CVE-2011-3377

2014-02-0519:55:00

Debian Security Bug Tracker

security-tracker.debian.org

4.3 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

0.003 Low

EPSS

Percentile

71.1%

JSON

The web browser plug-in in IcedTea-Web 1.0.x before 1.0.6 and 1.1.x before 1.1.4 allows remote attackers to bypass the Same Origin Policy (SOP) and execute arbitrary script or establish network connections to unintended hosts via an applet whose origin has the same second-level domain, but a different sub-domain than the targeted domain.

OSVersionArchitecturePackageVersionFilename
Debian12allicedtea-web< 1.1.4-1icedtea-web_1.1.4-1_all.deb
Debian11allicedtea-web< 1.1.4-1icedtea-web_1.1.4-1_all.deb
Debian10allicedtea-web< 1.1.4-1icedtea-web_1.1.4-1_all.deb
Debian999allicedtea-web< 1.1.4-1icedtea-web_1.1.4-1_all.deb
Debian13allicedtea-web< 1.1.4-1icedtea-web_1.1.4-1_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	12	all	icedtea-web	< 1.1.4-1	icedtea-web_1.1.4-1_all.deb
Debian	11	all	icedtea-web	< 1.1.4-1	icedtea-web_1.1.4-1_all.deb
Debian	10	all	icedtea-web	< 1.1.4-1	icedtea-web_1.1.4-1_all.deb
Debian	999	all	icedtea-web	< 1.1.4-1	icedtea-web_1.1.4-1_all.deb
Debian	13	all	icedtea-web	< 1.1.4-1	icedtea-web_1.1.4-1_all.deb