CVE Vulnerabilities

CVE-2015-5236

Insufficient Verification of Data Authenticity

Published: Jul 07, 2022 | Modified: Jul 15, 2022
CVSS 3.x
7.5
HIGH
Source:
NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS 2.x
5 MEDIUM
AV:N/AC:L/Au:N/C:P/I:N/A:N
RedHat/V2
5.8 MODERATE
AV:N/AC:M/Au:N/C:P/I:P/A:N
RedHat/V3
Ubuntu
NEGLIGIBLE

It was discovered that the IcedTea-Web used codebase attribute of the tag on the HTML page that hosts Java applet in the Same Origin Policy (SOP) checks. As the specified codebase does not have to match the applets actual origin, this allowed malicious site to bypass SOP via spoofed codebase value.

Weakness

The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.

Affected Software

Name Vendor Start Version End Version
Icedtea-web Icedtea-web_project - (including) - (including)
Icedtea-web Ubuntu bionic *
Icedtea-web Ubuntu hirsute *
Icedtea-web Ubuntu impish *
Icedtea-web Ubuntu kinetic *
Icedtea-web Ubuntu lunar *
Icedtea-web Ubuntu trusty *
Icedtea-web Ubuntu xenial *

References