CVE-2019-10182

Name of the Vulnerable Software and Affected Versions IcedTea-Web versions 1.7.2 and 1.8.2

Description The issue is related to the improper sanitization of paths from jar/ elements in JNLP files. This could allow an attacker to trick a victim into running a specially crafted application, potentially leading to the upload of arbitrary files to arbitrary locations on the user's system. The vulnerability can be exploited by a remote attacker using a specially crafted application to write arbitrary files to the device's file system.

Recommendations For IcedTea-Web versions 1.7.2 and 1.8.2, consider disabling the processing of JNLP files until a patch is available to prevent the exploitation of this issue. Restrict access to the jar/ elements in JNLP files to minimize the risk of arbitrary file uploads. At the moment, there is no information about a newer version that contains a fix for this vulnerability.