CVE-2011-2513

Upstream information

CVE-2011-2513 at MITRE

Description

The Java Network Launching Protocol (JNLP) implementation in IcedTea6 1.9.x before 1.9.9 and before 1.8.9, and IcedTea-Web 1.1.x before 1.1.1 and before 1.0.4, allows remote attackers to obtain the username and full path of the home and cache directories by accessing properties of the ClassLoader.

---

SUSE information

Overall state of this security issue: Resolved

This issue is currently rated as having moderate severity.

CVSS v2 Scores

	National Vulnerability Database
Base Score	5
Vector	AV:N/AC:L/Au:N/C:P/I:N/A:N
Access Vector	Network
Access Complexity	Low
Authentication	None
Confidentiality Impact	Partial
Integrity Impact	None
Availability Impact	None

SUSE Bugzilla entry: 704309 [RESOLVED / FIXED]

SUSE Security Advisories:

• openSUSE-SU-2011:0829-1, published Mon, 25 Jul 2011 13:08:28 +0200 (CEST)

List of released packages

Product(s)	Fixed package version(s)	References
SUSE Linux Enterprise Desktop 12	java-1_7_0-openjdk-plugin >= 1.5.1-1.13	Patchnames: SUSE Linux Enterprise Desktop 12 GA java-1_7_0-openjdk-plugin
SUSE Linux Enterprise Desktop 12 SP1	java-1_7_0-openjdk-plugin >= 1.6.1-2.3.1 java-1_8_0-openjdk-plugin >= 1.6.1-2.4.21	Patchnames: SUSE Linux Enterprise Desktop 12 SP1 GA java-1_7_0-openjdk-plugin
SUSE Linux Enterprise Desktop 12 SP2	java-1_7_0-openjdk-plugin >= 1.6.1-2.3.1 java-1_8_0-openjdk-plugin >= 1.6.1-2.4.21	Patchnames: SUSE Linux Enterprise Desktop 12 SP2 GA java-1_7_0-openjdk-plugin
SUSE Linux Enterprise Desktop 12 SP3	java-1_7_0-openjdk-plugin >= 1.6.2-2.8.3 java-1_8_0-openjdk-plugin >= 1.6.2-2.10.3	Patchnames: SUSE Linux Enterprise Desktop 12 SP3 GA java-1_7_0-openjdk-plugin
SUSE Linux Enterprise Desktop 12 SP4	java-1_7_0-openjdk-plugin >= 1.6.2-2.8.3 java-1_8_0-openjdk-plugin >= 1.6.2-2.10.3	Patchnames: SUSE Linux Enterprise Desktop 12 SP4 GA java-1_7_0-openjdk-plugin
SUSE Linux Enterprise Workstation Extension 12	java-1_7_0-openjdk-plugin >= 1.5.1-1.13	Patchnames: SUSE Linux Enterprise Workstation Extension 12 GA java-1_7_0-openjdk-plugin
SUSE Linux Enterprise Workstation Extension 12 SP1	java-1_7_0-openjdk-plugin >= 1.6.1-2.3.1 java-1_8_0-openjdk-plugin >= 1.6.1-2.4.21	Patchnames: SUSE Linux Enterprise Workstation Extension 12 SP1 GA java-1_7_0-openjdk-plugin
SUSE Linux Enterprise Workstation Extension 12 SP2	java-1_7_0-openjdk-plugin >= 1.6.1-2.3.1 java-1_8_0-openjdk-plugin >= 1.6.1-2.4.21	Patchnames: SUSE Linux Enterprise Workstation Extension 12 SP2 GA java-1_7_0-openjdk-plugin
SUSE Linux Enterprise Workstation Extension 12 SP3	java-1_7_0-openjdk-plugin >= 1.6.2-2.8.3 java-1_8_0-openjdk-plugin >= 1.6.2-2.10.3	Patchnames: SUSE Linux Enterprise Workstation Extension 12 SP3 GA java-1_7_0-openjdk-plugin
SUSE Linux Enterprise Workstation Extension 12 SP4	java-1_7_0-openjdk-plugin >= 1.6.2-2.8.3 java-1_8_0-openjdk-plugin >= 1.6.2-2.10.3	Patchnames: SUSE Linux Enterprise Workstation Extension 12 SP4 GA java-1_7_0-openjdk-plugin
SUSE Linux Enterprise Workstation Extension 15	icedtea-web >= 1.7.1-1.48	Patchnames: SUSE Linux Enterprise Workstation Extension 15 GA icedtea-web
openSUSE 11.3 openSUSE 11.4	icedtea-web >= 1.1-0.6.1 icedtea-web-javadoc >= 1.1-0.6.1
openSUSE 11.4	icedtea-web >= 1.1-0.6.1 icedtea-web-javadoc >= 1.1-0.6.1 java-1_6_0-openjdk >= 1.6.0.0_b22.1.10.2-4.3.1 java-1_6_0-openjdk-debuginfo >= 1.6.0.0_b22.1.10.2-4.3.1 java-1_6_0-openjdk-debugsource >= 1.6.0.0_b22.1.10.2-4.3.1 java-1_6_0-openjdk-demo >= 1.6.0.0_b22.1.10.2-4.3.1 java-1_6_0-openjdk-devel >= 1.6.0.0_b22.1.10.2-4.3.1 java-1_6_0-openjdk-devel-debuginfo >= 1.6.0.0_b22.1.10.2-4.3.1 java-1_6_0-openjdk-javadoc >= 1.6.0.0_b22.1.10.2-4.3.1 java-1_6_0-openjdk-src >= 1.6.0.0_b22.1.10.2-4.3.1	Patchnames: icedtea-web
openSUSE Leap 15.0	icedtea-web >= 1.7.1-lp150.1.22	Patchnames: openSUSE Leap 15.0 GA icedtea-web
openSUSE Leap 42.1	icedtea-web-javadoc >= 1.6.1-1.2 java-1_8_0-openjdk-plugin >= 1.6.1-1.2	Patchnames: openSUSE Leap 42.1 GA icedtea-web-javadoc
openSUSE Leap 42.2	icedtea-web-javadoc >= 1.6.1-2.37 java-1_8_0-openjdk-plugin >= 1.6.1-2.35	Patchnames: openSUSE Leap 42.2 GA icedtea-web-javadoc
openSUSE Leap 42.3	icedtea-web-javadoc >= 1.6.2-4.1 java-1_8_0-openjdk-plugin >= 1.6.2-4.1	Patchnames: openSUSE Leap 42.3 GA icedtea-web-javadoc
openSUSE Tumbleweed	icedtea-web-javadoc >= 1.6.2-3.3 java-1_7_0-openjdk-plugin >= 1.6.2-3.3 java-1_8_0-openjdk-plugin >= 1.6.2-3.3	Patchnames: openSUSE Tumbleweed GA icedtea-web-javadoc