CVE-2015-5235

IcedTea-Web before 1.5.3 and 1.6.x before 1.6.1 does not properly determine the origin of unsigned applets, which allows remote attackers to bypass the approval process or trick users into approving applet execution via a crafted web page.

CVSS v2.0 4.3 MEDIUM

4.3^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://lists.fedoraproject.org/pipermail/package-announce/2015-September/167120.html	Third Party Advisory
http://mail.openjdk.java.net/pipermail/distro-pkg-dev/2015-September/033546.html	Patch
https://bugzilla.redhat.com/show_bug.cgi?id=1233697	Issue Tracking
http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00019.html	Third Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2015-September/167130.html	Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2016-0778.html	Third Party Advisory
http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html
http://www.ubuntu.com/usn/USN-2817-1
http://www.securitytracker.com/id/1033780

Advertisement

Configurations

Configuration 1 (hide)

OR	cpe:2.3:o:fedoraproject:fedora:21:::::::*
	cpe:2.3:o:fedoraproject:fedora:22:::::::*

Configuration 2 (hide)

OR	cpe:2.3:o:redhat:enterprise_linux_server:6.0:::::::*
	cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:::::::*
	cpe:2.3:o:redhat:enterprise_linux_hpc_node:6:::::::*
	cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:::::::*

Configuration 3 (hide)

OR	cpe:2.3:o:opensuse:opensuse:13.2:::::::*
	cpe:2.3:o:opensuse:opensuse:13.1:::::::*

Configuration 4 (hide)

OR	cpe:2.3:a:redhat:icedtea::::::::
	cpe:2.3:a:redhat:icedtea:1.6:::::::*

Information

Published : 2015-10-09 07:59

Updated : 2018-10-30 09:27

NVD link : CVE-2015-5235

Mitre link : CVE-2015-5235

JSON object : View

CWE

CWE-20

Improper Input Validation

Advertisement

Products Affected

redhat

enterprise_linux_desktop
enterprise_linux_hpc_node
icedtea
enterprise_linux_workstation
enterprise_linux_server

fedoraproject

fedora

opensuse

opensuse

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-September/167120.html", "name": "FEDORA-2015-15676", "tags": ["Third Party Advisory"], "refsource": "FEDORA"}, {"url": "http://mail.openjdk.java.net/pipermail/distro-pkg-dev/2015-September/033546.html", "name": "[distro-pkg-dev] 20150911 IcedTea-Web 1.6.1 and 1.5.3 released", "tags": ["Patch"], "refsource": "MLIST"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1233697", "name": "https://bugzilla.redhat.com/show_bug.cgi?id=1233697", "tags": ["Issue Tracking"], "refsource": "CONFIRM"}, {"url": "http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00019.html", "name": "openSUSE-SU-2015:1595", "tags": ["Third Party Advisory"], "refsource": "SUSE"}, {"url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-September/167130.html", "name": "FEDORA-2015-15677", "tags": ["Third Party Advisory"], "refsource": "FEDORA"}, {"url": "http://rhn.redhat.com/errata/RHSA-2016-0778.html", "name": "RHSA-2016:0778", "tags": ["Third Party Advisory"], "refsource": "REDHAT"}, {"url": "http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html", "name": "http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html", "tags": [], "refsource": "CONFIRM"}, {"url": "http://www.ubuntu.com/usn/USN-2817-1", "name": "USN-2817-1", "tags": [], "refsource": "UBUNTU"}, {"url": "http://www.securitytracker.com/id/1033780", "name": "1033780", "tags": [], "refsource": "SECTRACK"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "IcedTea-Web before 1.5.3 and 1.6.x before 1.6.1 does not properly determine the origin of unsigned applets, which allows remote attackers to bypass the approval process or trick users into approving applet execution via a crafted web page."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "CWE-20"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2015-5235", "ASSIGNER": "secalert@redhat.com"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "severity": "MEDIUM", "impactScore": 2.9, "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}}, "publishedDate": "2015-10-09T14:59Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:o:fedoraproject:fedora:21:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:fedoraproject:fedora:22:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}, {"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:redhat:enterprise_linux_hpc_node:6:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}, {"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:o:opensuse:opensuse:13.2:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:opensuse:opensuse:13.1:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}, {"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:redhat:icedtea:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndIncluding": "1.5.2"}, {"cpe23Uri": "cpe:2.3:a:redhat:icedtea:1.6:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2018-10-30T16:27Z"}