CVE-2011-3377

CVE-2011-3377 affects the IcedTea-Web web browser plugin. The vulnerability is a Same Origin Policy bypass in applets whose origin shares the same second-level domain as the target but uses a different sub-domain. Affected are IcedTea-Web 1.0.x before 1.0.6 and 1.1.x before 1.1.4. This bypass can...

CVE-2012-4540

CVE-2012-4540 concerns IcedTea-Web: an off-by-one/heap-based overflow in the invoke function of IcedTeaScriptablePluginObject.cc. Affected are IcedTea-Web 1.1.x before 1.1.7, 1.2.x before 1.2.2, 1.3.x before 1.3.1, and 1.4.x before 1.4.1. Exploitation via a crafted webpage that triggers the apple...

CVE-2012-3422

The provided data confirms CVE-2012-3422 affects the IcedTea-Web plugin prior to 1.2.1, where getFirstInTableInstance returns an uninitialized pointer if the instance_to_id_map is empty. This can cause a denial of service (crash) and may enable arbitrary code execution via a crafted web page. Sev...

CVE-2011-0706

CVE-2011-0706 affects the JNLPClassLoader in IcedTea-Web (used with OpenJDK Runtime Environment 1.6.0). The issue allows remote attackers to gain privileges via vectors related to handling multiple signers and the assignment of an inappropriate security descriptor. The vulnerability is tied to Ic...

CVE-2011-2513

CVE-2011-2513 affects IcedTea6/ IcedTea-Web: the JNLP implementation allows remote attackers to obtain the username and full paths of the home and cache directories by querying ClassLoader properties. Affected versions include IcedTea6 1.9.x before 1.9.9 and before 1.8.9, and IcedTea-Web 1.1.x be...

CVE-2011-2514

CVE-2011-2514 affects the Java Web Start flow in IcedTea6 (1.9.x before 1.9.9 and before 1.8.9) and IcedTea-Web (1.1.x before 1.1.1 and before 1.0.4). The issue: an attacker can modify the Java Web Start Security Warning dialog, causing victims to grant access to local files for a different filen...

CVE-2013-1926

CVE-2013-1926 affects the IcedTea-Web plugin (icedtea-web). The vulnerability arises because the plugin uses the same class loader for applets with the same codebase path across different domains, enabling a remote attacker to potentially read sensitive information or alter other applets. Affecte...

CVE-2013-1927

CVE-2013-1927 affects the IcedTea-Web plugin. Vulnerable 1.2.3 and 1.3.x prior to 1.3.2 validate a file as both GIF and Java JAR (GIFAR), enabling remote code execution when processing crafted files. Mitigation: upgrade to icedtea-web 1.3.2 (or later). Exploitation status not detailed in the prov...

CVE-2012-3423

Summary (CVE-2012-3423) : The IcedTea-Web plugin (before 1.2.1) mishandles NPVariant NPStrings that are not NUL-terminated, enabling a remote attacker to crash the browser, potentially disclose memory and/or execute arbitrary code via a crafted Java applet. This is tied to IcedTea-Web’s NPString ...

CVE-2013-6493

The CVE-2013-6493 issue affects the OpenJDK IcedTea Web LiveConnect implementation in IcedTea-Web (IcedTeaNPPlugin.cc) prior to version 1.4.2. Local attackers could read inter-process messages by pre-creating a predictable temporary socket file in /tmp, exposing partial confidentiality. A fix is ...