High
icedtea-web — security advisory
It was discovered that the IcedTea-Web used codebase attribute of the tag on the HTML page that hosts Java applet in the Same Origin Policy (SOP) checks. As the specified codebase does not have to match the applet's actual origin, this allowed malicious site to bypass SOP via spoofed codebase value.
- Products
- icedtea-web
- Affected versions
- 1.5.2-1ubuntu2, 1.5.3-0ubuntu1, 1.6.1-1ubuntu2, 1.6.1-3ubuntu1, 1.6.1-4ubuntu1, 1.6.2-1ubuntu1, 1.6.2-2ubuntu1, 1.6.2-3.1ubuntu3, 1.6.2-3ubuntu1, 1.8-0ubuntu8, 1.8-0ubuntu8~18.04, 1.8.4-1build1, 1.8.8-2, 1.8.8-2ubuntu1, 1.8.8-3, 1.8.8-3build1, 1.8.8-3ubuntu1, 1.8.8-4
- Fixed versions
- Not specified
- CVEs
- CVE-2015-5236
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 00:21 UTC · Revision 1
Source evidence
It was discovered that the IcedTea-Web used codebase attribute of the tag on the HTML page that hosts Java applet in the Same Origin Policy (SOP) checks. As the specified codebase does not have to match the applet's actual origin, this allowed malicious site to bypass SOP via spoofed codebase value.
osv:UBUNTU-CVE-2015-5236
icedtea-web
Fixed versions: Not specified
icedtea-web
Fixed versions: Not specified
icedtea-web
Fixed versions: Not specified
icedtea-web
Fixed versions: Not specified
icedtea-web
Fixed versions: Not specified
icedtea-web
Fixed versions: Not specified
icedtea-web
Fixed versions: Not specified
icedtea-web
Fixed versions: Not specified
Complete source record
{
"id": "92ff6b1dc83c34268d072198b3891f1a7649e95e973ea5c73ecde991f7f5974f",
"url": "https://osv.dev/vulnerability/UBUNTU-CVE-2015-5236",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "UBUNTU-CVE-2015-5236",
"summary": "It was discovered that the IcedTea-Web used codebase attribute of the tag on the HTML page that hosts Java applet in the Same Origin Policy (SOP) checks. As the specified codebase does not have to match the applet's actual origin, this allowed malicious site to bypass SOP via spoofed codebase value.",
"evidence": "osv:UBUNTU-CVE-2015-5236",
"products": [
{
"name": {
"value": "icedtea-web",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "1.5.2-1ubuntu2",
"evidence": "/affected/0/versions"
},
{
"value": "1.5.3-0ubuntu1",
"evidence": "/affected/0/versions"
},
{
"value": "1.6.1-1ubuntu2",
"evidence": "/affected/0/versions"
},
{
"value": "1.6.1-3ubuntu1",
"evidence": "/affected/0/versions"
},
{
"value": "1.6.1-4ubuntu1",
"evidence": "/affected/0/versions"
},
{
"value": "1.6.2-1ubuntu1",
"evidence": "/affected/0/versions"
},
{
"value": "1.6.2-2ubuntu1",
"evidence": "/affected/0/versions"
},
{
"value": "1.6.2-3ubuntu1",
"evidence": "/affected/0/versions"
}
]
},
{
"name": {
"value": "icedtea-web",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "1.6.2-3.1ubuntu3",
"evidence": "/affected/1/versions"
},
{
"value": "1.8-0ubuntu8~18.04",
"evidence": "/affected/1/versions"
}
]
},
{
"name": {
"value": "icedtea-web",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "1.8-0ubuntu8",
"evidence": "/affected/2/versions"
}
]
},
{
"name": {
"value": "icedtea-web",
"evidence": "/affected/3/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "1.8.4-1build1",
"evidence": "/affected/3/versions"
}
]
},
{
"name": {
"value": "icedtea-web",
"evidence": "/affected/4/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "1.8.8-2",
"evidence": "/affected/4/versions"
},
{
"value": "1.8.8-2ubuntu1",
"evidence": "/affected/4/versions"
}
]
},
{
"name": {
"value": "icedtea-web",
"evidence": "/affected/5/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "1.8.8-3",
"evidence": "/affected/5/versions"
}
]
},
{
"name": {
"value": "icedtea-web",
"evidence": "/affected/6/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "1.8.8-4",
"evidence": "/affected/6/versions"
}
]
},
{
"name": {
"value": "icedtea-web",
"evidence": "/affected/7/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "1.8.8-3",
"evidence": "/affected/7/versions"
},
{
"value": "1.8.8-3build1",
"evidence": "/affected/7/versions"
},
{
"value": "1.8.8-3ubuntu1",
"evidence": "/affected/7/versions"
},
{
"value": "1.8.8-4",
"evidence": "/affected/7/versions"
}
]
}
],
"severity": "high",
"structured": {
"id": "UBUNTU-CVE-2015-5236",
