NetSight
IP …
medium6.8

CVE-2015-5234

IcedTea-Web before 1.5.3 and 1.6.x before 1.6.1 does not properly sanitize applet URLs, which allows remote attackers to inject applets into the .appletTrustSe…

Impact

IcedTea-Web before 1.5.3 and 1.6.x before 1.6.1 does not properly sanitize applet URLs, which allows remote attackers to inject applets into the .appletTrustSettings configuration file and bypass user approval to execute the applet via a crafted web page, possibly related to line breaks.

Affected products

VendorProductAffected versions
RedhatEnterprise Linux Desktop
Version 6.0
RedhatEnterprise Linux Hpc Node
Version 6.0
RedhatEnterprise Linux Server
Version 6.0
RedhatEnterprise Linux Workstation
Version 6.0
OpensuseOpensuse
Versions 13.1, 13.2
RedhatIcedtea
through 1.5.2
Version 1.6
FedoraprojectFedora
Versions 21, 22

Weakness classification

CWE-20

References