CVE-2015-5236: High severity oracle icedtea-web vulnerability
It was discovered that the IcedTea-Web used codebase attribute of the <applet> tag on the HTML page that hosts Java applet in the Same Origin Policy (SOP) checks. As the specified codebase does not have to match the applet's actual origin, this allowed malicious site to bypass SOP via spoofed codebase value.
Note that for Java applets, origin used for SOP checks is the site from which applet was loaded, not the site hosting the page embedding applet:
https://code.google.com/p/browsersec/wiki/Part2#Same-originpolicyforJava
Acknowledgement:
This issue was discovered by Red Hat Product Security.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2015-5236?
CVE-2015-5236 has a medium severity level due to its ability to bypass the Same Origin Policy.
How do I fix CVE-2015-5236?
To fix CVE-2015-5236, update IcedTea-Web to the latest version that addresses this vulnerability.
What systems are affected by CVE-2015-5236?
CVE-2015-5236 affects IcedTea-Web across all versions prior to the patches.
Can CVE-2015-5236 lead to a security breach?
Yes, CVE-2015-5236 can allow attackers to execute unauthorized operations on behalf of the user, potentially leading to a security breach.
What are the implications of CVE-2015-5236?
The implications of CVE-2015-5236 include increased risk of cross-site scripting attacks as the Same Origin Policy is bypassed.