- update to 1.3.2 (bnc#815596) 

  - Security Updates

  - CVE-2013-1927, RH884705: fixed gifar vulnerability

  - CVE-2013-1926, RH916774: Class-loader incorrectly shared     for applets with same relative-path.

  - Common

  - Added new option in itw-settings which allows users to     set JVM arguments when plugin is initialized.

  - NetX

  - PR580: http://www.horaoficial.cl/ loads improperly

  - Plugin

  - PR1260: IcedTea-Web should not rely on GTK obsoletes     icedtea-web-remove-gtk-dep.patch

  - PR1157: Applets can hang browser after fatal exception

The remote MiracleLinux 4 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2013-414:02 advisory.

    The IcedTea-Web project provides a Java web browser plugin, an implementation of Java Web Start     (originally based on the Netx project) and a settings tool to manage deployment settings for the     aforementioned plugin and Web Start implementations.
    Security issues fixed with this release:
     CVE-2013-1926      CVE-2013-1927     No description available at the time of writing, please use the CVE links below.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Updated icedtea-web packages that fix two security issues are now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The IcedTea-Web project provides a Java web browser plug-in and an implementation of Java Web Start, which is based on the Netx project.
It also contains a configuration tool for managing deployment settings for the plug-in and Web Start implementations.

It was discovered that the IcedTea-Web plug-in incorrectly used the same class loader instance for applets with the same value of the codebase attribute, even when they originated from different domains.
A malicious applet could use this flaw to gain information about and possibly manipulate applets from different domains currently running in the browser. (CVE-2013-1926)

The IcedTea-Web plug-in did not properly check the format of the downloaded Java Archive (JAR) files. This could cause the plug-in to execute code hidden in a file in a different format, possibly allowing attackers to execute code in the context of websites that allow uploads of specific file types, known as a GIFAR attack.
(CVE-2013-1927)

The CVE-2013-1926 issue was discovered by Jiri Vanek of the Red Hat OpenJDK Team, and CVE-2013-1927 was discovered by the Red Hat Security Response Team.

This erratum also upgrades IcedTea-Web to version 1.2.3. Refer to the NEWS file, linked to in the References, for further information.

All IcedTea-Web users should upgrade to these updated packages, which resolve these issues. Web browsers using the IcedTea-Web browser plug-in must be restarted for this update to take effect.

Changes in icedtea-web with update to 1.4 (bnc#818768) :

  - Added cs, de, pl localization

  - Splash screen for javaws and plugin

  - Better error reporting for plugin via     Error-splash-screen

  - All IcedTea-Web dialogues are centered to middle of     active screen

  - Download indicator made compact for more then one jar

  - User can select its own JVM via itw-settings and     deploy.properties.

  - Added extended applets security settings and dialogue

  - Security updates

  - CVE-2013-1926, RH916774: Class-loader incorrectly shared     for applets with same relative-path.

  - CVE-2013-1927, RH884705: fixed gifar vulnerabilit

  - CVE-2012-3422, RH840592: Potential read from an     uninitialized memory location

  - CVE-2012-3423, RH841345: Incorrect handling of not     0-terminated strings

  - NetX

  - PR1027: DownloadService is not supported by IcedTea-Web

  - PR725: JNLP applications will prompt for creating     desktop shortcuts every time they are run

  - PR1292: Javaws does not resolve versioned jar names with     periods correctly

  - Plugin

  - PR1106: Buffer overflow in plugin table-

  - PR1166: Embedded JNLP File is not supported in applet     tag

  - PR1217: Add command line arguments for plugins

  - PR1189: Icedtea-plugin requires code attribute when     using jnlp_href

  - PR1198: JSObject is not passed to JavaScript correctly

  - PR1260: IcedTea-Web should not rely on GTK

  - PR1157: Applets can hang browser after fatal exception

  - PR580: http://www.horaoficial.cl/ loads improperly

  - Common

  - PR1049: Extension jnlp's signed jar with the content of     only META-INF/* is considered

  - PR955: regression: SweetHome3D fails to run

  - PR1145: IcedTea-Web can cause ClassCircularityError

  - PR1161: X509VariableTrustManager does not work correctly     with OpenJDK7

  - PR822: Applets fail to load if jars have different     signers

  - PR1186:
    System.getProperty('deployment.user.security.trusted.cac     erts') is null

  - PR909: The Java applet at     http://de.gosupermodel.com/games/wardrobegame.jsp fails

  - PR1299: WebStart doesn't read socket proxy settings from     firefox correctly

It was discovered that the IcedTea-Web plug-in incorrectly used the same class loader instance for applets with the same value of the codebase attribute, even when they originated from different domains.
A malicious applet could use this flaw to gain information about and possibly manipulate applets from different domains currently running in the browser. (CVE-2013-1926)

The IcedTea-Web plug-in did not properly check the format of the downloaded Java Archive (JAR) files. This could cause the plug-in to execute code hidden in a file in a different format, possibly allowing attackers to execute code in the context of websites that allow uploads of specific file types, known as a GIFAR attack.
(CVE-2013-1927)

This erratum also upgrades IcedTea-Web to version 1.2.3.

Web browsers using the IcedTea-Web browser plug-in must be restarted for this update to take effect.

This update to version 1.3.2 fixes several security updates and common fixes. (bnc#815596)

Security Updates

  - fixed gifar vulnerability. (CVE-2013-1927)

  - Class-loader incorrectly shared for applets with same     relative-path. Common. (CVE-2013-1926)

  - Added new option in itw-settings which allows users to     set JVM arguments when plugin is initialized. NetX

  - PR580: http://www.horaoficial.cl/ loads improperly     Plugin

  - PR1260: IcedTea-Web should not rely on GTK obsoletes     icedtea-web-remove-gtk-dep.patch

  - PR1157: Applets can hang browser after fatal exception

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
74980	openSUSE Security Update : icedtea-web (openSUSE-SU-2013:0735-1)	Nessus	SuSE Local Security Checks	2014/6/13	2021/1/19	medium
289886	MiracleLinux 4 : icedtea-web-1.2.3-2.0.1.AXS4 (AXSA:2013-414:02)	Nessus	Miracle Linux Local Security Checks	2026/1/16	2026/1/16	high
66003	CentOS 6 : icedtea-web (CESA-2013:0753)	Nessus	CentOS Local Security Checks	2013/4/18	2021/1/4	medium
75010	openSUSE Security Update : icedtea-web (openSUSE-SU-2013:0893-1)	Nessus	SuSE Local Security Checks	2014/6/13	2021/1/19	high
66017	Scientific Linux Security Update : icedtea-web on SL6.x i386/x86_64 (20130417)	Nessus	Scientific Linux Local Security Checks	2013/4/18	2021/1/14	medium
66253	SuSE 11.2 Security Update : icedtea-web (SAT Patch Number 7642)	Nessus	SuSE Local Security Checks	2013/4/29	2021/1/19	medium

检测

插件搜索

medium

high

medium

high

medium

medium