{"id":"CVE-2019-10181","aliases":["DEBIAN-CVE-2019-10181","DLA-1914-1","EUVD-2019-2209","GHSA-xv8g-hcfj-ppcw","MGASA-2019-0242","RHSA-2019:2003","RHSA-2019:2004","SUSE-SU-2019:2033-1","SUSE-SU-2022:1259-1","UBUNTU-CVE-2019-10181","openSUSE-SU-2019:1911-1","openSUSE-SU-2024:10855-1"],"status":"published","title":"It was found that in icedtea-web up to and including 1.7.2 and 1.8.2 executable code could be...","description":"It was found that in icedtea-web up to and including 1.7.2 and 1.8.2 executable code could be injected in a JAR file without compromising the signature verification. An attacker could use this flaw to inject code in a trusted JAR. The code would be executed inside the sandbox.","severity":{"version":"3.0","score":6.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-08","score":0.01165,"percentile":0.67515,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-345"],"published":"2019-07-31T16:37:44Z","modified":"2026-10-20T10:50:36Z","fixes":[{"ecosystem":"Debian:12","package":"icedtea-web","fixed_in":["1.8.3-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"icedtea-web","fixed_in":["1.8.3-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"icedtea-web","fixed_in":["1.8.3-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"icedtea-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.3-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"icedtea-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.3-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"icedtea-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.3-1"}]}]},{"source":"osv","ecosystem":"Debian:8","package":"icedtea-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3-1+deb8u1"}]}],"versions":["1.5-2+deb8u1","1.5.1-1","1.5.2-1","1.5.2-1.1","1.5.2~rc1-1","1.5.3-1"],"bundled":3},{"source":"osv","ecosystem":"Mageia:6","package":"icedtea-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.2-4.mga6"}]}],"bundled":3},{"source":"osv","ecosystem":"Mageia:7","package":"icedtea-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8-2.1.mga7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"icedtea-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.1-2.el7_6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"icedtea-web-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.1-2.el7_6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"icedtea-web-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.1-2.el7_6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"icedtea-web-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.1-2.el7_6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"icedtea-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.1-2.el7_6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"icedtea-web-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.1-2.el7_6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"icedtea-web-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.1-2.el7_6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"icedtea-web-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.1-2.el7_6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"icedtea-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.1-2.el7_6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"icedtea-web-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.1-2.el7_6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"icedtea-web-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.1-2.el7_6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"icedtea-web-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.1-2.el7_6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"icedtea-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.1-17.el8_0"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"icedtea-web-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.1-17.el8_0"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 15","package":"icedtea-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.2-3.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP3","package":"icedtea-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.2-150100.7.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP4","package":"icedtea-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.2-150100.7.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP3","package":"icedtea-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.2-150100.7.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"icedtea-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.2-150100.7.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"icedtea-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.5.2-1ubuntu2","1.5.3-0ubuntu1","1.6.1-1ubuntu2","1.6.1-3ubuntu1","1.6.1-4ubuntu1","1.6.2-1ubuntu1","1.6.2-2ubuntu1","1.6.2-3ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"icedtea-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.6.2-3.1ubuntu3","1.8-0ubuntu8~18.04"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"icedtea-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.8-0ubuntu8"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"icedtea-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.8.4-1build1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"icedtea-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.8.8-2","1.8.8-2ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"icedtea-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.8.8-3"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"icedtea-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.8.8-4"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"icedtea-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.8.8-3","1.8.8-3build1","1.8.8-3ubuntu1","1.8.8-4"]},{"source":"osv","ecosystem":"openSUSE:Leap 15.0","package":"icedtea-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.2-lp150.2.