CVE-2019-10181: medium-severity vulnerability in icedtea-web
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
A flaw in icedtea-web allows attackers to inject malicious code into JAR files while keeping the digital signature valid. This means users could run untrusted code thinking they are running a legitimate, trusted application.
CWE-345 (Insufficient Verification of Data Authenticity) affects icedtea-web versions up to 1.7.2 and 1.8.2, enabling code injection into signed JAR files without invalidating the signature. The attack vector is local/network delivery of a crafted JAR; the injected code executes within the Java sandbox, limiting but not eliminating the security impact.
In the same product, most dangerous first.