Description
IcedTea 1.7.x before 1.7.6, 1.8.x before 1.8.3, and 1.9.x before 1.9.2, as based on OpenJDK 6, declares multiple sensitive variables as public, which allows remote attackers to obtain sensitive information including (1) user.name, (2) user.home, and (3) java.home system properties, and other sensitive information such as installation directories.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | java-1.6.0-openjdk +4 | 1:1.6.0.0-1.17.b17.el5 | RHSA-2011:0176 |
Advisories 1
- RHSA-2011:0176 Red Hat Security Advisory: java-1.6.0-openjdk security update Red Hat Security Advisories (RHSA) · Jun 28, 2026
References
- GLSA-201406-32 vendor-advisory
- FEDORA-2010-18393 vendor-advisory
- 43085 third-party-advisory
- ADV-2011-0215 vdb-entry
- USN-1024-1 vendor-advisory
- SUSE-SR:2010:023 vendor-advisory
- 42412 third-party-advisory
- ADV-2010-3090 vdb-entry
- http://blog.fuseyism.com/index.php/2010/11/24/icedtea6-176-183-and-192-released/
- ADV-2010-3108 vdb-entry
- https://bugzilla.redhat.com/show_bug.cgi?id=645843
- 42417 third-party-advisory
- 45114 vdb-entry
- http://icedtea.classpath.org/hg/release/icedtea6-1.9/rev/9aa0018d8c28
- RHSA-2011:0176 vendor-advisory