oss-sec mailing list archives
icedtea-web: CVE-2019-10181 CVE-2019-10182 CVE-2019-10185
From: Cedric Buissart <cbuissar () redhat com>
Date: Wed, 31 Jul 2019 17:26:22 +0200
Hello, The IcedTea-Web project provides a Java web browser plug-in and an implementation of Java Web Start, which is based on the Netx project. Upstream URL : http://icedtea.classpath.org/wiki/IcedTea-Web This is to disclose the following 3 vulnerabilities : CVE-2019-10182 and CVE-2019-10185 are considered High, since they can easily be used to take over the client before checking signatures. All versions of icedtea-web are believed to be vulnerable. See the following pull request for the proposed fixes : https://github.com/AdoptOpenJDK/IcedTea-Web/pull/344 * CVE-2019-10182 icedtea-web: path traversal while processing <jar/> elements of JNLP files results in arbitrary file overwrite It was found that icedtea-web did not properly sanitize paths from <jar/> elements in JNLP files. An attacker could trick a victim into running a specially crafted application and use this flaw to upload arbitrary files to arbitrary locations in the context of the user. * CVE-2019-10185 icedtea-web: directory traversal in the nested jar auto-extraction leading to arbitrary file overwrite It was found that icedtea-web was vulnerable to a zip-slip attack during auto-extraction of a JAR file. An attacker could use this flaw to write files to arbitrary locations. This could also be used to replace the main running application and, possibly, break out of the sandbox. * CVE-2019-10181 icedtea-web: unsigned code injection in a signed JAR file It was found that executable code could be injected in a JAR file without compromising the signature verification. An attacker could use this flaw to inject code in a trusted JAR. The code would be executed inside the sandbox. Red Hat would like to thank Imre Rad for reporting all the vulnerabilities above. Thanks!
Attachment:
signature.asc
Description:
Current thread:
- icedtea-web: CVE-2019-10181 CVE-2019-10182 CVE-2019-10185 Cedric Buissart (Jul 31)