CVE-2012-3423: Improper Restriction of Operations within the Bounds of a Memory Buffer

The IcedTea-Web plugin before 1.2.1 does not properly handle NPVariant NPStrings without NUL terminators, which allows remote attackers to cause a denial of service crash, obtain sensitive information from memory, or execute arbitrary code via a crafted Java applet...

Scientific Linux Security Update : firefox on SL4.x, SL5.x, SL6.x i386/x86_64

This erratum blacklists a small number of HTTPS certificates. BZ689430 These updated firefox packages also fixes the following bug : - Prior to this update, some Java applets would fail to load in the 3.6.14 version of Firefox. In this newly-released version Firefox 3.6.15, Java applets no longer...

Scientific Linux Security Update : java-1.6.0-openjdk on SL5.3 i386/x86_64

CVE-2009-0217 xmlsec1, mono, xml-security-c, xml-security-1.3.0-1jpp.ep1.: XMLDsig HMAC-based signatures spoofing and authentication bypass CVE-2009-2670 OpenJDK Untrusted applet System properties access 6738524 CVE-2009-2671 CVE-2009-2672 OpenJDK Proxy mechanism information leaks 6801071...

icedtea-web: incorrect handling of not 0-terminated strings

The IcedTea-Web plugin before 1.2.1 does not properly handle NPVariant NPStrings without NUL terminators, which allows remote attackers to cause a denial of service crash, obtain sensitive information from memory, or execute arbitrary code via a crafted Java applet...

CVE-2012-3423

The IcedTea-Web plugin before 1.2.1 does not properly handle NPVariant NPStrings without NUL terminators, which allows remote attackers to cause a denial of service crash, obtain sensitive information from memory, or execute arbitrary code via a crafted Java applet...

PT-2012-4700

Name of the Vulnerable Software and Affected Versions IcedTea-Web plugin versions prior to 1.2.1 Description The issue allows remote attackers to cause a denial of service, obtain sensitive information from memory, or execute arbitrary code via a crafted Java applet, due to improper handling of...

Oracle Java Runtime Hotspot Bytecode Verifier Type Confusion

Added: 07/23/2012 CVE: CVE-2012-1723 BID: 53960 OSVDB: 82877 Background Java is a programming language that compiles programs to bytecode, which is then executed inside a Java Virtual Machine. This is optimal for applications that must run on various hardware platforms, such as web applets. Probl...

Ubuntu: Security Advisory (USN-1505-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2012 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Ubuntu 10.04 LTS / 11.04 / 11.10 / 12.04 LTS : icedtea-web, openjdk-6 vulnerabilities (USN-1505-1)

It was discovered that multiple flaws existed in the CORBA Common Object Request Broker Architecture implementation in OpenJDK. An attacker could create a Java application or applet that used these flaws to bypass Java sandbox restrictions or modify immutable object data. CVE-2012-1711,...

Cross-platform Trojan : Mac, Windows, Linux - Nothing safe !

Security researchers working for F-Secure have found a web exploit that detects the operating system of the computer and drops a different trojan to match.The attack was first seen on a Columbian transport website which had been hacked by a third party. This malware is known as GetShell.A and...

Trojan Downloader Determines OS, Infects Systems With Custom Malware

A new downloader uncovered by researchers at the Finnish security firm F-Secure is capable of sniffing out which operating system a user is running and infecting them with a custom malicious payload. F-Secure’s Karmina Aquino discovered the attack on a compromised Colombian transport website. The...

Java Applet Field Bytecode Verifier Cache Remote Code Execution

Exploit for java platform in category remote exploits This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/...

Ubuntu 10.04 LTS / 11.04 / 11.10 : network-manager-applet vulnerability (USN-1483-2)

USN-1483-1 fixed a vulnerability in NetworkManager by disabling the creation of WPA-secured AdHoc wireless connections. This update provides the corresponding change for network-manager-applet. It was discovered that certain wireless drivers incorrectly handled the creation of WPA-secured AdHoc...

Ubuntu: Security Advisory (USN-1483-2)

The remote host is missing an update for the SPDX-FileCopyrightText: 2012 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2012-2496

A certain Java applet in the VPN downloader implementation in the WebLaunch feature in Cisco AnyConnect Secure Mobility Client 3.x before 3.0 MR7 on 64-bit Linux platforms does not properly restrict use of Java components, which allows remote attackers to execute arbitrary code via a crafted web...

Information disclosure

A certain Java applet in the VPN downloader implementation in the WebLaunch feature in Cisco AnyConnect Secure Mobility Client 3.x before 3.0 MR7 on 64-bit Linux platforms does not properly restrict use of Java components, which allows remote attackers to execute arbitrary code via a crafted web...

CVE-2012-2496

A certain Java applet in the VPN downloader implementation in the WebLaunch feature in Cisco AnyConnect Secure Mobility Client 3.x before 3.0 MR7 on 64-bit Linux platforms does not properly restrict use of Java components, which allows remote attackers to execute arbitrary code via a crafted web...

CVE-2012-2496

CVE-2012-2496 concerns Cisco AnyConnect Secure Mobility Client (WebLaunch VPN downloader) on 64‑bit Linux. A Java applet used by the VPN downloader does not properly restrict Java components, allowing a remote, unauthenticated attacker to execute arbitrary code via a crafted malicious website. Th...

Cisco AnyConnect Secure Mobility Client and Secure Desktop WebLaunch Software Downgrade Vulnerability

Cisco AnyConnect Secure Mobility Client and Secure Desktop contain a vulnerability that could allow an unauthenticated, remote attacker to replace software components on a targeted system. The vulnerability exists because the affected software performs insufficient validation of user-supplied...

PT-2012-4066

Name of the Vulnerable Software and Affected Versions Cisco AnyConnect Secure Mobility Client version 3.x before 3.0 MR7 on 64-bit Linux platforms Description The issue is related to a Java applet in the VPN downloader implementation in the WebLaunch feature, which does not properly restrict the...