CVE-2015-5234

Publication date 9 October 2015

Last updated 24 July 2024

Ubuntu priority

IcedTea-Web before 1.5.3 and 1.6.x before 1.6.1 does not properly sanitize applet URLs, which allows remote attackers to inject applets into the .appletTrustSettings configuration file and bypass user approval to execute the applet via a crafted web page, possibly related to line breaks.

Read the notes from the security team

Status

Show unmaintained releases

Package	Ubuntu Release	Status
icedtea-web	15.10 wily	Fixed 1.5.3-0ubuntu0.15.10.1
	15.04 vivid	Fixed 1.5.3-0ubuntu0.15.04.1
	14.04 LTS trusty	Fixed 1.5.3-0ubuntu0.14.04.1
	12.04 LTS precise	Not affected

Notes

mdeslaur

extended applets security was introduced in icedtea-web 1.4

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package	Patch details
icedtea-web	Upstream: http://icedtea.classpath.org/hg/icedtea-web/rev/53500e3de1bc Upstream: http://icedtea.classpath.org/hg/icedtea-web/rev/c9befa549f63 Upstream: http://icedtea.classpath.org/hg/icedtea-web/rev/5ddfe3e389ab Upstream: http://icedtea.classpath.org/hg/icedtea-web/rev/1a1cbf3b1123

CVE-2015-5234

Status

Notes

mdeslaur

Patch details

References

Related Ubuntu Security Notices (USN)

Other references