CVE-2015-5234

MEDIUM 6.8CVE-2015-5234 · Published 09/10/2015 · updated 17/06/2026

In short

CVE-2015-5234 is a MEDIUM (CVSS 6.8) vulnerability affecting icedtea (redhat).
Chance of exploitation in the next 30 days (EPSS): 2.1%, higher than 81.9% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
icedtea redhat	`= 1.6≤ 1.5.2`	No fix yet

Description

IcedTea-Web before 1.5.3 and 1.6.x before 1.6.1 does not properly sanitize applet URLs, which allows remote attackers to inject applets into the .appletTrustSettings configuration file and bypass user approval to execute the applet via a crafted web page, possibly related to line breaks.

References

lists.fedoraproject.org/pipermail/package-announce/2015-September/167120.html · Third Party Advisory
lists.fedoraproject.org/pipermail/package-announce/2015-September/167130.html · Third Party Advisory
lists.opensuse.org/opensuse-security-announce/2015-09/msg00019.html · Third Party Advisory
mail.openjdk.java.net/pipermail/distro-pkg-dev/2015-September/033546.html · Patch
rhn.redhat.com/errata/RHSA-2016-0778.html · Third Party Advisory
oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html
securitytracker.com/id/1033780
ubuntu.com/usn/USN-2817-1
bugzilla.redhat.com/show_bug.cgi · Issue Tracking

More vulnerabilities in icedtea

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free