CVE-2011-2514
The Java Network Launching Protocol (JNLP) implementation in IcedTea6 1.9.x before 1.9.9 and...
The Java Network Launching Protocol (JNLP) implementation in IcedTea6 1.9.x before 1.9.9 and before 1.8.9, and IcedTea-Web 1.1.x before 1.1.1 and before 1.0.4, allows remote attackers to trick victims into granting access to local files by modifying the content of the Java Web Start Security Warning dialog box to represent a different filename than the file for which access will be granted.
Exploit likelihood
What each source reports
NVD Score used
The Java Network Launching Protocol (JNLP) implementation in IcedTea6 1.9.x before 1.9.9 and before 1.8.9, and IcedTea-Web 1.1.x before 1.1.1 and before 1.0.4, allows remote attackers to trick victims into granting access to local files by modifying the content of the Java Web Start Security Warning dialog box to represent a different filename than the file for which access will be granted.
- Record
CVE-2011-2514- CVSS 2.0
- 6.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:P - Weakness
- CWE-264
- Updated
- 2026-11-02
CVE List No score
The Java Network Launching Protocol (JNLP) implementation in IcedTea6 1.9.x before 1.9.9 and before 1.8.9, and IcedTea-Web 1.1.x before 1.1.1 and before 1.0.4, allows remote attackers to trick victims into granting access to local files by modifying the content of the Java Web Start Security Warning dialog box to represent a different filename than the file for which access will be granted.
- Record
CVE-2011-2514- Updated
- 2026-11-02
EUVDEUVD-2011-2499 No score
The Java Network Launching Protocol (JNLP) implementation in IcedTea6 1.9.x before 1.9.9 and before 1.8.9, and IcedTea-Web 1.1.x before 1.1.1 and before 1.0.4, allows remote attackers to trick victims into granting access to local files by modifying the content of the Java Web Start Security Warning dialog box to represent a different filename than the file for which access will be granted.
- Record
EUVD-2011-2499- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-mfx6-3x7c-57wf No score
The Java Network Launching Protocol (JNLP) implementation in IcedTea6 1.9.x before 1.9.9 and...
The Java Network Launching Protocol (JNLP) implementation in IcedTea6 1.9.x before 1.9.9 and before 1.8.9, and IcedTea-Web 1.1.x before 1.1.1 and before 1.0.4, allows remote attackers to trick victims into granting access to local files by modifying the content of the Java Web Start Security Warning dialog box to represent a different filename than the file for which access will be granted.
- Record
GHSA-mfx6-3x7c-57wf- Updated
- 2026-11-02
OSV No score
The Java Network Launching Protocol (JNLP) implementation in IcedTea6 1.9.x before 1.9.9 and before 1.8.9, and IcedTea-Web 1.1.x before 1.1.1 and before 1.0.4, allows remote attackers to trick victims into granting access to local files by modifying the content of the Java Web Start Security Warning dialog box to represent a different filename than the file for which access will be granted.
- Record
CVE-2011-2514- Updated
- 2026-11-02
OSVDEBIAN-CVE-2011-2514 No score
The Java Network Launching Protocol (JNLP) implementation in IcedTea6 1.9.x before 1.9.9 and before 1.8.9, and IcedTea-Web 1.1.x before 1.1.1 and before 1.0.4, allows remote attackers to trick victims into granting access to local files by modifying the content of the Java Web Start Security Warning dialog box to represent a different filename than the file for which access will be granted.
- Record
DEBIAN-CVE-2011-2514- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10316-1 No score
icedtea-web-javadoc-1.6.2-3.3 on GA media
These are all security issues fixed in the icedtea-web-javadoc-1.6.2-3.3 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10316-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
icedtea-webDebian:12 |
before 1.1-1 | 1.1-1 |
icedtea-webDebian:13 |
before 1.1-1 | 1.1-1 |
icedtea-webDebian:14 |
before 1.1-1 | 1.1-1 |
icedtea-webRed Hat:enterprise_linux:6::server From an advisory covering 2 CVEs |
before 0:1.0.4-2.el6_1 | 0:1.0.4-2.el6_1 |
icedtea-web-debuginfoRed Hat:enterprise_linux:6::server From an advisory covering 2 CVEs |
before 0:1.0.4-2.el6_1 | 0:1.0.4-2.el6_1 |
icedtea-web-javadocRed Hat:enterprise_linux:6::server From an advisory covering 2 CVEs |
before 0:1.0.4-2.el6_1 | 0:1.0.4-2.el6_1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2011-2514 is a medium vulnerability (CVSS 6.8) in Redhat Icedtea-web, published May 14, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.40%, the 84th percentile. Fixed in icedtea-web 1.1-1.
References
mail.openjdk.java.net/pipermail/distro-pkg-dev/2011-July/015171.html
ubuntu.com/usn/usn-1178-1
rhn.redhat.com/errata/RHSA-2011-1100.html
icedtea.classpath.org/hg/release/icedtea-web-1.0/rev/b99f9a9769e0
Show 25 moreShow less
bugzilla.redhat.com/show_bug.cgi?id=718170
securitytracker.com/id?1025854
nvd.nist.gov/vuln/detail/CVE-2011-2514
github.com/advisories/GHSA-mfx6-3x7c-57wf
security-tracker.debian.org/tracker/CVE-2011-2514
access.redhat.com/errata/RHSA-2011:1100
security.access.redhat.com/data/csaf/v2/advisories/2011/rhsa-2011_1100.json
cve.org/CVERecord?id=CVE-2011-2513
suse.com/security/cve/CVE-2011-2513