CVE-2019-10185: Path Traversal
It was found that icedtea-web up to and including 1.7.2 and 1.8.2 was vulnerable to a zip-slip attack during auto-extraction of a JAR file. An attacker could use this flaw to write files to arbitrary locations. This could also be used to replace the main running application and, possibly, break out of the sandbox.
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is CVE-2019-10185?
CVE-2019-10185 is a vulnerability in icedtea-web up to and including versions 1.7.2 and 1.8.2 that allows an attacker to write files to arbitrary locations and potentially replace the main running application.
How does CVE-2019-10185 work?
CVE-2019-10185 is a zip-slip vulnerability that occurs during auto-extraction of a JAR file, allowing an attacker to write files to unintended locations.
What is the severity of CVE-2019-10185?
CVE-2019-10185 has a severity rating of 8.6, which is considered high.
Which software versions are affected by CVE-2019-10185?
CVE-2019-10185 affects icedtea-web versions up to and including 1.7.2 and 1.8.2, as well as Debian Linux 8.0 and openSUSE Leap 15.0.
How can I mitigate CVE-2019-10185?
To mitigate CVE-2019-10185, it is recommended to update to the latest version of icedtea-web and apply any patches or security updates provided by the vendor.