CVE-2015-5234

What it actually does

Improper sanitization of applet URLs allows injection of arbitrary applet entries into the .appletTrustSettings file, bypassing the user approval mechanism for applet execution.

Why it matters to the business

Attackers can execute unauthorized Java applets on affected systems without user consent, increasing risk of code execution on legacy Red Hat and openSUSE deployments that still rely on IcedTea-Web.

How an attack unfolds

An attacker hosts a crafted web page containing a malicious applet URL with embedded line breaks or special characters; when a victim browser loads the page, the applet details are written into the local trust configuration, allowing subsequent execution without prompting.

How to fix it

Upgrade IcedTea-Web to version 1.5.3 or newer and 1.6.1 or newer on all affected Red Hat Enterprise Linux and openSUSE systems; remove or audit existing .appletTrustSettings files for unexpected entries after patching.

How to confirm the fix worked

Verify installed IcedTea-Web package version is at or above 1.5.3/1.6.1; inspect .appletTrustSettings files for unauthorized applet entries and confirm no execution bypass artifacts remain.

Typical attack path

1. Host a web page embedding a malicious applet URL with crafted line breaks
2. Victim browser visits the page and processes the URL
3. Injected applet entry written to .appletTrustSettings
4. Applet executes with user privileges without approval dialog

How to detect it

Search system and browser logs for unexpected applet loads, inspect .appletTrustSettings files for entries containing unusual URLs or line-break artifacts, and review web access logs for visits to pages that could trigger URL injection.

• .appletTrustSettings
• appletTrustSettings

What your security team should do

• Prioritize patching legacy systems still running vulnerable IcedTea-Web packages
• Audit and clean .appletTrustSettings files across the environment
• Disable Java applet support where feasible given the age of the component