CVE-2011-0025
Summary
| CVE | CVE-2011-0025 |
|---|---|
| State | PUBLISHED |
| Assigner | redhat |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2011-02-04 20:00:02 UTC |
| Updated | 2026-04-29 01:13:23 UTC |
| Description | IcedTea 1.7 before 1.7.8, 1.8 before 1.8.5, and 1.9 before 1.9.5 does not properly verify signatures for JAR files that (1) are "partially signed" or (2) signed by multiple entities, which allows remote attackers to trick users into executing code that appears to come from a trusted source. |
Risk And Classification
CVSS v2.0 Breakdown
Access Vector
NetworkAccess Complexity
MediumAuthentication
NoneConfidentiality
PartialIntegrity
PartialAvailability
PartialAV:N/AC:M/Au:N/C:P/I:P/A:P
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Redhat | Icedtea | 1.7 | All | All | All |
| Application | Redhat | Icedtea | 1.7.1 | All | All | All |
| Application | Redhat | Icedtea | 1.7.2 | All | All | All |
| Application | Redhat | Icedtea | 1.7.3 | All | All | All |
| Application | Redhat | Icedtea | 1.7.4 | All | All | All |
| Application | Redhat | Icedtea | 1.7.5 | All | All | All |
| Application | Redhat | Icedtea | 1.7.6 | All | All | All |
| Application | Redhat | Icedtea | 1.7.7 | All | All | All |
| Application | Redhat | Icedtea | 1.8 | All | All | All |
| Application | Redhat | Icedtea | 1.8.1 | All | All | All |
| Application | Redhat | Icedtea | 1.8.2 | All | All | All |
| Application | Redhat | Icedtea | 1.8.3 | All | All | All |
| Application | Redhat | Icedtea | 1.8.4 | All | All | All |
| Application | Redhat | Icedtea | 1.9 | All | All | All |
| Application | Redhat | Icedtea | 1.9.1 | All | All | All |
| Application | Redhat | Icedtea | 1.9.2 | All | All | All |
| Application | Redhat | Icedtea | 1.9.3 | All | All | All |
| Application | Redhat | Icedtea | 1.9.4 | All | All | All |
Vendor Declared Affected Products
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| Debian -- Security Information -- DSA-2224-1 openjdk-6 | af854a3a-2127-422b-91ae-364da2661108 | www.debian.org | |
| release/icedtea-web-1.0: 3bd328e4b515 | af854a3a-2127-422b-91ae-364da2661108 | icedtea.classpath.org | |
| OpenJDK 'IcedTea' Plugin JAR Signature Verification Security Bypass Vulnerability | af854a3a-2127-422b-91ae-364da2661108 | www.securityfocus.com | |
| Security Advisories | Mandriva Linux | af854a3a-2127-422b-91ae-364da2661108 | www.mandriva.com | |
| USN-1055-1: OpenJDK vulnerabilities | Ubuntu | af854a3a-2127-422b-91ae-364da2661108 | www.ubuntu.com | |
| Gentoo Linux Documentation -- IcedTea JDK: Multiple vulnerabilities | af854a3a-2127-422b-91ae-364da2661108 | security.gentoo.org | |
| Ubuntu update for openjdk-6 - Secunia.com | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | Vendor Advisory |
| GNU/Andrew’s Blog » [SECURITY] IcedTea6 1.7.8, 1.8.5, 1.9.5 Released! | af854a3a-2127-422b-91ae-364da2661108 | blog.fuseyism.com | Patch |
| IBM X-Force Exchange | af854a3a-2127-422b-91ae-364da2661108 | exchange.xforce.ibmcloud.com | |
| release/icedtea-web-1.0: 3bd328e4b515 | MITRE | icedtea.classpath.org | |
| CVE-2011-0025 - Red Hat Customer Portal | MITRE | access.redhat.com | |
| Bug 672262 – CVE-2011-0025 IcedTea jarfile signature verification bypass | MITRE | bugzilla.redhat.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.