National Cyber Awareness System

Vulnerability Summary for CVE-2010-4351

Overview

The JNLP SecurityManager in IcedTea (IcedTea.so) 1.7 before 1.7.7, 1.8 before 1.8.4, and 1.9 before 1.9.4 for Java OpenJDK returns from the checkPermission method instead of throwing an exception in certain circumstances, which might allow context-dependent attackers to bypass the intended security policy by creating instances of ClassLoader.

Impact

CVSS Severity (version 2.0):

CVSS Version 2 Metrics:

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

External Source: CONFIRM

Name: https://bugzilla.redhat.com/show_bug.cgi?id=663680

Type: Patch Information

Hyperlink:https://bugzilla.redhat.com/show_bug.cgi?id=663680

External Source: XF

Name: icedtea-jnlp-code-execution(64893)

Hyperlink:http://xforce.iss.net/xforce/xfdb/64893

External Source: MISC

Name: http://www.zerodayinitiative.com/advisories/ZDI-11-014/

Hyperlink:http://www.zerodayinitiative.com/advisories/ZDI-11-014/

External Source: VUPEN

Name: ADV-2011-0239

Hyperlink:http://www.vupen.com/english/advisories/2011/0239

External Source: VUPEN

Name: ADV-2011-0215

Hyperlink:http://www.vupen.com/english/advisories/2011/0215

External Source: VUPEN

Name: ADV-2011-0166

Type: Advisory

Hyperlink:http://www.vupen.com/english/advisories/2011/0166

External Source: VUPEN

Name: ADV-2011-0165

Type: Advisory

Hyperlink:http://www.vupen.com/english/advisories/2011/0165

External Source: UBUNTU

Name: USN-1055-1

Hyperlink:http://www.ubuntu.com/usn/USN-1055-1

External Source: UBUNTU

Name: USN-1052-1

Hyperlink:http://www.ubuntu.com/usn/USN-1052-1

External Source: BID

Name: 45894

Hyperlink:http://www.securityfocus.com/bid/45894

External Source: REDHAT

Name: RHSA-2011:0176

Hyperlink:http://www.redhat.com/support/errata/RHSA-2011-0176.html

External Source: MANDRIVA

Name: MDVSA-2011:054

Hyperlink:http://www.mandriva.com/security/advisories?name=MDVSA-2011:054

External Source: DEBIAN

Name: DSA-2224

Hyperlink:http://www.debian.org/security/2011/dsa-2224

External Source: SECUNIA

Name: 43135

Hyperlink:http://secunia.com/advisories/43135

External Source: SECUNIA

Name: 43085

Hyperlink:http://secunia.com/advisories/43085

External Source: SECUNIA

Name: 43078

Hyperlink:http://secunia.com/advisories/43078

External Source: SECUNIA

Name: 43002

Type: Advisory

Hyperlink:http://secunia.com/advisories/43002

External Source: OSVDB

Name: 70605

Hyperlink:http://osvdb.org/70605

External Source: FEDORA

Name: FEDORA-2011-0500

Hyperlink:http://lists.fedoraproject.org/pipermail/package-announce/2011-January/053288.html

External Source: FEDORA

Name: FEDORA-2011-0521

Hyperlink:http://lists.fedoraproject.org/pipermail/package-announce/2011-January/053276.html

External Source: CONFIRM

Name: http://blog.fuseyism.com/index.php/2011/01/18/security-icedtea6-177-184-194-released/

Hyperlink:http://blog.fuseyism.com/index.php/2011/01/18/security-icedtea6-177-184-194-released/