Path Traversal in Icedtea Icedtea-Web
CVE-2019-10185
It was found that icedtea-web up to and including 1.7.2 and 1.8.2 was vulnerable to a zip-slip attack during auto-extraction of a JAR file. An attacker could use this flaw to write files to arbitrary locations. This could also be used to replace the main running application and, possibly, break out of the sandbox.
Vulnerability class: Path Traversal (Directory Traversal)
EPSS: 0.040 (89.5th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.6 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N.
Affected products
- Icedtea Icedtea-web — versions affects up to and including 1.7.2 and 1.8.2
- Icedtea-web_project Icedtea-web — versions 1.8.2
- Debian Debian_linux — versions 8.0
- Opensuse Leap — versions 15.0
Weakness classification (CWE)
Public proof-of-concept exploits
References
- secalert@redhat.com (x_refsource_CONFIRM, Patch, Third Party Advisory)
- secalert@redhat.com (x_refsource_CONFIRM, Third Party Advisory)
- secalert@redhat.com (x_refsource_CONFIRM, Third Party Advisory, Issue Tracking)
- secalert@redhat.com (vendor-advisory, Third Party Advisory, x_refsource_SUSE)
- secalert@redhat.com (mailing-list, x_refsource_MLIST, Third Party Advisory)
- secalert@redhat.com (mailing-list, x_refsource_BUGTRAQ, Mailing List, Third Party Advisory)
- secalert@redhat.com (VDB Entry, Third Party Advisory, x_refsource_MISC)
- secalert@redhat.com (vendor-advisory, Patch, Third Party Advisory, x_refsource_GENTOO)
Frequently asked questions
- What is CVE-2019-10185?
- CVE-2019-10185 is a high-severity vulnerability in Icedtea Icedtea-Web, classified under Path Traversal. CVSS score: 8.6/10. Published 2019-07-31.
- How severe is CVE-2019-10185?
- High severity. CVSS v3 base score is 8.6 out of 10.
- Is CVE-2019-10185 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.