VULNERABILITY INTELLIGENCE

CVE-2011-0025

CVSS score6.8 MEDIUM
EPSS probability2.58%
CISA KEVNot currently listed
Published2011-02-04
Last modified2026-06-16
CVSS vectorAV:N/AC:M/Au:N/C:P/I:P/A:P

Description

IcedTea 1.7 before 1.7.8, 1.8 before 1.8.5, and 1.9 before 1.9.5 does not properly verify signatures for JAR files that (1) are "partially signed" or (2) signed by multiple entities, which allows remote attackers to trick users into executing code that appears to come from a trusted source.

Weakness classification

  • CWE-20: Improper Input Validation

Primary references