CVE-2015-5234

MediumCVSS 6.8/10Last modified Jun 17, 2026

Description

IcedTea-Web before 1.5.3 and 1.6.x before 1.6.1 does not properly sanitize applet URLs, which allows remote attackers to inject applets into the .appletTrustSettings configuration file and bypass user approval to execute the applet via a crafted web page, possibly related to line breaks.

Metrics

CVSS 2.0 6.8/10AV:N/AC:M/Au:N/C:P/I:P/A:P

Weakness enumeration

CWE-20

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://lists.fedoraproject.org/pipermail/package-announce/2015-September/167120.htmlThird Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2015-September/167130.htmlThird Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00019.htmlThird Party Advisory
http://mail.openjdk.java.net/pipermail/distro-pkg-dev/2015-September/033546.htmlPatch
http://rhn.redhat.com/errata/RHSA-2016-0778.htmlThird Party Advisory
http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html
http://www.securitytracker.com/id/1033780
http://www.ubuntu.com/usn/USN-2817-1
https://bugzilla.redhat.com/show_bug.cgi?id=1233667Issue Tracking
http://lists.fedoraproject.org/pipermail/package-announce/2015-September/167120.htmlThird Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2015-September/167130.htmlThird Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00019.htmlThird Party Advisory
http://mail.openjdk.java.net/pipermail/distro-pkg-dev/2015-September/033546.htmlPatch
http://rhn.redhat.com/errata/RHSA-2016-0778.htmlThird Party Advisory
http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html
http://www.securitytracker.com/id/1033780
http://www.ubuntu.com/usn/USN-2817-1
https://bugzilla.redhat.com/show_bug.cgi?id=1233667Issue Tracking

Timeline

Published: Oct 9, 2015
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2015

CVE-2015-52354.3IcedTea-Web before 1.5.3 and 1.6.x before 1.6.1 does not properly determine the origin of unsigned applets, which allows remote attackers to CVE-2015-52367.5It was discovered that the IcedTea-Web used codebase attribute of the <applet> tag on the HTML page that hosts Java applet in the Same Origi CVE-2015-52378.8protobuf allows remote authenticated attackers to cause a heap-based buffer overflow.CVE-2015-52396.5Integer overflow in the VNC display driver in QEMU before 2.1.0 allows attachers to cause a denial of service (process crash) via a CLIENT_C CVE-2015-52403.5Race condition in OpenStack Neutron before 2014.2.4 and 2015.1 before 2015.1.2, when using the ML2 plugin or the security groups AMQP API, a CVE-2015-52416.1After logging into the portal, the logout jsp page redirects the browser back to the login page after. It is feasible for malicious users to CVE-2015-52426.0OpenStack Swift-on-File (aka Swiftonfile) does not properly restrict use of the pickle Python module when loading metadata, which allows rem CVE-2015-52439.8phpWhois allows remote attackers to execute arbitrary code via a crafted whois record.CVE-2015-52449.8The NSSCipherSuite option with ciphersuites enabled in mod_nss before 1.0.12 allows remote attackers to bypass application restrictions.CVE-2015-52454.3CRLF injection vulnerability in the Ceph Object Gateway (aka radosgw or RGW) in Ceph before 0.94.4 allows remote attackers to inject arbitra CVE-2015-52468.1The LDAP Authentication functionality in Foreman might allow remote attackers with knowledge of old passwords to gain access via vectors inv CVE-2015-52476.5The virStorageVolCreateXML API in libvirt 1.2.14 through 1.2.19 allows remote authenticated users with a read-write connection to cause a de