CVE-2011-2514

Related Files

Ubuntu Security Notice USN-1178-1

Posted Jul 28, 2011

Authored by Ubuntu | Site security.ubuntu.com

Ubuntu Security Notice 1178-1 - Omair Majid discovered that an unsigned Web Start application or applet could determine the path to the cache directory used to store downloaded class and jar files by querying class loader properties. This could allow a remote attacker to discover a user's name and home directory path. Omair Majid discovered that an unsigned Web Start application could manipulate the content of the security warning dialog message to show different file names in prompts. This could allow a remote attacker to confuse a user into granting access to a different file than they believe they are granting access to. This issue only affected Ubuntu 11.04. Various other issues were also addressed.

tags | advisory, remote, web

systems | linux, ubuntu

advisories | CVE-2011-2513, CVE-2011-2514

SHA-256 | 5cb5e15a07f22e63f6d9edc10245fda02e4b60327dd01c9ab1b2dc2afcfb6e68

Download | Favorite | View

Red Hat Security Advisory 2011-1100-01

Posted Jul 27, 2011

Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2011-1100-01 - The IcedTea-Web project provides a Java web browser plug-in and an implementation of Java Web Start, which is based on the Netx project. It also contains a configuration tool for managing deployment settings for the plug-in and Web Start implementations. A flaw was discovered in the JNLP implementation in IcedTea-Web. An unsigned Java Web Start application could use this flaw to manipulate the content of a Security Warning dialog box, to trick a user into granting the application unintended access permissions to local files.

tags | advisory, java, web, local

systems | linux, redhat

advisories | CVE-2011-2513, CVE-2011-2514

SHA-256 | 1aa0fc44e9203cd83f9e35c5f4c37ec5b68f33d5745644ea51197952cea44e7d

Download | Favorite | View