Cette page suit l'état du correctif pour Debian. La vulnérabilité elle-même est décrite sur la page CVE principale.
Voir CVE-2019-10182 →
DEBIAN-CVE-2019-10182
It was found that icedtea-web though 1.7.2 and 1.8.2 did not properly sanitize paths from elements in JNLP files. An attacker could trick a victim in...
Description d'origine
La description telle que publiée par la source (souvent en anglais).
It was found that icedtea-web though 1.7.2 and 1.8.2 did not properly sanitize paths from elements in JNLP files. An attacker could trick a victim into running a specially crafted application and use this flaw to upload arbitrary files to arbitrary locations in the context of the user.
Source: OSV.dev (Open Source Vulnerabilities) OSV
Paquets affectés
Debian:12
icedtea-web
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.3-1"}]}]
Debian:13
icedtea-web
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.3-1"}]}]
Debian:14
icedtea-web
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.3-1"}]}]
Références
- advisory security-tracker.debian.org