The LiveConnect implementation in plugin/icedteanp/IcedTeaNPPlugin.cc in IcedTea-Web before 1.4.2 allows local users to read the messages between a Java applet and a web browser by pre-creating a temporary socket file with a predictable name in /tmp.
OS | Version | Architecture | Package | Version | Filename |
---|---|---|---|---|---|
Debian | 12 | all | icedtea-web | < 1.4.2-1 | icedtea-web_1.4.2-1_all.deb |
Debian | 11 | all | icedtea-web | < 1.4.2-1 | icedtea-web_1.4.2-1_all.deb |
Debian | 10 | all | icedtea-web | < 1.4.2-1 | icedtea-web_1.4.2-1_all.deb |
Debian | 999 | all | icedtea-web | < 1.4.2-1 | icedtea-web_1.4.2-1_all.deb |
Debian | 13 | all | icedtea-web | < 1.4.2-1 | icedtea-web_1.4.2-1_all.deb |