The JNLP SecurityManager in IcedTea (IcedTea.so) 1.7 before 1.7.7, 1.8 before 1.8.4, and 1.9 before 1.9.4 for Java OpenJDK returns from the checkPermission method instead of throwing an exception in certain circumstances, which might allow context-dependent attackers to bypass the intended security policy by creating instances of ClassLoader.
CVSS Details
- CVSS 3.1 Base Score: 5
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade java-1.6.0-openjdk-demoUpgrade java-1.6.0-openjdkUpgrade java-1.6.0-openjdk-srcUpgrade java-1.6.0-openjdk-javadocUpgrade java-1.6.0-openjdk-devel | Dec 1, 2016 | Jan 20, 2011 |
| Gentoo Linux | — | Upgrade dev-java/icedtea-bin. | Oct 30, 2017 | Jan 20, 2011 |
| Oracle_linux | — | Upgrade java-1.6.0-openjdk-develUpgrade java-1.6.0-openjdk-demoUpgrade java-1.6.0-openjdk-srcUpgrade java-1.6.0-openjdk-javadocUpgrade java-1.6.0-openjdk | Oct 16, 2024 | Jan 20, 2011 |
| Suse | — | Upgrade java-1_6_0-openjdk-javadocUpgrade java-1_6_0-openjdkUpgrade java-1_6_0-openjdk-srcUpgrade java-1_6_0-openjdk-develUpgrade java-1_6_0-openjdk-demoUpgrade java-1_6_0-openjdk-plugin | Dec 12, 2013 | Jan 20, 2011 |
| Ubuntu | — | Upgrade icedtea6-plugin | Nov 8, 2024 | Jan 20, 2011 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub