CVE-2019-10181

HighCVSS 8.1/10Last modified Jun 17, 2026

Description

It was found that in icedtea-web up to and including 1.7.2 and 1.8.2 executable code could be injected in a JAR file without compromising the signature verification. An attacker could use this flaw to inject code in a trusted JAR. The code would be executed inside the sandbox.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-345

Affected software

Vendor	Product	Versions
IcedTea	icedtea-web	affects up to and including 1.7.2 and 1.8.2

References

http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00045.htmlThird Party Advisory
http://packetstormsecurity.com/files/154748/IcedTeaWeb-Validation-Bypass-Directory-Traversal-Code-Execution.htmlThird Party Advisory, VDB Entry
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10181Issue Tracking, Third Party Advisory
https://github.com/AdoptOpenJDK/IcedTea-Web/issues/327Third Party Advisory
https://github.com/AdoptOpenJDK/IcedTea-Web/pull/344Patch, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2019/09/msg00008.htmlThird Party Advisory
https://seclists.org/bugtraq/2019/Oct/5Mailing List, Third Party Advisory
https://security.gentoo.org/glsa/202107-51Patch, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00045.htmlThird Party Advisory
http://packetstormsecurity.com/files/154748/IcedTeaWeb-Validation-Bypass-Directory-Traversal-Code-Execution.htmlThird Party Advisory, VDB Entry
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10181Issue Tracking, Third Party Advisory
https://github.com/AdoptOpenJDK/IcedTea-Web/issues/327Third Party Advisory
https://github.com/AdoptOpenJDK/IcedTea-Web/pull/344Patch, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2019/09/msg00008.htmlThird Party Advisory
https://seclists.org/bugtraq/2019/Oct/5Mailing List, Third Party Advisory
https://security.gentoo.org/glsa/202107-51Patch, Third Party Advisory

Timeline

Published: Jul 31, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-101826.5It was found that icedtea-web though 1.7.2 and 1.8.2 did not properly sanitize paths from <jar/> elements in JNLP files. An attacker could t CVE-2019-101833.3Virt-install(1) utility used to provision new virtual machines has introduced an option '--unattended' to create VMs without user interactio CVE-2019-101847.5undertow before version 2.0.23.Final is vulnerable to an information leak issue. Web apps may have their directory structures predicted thro CVE-2019-101858.6It was found that icedtea-web up to and including 1.7.2 and 1.8.2 was vulnerable to a zip-slip attack during auto-extraction of a JAR file. CVE-2019-101868.8A flaw was found in moodle before versions 3.7.1, 3.6.5, 3.5.7. A sesskey (CSRF) token was not being utilised by the XML loading/unloading a CVE-2019-101874.3A flaw was found in moodle before versions 3.7.1, 3.6.5, 3.5.7. Users with permission to delete entries from a glossary were able to delete CVE-2019-101884.3A flaw was found in moodle before versions 3.7.1, 3.6.5, 3.5.7. Teachers in a quiz group could modify group overrides for other groups in th CVE-2019-101894.3A flaw was found in moodle before versions 3.7.1, 3.6.5, 3.5.7. Teachers in an assignment group could modify group overrides for other group CVE-2019-10198.5A security feature bypass vulnerability exists where a NETLOGON message is able to obtain the session key and sign messages. To exploit this CVE-2019-101907.5A vulnerability was discovered in DNS resolver component of knot resolver through version 3.2.0 before 4.1.0 which allows remote attackers t CVE-2019-101917.5A vulnerability was discovered in DNS resolver of knot resolver before version 4.1.0 which allows remote attackers to downgrade DNSSEC-secur CVE-2019-101927.2A heap-buffer overflow vulnerability was found in the Redis hyperloglog data structure versions 3.x before 3.2.13, 4.x before 4.0.14 and 5.x