[<prev] [next>] [day] [month] [year] [list]
Message-ID: <20190731152622.GA24743@cbuissar-ltop.localdomain>
Date: Wed, 31 Jul 2019 17:26:22 +0200
From: Cedric Buissart <cbuissar@...hat.com>
To: oss-security@...ts.openwall.com
Subject: icedtea-web: CVE-2019-10181 CVE-2019-10182 CVE-2019-10185
Hello,
The IcedTea-Web project provides a Java web browser plug-in and an
implementation of Java Web Start, which is based on the Netx project.
Upstream URL : http://icedtea.classpath.org/wiki/IcedTea-Web
This is to disclose the following 3 vulnerabilities :
CVE-2019-10182 and CVE-2019-10185 are considered High, since they can
easily be used to take over the client before checking signatures.
All versions of icedtea-web are believed to be vulnerable.
See the following pull request for the proposed fixes :
https://github.com/AdoptOpenJDK/IcedTea-Web/pull/344
* CVE-2019-10182 icedtea-web: path traversal while processing <jar/>
elements of JNLP files results in arbitrary file overwrite
It was found that icedtea-web did not properly sanitize paths from
<jar/> elements in JNLP files. An attacker could trick a victim into
running a specially crafted application and use this flaw to upload
arbitrary files to arbitrary locations in the context of the user.
* CVE-2019-10185 icedtea-web: directory traversal in the nested jar
auto-extraction leading to arbitrary file overwrite
It was found that icedtea-web was vulnerable to a zip-slip attack during
auto-extraction of a JAR file. An attacker could use this flaw to write
files to arbitrary locations. This could also be used to replace the
main running application and, possibly, break out of the sandbox.
* CVE-2019-10181 icedtea-web: unsigned code injection in a signed JAR
file
It was found that executable code could be injected in a JAR file
without compromising the signature verification. An attacker could use
this flaw to inject code in a trusted JAR. The code would be executed
inside the sandbox.
Red Hat would like to thank Imre Rad for reporting all the
vulnerabilities above.
Thanks!
Download attachment "signature.asc" of type "application/pgp-signature" (456 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
