Red Hat Icedtea vulnerabilities

9 CVEs affecting Red Hat Icedtea, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2017-3544, published 2017-04-24.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2015-5235, published 2015-10-09. Medium severity, CVSS 4.3. EPSS: 3% chance of exploitation in the next 30 days. IcedTea-Web before 1.5.3 and 1.6.x before 1.6.1 does not properly determine the origin of unsigned applets, which allows remote attackers to bypass the approval process or trick users into approving…
CVE-2010-3860, published 2010-12-08. Medium severity, CVSS 5.0. EPSS: 3% chance of exploitation in the next 30 days. IcedTea 1.7.x before 1.7.6, 1.8.x before 1.8.3, and 1.9.x before 1.9.2, as based on OpenJDK 6, declares multiple sensitive variables as public, which allows remote attackers to obtain sensitive…
CVE-2017-3533, published 2017-04-24. Low severity, CVSS 3.7. EPSS: 3% chance of exploitation in the next 30 days. Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Networking). Supported versions that are affected are Java SE: 6u141, 7u131 and 8u121; Java SE…
CVE-2017-3512, published 2017-04-24. High severity, CVSS 8.3. EPSS: 2.8% chance of exploitation in the next 30 days. Vulnerability in the Java SE component of Oracle Java SE (subcomponent: AWT). Supported versions that are affected are Java SE: 7u131 and 8u121. Difficult to exploit vulnerability allows…
CVE-2011-0025, published 2011-02-04. Medium severity, CVSS 6.8. EPSS: 2.6% chance of exploitation in the next 30 days. IcedTea 1.7 before 1.7.8, 1.8 before 1.8.5, and 1.9 before 1.9.5 does not properly verify signatures for JAR files that (1) are "partially signed" or (2) signed by multiple entities, which allows…
CVE-2010-4351, published 2011-01-20. Medium severity, CVSS 6.8. EPSS: 2.5% chance of exploitation in the next 30 days. The JNLP SecurityManager in IcedTea (IcedTea.so) 1.7 before 1.7.7, 1.8 before 1.8.4, and 1.9 before 1.9.4 for Java OpenJDK returns from the checkPermission method instead of throwing an exception in…
CVE-2015-5234, published 2015-10-09. Medium severity, CVSS 6.8. EPSS: 2.1% chance of exploitation in the next 30 days. IcedTea-Web before 1.5.3 and 1.6.x before 1.6.1 does not properly sanitize applet URLs, which allows remote attackers to inject applets into the .appletTrustSettings configuration file and bypass…
CVE-2017-3539, published 2017-04-24. Low severity, CVSS 3.1. EPSS: 2% chance of exploitation in the next 30 days. Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Security). Supported versions that are affected are Java SE: 6u141, 7u131 and 8u121; Java SE Embedded: 8u121.…
CVE-2017-3544, published 2017-04-24. Low severity, CVSS 3.7. EPSS: 1.7% chance of exploitation in the next 30 days. Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Networking). Supported versions that are affected are Java SE: 6u141, 7u131 and 8u121; Java SE…