CVSS: 8.3EPSS: 1%CPEs: 5EXPL: 0CVE-2017-3512 – Gentoo Linux Security Advisory 201705-03
https://notcve.org/view.php?id=CVE-2017-3512
24 Apr 2017 — Vulnerability in the Java SE component of Oracle Java SE (subcomponent: AWT). Supported versions that are affected are Java SE: 7u131 and 8u121. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in... • http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html •
CVSS: 4.3EPSS: 0%CPEs: 25EXPL: 0CVE-2017-3533 – OpenJDK: newline injection in the FTP client (Networking, 8170222)
https://notcve.org/view.php?id=CVE-2017-3533
21 Apr 2017 — Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Networking). Supported versions that are affected are Java SE: 6u141, 7u131 and 8u121; Java SE Embedded: 8u121; JRockit: R28.3.13. Difficult to exploit vulnerability allows unauthenticated attacker with network access via FTP to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE, Java SE Embedded,... • http://www.debian.org/security/2017/dsa-3858 • CWE-20: Improper Input Validation •
CVSS: 3.1EPSS: 0%CPEs: 24EXPL: 0CVE-2017-3539 – OpenJDK: MD5 allowed for jar verification (Security, 8171121)
https://notcve.org/view.php?id=CVE-2017-3539
21 Apr 2017 — Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Security). Supported versions that are affected are Java SE: 6u141, 7u131 and 8u121; Java SE Embedded: 8u121. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, i... • http://www.debian.org/security/2017/dsa-3858 • CWE-327: Use of a Broken or Risky Cryptographic Algorithm •
CVSS: 4.3EPSS: 0%CPEs: 33EXPL: 0CVE-2017-3544 – OpenJDK: newline injection in the SMTP client (Networking, 8171533)
https://notcve.org/view.php?id=CVE-2017-3544
21 Apr 2017 — Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Networking). Supported versions that are affected are Java SE: 6u141, 7u131 and 8u121; Java SE Embedded: 8u121; JRockit: R28.3.13. Difficult to exploit vulnerability allows unauthenticated attacker with network access via SMTP to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE, Java SE Embedded... • http://www.debian.org/security/2017/dsa-3858 • CWE-20: Improper Input Validation •
CVSS: 8.1EPSS: 0%CPEs: 10EXPL: 0CVE-2015-5234 – icedtea-web: unexpected permanent authorization of unsigned applets
https://notcve.org/view.php?id=CVE-2015-5234
09 Oct 2015 — IcedTea-Web before 1.5.3 and 1.6.x before 1.6.1 does not properly sanitize applet URLs, which allows remote attackers to inject applets into the .appletTrustSettings configuration file and bypass user approval to execute the applet via a crafted web page, possibly related to line breaks. IcedTea-Web en versiones anteriores a 1.5.3 y 1.6.x anterior a 1.6.1 no limpia correctamente URLs de applet, lo que permite a atacantes remotos inyectar applets en el archivo de configuración .appletTrustSettings y eludir l... • http://lists.fedoraproject.org/pipermail/package-announce/2015-September/167120.html • CWE-20: Improper Input Validation CWE-138: Improper Neutralization of Special Elements •
CVSS: 8.1EPSS: 0%CPEs: 10EXPL: 0CVE-2015-5235 – icedtea-web: applet origin spoofing
https://notcve.org/view.php?id=CVE-2015-5235
09 Oct 2015 — IcedTea-Web before 1.5.3 and 1.6.x before 1.6.1 does not properly determine the origin of unsigned applets, which allows remote attackers to bypass the approval process or trick users into approving applet execution via a crafted web page. IcedTea-Web en versiones anteriores a 1.5.3 y 1.6.x en versiones anteriores a 1.6.1 no determina correctamente el origen de applets no firmados, lo que permite a atacantes remotos eludir el proceso de autorización o engañar al usuario para que acepte la ejecución del appl... • http://lists.fedoraproject.org/pipermail/package-announce/2015-September/167120.html • CWE-20: Improper Input Validation CWE-345: Insufficient Verification of Data Authenticity •
CVSS: 7.5EPSS: 2%CPEs: 18EXPL: 0CVE-2011-0025 – Gentoo Linux Security Advisory 201406-32
https://notcve.org/view.php?id=CVE-2011-0025
04 Feb 2011 — IcedTea 1.7 before 1.7.8, 1.8 before 1.8.5, and 1.9 before 1.9.5 does not properly verify signatures for JAR files that (1) are "partially signed" or (2) signed by multiple entities, which allows remote attackers to trick users into executing code that appears to come from a trusted source. IcedTea v1.7 anterior a v1.7.8, v1.8 anterior a v1.8.5 y v1.9 anterior a v1.9.5 no verifica adecuadamente las firmas de los archivos JAR que (1) están "parcialmente firmados" o (2), firmado por varias entidades, lo que p... • http://blog.fuseyism.com/index.php/2011/02/01/security-icedtea6-178-185-195-released • CWE-20: Improper Input Validation •
CVSS: 9.1EPSS: 1%CPEs: 16EXPL: 0CVE-2010-4351 – Red Hat OpenJDK IcedTea6 ClassLoader Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2010-4351
18 Jan 2011 — The JNLP SecurityManager in IcedTea (IcedTea.so) 1.7 before 1.7.7, 1.8 before 1.8.4, and 1.9 before 1.9.4 for Java OpenJDK returns from the checkPermission method instead of throwing an exception in certain circumstances, which might allow context-dependent attackers to bypass the intended security policy by creating instances of ClassLoader. El JNLP SecurityManager en IcedTea (IcedTea.so) v1.7 anteriores a v1.7.7, v1.8 anteriores a v1.8.4 y v1.9 anteriores a v1.9.4 de Java OpenJDK devuelve desde el método ... • http://blog.fuseyism.com/index.php/2011/01/18/security-icedtea6-177-184-194-released • CWE-264: Permissions, Privileges, and Access Controls CWE-305: Authentication Bypass by Primary Weakness •
CVSS: 7.5EPSS: 1%CPEs: 10EXPL: 0CVE-2010-3860 – IcedTea System property information leak via public static
https://notcve.org/view.php?id=CVE-2010-3860
08 Dec 2010 — IcedTea 1.7.x before 1.7.6, 1.8.x before 1.8.3, and 1.9.x before 1.9.2, as based on OpenJDK 6, declares multiple sensitive variables as public, which allows remote attackers to obtain sensitive information including (1) user.name, (2) user.home, and (3) java.home system properties, and other sensitive information such as installation directories. IcedTea anterior v1.9.2, como el basado en OpenJDK v6, declara múltiples variables sensibles como públicas, lo que permite a atacantes remotos obtener información ... • http://blog.fuseyism.com/index.php/2010/11/24/icedtea6-176-183-and-192-released • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •