CVE-2011-2513: Red Hat Icedtea-Web

Medium severity, CVSS 5.0. EPSS: 2.5% chance of exploitation in the next 30 days.

The Java Network Launching Protocol (JNLP) implementation in IcedTea6 1.9.x before 1.9.9 and before 1.8.9, and IcedTea-Web 1.1.x before 1.1.1 and before 1.0.4, allows remote attackers to obtain the username and full path of the home and cache directories by accessing properties of the ClassLoader.

Affected products

• Red Hat Icedtea-Web: up to and including 1.0.3; version 1.0 only; version 1.0.1 only; version 1.0.2 only; version 1.1 only
• Red Hat ICEDTEA6: up to and including 1.8.8; version 1.8 only; version 1.8.1 only; version 1.8.2 only; version 1.8.3 only; version 1.8.4 only; …

Published 2014-05-14. Last modified 2026-06-16.