CVE-2010-3860: Infoleak
IcedTea 1.7.x before 1.7.6, 1.8.x before 1.8.3, and 1.9.x before 1.9.2, as based on OpenJDK 6, declares multiple sensitive variables as public, which allows remote attackers to obtain sensitive information including (1) user.name, (2) user.home, and (3) java.home system properties, and other sensitive information such as installation directories.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2010-3860?
CVE-2010-3860 has been rated as a medium severity vulnerability due to its potential to disclose sensitive information.
How do I fix CVE-2010-3860?
To fix CVE-2010-3860, update IcedTea to version 1.7.6 or later, or 1.8.3 or later, or 1.9.2 or later.
What systems are affected by CVE-2010-3860?
CVE-2010-3860 affects multiple versions of Red Hat IcedTea, including versions up to 1.9.1.
What information can be exposed by CVE-2010-3860?
CVE-2010-3860 allows remote attackers to obtain sensitive system properties, including user.name, user.home, and java.home.
Is CVE-2010-3860 a zero-day vulnerability?
CVE-2010-3860 is not a zero-day vulnerability, as it was publicly disclosed in 2010.