File _patchinfo of Package patchinfo.23597

<patchinfo incident="23597">
  <issue tracker="cve" id="2019-10185"/>
  <issue tracker="cve" id="2019-10181"/>
  <issue tracker="cve" id="2019-10182"/>
  <issue tracker="bnc" id="1142832">VUL-0: CVE-2019-10185: icedtea-web: directory traversal in the nested jar auto-extraction leading to arbitrary file overwrite</issue>
  <issue tracker="bnc" id="1142835">VUL-0: CVE-2019-10181: icedtea-web: unsigned code injection in a signed JAR file</issue>
  <issue tracker="bnc" id="1142825">VUL-0: CVE-2019-10182: icedtea-web: path traversal while processing &lt;jar/&gt; elements of JNLP files results in arbitrary file overwrite</issue>
  <packager>fstrba</packager>
  <rating>important</rating>
  <category>security</category>
  <summary>Security update for icedtea-web</summary>
  <description>This update for icedtea-web fixes the following issues:

- CVE-2019-10181: Fixed an issue where an attacker could inject unsigned code
  in a signed JAR file (bsc#1142835).
- CVE-2019-10182: Fixed a path traversal issue where an attacker could upload
  arbritrary files by tricking a victim into running a specially crafted
  application(bsc#1142825).
- CVE-2019-10185: Fixed an issue where an attacker could write files to arbitrary
  locations during JAR auto-extraction (bsc#1142832).
</description>
</patchinfo>