IC
Product
Icedtea-web
4
CVEs
0
On KEV
8.6
Max CVSS
0
New 30D
Severity mix
Critical 0High 3Medium 1Low 0
Watch
Add Icedtea-web to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2019-10185 | 8.6 | Jul 31 | It was found that icedtea-web up to and including 1.7.2 and 1.8.2 was vulnerable to a zip-slip attack during auto-extraction of a JAR file Affected: through 1.7.2; 1.8.2 |
| CVE-2019-10181 | 8.1 | Jul 31 | It was found that in icedtea-web up to and including 1.7.2 and 1.8.2 executable code could be injected in a JAR file without compromising the signature verification Affected: through 1.7.2; 1.8.2 |
| CVE-2015-5236 | 7.5 | Jul 7 | It was discovered that the IcedTea-Web used codebase attribute of the <applet> tag on the HTML page that hosts Java applet in the Same Origin Policy (SOP) checks Affected: All versions, or not specified |
Showing 3