Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.8
CVE-2011-2514: IcedTea Web may grant access to wrong local file
CVE-2011-2514 · published 12 years ago
Summary
Versions of IcedTea6 and IcedTea‑Web used for Java Web Start can be tricked into showing a misleading security warning. An attacker can change the name shown in the dialog so a user thinks they are allowing access to one file, while actually granting access to a different local file. Update to the latest IcedTea packages or apply the vendor’s security patch to stop this deception.
What to do
- Update debian icedtea-web to version 1.1-1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Debian:11 | debian | icedtea-web |
< 1.1-1 Fix: upgrade to 1.1-1
|
| Debian:12 | debian | icedtea-web |
< 1.1-1 Fix: upgrade to 1.1-1
|
| Debian:13 | debian | icedtea-web |
< 1.1-1 Fix: upgrade to 1.1-1
|
| Debian:14 | debian | icedtea-web |
< 1.1-1 Fix: upgrade to 1.1-1
|
| – | redhat | icedtea-web |
<= 1.0.3 1.0 1.0.1 1.0.2 1.1 cpe:2.3:a:redhat:icedtea-web:*:*:*:*:*:*:*:* |
| – | redhat | icedtea6 |
<= 1.8.8 1.8 1.8.1 1.8.2 1.8.3 1.8.4 1.8.5 1.8.6 1.8.7 1.9.1 1.9.2 1.9.3 5 more version ranges
cpe:2.3:a:redhat:icedtea6:*:*:*:*:*:*:*:* |
Original advisory text
The Java Network Launching Protocol (JNLP) implementation in IcedTea6 1.9.x before 1.9.9 and before 1.8.9, and IcedTea-Web 1.1.x before 1.1.1 and before 1.0.4, allows remote attackers to trick vict...
The Java Network Launching Protocol (JNLP) implementation in IcedTea6 1.9.x before 1.9.9 and before 1.8.9, and IcedTea-Web 1.1.x before 1.1.1 and before 1.0.4, allows remote attackers to trick victims into granting access to local files by modifying the content of the Java Web Start Security Warning dialog box to represent a different filename than the file for which access will be granted.
References
- https://security-tracker.debian.org/tracker/CVE-2011-2514 Vendor Advisory
- http://icedtea.classpath.org/hg/release/icedtea-web-1.0/rev/b99f9a9769e0
- http://icedtea.classpath.org/hg/release/icedtea-web-1.1/rev/512de5d90388
- http://mail.openjdk.java.net/pipermail/distro-pkg-dev/2011-July/015170.html
- http://mail.openjdk.java.net/pipermail/distro-pkg-dev/2011-July/015171.html Patch Vendor Advisory
- http://rhn.redhat.com/errata/RHSA-2011-1100.html
- http://securitytracker.com/id?1025854
- http://ubuntu.com/usn/usn-1178-1 Patch
- https://bugzilla.redhat.com/show_bug.cgi?id=718170
Severity
6.8
Medium
Type
CWE-264Permissions, Privileges, and Access Controls
Timeline
Published14 May 2014
Updated29 Oct 2026
First seen25 Aug 2026
Track software like this
Free during beta