Red Hat Security Advisory: icedtea-web security update
An update for icedtea-web is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
describes (3)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2019-10185US | high8.6 | — | ||
It was found that icedtea-web up to and including 1.7.2 and 1.8.2 was vulnerable to a zip-slip attack during auto-extraction of a JAR file. An attacker could use this flaw to write… | ||||
| CVE-2019-10181US | high8.1OT elevated | — | ||
It was found that in icedtea-web up to and including 1.7.2 and 1.8.2 executable code could be injected in a JAR file without compromising the signature verification. An attacker co… | ||||
| CVE-2019-10182US | medium6.5 | — | ||
It was found that icedtea-web though 1.7.2 and 1.8.2 did not properly sanitize paths from <jar/> elements in JNLP files. An attacker could trick a victim into running a specially c… | ||||
references
External citations — patches, advisories, analysis.
- https://access.redhat.com/errata/RHSA-2019:2004self
- https://access.redhat.com/security/updates/classification/#importantexternal
- 1724958external
- 1724989external
- 1725928external
- Canonical URLself
remediations (15)
- Fixedicedtea-web-0:1.7.1-17.el8_0.noarch as a component of Red Hat Enterprise Linux AppStream (v. 8)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Web browsers using the IcedTea-Web browser plug-in must be restarted for this update to take effect.
https://access.redhat.com/errata/RHSA-2019:2004 - Fixedicedtea-web-0:1.7.1-17.el8_0.noarch as a component of Red Hat Enterprise Linux AppStream (v. 8)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Web browsers using the IcedTea-Web browser plug-in must be restarted for this update to take effect.
https://access.redhat.com/errata/RHSA-2019:2004 - Fixedicedtea-web-0:1.7.1-17.el8_0.noarch as a component of Red Hat Enterprise Linux AppStream (v. 8)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Web browsers using the IcedTea-Web browser plug-in must be restarted for this update to take effect.
https://access.redhat.com/errata/RHSA-2019:2004 - Fixedicedtea-web-0:1.7.1-17.el8_0.src as a component of Red Hat Enterprise Linux AppStream (v. 8)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Web browsers using the IcedTea-Web browser plug-in must be restarted for this update to take effect.
https://access.redhat.com/errata/RHSA-2019:2004 - Fixedicedtea-web-0:1.7.1-17.el8_0.src as a component of Red Hat Enterprise Linux AppStream (v. 8)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Web browsers using the IcedTea-Web browser plug-in must be restarted for this update to take effect.
https://access.redhat.com/errata/RHSA-2019:2004 - Fixedicedtea-web-0:1.7.1-17.el8_0.src as a component of Red Hat Enterprise Linux AppStream (v. 8)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Web browsers using the IcedTea-Web browser plug-in must be restarted for this update to take effect.
https://access.redhat.com/errata/RHSA-2019:2004 - Fixedicedtea-web-javadoc-0:1.7.1-17.el8_0.noarch as a component of Red Hat Enterprise Linux AppStream (v. 8)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Web browsers using the IcedTea-Web browser plug-in must be restarted for this update to take effect.
https://access.redhat.com/errata/RHSA-2019:2004 - Fixedicedtea-web-javadoc-0:1.7.1-17.el8_0.noarch as a component of Red Hat Enterprise Linux AppStream (v. 8)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Web browsers using the IcedTea-Web browser plug-in must be restarted for this update to take effect.
https://access.redhat.com/errata/RHSA-2019:2004 - Fixedicedtea-web-javadoc-0:1.7.1-17.el8_0.noarch as a component of Red Hat Enterprise Linux AppStream (v. 8)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Web browsers using the IcedTea-Web browser plug-in must be restarted for this update to take effect.
https://access.redhat.com/errata/RHSA-2019:2004 - Workaroundicedtea-web-0:1.7.1-17.el8_0.noarch as a component of Red Hat Enterprise Linux AppStream (v. 8)
No known mitigation.
- Workaroundicedtea-web-0:1.7.1-17.el8_0.noarch as a component of Red Hat Enterprise Linux AppStream (v. 8)
No known mitigation.
- Workaroundicedtea-web-0:1.7.1-17.el8_0.src as a component of Red Hat Enterprise Linux AppStream (v. 8)
No known mitigation.
- Workaroundicedtea-web-0:1.7.1-17.el8_0.src as a component of Red Hat Enterprise Linux AppStream (v. 8)
No known mitigation.
- Workaroundicedtea-web-javadoc-0:1.7.1-17.el8_0.noarch as a component of Red Hat Enterprise Linux AppStream (v. 8)
No known mitigation.
- Workaroundicedtea-web-javadoc-0:1.7.1-17.el8_0.noarch as a component of Red Hat Enterprise Linux AppStream (v. 8)
No known mitigation.
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan