The Java Web Start framework in IcedTea in OpenJDK before 1.6.0.0-20.b16.fc10 on Fedora 10, and before 1.6.0.0-27.b16.fc11 on Fedora 11, trusts an entire application when at least one of the listed jar files is trusted, which allows context-dependent attackers to execute arbitrary code without the untrusted-code restrictions via a crafted application, related to NetX.
CVSS Details
- CVSS 3.1 Base Score: 9.8
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Suse | — | Upgrade java-1_6_0-openjdk-demoUpgrade java-1_6_0-openjdk-pluginUpgrade java-1_6_0-openjdkUpgrade java-1_6_0-openjdk-javadocUpgrade java-1_6_0-openjdk-develUpgrade java-1_6_0-openjdk-src | Dec 12, 2013 | Aug 10, 2009 |
| Ubuntu | — | Upgrade openjdk-6-jre-libUpgrade openjdk-6-jreUpgrade icedtea6-plugin | Nov 8, 2024 | Aug 10, 2009 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub