IcedTea 1.7.x before 1.7.6, 1.8.x before 1.8.3, and 1.9.x before 1.9.2, as based on OpenJDK 6, declares multiple sensitive variables as public, which allows remote attackers to obtain sensitive information including (1) user.name, (2) user.home, and (3) java.home system properties, and other sensitive information such as installation directories.
CVSS Details
- CVSS 3.1 Base Score: 5.3
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade java-1.6.0-openjdk-demoUpgrade java-1.6.0-openjdk-srcUpgrade java-1.6.0-openjdk-javadocUpgrade java-1.6.0-openjdk-develUpgrade java-1.6.0-openjdk | Dec 1, 2016 | Dec 8, 2010 |
| Gentoo Linux | — | Upgrade dev-java/icedtea-bin. | Oct 30, 2017 | Dec 8, 2010 |
| Oracle_linux | — | Upgrade java-1.6.0-openjdk-javadocUpgrade java-1.6.0-openjdkUpgrade java-1.6.0-openjdk-srcUpgrade java-1.6.0-openjdk-develUpgrade java-1.6.0-openjdk-demo | Oct 16, 2024 | Dec 8, 2010 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Nov 24, 2010 |
| Suse | — | Upgrade java-1_6_0-openjdkUpgrade java-1_6_0-openjdk-demoUpgrade java-1_6_0-openjdk-srcUpgrade java-1_6_0-openjdk-pluginUpgrade java-1_6_0-openjdk-develUpgrade java-1_6_0-openjdk-javadoc | Feb 17, 2015 | Dec 8, 2010 |
| Ubuntu | — | Upgrade openjdk-6-jdkUpgrade openjdk-6-jre-headlessUpgrade openjdk-6-jreUpgrade icedtea6-plugin | Nov 8, 2024 | Dec 8, 2010 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub