[Forgot Password]
Login  Register Subscribe

30389

 
 

423868

 
 

244411

 
 

909

 
 

193363

 
 

277

Paid content will be excluded from the download.


Download | Alert*
OVAL

RHSA-2013:0753-01 -- Redhat icedtea-web

ID: oval:org.secpod.oval:def:501043Date: (C)2013-04-18   (M)2023-07-28
Class: PATCHFamily: unix




The IcedTea-Web project provides a Java web browser plug-in and an implementation of Java Web Start, which is based on the Netx project. It also contains a configuration tool for managing deployment settings for the plug-in and Web Start implementations. It was discovered that the IcedTea-Web plug-in incorrectly used the same class loader instance for applets with the same value of the codebase attribute, even when they originated from different domains. A malicious applet could use this flaw to gain information about and possibly manipulate applets from different domains currently running in the browser. The IcedTea-Web plug-in did not properly check the format of the downloaded Java Archive files. This could cause the plug-in to execute code hidden in a file in a different format, possibly allowing attackers to execute code in the context of web sites that allow uploads of specific file types, known as a GIFAR attack. The CVE-2013-1926 issue was discovered by Jiri Vanek of the Red Hat OpenJDK Team, and CVE-2013-1927 was discovered by the Red Hat Security Response Team. This erratum also upgrades IcedTea-Web to version 1.2.3. Refer to the NEWS file, linked to in the References, for further information. All IcedTea-Web users should upgrade to these updated packages, which resolve these issues. Web browsers using the IcedTea-Web browser plug-in must be restarted for this update to take effect.

Platform:
Red Hat Enterprise Linux 6
Product:
icedtea-web
Reference:
RHSA-2013:0753-01
CVE-2013-1926
CVE-2013-1927
CVE    2
CVE-2013-1927
CVE-2013-1926
CPE    22
cpe:/a:redhat:icedtea-web:1.3
cpe:/a:redhat:icedtea-web
cpe:/a:redhat:icedtea-web:1.1
cpe:/a:redhat:icedtea-web:1.2
...

© SecPod Technologies