Description
IcedTea-Web before 1.5.3 and 1.6.x before 1.6.1 does not properly sanitize applet URLs, which allows remote attackers to inject applets into the .appletTrustSettings configuration file and bypass user approval to execute the applet via a crafted web page, possibly related to line breaks.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | icedtea-web | 1.6.1-1 | — |
| Debian 13 | icedtea-web | 1.6.1-1 | — |
| Debian 12 | icedtea-web | 1.6.1-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 14.04 LTS | icedtea-web | 1.5.3-0ubuntu0.14.04.1 | USN-2817-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 7 | icedtea-web +1 | 1.6.1-4.el7 | RHBA-2015:2457 |
| RHEL 6 | icedtea-web +1 | 1.6.2-1.el6 | RHSA-2016:0778 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 12 | java-1_7_0-openjdk-plugin | 1.6.1-2.3.1 | SUSE-SU-2015:1682-1 |
| SLES 11 SP4 | icedtea-web | 1.5.3-0.9.1 | SUSE-SU-2015:1689-1 |
Advisories 5
- RHSA-2016:0778 Red Hat Security Advisory: icedtea-web security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHBA-2015:2457 Red Hat Bug Fix Advisory: icedtea-web bug fix and enhancement update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- USN-2817-1 icedtea-web vulnerabilities Ubuntu Security Notices (USN) · Feb 10, 2026
- SUSE-SU-2015:1682-1 Security update for icedtea-web SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2015:1689-1 Security update for icedtea-web SUSE / openSUSE Security Updates · Feb 4, 2026
References
- USN-2817-1 vendor-advisory
- openSUSE-SU-2015:1595 vendor-advisory
- http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html
- FEDORA-2015-15676 vendor-advisory
- 1033780 vdb-entry
- [distro-pkg-dev] 20150911 IcedTea-Web 1.6.1 and 1.5.3 released mailing-list
- RHSA-2016:0778 vendor-advisory
- FEDORA-2015-15677 vendor-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1233667