"aliases": [
"UBUNTU-CVE-2015-5236"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
},
{
"type": "Ubuntu",
"score": "negligible"
}
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "icedtea-web",
"purl": "pkg:deb/ubuntu/icedtea-web?arch=source&distro=xenial",
"ecosystem": "Ubuntu:16.04:LTS"
},
"versions": [
"1.5.2-1ubuntu2",
"1.5.3-0ubuntu1",
"1.6.1-1ubuntu2",
"1.6.1-3ubuntu1",
"1.6.1-4ubuntu1",
"1.6.2-1ubuntu1",
"1.6.2-2ubuntu1",
"1.6.2-3ubuntu1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2015/UBUNTU-CVE-2015-5236.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "icedtea-8-plugin",
"binary_version": "1.6.2-3ubuntu1"
},
{
"binary_name": "icedtea-netx",
"binary_version": "1.6.2-3ubuntu1"
},
{
"binary_name": "icedtea-netx-common",
"binary_version": "1.6.2-3ubuntu1"
},
{
"binary_name": "icedtea-plugin",
"binary_version": "1.6.2-3ubuntu1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "icedtea-web",
"purl": "pkg:deb/ubuntu/icedtea-web?arch=source&distro=bionic",
"ecosystem": "Ubuntu:18.04:LTS"
},
"versions": [
"1.6.2-3.1ubuntu3",
"1.8-0ubuntu8~18.04"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2015/UBUNTU-CVE-2015-5236.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "icedtea-8-plugin",
"binary_version": "1.8-0ubuntu8~18.04"
},
{
"binary_name": "icedtea-netx",
"binary_version": "1.8-0ubuntu8~18.04"
},
{
"binary_name": "icedtea-netx-common",
"binary_version": "1.8-0ubuntu8~18.04"
},
{
"binary_name": "icedtea-plugin",
"binary_version": "1.8-0ubuntu8~18.04"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "icedtea-web",
"purl": "pkg:deb/ubuntu/icedtea-web?arch=source&distro=focal",
"ecosystem": "Ubuntu:20.04:LTS"
},
"versions": [
"1.8-0ubuntu8"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2015/UBUNTU-CVE-2015-5236.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "icedtea-netx",
"binary_version": "1.8-0ubuntu8"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "icedtea-web",
"purl": "pkg:deb/ubuntu/icedtea-web?arch=source&distro=jammy",
"ecosystem": "Ubuntu:22.04:LTS"
},
"versions": [
"1.8.4-1build1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2015/UBUNTU-CVE-2015-5236.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "icedtea-netx",
"binary_version": "1.8.4-1build1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "icedtea-web",
"purl": "pkg:deb/ubuntu/icedtea-web?arch=source&distro=noble",
"ecosystem": "Ubuntu:24.04:LTS"
},
"versions": [
"1.8.8-2",
"1.8.8-2ubuntu1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2015/UBUNTU-CVE-2015-5236.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "icedtea-netx",
"binary_version": "1.8.8-2ubuntu1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "icedtea-web",
"purl": "pkg:deb/ubuntu/icedtea-web?arch=source&distro=questing",
"ecosystem": "Ubuntu:25.10"
},
"versions": [
"1.8.8-3"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2015/UBUNTU-CVE-2015-5236.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "icedtea-netx",
"binary_version": "1.8.8-3"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "icedtea-web",
"purl": "pkg:deb/ubuntu/icedtea-web?arch=source&distro=stonking",
"ecosystem": "Ubuntu:26.10"
},
"versions": [
"1.8.8-4"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2015/UBUNTU-CVE-2015-5236.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "icedtea-netx",
"binary_version": "1.8.8-4"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "icedtea-web",
"purl": "pkg:deb/ubuntu/icedtea-web?arch=source&distro=resolute",
"ecosystem": "Ubuntu:26.04:LTS"
},
"versions": [
"1.8.8-3",
"1.8.8-3build1",
"1.8.8-3ubuntu1",
"1.8.8-4"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2015/UBUNTU-CVE-2015-5236.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "icedtea-netx",
"binary_version": "1.8.8-4"
}
]
}
}
],
"modified": "2026-10-17T12:52:54.097623002Z",
"provider": "osv",
"upstream": [
"CVE-2015-5236"
],
"references": [
"https://ubuntu.com/security/CVE-2015-5236",
"https://bugzilla.redhat.com/show_bug.cgi?id=1256403",
"https://www.cve.org/CVERecord?id=CVE-2015-5236"
]
},
"related_cves": [
{
"value": "CVE-2015-5236",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 353346,
"published_at": "2022-07-07T16:15:00+00:00"
}