CVE-2015-5235

NameCVE-2015-5235
DescriptionIcedTea-Web before 1.5.3 and 1.6.x before 1.6.1 does not properly determine the origin of unsigned applets, which allows remote attackers to bypass the approval process or trick users into approving applet execution via a crafted web page.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs798467

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
icedtea-web (PTS)bullseye1.8.4-1fixed
bookworm1.8.8-2fixed
sid, trixie1.8.8-3fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
icedtea-websourcejessie1.5.3-1
icedtea-websource(unstable)1.6.1-1798467

Notes

[wheezy] - icedtea-web <no-dsa> (Minor issue)
Search for package or bug name: Reporting problems