CVE-2010-2548 - IcedTea Incomplete property access check for unsigned applications

CRITICAL

IcedTea Incomplete property access check for unsigned applications

Published Oct 31, 2019

9.1

CRITICAL

CVSS 3.1

EPSS 1.99%

IcedTea6 before 1.7.4 does not properly check property access, which allows unsigned apps to read and write arbitrary files.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

Version	Status	Constraints
1.7.4	affected	-

Product	Package	State	Advisory
Red Hat Enterprise Linux 6	java-1.6.0-openjdk	Affected	n/a

Red Hat statement

This issue does not affect the version of the java-1.6.0-openjdk package, as shipped with Red Hat Enterprise Linux 5.

Weaknesses (1)

CWE-863

Incorrect Authorization

Link	Providers	Tags
http://blog.fuseyism.com/index.php/2010/07/28/icedtea6-174-released/		x_refsource_CONFIRMPatchThird Party Advisory
https://access.redhat.com/security/cve/CVE-2010-2548		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=616893		Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2010-2548		x_refsource_MISCIssue TrackingVendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2010-2548
https://security-tracker.debian.org/tracker/CVE-2010-2548		x_refsource_MISCThird Party Advisory
https://www.cve.org/CVERecord?id=CVE-2010-2548