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"icedtea-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.6-1.3"}]}],"bundled":3}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"icedtea","product":"icedtea-web"},{"vendor":"icedtea-web_project","product":"icedtea-web"},{"vendor":"opensuse","product":"leap"}],"references":[{"url":"https://github.com/AdoptOpenJDK/IcedTea-Web/pull/344","tags":["x_refsource_CONFIRM","x_transferred","Patch","Third Party Advisory","fix","report"]},{"url":"https://github.com/AdoptOpenJDK/IcedTea-Web/issues/327","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10181","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Third Party Advisory","report"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00045.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Third Party Advisory","advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2019/09/msg00008.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Third Party Advisory","advisory"]},{"url":"https://seclists.org/bugtraq/2019/Oct/5","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"http://packetstormsecurity.com/files/154748/IcedTeaWeb-Validation-Bypass-Directory-Traversal-Code-Execution.html","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://security.gentoo.org/glsa/202107-51","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Patch","Third Party Advisory","fix"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-10181","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2019:2003","tags":["web","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2019:2004","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-10181","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1725928","tags":["report"]},{"url":"https://github.com/advisories/GHSA-xv8g-hcfj-ppcw"},{"url":"https://security-tracker.debian.org/tracker/CVE-2019-10181","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2019-0242.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=25228","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2019/07/31/2","tags":["web","report"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1724958","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1724989","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_2003.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-10181","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-10182","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-10182","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-10182","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-10185","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-10185","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-10185","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_2004.json","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20192033-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1142825","tags":["report"]},{"url":"https://bugzilla.suse.com/1142832","tags":["report"]},{"url":"https://bugzilla.suse.com/1142835","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2019-10181","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-10182","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-10185","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20221259-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2019-10181","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/TWXDTQ55XR63SPXVSZQDDIRRJUKGOCDE/#TWXDTQ55XR63SPXVSZQDDIRRJUKGOCDE","tags":["advisory"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2019-10181","description":"It was found that in icedtea-web up to and including 1.7.2 and 1.8.2 executable code could be injected in a JAR file without compromising the signature verification. An attacker could use this flaw to inject code in a trusted JAR. The code would be executed inside the sandbox.","status":"published","published":"2019-07-31T21:56:11Z","modified":"2024-08-04T22:10:09.998Z","cvss":[{"version":"3.0","score":6.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-345"],"updated_at":"2026-11-02T14:20:19.056416Z"}],"euvd":[{"id":"EUVD-2019-2209","description":"It was found that in icedtea-web up to and including 1.7.2 and 1.8.2 executable code could be injected in a JAR file without compromising the signature verification. An attacker could use this flaw to inject code in a trusted JAR. The code would be executed inside the sandbox.","status":"published","published":"2019-07-31T21:56:11Z","modified":"2024-08-04T22:10:09Z","cvss":[{"version":"3.0","score":6.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-03T02:40:54.154728Z"}],"ghsa":[{"id":"GHSA-xv8g-hcfj-ppcw","title":"It was found that in icedtea-web up to and including 1.7.2 and 1.8.2 executable code could be...","description":"It was found that in icedtea-web up to and including 1.7.2 and 1.8.2 executable code could be injected in a JAR file without compromising the signature verification. An attacker could use this flaw to inject code in a trusted JAR. The code would be executed inside the sandbox.","status":"published","published":"2022-05-24T16:52:01Z","modified":"2023-02-10T05:06:58Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-345"],"updated_at":"2026-11-02T14:54:03.327923Z"}],"nvd":[{"id":"CVE-2019-10181","description":"It was found that in icedtea-web up to and including 1.7.2 and 1.8.2 executable code could be injected in a JAR file without compromising the signature verification. An attacker could use this flaw to inject code in a trusted JAR. The code would be executed inside the sandbox.","status":"published","published":"2019-07-31T23:15:10.777Z","modified":"2026-06-17T02:10:25.997Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"3.0","score":6.