CVE-2019-10181: High severity oracle icedtea-web vulnerability
It was found that in icedtea-web up to and including 1.7.2 and 1.8.2 executable code could be injected in a JAR file without compromising the signature verification. An attacker could use this flaw to inject code in a trusted JAR. The code would be executed inside the sandbox.
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is CVE-2019-10181?
CVE-2019-10181 is a vulnerability found in icedtea-web up to and including versions 1.7.2 and 1.8.2.
How does CVE-2019-10181 work?
CVE-2019-10181 allows an attacker to inject executable code in a trusted JAR file without compromising the signature verification.
What is the severity of CVE-2019-10181?
The severity of CVE-2019-10181 is high, with a severity value of 8.1.
Which software versions are affected by CVE-2019-10181?
Icedtea-web versions up to and including 1.7.2 and 1.8.2 are affected by CVE-2019-10181, as well as Debian Linux 8.0 and openSUSE Leap 15.0.
How can CVE-2019-10181 be fixed?
To fix CVE-2019-10181, it is recommended to update icedtea-web to a version higher than 1.8.2 and apply any available security patches for the affected operating systems.