Description
The JNLPClassLoader class in IcedTea-Web before 1.0.1, as used in OpenJDK Runtime Environment 1.6.0, allows remote attackers to gain privileges via unknown vectors related to multiple signers and the assignment of "an inappropriate security descriptor."
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 6.0 | openjdk-6 | 6b18-1.8.7-2~squeeze1 | DSA-2224-1 |
| Debian 5.0 | openjdk-6 | 6b18-1.8.7-2~lenny1 | DSA-2224-1 |
Advisories 1
- DSA-2224-1 openjdk-6 - several Debian Security (DSA / DLA) · Mar 9, 2026
References
- FEDORA-2011-1631 vendor-advisory
- GLSA-201406-32 vendor-advisory
- FEDORA-2011-1645 vendor-advisory
- 46439 vdb-entry
- icedtea-jnlpclassloader-priv-esc(65534) vdb-entry
- http://dbhole.wordpress.com/2011/02/15/icedtea-web-1-0-1-released/
- 43350 third-party-advisory
- DSA-2224 vendor-advisory
- oval:org.mitre.oval:def:14117 vdb-entry signature
- https://bugzilla.redhat.com/show_bug.cgi?id=677332
- MDVSA-2011:054 vendor-advisory