Critical Security Vulnerability in IcedTea-Web Package: CVE-2019-10181, CVE-2019-10182, CVE-2019-10185
Summary
RHSA-2019:2003: Red Hat Security Advisory: icedtea-web security update. Affects icedtea-web versions < 0:1.7.1-2.el7_6. Fixed in 0:1.7.1-2.el7_6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
IcedTea-Web is an open-source implementation of the Java Web Start technology and Java applets. It allows users to launch Java applications directly from the web browser. The package is widely used in Red Hat Enterprise Linux environments, providing essential functionality for running Java applications. However, recent vulnerabilities have been identified that could compromise the security of systems utilizing this package.
Vulnerability Detail
The vulnerabilities identified as CVE-2019-10181, CVE-2019-10182, and CVE-2019-10185 stem from flaws in the IcedTea-Web package that could allow an attacker to execute arbitrary code, leading to potential data breaches or system compromise. These vulnerabilities arise from improper handling of certain inputs and can be exploited remotely, making them particularly dangerous. The CVSS score of this vulnerability is 8.2, indicating a high level of risk associated with its exploitation.
How To Fix
Minimum fixed version
0:1.7.1-2.el7_6
This is the first release that contains the fix.
sudo dnf update icedtea-webTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can disable the execution of Java applets in their web browsers or restrict access to applications that rely on IcedTea-Web until the package is updated. This can help reduce the risk of exploitation while waiting for a permanent fix.
Conclusion
The IcedTea-Web package has critical vulnerabilities that could lead to severe security risks. It is essential to update to the latest patched version to protect your systems. Users should also consider temporary workarounds until the update can be applied.
See every vulnerability recorded for icedtea-web →
FAQ
IcedTea-Web is an open-source implementation of Java Web Start and Java applets, allowing users to run Java applications from their web browsers.
The vulnerabilities are identified as CVE-2019-10181, CVE-2019-10182, and CVE-2019-10185.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The CVSS score of this vulnerability is 8.2, indicating a high severity level.
If immediate updates are not possible, consider disabling Java applet execution in your browser or restricting access to affected applications as a temporary workaround.
Related vulnerabilities
Recent vulnerabilities recorded for icedtea-web.
