CVE-2010-3860
IcedTea System property information leak via public static
Severity Score
7.5
*CVSS v3
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
0
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
-
*SSVC
Descriptions
IcedTea 1.7.x before 1.7.6, 1.8.x before 1.8.3, and 1.9.x before 1.9.2, as based on OpenJDK 6, declares multiple sensitive variables as public, which allows remote attackers to obtain sensitive information including (1) user.name, (2) user.home, and (3) java.home system properties, and other sensitive information such as installation directories.
IcedTea anterior v1.9.2, como el basado en OpenJDK v6, declara múltiples variables sensibles como públicas, lo que permite a atacantes remotos obtener información sensible incluida en las propiedades del sistema (1) user.name, (2) user.home, y (3) java.home, y otra información referente a los directorios de instalación.
Multiple vulnerabilities have been found in the IcedTea JDK, the worst of which could lead to arbitrary code execution. Versions less than 6.1.13.3 are affected.
*Credits:
N/A
CVSS Scores
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:-
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2010-10-08 CVE Reserved
- 2010-12-08 CVE Published
- 2024-08-07 CVE Updated
- 2025-03-30 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
CAPEC
References (16)
| URL | Tag | Source |
|---|---|---|
| http://blog.fuseyism.com/index.php/2010/11/24/icedtea6-176-183-and-192-released | X_refsource_confirm | |
| http://secunia.com/advisories/43085 | Third Party Advisory | |
| http://www.securityfocus.com/bid/45114 | Vdb Entry | |
| http://www.vupen.com/english/advisories/2011/0215 | Vdb Entry |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| http://icedtea.classpath.org/hg/release/icedtea6-1.9/rev/9aa0018d8c28 | 2014-10-04 | |
| https://bugzilla.redhat.com/show_bug.cgi?id=645843 | 2011-01-25 |
| URL | Date | SRC |
|---|---|---|
| http://lists.fedoraproject.org/pipermail/package-announce/2010-December/051711.html | 2014-10-04 | |
| http://lists.opensuse.org/opensuse-security-announce/2010-12/msg00000.html | 2014-10-04 | |
| http://secunia.com/advisories/42412 | 2014-10-04 | |
| http://secunia.com/advisories/42417 | 2014-10-04 | |
| http://security.gentoo.org/glsa/glsa-201406-32.xml | 2014-10-04 | |
| http://www.redhat.com/support/errata/RHSA-2011-0176.html | 2014-10-04 | |
| http://www.ubuntu.com/usn/USN-1024-1 | 2014-10-04 | |
| http://www.vupen.com/english/advisories/2010/3090 | 2014-10-04 | |
| http://www.vupen.com/english/advisories/2010/3108 | 2014-10-04 | |
| https://access.redhat.com/security/cve/CVE-2010-3860 | 2011-01-25 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Redhat Search vendor "Redhat" | Icedtea Search vendor "Redhat" for product "Icedtea" | <= 1.9.1 Search vendor "Redhat" for product "Icedtea" and version " <= 1.9.1" | - |
Affected
| ||||||
| Redhat Search vendor "Redhat" | Icedtea Search vendor "Redhat" for product "Icedtea" | 1.5 Search vendor "Redhat" for product "Icedtea" and version "1.5" | rc1 |
Affected
| ||||||
| Redhat Search vendor "Redhat" | Icedtea Search vendor "Redhat" for product "Icedtea" | 1.5 Search vendor "Redhat" for product "Icedtea" and version "1.5" | rc2 |
Affected
| ||||||
| Redhat Search vendor "Redhat" | Icedtea Search vendor "Redhat" for product "Icedtea" | 1.5 Search vendor "Redhat" for product "Icedtea" and version "1.5" | rc3 |
Affected
| ||||||
| Redhat Search vendor "Redhat" | Icedtea Search vendor "Redhat" for product "Icedtea" | 1.6 Search vendor "Redhat" for product "Icedtea" and version "1.6" | - |
Affected
| ||||||
| Redhat Search vendor "Redhat" | Icedtea Search vendor "Redhat" for product "Icedtea" | 1.7 Search vendor "Redhat" for product "Icedtea" and version "1.7" | - |
Affected
| ||||||
| Redhat Search vendor "Redhat" | Icedtea Search vendor "Redhat" for product "Icedtea" | 1.8 Search vendor "Redhat" for product "Icedtea" and version "1.8" | - |
Affected
| ||||||
| Redhat Search vendor "Redhat" | Icedtea Search vendor "Redhat" for product "Icedtea" | 1.8.1 Search vendor "Redhat" for product "Icedtea" and version "1.8.1" | - |
Affected
| ||||||
| Redhat Search vendor "Redhat" | Icedtea Search vendor "Redhat" for product "Icedtea" | 1.8.2 Search vendor "Redhat" for product "Icedtea" and version "1.8.2" | - |
Affected
| ||||||
| Redhat Search vendor "Redhat" | Icedtea Search vendor "Redhat" for product "Icedtea" | 1.9 Search vendor "Redhat" for product "Icedtea" and version "1.9" | - |
Affected
| ||||||