Red Hat Security Advisory: icedtea-web security update

Fixed packages 2

Vulnerabilities 3

• High 8.2
  CVE-2019-10182

  It was found that icedtea-web though 1.7.2 and 1.8.2 did not properly sanitize paths from <jar/> elements in JNLP files…

  IcedTea icedtea-web icedtea-web icedtea-web Debian Ubuntu
  Jul 31, 2019
• High 8.2
  CVE-2019-10185

  It was found that icedtea-web up to and including 1.7.2 and 1.8.2 was vulnerable to a zip-slip attack during auto-extra…

  IcedTea icedtea-web icedtea-web icedtea-web Debian Ubuntu
  Jul 31, 2019
• Medium 6.3
  CVE-2019-10181

  It was found that in icedtea-web up to and including 1.7.2 and 1.8.2 executable code could be injected in a JAR file wi…

  IcedTea icedtea-web icedtea-web icedtea-web Debian Ubuntu
  Jul 31, 2019

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1724958
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1724989
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1725928
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_2004.json
• report
  https://access.redhat.com/security/cve/CVE-2019-10181
• advisory
  https://www.cve.org/CVERecord?id=CVE-2019-10181
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2019-10181
• report
  https://access.redhat.com/security/cve/CVE-2019-10182
• advisory
  https://www.cve.org/CVERecord?id=CVE-2019-10182
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2019-10182
• report
  https://access.redhat.com/security/cve/CVE-2019-10185
• advisory
  https://www.cve.org/CVERecord?id=CVE-2019-10185
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2019-10185