CVE-2011-0025
Summary
| CVE | CVE-2011-0025 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2011-02-04 20:00:00 UTC |
| Updated | 2023-02-13 00:15:00 UTC |
| Description | IcedTea 1.7 before 1.7.8, 1.8 before 1.8.5, and 1.9 before 1.9.5 does not properly verify signatures for JAR files that (1) are "partially signed" or (2) signed by multiple entities, which allows remote attackers to trick users into executing code that appears to come from a trusted source. |
Risk And Classification
Problem Types: CWE-20
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Redhat | Icedtea | 1.7 | All | All | All |
| Application | Redhat | Icedtea | 1.7.1 | All | All | All |
| Application | Redhat | Icedtea | 1.7.2 | All | All | All |
| Application | Redhat | Icedtea | 1.7.3 | All | All | All |
| Application | Redhat | Icedtea | 1.7.4 | All | All | All |
| Application | Redhat | Icedtea | 1.7.5 | All | All | All |
| Application | Redhat | Icedtea | 1.7.6 | All | All | All |
| Application | Redhat | Icedtea | 1.7.7 | All | All | All |
| Application | Redhat | Icedtea | 1.8 | All | All | All |
| Application | Redhat | Icedtea | 1.8.1 | All | All | All |
| Application | Redhat | Icedtea | 1.8.2 | All | All | All |
| Application | Redhat | Icedtea | 1.8.3 | All | All | All |
| Application | Redhat | Icedtea | 1.8.4 | All | All | All |
| Application | Redhat | Icedtea | 1.9 | All | All | All |
| Application | Redhat | Icedtea | 1.9.1 | All | All | All |
| Application | Redhat | Icedtea | 1.9.2 | All | All | All |
| Application | Redhat | Icedtea | 1.9.3 | All | All | All |
| Application | Redhat | Icedtea | 1.9.4 | All | All | All |
| Application | Redhat | Icedtea | 1.7 | All | All | All |
| Application | Redhat | Icedtea | 1.7.1 | All | All | All |
| Application | Redhat | Icedtea | 1.7.2 | All | All | All |
| Application | Redhat | Icedtea | 1.7.3 | All | All | All |
| Application | Redhat | Icedtea | 1.7.4 | All | All | All |
| Application | Redhat | Icedtea | 1.7.5 | All | All | All |
| Application | Redhat | Icedtea | 1.7.6 | All | All | All |
| Application | Redhat | Icedtea | 1.7.7 | All | All | All |
| Application | Redhat | Icedtea | 1.8 | All | All | All |
| Application | Redhat | Icedtea | 1.8.1 | All | All | All |
| Application | Redhat | Icedtea | 1.8.2 | All | All | All |
| Application | Redhat | Icedtea | 1.8.3 | All | All | All |
| Application | Redhat | Icedtea | 1.8.4 | All | All | All |
| Application | Redhat | Icedtea | 1.9 | All | All | All |
| Application | Redhat | Icedtea | 1.9.1 | All | All | All |
| Application | Redhat | Icedtea | 1.9.2 | All | All | All |
| Application | Redhat | Icedtea | 1.9.3 | All | All | All |
| Application | Redhat | Icedtea | 1.9.4 | All | All | All |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| GNU/Andrew’s Blog » [SECURITY] IcedTea6 1.7.8, 1.8.5, 1.9.5 Released! | CONFIRM | blog.fuseyism.com | Patch |
| USN-1055-1: OpenJDK vulnerabilities | Ubuntu | UBUNTU | www.ubuntu.com | |
| Security Advisories | Mandriva Linux | MANDRIVA | www.mandriva.com | |
| CVE-2011-0025 - Red Hat Customer Portal | MISC | access.redhat.com | |
| Bug 672262 – CVE-2011-0025 IcedTea jarfile signature verification bypass | MISC | bugzilla.redhat.com | |
| Ubuntu update for openjdk-6 - Secunia.com | SECUNIA | secunia.com | Vendor Advisory |
| IBM X-Force Exchange | XF | exchange.xforce.ibmcloud.com | |
| Gentoo Linux Documentation -- IcedTea JDK: Multiple vulnerabilities | GENTOO | security.gentoo.org | |
| Debian -- Security Information -- DSA-2224-1 openjdk-6 | DEBIAN | www.debian.org | |
| OpenJDK 'IcedTea' Plugin JAR Signature Verification Security Bypass Vulnerability | BID | www.securityfocus.com | |
| release/icedtea-web-1.0: 3bd328e4b515 | MISC | icedtea.classpath.org | Patch |
| release/icedtea-web-1.0: 3bd328e4b515 | MISC | icedtea.classpath.org | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.