NVD

Id
26445  
Name
CVE-2015-5234  
Description
IcedTea-Web before 1.5.3 and 1.6.x before 1.6.1 does not properly sanitize applet URLs, which allows remote attackers to inject applets into the .appletTrustSettings configuration file and bypass user approval to execute the applet via a crafted web page, possibly related to line breaks.  
Reject
 
CVSS Version
2  
CVSS Score
6.8  
Severity
Medium  
CVSS Base Score
6.8  
CVSS Impact Subscore
6.4  
CVSS Exploit Subscore
8.6  
CVSS Vector
(AV:N/AC:M/Au:N/C:P/I:P/A:P)  
Pub Date
2017-01-19  
Published
2015-10-09  
Modified Date
2016-12-07  
Seq
2015-5234  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
139819 26445 CVE-2015-5234 FEDORA-2015-15676  View
139820 26445 CVE-2015-5234 FEDORA-2015-15677  View
139821 26445 CVE-2015-5234 openSUSE-SU-2015:1595  View
139822 26445 CVE-2015-5234 [distro-pkg-dev] 20150911 IcedTea-Web 1.6.1 and 1.5.3 released  View
139823 26445 CVE-2015-5234 RHSA-2016:0778  View
139824 26445 CVE-2015-5234 http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html  View
139825 26445 CVE-2015-5234 1033780  View
139826 26445 CVE-2015-5234 USN-2817-1  View
139827 26445 CVE-2015-5234 https://bugzilla.redhat.com/show_bug.cgi?id=1233667  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
9865 JVNDB-2015-005185 IcedTea-Web における .appletTrustSettings 設定ファイルにアプレットを挿入される脆弱性 IcedTea-Web は、アプレットの URL を適切にサニタイズしないため、.appletTrustSettings 設定ファイルにアプレットを挿入され、アプレットの実行に対するユーザの承認を回避される脆弱性が存在します。 CVE-2015-5234 82459 CVE-2015-5234 26445 6.8 http://jvndb.jvn.jp/ja/contents/2015/JVNDB-2015-005185.html 2015-09-11 2015-10-14 View