CVE-2019-10185

Description

It was found that icedtea-web up to and including 1.7.2 and 1.8.2 was vulnerable to a zip-slip attack during auto-extraction of a JAR file. An attacker could use this flaw to write files to arbitrary locations. This could also be used to replace the main running application and, possibly, break out of the sandbox.

References

https://security.gentoo.org/glsa/202107-51

https://seclists.org/bugtraq/2019/Oct/5

https://lists.debian.org/debian-lts-announce/2019/09/msg00008.html

https://github.com/AdoptOpenJDK/IcedTea-Web/pull/344

https://github.com/AdoptOpenJDK/IcedTea-Web/issues/327

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10185

http://packetstormsecurity.com/files/154748/IcedTeaWeb-Validation-Bypass-Directory-Traversal-Code-Execution.html

http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00045.html

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3