Unscored severity · published Oct 9, 2015
CVE-2015-5235
IcedTea-Web before 1.5.3 and 1.6.x before 1.6.1 does not properly determine the origin of unsigned applets, which allows remote attackers to bypass the approval process or trick…
–
CVSS
3%
EPSS
No
On KEV
Description
IcedTea-Web before 1.5.3 and 1.6.x before 1.6.1 does not properly determine the origin of unsigned applets, which allows remote attackers to bypass the approval process or trick users into approving applet execution via a crafted web page.
Exploitation
Is it being used?
Exploit prediction (EPSS)3.0% · higher than 87% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EL
Enterprise Linux Desktop · Redhat
6.0 · source: NVD
EL
Enterprise Linux Hpc Node · Redhat
6 · source: NVD
EL
Enterprise Linux Server · Redhat
6.0 · source: NVD
EL
Enterprise Linux Workstation · Redhat
6.0 · source: NVD
FE
Fedora · Fedoraproject
21; 22 · source: NVD
IC
Icedtea · Redhat
through 1.5.2; 1.6 · source: NVD
OP
Opensuse · Opensuse
13.1; 13.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2015-5235
CVE.org
https://www.cve.org/CVERecord?id=CVE-2015-5235
Third Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2015-September/167120.html
Third Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2015-September/167130.html
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00019.html
Patch
http://mail.openjdk.java.net/pipermail/distro-pkg-dev/2015-September/033546.html
Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2016-0778.html
www.oracle.com
http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html
More from Fedora
10.0
CVE-2021-44228
Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints
10.0
CVE-2015-3306
ProFTPD Improper Access Control Vulnerability
9.8
CVE-2024-4577
Argument Injection in PHP-CGI
9.8
CVE-2021-44026
Roundcube Webmail SQL Injection Vulnerability
9.8
CVE-2021-42013
Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)