Description
The JNLP SecurityManager in IcedTea (IcedTea.so) 1.7 before 1.7.7, 1.8 before 1.8.4, and 1.9 before 1.9.4 for Java OpenJDK returns from the checkPermission method instead of throwing an exception in certain circumstances, which might allow context-dependent attackers to bypass the intended security policy by creating instances of ClassLoader.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 6.0 | openjdk-6 | 6b18-1.8.7-2~squeeze1 | DSA-2224-1 |
| Debian 5.0 | openjdk-6 | 6b18-1.8.7-2~lenny1 | DSA-2224-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | java-1.6.0-openjdk +4 | 1:1.6.0.0-1.17.b17.el5 | RHSA-2011:0176 |
Advisories 2
- RHSA-2011:0176 Red Hat Security Advisory: java-1.6.0-openjdk security update Red Hat Security Advisories (RHSA) · Jun 28, 2026
- DSA-2224-1 openjdk-6 - several Debian Security (DSA / DLA) · Mar 9, 2026
References
- http://blog.fuseyism.com/index.php/2011/01/18/security-icedtea6-177-184-194-released/
- USN-1055-1 vendor-advisory
- GLSA-201406-32 vendor-advisory
- FEDORA-2011-0521 vendor-advisory
- 45894 vdb-entry
- 43085 third-party-advisory
- USN-1052-1 vendor-advisory
- ADV-2011-0215 vdb-entry
- 70605 vdb-entry
- ADV-2011-0239 vdb-entry
- http://www.zerodayinitiative.com/advisories/ZDI-11-014/
- FEDORA-2011-0500 vendor-advisory
- 43002 third-party-advisory
- ADV-2011-0165 vdb-entry
- 43078 third-party-advisory
- DSA-2224 vendor-advisory
- 43135 third-party-advisory
- ADV-2011-0166 vdb-entry
- icedtea-jnlp-code-execution(64893) vdb-entry
- https://bugzilla.redhat.com/show_bug.cgi?id=663680
- MDVSA-2011:054 vendor-advisory
- RHSA-2011:0176 vendor-advisory