Description
The Java Network Launching Protocol (JNLP) implementation in IcedTea6 1.9.x before 1.9.9 and before 1.8.9, and IcedTea-Web 1.1.x before 1.1.1 and before 1.0.4, allows remote attackers to obtain the username and full path of the home and cache directories by accessing properties of the ClassLoader.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | icedtea-web | 1.1.2-1 | — |
| Debian 13 | icedtea-web | 1.1.2-1 | — |
| Debian 12 | icedtea-web | 1.1.2-1 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 6 | icedtea-web +1 | 1.0.4-2.el6_1 | RHSA-2011:1100 |
Advisories 1
- RHSA-2011:1100 Red Hat Security Advisory: icedtea-web security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
References
- [distro-pkg-dev] 20110720 IcedTea-Web 1.0.4 and 1.1.1 (security releases) released mailing-list
- http://icedtea.classpath.org/hg/release/icedtea-web-1.0/rev/b29fdd0f4d04
- USN-1178-1 vendor-advisory
- RHSA-2011:1100 vendor-advisory
- [distro-pkg-dev] 20110720 [SECURITY] IcedTea6 1.8.9 & 1.9.9 Released! mailing-list
- http://icedtea.classpath.org/hg/release/icedtea-web-1.1/rev/c7ce6c0e6227
- 1025854 vdb-entry
- https://bugzilla.redhat.com/show_bug.cgi?id=718164