Unscored severity · published Oct 9, 2015
CVE-2015-5234
IcedTea-Web before 1.5.3 and 1.6.x before 1.6.1 does not properly sanitize applet URLs, which allows remote attackers to inject applets into the .appletTrustSettings configuration…
–
CVSS
2.1%
EPSS
No
On KEV
Description
IcedTea-Web before 1.5.3 and 1.6.x before 1.6.1 does not properly sanitize applet URLs, which allows remote attackers to inject applets into the .appletTrustSettings configuration file and bypass user approval to execute the applet via a crafted web page, possibly related to line breaks.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.1% · higher than 82% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EL
Enterprise Linux Desktop · Redhat
6.0 · source: NVD
EL
Enterprise Linux Hpc Node · Redhat
6.0 · source: NVD
EL
Enterprise Linux Server · Redhat
6.0 · source: NVD
EL
Enterprise Linux Workstation · Redhat
6.0 · source: NVD
FE
Fedora · Fedoraproject
21; 22 · source: NVD
IC
Icedtea · Redhat
through 1.5.2; 1.6 · source: NVD
OP
Opensuse · Opensuse
13.1; 13.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2015-5234
CVE.org
https://www.cve.org/CVERecord?id=CVE-2015-5234
Third Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2015-September/167120.html
Third Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2015-September/167130.html
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00019.html
Patch
http://mail.openjdk.java.net/pipermail/distro-pkg-dev/2015-September/033546.html
Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2016-0778.html
www.oracle.com
http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html
More from Fedora
10.0
CVE-2021-44228
Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints
10.0
CVE-2015-3306
ProFTPD Improper Access Control Vulnerability
9.8
CVE-2024-4577
Argument Injection in PHP-CGI
9.8
CVE-2021-44026
Roundcube Webmail SQL Injection Vulnerability
9.8
CVE-2021-42013
Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)