It was found that icedtea-web up to and including 1.7.2 and 1.8.2 was vulnerable to a zip-slip attack during auto-extraction of a JAR file. An attacker could use this flaw to write files to arbitrary locations. This could also be used to replace the main running application and, possibly, break out of the sandbox.
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
| Link | Tags |
|---|---|
| https://github.com/AdoptOpenJDK/IcedTea-Web/pull/344 | third party advisory patch |
| https://github.com/AdoptOpenJDK/IcedTea-Web/issues/327 | third party advisory |
| https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10185 | issue tracking third party advisory |
| http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00045.html | third party advisory vendor advisory |
| https://lists.debian.org/debian-lts-announce/2019/09/msg00008.html | third party advisory mailing list |
| https://seclists.org/bugtraq/2019/Oct/5 | third party advisory mailing list |
| http://packetstormsecurity.com/files/154748/IcedTeaWeb-Validation-Bypass-Directory-Traversal-Code-Execution.html | vdb entry third party advisory |
| https://security.gentoo.org/glsa/202107-51 | third party advisory patch vendor advisory |