CVE-2010-4351
The JNLP SecurityManager in IcedTea (IcedTea.so) 1.7 before 1.7.7, 1.8 before 1.8.4, and 1.9...
The JNLP SecurityManager in IcedTea (IcedTea.so) 1.7 before 1.7.7, 1.8 before 1.8.4, and 1.9 before 1.9.4 for Java OpenJDK returns from the checkPermission method instead of throwing an exception in certain circumstances, which might allow context-dependent attackers to bypass the intended security policy by creating instances of ClassLoader.
Exploit likelihood
What each source reports
NVD Score used
The JNLP SecurityManager in IcedTea (IcedTea.so) 1.7 before 1.7.7, 1.8 before 1.8.4, and 1.9 before 1.9.4 for Java OpenJDK returns from the checkPermission method instead of throwing an exception in certain circumstances, which might allow context-dependent attackers to bypass the intended security policy by creating instances of ClassLoader.
- Record
CVE-2010-4351- CVSS 2.0
- 6.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:P - Weakness
- CWE-264
- Updated
- 2026-11-02
CVE List No score
The JNLP SecurityManager in IcedTea (IcedTea.so) 1.7 before 1.7.7, 1.8 before 1.8.4, and 1.9 before 1.9.4 for Java OpenJDK returns from the checkPermission method instead of throwing an exception in certain circumstances, which might allow context-dependent attackers to bypass the intended security policy by creating instances of ClassLoader.
- Record
CVE-2010-4351- Updated
- 2026-11-02
EUVDEUVD-2010-4320 No score
The JNLP SecurityManager in IcedTea (IcedTea.so) 1.7 before 1.7.7, 1.8 before 1.8.4, and 1.9 before 1.9.4 for Java OpenJDK returns from the checkPermission method instead of throwing an exception in certain circumstances, which might allow context-dependent attackers to bypass the intended security policy by creating instances of ClassLoader.
- Record
EUVD-2010-4320- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-g6jh-xpq2-3rw2 No score
The JNLP SecurityManager in IcedTea (IcedTea.so) 1.7 before 1.7.7, 1.8 before 1.8.4, and 1.9...
The JNLP SecurityManager in IcedTea (IcedTea.so) 1.7 before 1.7.7, 1.8 before 1.8.4, and 1.9 before 1.9.4 for Java OpenJDK returns from the checkPermission method instead of throwing an exception in certain circumstances, which might allow context-dependent attackers to bypass the intended security policy by creating instances of ClassLoader.
- Record
GHSA-g6jh-xpq2-3rw2- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
openjdk-6Debian:5.0 From an advisory covering 10 CVEs |
before 6b18-1.8.7-2~lenny1, plus listed versions 6b11-9.16b11-9.1+lenny26b12-06b12-1~exp16b12~pre1-0 Show 44 moreShow less6b12~pre2-16b14-1.5~pre1-16b14-1.5~pre1-26b14-1.5~pre1-36b14-1.5~pre1-46b14-1.5~pre1-56b14-1~exp16b16-16b16-1.6-16b16-1.6.1-16b16-1.6.1-26b16-1.6~pre2-16b16-26b16-36b16-46b17-1.7-16b17-1.7-1+sh4.16b17~pre3-16b17~pre3-1+sh46b17~pre3-1+sh4.16b18-1.8-16b18-1.8-26b18-1.8-36b18-1.8-46b18-1.8.1-16b18-1.8.1-26b18-1.8.2-16b18-1.8.2-26b18-1.8.2-36b18-1.8.2-46b18-1.8.3-16b18-1.8.3-26b18-1.8.3-2+squeeze16b18-1.8.3-2~lenny16b18-1.8.4-16b18-1.8.5-16b18-1.8.7-16b18~pre1-16b18~pre1-26b18~pre1-36b18~pre1-46b18~pre2-16b18~pre3-16b18~pre4-1 |
6b18-1.8.7-2~lenny1 |
openjdk-6Debian:6.0 From an advisory covering 10 CVEs |
before 6b18-1.8.7-2~squeeze1, plus listed versions 6b18-1.8.3-26b18-1.8.3-2+squeeze16b18-1.8.4-16b18-1.8.5-16b18-1.8.7-16b18-1.8.7-2~lenny1 |
6b18-1.8.7-2~squeeze1 |
java-1.6.0-openjdkRed Hat:enterprise_linux:5::server From an advisory covering 2 CVEs |
before 1:1.6.0.0-1.17.b17.el5 | 1:1.6.0.0-1.17.b17.el5 |
java-1.6.0-openjdk-debuginfoRed Hat:enterprise_linux:5::server From an advisory covering 2 CVEs |
before 1:1.6.0.0-1.17.b17.el5 | 1:1.6.0.0-1.17.b17.el5 |
java-1.6.0-openjdk-demoRed Hat:enterprise_linux:5::server From an advisory covering 2 CVEs |
before 1:1.6.0.0-1.17.b17.el5 | 1:1.6.0.0-1.17.b17.el5 |
java-1.6.0-openjdk-develRed Hat:enterprise_linux:5::server From an advisory covering 2 CVEs |
before 1:1.6.0.0-1.17.b17.el5 | 1:1.6.0.0-1.17.b17.el5 |
java-1.6.0-openjdk-javadocRed Hat:enterprise_linux:5::server From an advisory covering 2 CVEs |
before 1:1.6.0.0-1.17.b17.el5 | 1:1.6.0.0-1.17.b17.el5 |
java-1.6.0-openjdk-srcRed Hat:enterprise_linux:5::server From an advisory covering 2 CVEs |
before 1:1.6.0.0-1.17.b17.el5 | 1:1.6.0.0-1.17.b17.el5 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2010-4351 is a medium vulnerability (CVSS 6.8) in Redhat Icedtea, published January 20, 2011. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.53%, the 85th percentile. No source names a fixed version.
References
blog.fuseyism.com/index.php/2011/01/18/security-icedtea6-177-184-194-released
ubuntu.com/usn/USN-1055-1
security.gentoo.org/glsa/glsa-201406-32.xml
lists.fedoraproject.org/pipermail/package-announce/2011-January/053276.html
securityfocus.com/bid/45894
secunia.com/advisories/43085
Show 28 moreShow less
vupen.com/english/advisories/2011/0215
osvdb.org/70605
zerodayinitiative.com/advisories/ZDI-11-014
debian.org/security/2011/dsa-2224
exchange.xforce.ibmcloud.com/vulnerabilities/64893
bugzilla.redhat.com/show_bug.cgi?id=663680
mandriva.com/security/advisories?name=MDVSA-2011:054
redhat.com/support/errata/RHSA-2011-0176.html
nvd.nist.gov/vuln/detail/CVE-2010-4351
access.redhat.com/errata/RHSA-2011:0176
github.com/advisories/GHSA-g6jh-xpq2-3rw2
icedtea.classpath.org/hg/release/icedtea6-1.7/file/af20d64bc8b9/NEWS
security.access.redhat.com/data/csaf/v2/advisories/2011/rhsa-2011_0176.json
cve.org/CVERecord?id=CVE-2010-3860