CVE:CVE-2019-10182
CNNVD:CNNVD-201907-1637
icedtea-web是一款JSR-56（Java网络启动协议和API）的开源实现。
icedtea-web 1.7.2及之前版本和1.8.2及之前版本中存在代码注入漏洞，该漏洞源于程序没有正确过滤来自<jar/>元素的路径。攻击者可通过诱使用户运行特制的应用程序利用该漏洞向任意地址上传任意文件。
solution:Upgrade icedtea-web_project icedtea-web to a higher version than 1.7.2,1.8.2,and avoid the version (,1.7.2],1.8.2; Upgrade redhat enterprise_linux_desktop to a higher version than 7.0,and avoid the version 7.0; Upgrade redhat enterprise_linux_server to a higher version than 7.0,and avoid the version 7.0; Upgrade redhat enterprise_linux_server_aus to a higher version than 7.6,and avoid the version 7.6; Upgrade redhat enterprise_linux_server_eus to a higher version than 7.6,and avoid the version 7.6; Upgrade redhat enterprise_linux_workstation to a higher version than 7.0,and avoid the version 7.0