CVE-2011-0025: Input Validation
IcedTea 1.7 before 1.7.8, 1.8 before 1.8.5, and 1.9 before 1.9.5 does not properly verify signatures for JAR files that (1) are "partially signed" or (2) signed by multiple entities, which allows remote attackers to trick users into executing code that appears to come from a trusted source.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2011-0025?
CVE-2011-0025 is a moderate severity vulnerability that could allow remote code execution due to improper verification of JAR file signatures.
How do I fix CVE-2011-0025?
To fix CVE-2011-0025, you should update IcedTea to version 1.7.8, 1.8.5, or 1.9.5 or later.
Which versions of IcedTea are affected by CVE-2011-0025?
Versions of IcedTea affected by CVE-2011-0025 include 1.7.0 through 1.7.7, 1.8.0 through 1.8.4, and 1.9.0 through 1.9.4.
What types of attacks can exploit CVE-2011-0025?
CVE-2011-0025 can be exploited by tricking users into executing malicious code crafted to appear as from a trusted source.
What are the implications of CVE-2011-0025 for users?
Users affected by CVE-2011-0025 could potentially execute untrusted code, leading to unauthorized access or control over their systems.