CVE-2019-10181
icedtea-web: unsigned code injection in a signed JAR file
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
It was found that in icedtea-web up to and including 1.7.2 and 1.8.2 executable code could be injected in a JAR file without compromising the signature verification. An attacker could use this flaw to inject code in a trusted JAR. The code would be executed inside the sandbox.
Se descubrió icedtea-web hasta 1.7.2 y 1.8.2 inclusive con código ejecutable podría ser inyectado en un archivo JAR sin comprometer la verificación de la firma. Un atacante podría usar este defecto para inyectar un código en un archivo JAR seguro. El código podría ser ejecutado dentro de sandbox
It was found that executable code could be injected in a JAR file without compromising the signature verification. An attacker could use this flaw to inject code in a trusted JAR. The code would be executed inside the sandbox.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2019-03-27 CVE Reserved
- 2019-07-31 CVE Published
- 2024-07-24 EPSS Updated
- 2024-08-04 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-345: Insufficient Verification of Data Authenticity
CAPEC
References (10)
| URL | Tag | Source |
|---|---|---|
| http://packetstormsecurity.com/files/154748/IcedTeaWeb-Validation-Bypass-Directory-Traversal-Code-Execution.html | Third Party Advisory |
|
| https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10181 | Issue Tracking | |
| https://github.com/AdoptOpenJDK/IcedTea-Web/issues/327 | Third Party Advisory | |
| https://lists.debian.org/debian-lts-announce/2019/09/msg00008.html | Mailing List |
|
| https://seclists.org/bugtraq/2019/Oct/5 | Mailing List |
|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| https://github.com/AdoptOpenJDK/IcedTea-Web/pull/344 | 2023-02-12 | |
| https://security.gentoo.org/glsa/202107-51 | 2023-02-12 |
| URL | Date | SRC |
|---|---|---|
| http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00045.html | 2023-02-12 | |
| https://access.redhat.com/security/cve/CVE-2019-10181 | 2019-07-31 | |
| https://bugzilla.redhat.com/show_bug.cgi?id=1725928 | 2019-07-31 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Icedtea-web Project Search vendor "Icedtea-web Project" | Icedtea-web Search vendor "Icedtea-web Project" for product "Icedtea-web" | <= 1.7.2 Search vendor "Icedtea-web Project" for product "Icedtea-web" and version " <= 1.7.2" | - |
Affected
| ||||||
| Icedtea-web Project Search vendor "Icedtea-web Project" | Icedtea-web Search vendor "Icedtea-web Project" for product "Icedtea-web" | 1.8.2 Search vendor "Icedtea-web Project" for product "Icedtea-web" and version "1.8.2" | - |
Affected
| ||||||
| Debian Search vendor "Debian" | Debian Linux Search vendor "Debian" for product "Debian Linux" | 8.0 Search vendor "Debian" for product "Debian Linux" and version "8.0" | - |
Affected
| ||||||
| Opensuse Search vendor "Opensuse" | Leap Search vendor "Opensuse" for product "Leap" | 15.0 Search vendor "Opensuse" for product "Leap" and version "15.0" | - |
Affected
| ||||||