icedtea-web-1.6.2-1.0.1.AXS4

The IcedTea-Web project provides a Java web browser plugin, an implementation
of Java Web Start (originally based on the Netx project) and a settings tool to
manage deployment settings for the aforementioned plugin and Web Start
implementations.

Security issues fixed with this release:

CVE-2015-5234
IcedTea-Web before 1.5.3 and 1.6.x before 1.6.1 does not properly
sanitize applet URLs, which allows remote attackers to inject applets
into the .appletTrustSettings configuration file and bypass user
approval to execute the applet via a crafted web page, possibly
related to line breaks.
CVE-2015-5235
IcedTea-Web before 1.5.3 and 1.6.x before 1.6.1 does not properly
determine the origin of unsigned applets, which allows remote
attackers to bypass the approval process or trick users into approving
applet execution via a crafted web page.

The following packages have been upgraded to a newer upstream version: icedtea-web (1.6.2).