VulnerabilityModified
CVE-2013-1926
The IcedTea-Web plugin before 1.2.3 and 1.3.x before 1.3.2 uses the same class loader for applets with the same codebase path but from different domains, which allows remote attackers to obtain sensitive information or possibly alter other applets via a…
MEDIUM 5.8EPSS 1.86%
Does this matter?
Lower severity and a low EPSS score (1.86%). Track it; it rarely justifies an emergency change on its own.
Description
The IcedTea-Web plugin before 1.2.3 and 1.3.x before 1.3.2 uses the same class loader for applets with the same codebase path but from different domains, which allows remote attackers to obtain sensitive information or possibly alter other applets via a crafted applet.
- CVSS 2.0
- 5.8 MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:N
- EPSS
- 1.86% probability · 78th percentile
- CISA KEV
- Not listed
- Affected
- redhat/icedtea-web · canonical/ubuntu linux · opensuse/opensuse
- Source
- secalert@redhat.com
References
- http://icedtea.classpath.org/hg/release/icedtea-web-1.2/file/icedtea-web-1.2.3/NEWS
- http://icedtea.classpath.org/hg/release/icedtea-web-1.2/rev/34b6f60ae586
- http://icedtea.classpath.org/hg/release/icedtea-web-1.3/rev/25dd7c7ac39c
- http://lists.opensuse.org/opensuse-security-announce/2013-05/msg00020.html
- http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00013.html
- http://lists.opensuse.org/opensuse-updates/2013-04/msg00106.html
- http://lists.opensuse.org/opensuse-updates/2013-05/msg00003.html
- http://lists.opensuse.org/opensuse-updates/2013-05/msg00032.html
- http://lists.opensuse.org/opensuse-updates/2013-06/msg00030.html
- http://lists.opensuse.org/opensuse-updates/2013-06/msg00034.html
- http://lists.opensuse.org/opensuse-updates/2013-06/msg00101.html
- http://mail.openjdk.java.net/pipermail/distro-pkg-dev/2013-April/022790.html
- http://osvdb.org/92543
- http://rhn.redhat.com/errata/RHSA-2013-0753.html
- http://secunia.com/advisories/53109Vendor Advisory
- http://secunia.com/advisories/53117Vendor Advisory
- http://www.mandriva.com/security/advisories?name=MDVSA-2013:146
- http://www.securityfocus.com/bid/59281
- http://www.ubuntu.com/usn/USN-1804-1
- https://bugzilla.redhat.com/show_bug.cgi?id=916774
- https://exchange.xforce.ibmcloud.com/vulnerabilities/83642
- https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0123
- http://icedtea.classpath.org/hg/release/icedtea-web-1.2/file/icedtea-web-1.2.3/NEWS
- http://icedtea.classpath.org/hg/release/icedtea-web-1.2/rev/34b6f60ae586
- http://icedtea.classpath.org/hg/release/icedtea-web-1.3/rev/25dd7c7ac39c
- http://lists.opensuse.org/opensuse-security-announce/2013-05/msg00020.html
- http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00013.html
- http://lists.opensuse.org/opensuse-updates/2013-04/msg00106.html
- http://lists.opensuse.org/opensuse-updates/2013-05/msg00003.html
- http://lists.opensuse.org/opensuse-updates/2013-05/msg00032.html
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.