CVE-2019-10185: Path Traversal
First published: Wed Jul 31 2019(Updated: )
It was found that icedtea-web up to and including 1.7.2 and 1.8.2 was vulnerable to a zip-slip attack during auto-extraction of a JAR file. An attacker could use this flaw to write files to arbitrary locations. This could also be used to replace the main running application and, possibly, break out of the sandbox.
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Icedtea-web Project Icedtea-web | <=1.7.2 | |
| Icedtea-web Project Icedtea-web | =1.8.2 | |
| Debian Debian Linux | =8.0 | |
| openSUSE Leap | =15.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00045.html
- http://packetstormsecurity.com/files/154748/IcedTeaWeb-Validation-Bypass-Directory-Traversal-Code-Execution.html
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10185
- https://github.com/AdoptOpenJDK/IcedTea-Web/issues/327
- https://github.com/AdoptOpenJDK/IcedTea-Web/pull/344
- https://lists.debian.org/debian-lts-announce/2019/09/msg00008.html
- https://seclists.org/bugtraq/2019/Oct/5
- https://security.gentoo.org/glsa/202107-51
Frequently Asked Questions
What is CVE-2019-10185?
CVE-2019-10185 is a vulnerability in icedtea-web up to and including versions 1.7.2 and 1.8.2 that allows an attacker to write files to arbitrary locations and potentially replace the main running application.
How does CVE-2019-10185 work?
CVE-2019-10185 is a zip-slip vulnerability that occurs during auto-extraction of a JAR file, allowing an attacker to write files to unintended locations.
What is the severity of CVE-2019-10185?
CVE-2019-10185 has a severity rating of 8.6, which is considered high.
Which software versions are affected by CVE-2019-10185?
CVE-2019-10185 affects icedtea-web versions up to and including 1.7.2 and 1.8.2, as well as Debian Linux 8.0 and openSUSE Leap 15.0.
How can I mitigate CVE-2019-10185?
To mitigate CVE-2019-10185, it is recommended to update to the latest version of icedtea-web and apply any patches or security updates provided by the vendor.
- collector/nvd-index
- agent/weakness
- agent/type
- agent/references
- agent/severity
- agent/author
- agent/tags
- agent/event
- agent/description
- agent/remedy
- agent/last-modified-date
- agent/softwarecombine
- agent/first-publish-date
- collector/mitre-cve
- source/MITRE
- vendor/icedtea-web project
- canonical/icedtea-web project icedtea-web
- version/icedtea-web project icedtea-web/1.7.2
- version/icedtea-web project icedtea-web/1.8.2
- vendor/debian
- canonical/debian debian linux
- version/debian debian linux/8.0
- vendor/opensuse
- canonical/opensuse leap
- version/opensuse leap/15.0