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","level":"medium","assessor":"secondary"},{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-345"],"updated_at":"2026-11-02T14:05:21.892729Z"}],"osv":[{"id":"CVE-2019-10181","description":"It was found that in icedtea-web up to and including 1.7.2 and 1.8.2 executable code could be injected in a JAR file without compromising the signature verification. An attacker could use this flaw to inject code in a trusted JAR. The code would be executed inside the sandbox.","status":"published","published":"2019-07-31T23:15:10.777Z","modified":"2026-10-20T10:50:36.32389009Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:10.383287Z"},{"id":"DEBIAN-CVE-2019-10181","description":"It was found that in icedtea-web up to and including 1.7.2 and 1.8.2 executable code could be injected in a JAR file without compromising the signature verification. An attacker could use this flaw to inject code in a trusted JAR. The code would be executed inside the sandbox.","status":"published","published":"2019-07-31T23:15:10.777Z","modified":"2026-09-21T07:01:57.485128641Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:31.170944Z"},{"id":"RHSA-2019:2003","title":"Red Hat Security Advisory: icedtea-web security update","status":"published","published":"2024-09-16T02:44:48Z","modified":"2026-06-26T10:42:39Z","cvss":[{"version":"3.0","score":8.2,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:L","level":"high"}],"updated_at":"2026-11-02T15:53:06.0195Z"},{"id":"RHSA-2019:2004","title":"Red Hat Security Advisory: icedtea-web security update","status":"published","published":"2024-09-16T02:44:42Z","modified":"2026-02-21T10:03:09Z","cvss":[{"version":"3.0","score":8.2,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:L","level":"high"}],"updated_at":"2026-11-02T15:53:06.0195Z"},{"id":"UBUNTU-CVE-2019-10181","description":"It was found that in icedtea-web up to and including 1.7.2 and 1.8.2 executable code could be injected in a JAR file without compromising the signature verification. An attacker could use this flaw to inject code in a trusted JAR. The code would be executed inside the sandbox.","status":"published","published":"2019-07-31T23:15:00Z","modified":"2026-10-17T12:55:30.267572022Z","cvss":[{"version":"3.0","score":6.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","level":"medium"},{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:19.202697Z"},{"id":"DLA-1914-1","title":"icedtea-web - security update","status":"published","published":"2019-09-09T00:00:00Z","modified":"2026-03-09T01:17:55.376872Z","updated_at":"2026-11-02T15:46:10.227108Z"},{"id":"MGASA-2019-0242","title":"Updated icedtea-web packages fix security vulnerabilities","description":"Updated icedtea-web packages fix security vulnerabilities:\n\nIt was found that in icedtea-web up to and including 1.7.2 and 1.8.2\nexecutable code could be injected in a JAR file without compromising the\nsignature verification. An attacker could use this flaw to inject code in\na trusted JAR. The code would be executed inside the sandbox.\n(CVE-2019-10181)\n\nIt was found that icedtea-web though 1.7.2 and 1.8.2 did not properly\nsanitize paths from \u003cjar/\u003e elements in JNLP files. An attacker could trick\na victim into running a specially crafted application and use this flaw to\nupload arbitrary files to arbitrary locations in the context of the user.\n(CVE-2019-10182)\n\nIt was found that icedtea-web up to and including 1.7.2 and 1.8.2 was\nvulnerable to a zip-slip attack during auto-extraction of a JAR file.\nAn attacker could use this flaw to write files to arbitrary locations.\nThis could also be used to replace the main running application and,\npossibly, break out of the sandbox. (CVE-2019-10185)\n","status":"published","published":"2019-09-06T21:09:08Z","modified":"2026-04-16T04:43:52.772381173Z","updated_at":"2026-11-02T15:49:40.793816Z"},{"id":"openSUSE-SU-2019:1911-1","title":"Security update for icedtea-web","description":"This update for icedtea-web to version 1.7.2 fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2019-10181: Fixed an unsigned code injection in a signed JAR file (bsc#1142835)\n- CVE-2019-10182: Fixed a path traversal while processing \u003cjar/\u003e elements of JNLP files results in arbitrary file overwrite (bsc#1142825).\n- CVE-2019-10185: Fixed a directory traversal in the nested jar auto-extraction leading to arbitrary file overwrite (bsc#1142832).\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2019-08-15T09:46:31Z","modified":"2026-02-04T02:19:23.318254Z","updated_at":"2026-11-02T16:58:30.784344Z"},{"id":"openSUSE-SU-2024:10855-1","title":"icedtea-web-1.8.6-1.3 on GA media","description":"These are all security issues fixed in the icedtea-web-1.8.6-1.3 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:06:32.634618Z","updated_at":"2026-11-02T16:58:34.894275Z"},{"id":"SUSE-SU-2019:2033-1","title":"Security update for icedtea-web","description":"This update for icedtea-web to version 1.7.2 fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2019-10181: Fixed an unsigned code injection in a signed JAR file (bsc#1142835)\n- CVE-2019-10182: Fixed a path traversal while processing \u003cjar/\u003e elements of JNLP files results in arbitrary file overwrite (bsc#1142825).\n- CVE-2019-10185: Fixed a directory traversal in the nested jar auto-extraction leading to arbitrary file overwrite (bsc#1142832).\n","status":"published","published":"2019-07-31T16:37:44Z","modified":"2025-05-02T04:08:32.205974Z","updated_at":"2026-11-02T15:53:46.44301Z"},{"id":"SUSE-SU-2022:1259-1","title":"Security update for icedtea-web","description":"This update for icedtea-web fixes the following issues:\n\n- CVE-2019-10181: Fixed an issue where an attacker could inject unsigned code\n  in a signed JAR file (bsc#1142835).\n- CVE-2019-10182: Fixed a path traversal issue where an attacker could upload\n  arbritrary files by tricking a victim into running a specially crafted\n  application(bsc#1142825).\n- CVE-2019-10185: Fixed an issue where an attacker could write files to arbitrary\n  locations during JAR auto-extraction (bsc#1142832).\n","status":"published","published":"2022-04-19T09:10:35Z","modified":"2026-02-04T02:49:40.06277Z","updated_at":"2026-11-02T15:53:50.513981Z"}]}}