Critical Security Update for IcedTea-Web: Addressing Multiple Vulnerabilities
Summary
RHSA-2016:0778: Red Hat Security Advisory: icedtea-web security, bug fix, and enhancement update. Affects icedtea-web versions < 0:1.6.2-1.el6. Fixed in 0:1.6.2-1.el6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
IcedTea-Web is an open-source implementation of the Java Web Start technology and provides a framework for launching Java applications from a web browser. It is widely used in enterprise environments to facilitate the deployment of Java applications. However, vulnerabilities in IcedTea-Web can expose systems to security risks, making it essential to keep the software updated.
Vulnerability Detail
The vulnerabilities identified in IcedTea-Web (CVE-2015-5234 and CVE-2015-5235) stem from improper handling of certain inputs, which could allow an attacker to execute arbitrary code or cause a denial of service. These vulnerabilities can lead to significant security breaches, including unauthorized access to sensitive data and disruption of services.
How To Fix
Minimum fixed version
0:1.6.2-1.el6
This is the first release that contains the fix.
sudo dnf update icedtea-webTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updating is not feasible, consider disabling the IcedTea-Web plugin in your browser settings to mitigate the risk until the update can be applied.
Conclusion
The vulnerabilities in IcedTea-Web pose significant risks to systems utilizing this software. It is imperative to update to the latest patched version to safeguard against potential exploits. Utilizing tools like Vulert can further enhance your security posture by providing real-time monitoring for vulnerabilities.
See every vulnerability recorded for icedtea-web →
FAQ
The main vulnerabilities are CVE-2015-5234 and CVE-2015-5235, which could allow arbitrary code execution or denial of service.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Consider disabling the IcedTea-Web plugin in your browser as a temporary workaround until you can apply the update.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities using just a manifest file like package-lock.json.
Updating to the patched version is crucial to protect your system from potential exploits that could arise from these vulnerabilities.
Related vulnerabilities
Recent vulnerabilities recorded for icedtea-web.
