File _patchinfo of Package patchinfo.12078
<patchinfo incident="12078">
<issue tracker="cve" id="2019-10181"/>
<issue tracker="cve" id="2019-10182"/>
<issue tracker="cve" id="2019-10185"/>
<issue tracker="bnc" id="1142825">VUL-0: EMBARGOED: CVE-2019-10182: icedtea-web: path traversal while processing <jar/> elements of JNLP files results in arbitrary file overwrite</issue>
<issue tracker="bnc" id="1142832">VUL-0: EMBARGOED: CVE-2019-10185: icedtea-web: directory traversal in the nested jar auto-extraction leading to arbitrary file overwrite</issue>
<issue tracker="bnc" id="1142835">VUL-0: EMBARGOED: CVE-2019-10181: icedtea-web: unsigned code injection in a signed JAR file</issue>
<packager>fstrba</packager>
<rating>important</rating>
<category>security</category>
<summary>Security update for icedtea-web</summary>
<description>This update for icedtea-web to version 1.7.2 fixes the following issues:
Security issues fixed:
- CVE-2019-10181: Fixed an unsigned code injection in a signed JAR file (bsc#1142835)
- CVE-2019-10182: Fixed a path traversal while processing <jar/> elements of JNLP files results in arbitrary file overwrite (bsc#1142825).
- CVE-2019-10185: Fixed a directory traversal in the nested jar auto-extraction leading to arbitrary file overwrite (bsc#1142832).
</description>
</patchinfo>