CVE-2015-5235

Publication date 9 October 2015

Last updated 24 July 2024

Ubuntu priority

IcedTea-Web before 1.5.3 and 1.6.x before 1.6.1 does not properly determine the origin of unsigned applets, which allows remote attackers to bypass the approval process or trick users into approving applet execution via a crafted web page.

Read the notes from the security team

Status

Show unmaintained releases

Package	Ubuntu Release	Status
icedtea-web	15.10 wily	Fixed 1.5.3-0ubuntu0.15.10.1
	15.04 vivid	Fixed 1.5.3-0ubuntu0.15.04.1
	14.04 LTS trusty	Fixed 1.5.3-0ubuntu0.14.04.1
	12.04 LTS precise	Not affected

Notes

mdeslaur

extended applets security was introduced in icedtea-web 1.4

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package	Patch details
icedtea-web	Upstream: http://icedtea.classpath.org/hg/icedtea-web/rev/531034ce3e30 Upstream: http://icedtea.classpath.org/hg/icedtea-web/rev/ee5e2cb91774

References

Related Ubuntu Security Notices (USN)

USN-2817-1
IcedTea Web vulnerabilities
24 November 2015

Other references

https://www.cve.org/CVERecord?id=CVE-2015-5235