CVE-2011-0706 Privilege escalation in n/a
Remote attackers can gain privileges via JNLPClassLoader flaws in IcedTea-Web, requiring user interaction to launch malicious Java Web Start applications.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2011-0706?
CVE-2011-0706 is a high-severity vulnerability in Sun Jdk, published on 18 Feb 2011. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
The JNLPClassLoader class in IcedTea-Web before 1.0.1, as used in OpenJDK Runtime Environment 1.6.0, allows remote attackers to gain privileges via unknown vectors related to multiple signers and the assignment of "an inappropriate security descriptor."
Weakness: CWE-264
Which versions are affected by CVE-2011-0706?
It affects 2 products.
Products include Redhat Icedtea-Web, Sun Jdk.
How do I fix CVE-2011-0706?
Upgrade to a fixed version.
Is CVE-2011-0706 being exploited?
There is no known exploitation of CVE-2011-0706 in the wild and no public exploit code.
Other vulnerabilities in Sun Jdk
Sources
Also known as GHSA-6228-hc88-4m3g.