Description
The Java Network Launching Protocol (JNLP) implementation in IcedTea6 1.9.x before 1.9.9 and before 1.8.9, and IcedTea-Web 1.1.x before 1.1.1 and before 1.0.4, allows remote attackers to trick victims into granting access to local files by modifying the content of the Java Web Start Security Warning dialog box to represent a different filename than the file for which access will be granted.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | icedtea-web | 1.1-1 | — |
| Debian 13 | icedtea-web | 1.1-1 | — |
| Debian 12 | icedtea-web | 1.1-1 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 6 | icedtea-web +1 | 1.0.4-2.el6_1 | RHSA-2011:1100 |
Advisories 1
- RHSA-2011:1100 Red Hat Security Advisory: icedtea-web security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
References
- [distro-pkg-dev] 20110720 IcedTea-Web 1.0.4 and 1.1.1 (security releases) released mailing-list
- USN-1178-1 vendor-advisory
- RHSA-2011:1100 vendor-advisory
- [distro-pkg-dev] 20110720 [SECURITY] IcedTea6 1.8.9 & 1.9.9 Released! mailing-list
- http://icedtea.classpath.org/hg/release/icedtea-web-1.0/rev/b99f9a9769e0
- http://icedtea.classpath.org/hg/release/icedtea-web-1.1/rev/512de5d90388
- https://bugzilla.redhat.com/show_bug.cgi?id=718170
- 1025854 vdb-entry