CVE-2011-0025
redhat icedtea: no CVSS score yet. EPSS 2.6% chance of exploitation in the next 30 days.
IcedTea 1.7 before 1.7.8, 1.8 before 1.8.5, and 1.9 before 1.9.5 does not properly verify signatures for JAR files that (1) are "partially signed" or (2) signed by multiple entities, which allows remote attackers to trick users into executing code that appears to come from a trusted source.
- EPSS
- 2.6% chance of exploitation in the next 30 days; higher than 85% of CVEs (scores of 2026-10-31)
- CWE
- CWE-20
- Published
- Modified
- Record from
- the NVD, synced
Affected
- redhat:icedtea
References
- http://blog.fuseyism.com/index.php/2011/02/01/security-icedtea6-178-185-195-released/
- http://icedtea.classpath.org/hg/release/icedtea-web-1.0?cmd=changeset%3Bnode=3bd328e4b515
- http://secunia.com/advisories/43135
- http://security.gentoo.org/glsa/glsa-201406-32.xml
- http://www.debian.org/security/2011/dsa-2224