CVE-2019-10181CWE-345

It was found that in icedtea-web up to and including 1.7.2 and 1.8.2 executable code could be injected in a JAR file without compromising the signature…

Medium · published July 31, 2019

CVSS v3.0
6.3
EPSS
1%
Percentile
66.9
In the wild
Unconfirmed
What it is

It was found that in icedtea-web up to and including 1.7.2 and 1.8.2 executable code could be injected in a JAR file without compromising the signature verification. An attacker could use this flaw to inject code in a trusted JAR. The code would be executed inside the sandbox.

The record
Technical detail
CVSS v3.0
6.3 · MEDIUM
Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.01165 · 66.9th percentile
Weakness
CWE-345 · Insufficient Verification of Data Authenticity
Published
2019-07-31T21:56Z
EPSS history
Timeline
  • 31 JUL 21:56Z
    It was found that in icedtea-web up to and including 1.7.2 and 1.8.2 executable code could be injected in a JAR file without compromising the signature…
    cvelistv5