CVE-2019-10182

It was found that icedtea-web though 1.7.2 and 1.8.2 did not properly sanitize paths from elements in JNLP files. An attacker could trick a victim into running a specially crafted application and use this flaw to upload arbitrary files to arbitrary locations in the context of the user.

Link	Resource
https://github.com/AdoptOpenJDK/IcedTea-Web/issues/327	Patch Third Party Advisory
https://github.com/AdoptOpenJDK/IcedTea-Web/pull/344	Patch Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10182	Issue Tracking Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00045.html
https://lists.debian.org/debian-lts-announce/2019/09/msg00008.html
https://seclists.org/bugtraq/2019/Oct/5
http://packetstormsecurity.com/files/154748/IcedTeaWeb-Validation-Bypass-Directory-Traversal-Code-Execution.html

Configuration 1

cpe:2.3:a:icedtea-web_project:icedtea-web:*:*:*:*:*:*:*:* cpe:2.3:a:icedtea-web_project:icedtea-web:1.8.2:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_server_eus:7.6:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_server_aus:7.6:*:*:*:*:*:*:*

---

Published : 2019-07-31 10:15

Updated : 2023-02-12 11:33

---

NVD link : CVE-2019-10182

Mitre link : CVE-2019-10182

No products.

CWE-22

CWE-94