CVE-2019-10185 It was found that icedtea-web up to and including 1.7.2 and 1.8.2 was vulnerable to a zip-slip attack during auto-extraction of a JAR file. An attacker could use this flaw to write files to arbitrary....
HighCVSS 8.6
EPSS 4.0%
- Published
- Updated
- Exploit status
- No public exploit known
Description
It was found that icedtea-web up to and including 1.7.2 and 1.8.2 was vulnerable to a zip-slip attack during auto-extraction of a JAR file. An attacker could use this flaw to write files to arbitrary locations. This could also be used to replace the main running application and, possibly, break out of the sandbox.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/icedtea-web(Debian:12) | < 1.8.3-1 | 1.8.3-1 |
| debian/icedtea-web(Debian:13) | < 1.8.3-1 | 1.8.3-1 |
| debian/icedtea-web(Debian:14) | < 1.8.3-1 | 1.8.3-1 |
| icedtea-web project icedtea-web | <= 1.7.2 | No fix listed |
| icedtea-web project icedtea-web | = 1.8.2 | No fix listed |
| debian linux | = 8.0 | No fix listed |
| openSUSE leap | = 15.0 | No fix listed |
| ubuntu/icedtea-web(Ubuntu:24.04) | All versions | No fix listed |
| icedtea-web | = affects up to and including 1.7.2 and 1.8.2 | No fix listed |
| ubuntu/icedtea-web(Ubuntu:26.04) | All versions | No fix listed |
| ubuntu/icedtea-web(Ubuntu:26.10) | All versions | No fix listed |
| ubuntu/icedtea-web(Ubuntu:22.04) | All versions | No fix listed |
References
- Ubuntu CVE tracker vendor-advisory
- www.cve.org
- Debian Security Tracker CVE-2019-10185 vendor-advisory
- openSUSE-SU-2019:1911 third-party-advisory vendor-advisory
- packetstormsecurity.com third-party-advisory vdb-entry
- bugzilla.redhat.com issue-tracking third-party-advisory
- github.com third-party-advisory
- github.com patch third-party-advisory
- [debian-lts-announce] 20190909 [SECURITY] [DLA 1914-1] icedtea-web security update mailing-list third-party-advisory
- 20191007 CVE-2019-10181, CVE-2019-10182, CVE-2019-10185: IcedTea-Web vulnerabilities leading to RCE mailing-list third-party-advisory
- GLSA-202107-51 patch third-party-advisory vendor-advisory
- bugs.debian.org issue-tracking