PT-2014-2123

CVE-2011-2513

Published

2011-07-27

Updated

2014-06-25

Description by

CVSS 2.0

5.0

Medium

MetricsAV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions IcedTea6 versions 1.9.x before 1.9.9 IcedTea6 versions 1.8.x before 1.8.9 IcedTea-Web versions 1.1.x before 1.1.1 IcedTea-Web versions 1.0.x before 1.0.4

Description The Java Network Launching Protocol (JNLP) implementation allows remote attackers to obtain the username and full path of the home and cache directories by accessing properties of the ClassLoader.

Recommendations For IcedTea6 versions 1.9.x before 1.9.9, update to version 1.9.9 or later. For IcedTea6 versions 1.8.x before 1.8.9, update to version 1.8.9 or later. For IcedTea-Web versions 1.1.x before 1.1.1, update to version 1.1.1 or later. For IcedTea-Web versions 1.0.x before 1.0.4, update to version 1.0.4 or later.

Exploitability

Fix

Impacts

Researchers

Vendors

Affected products

Weakness enumeration

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

Related identifiers

CVE-2011-2513

OPENSUSE-SU-2024:10316-1

RHSA-2011:1100