debian.org/security/2011/dsa-2224
More from Icedtea-web
–
CVE-2011-2514
The Java Network Launching Protocol (JNLP) implementation in IcedTea6 1.9.x before 1.9.9 and before 1.8.9, and IcedTea-Web 1.1.x before 1.1.1 and before 1.0.4, allows remote…
–
CVE-2011-2513
The Java Network Launching Protocol (JNLP) implementation in IcedTea6 1.9.x before 1.9.9 and before 1.8.9, and IcedTea-Web 1.1.x before 1.1.1 and before 1.0.4, allows remote…
–
CVE-2013-6493
The LiveConnect implementation in plugin/icedteanp/IcedTeaNPPlugin.cc in IcedTea-Web before 1.4.2 allows local users to read the messages between a Java applet and a web browser…
–
CVE-2011-3377
The web browser plug-in in IcedTea-Web 1.0.x before 1.0.6 and 1.1.x before 1.1.4 allows remote attackers to bypass the Same Origin Policy (SOP) and execute arbitrary script or…
–
CVE-2013-1927
The IcedTea-Web plugin before 1.2.3 and 1.3.x before 1.3.2 allows remote attackers to execute arbitrary code via a crafted file that validates as both a GIF and a Java JAR file,…