SB2013043002 - Input validation error in redhat icedtea-web

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2013043002

SB2013043002 - Input validation error in redhat icedtea-web

Published: April 30, 2013 Updated: August 4, 2020

Security Bulletin ID SB2013043002
Severity
Medium
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 security vulnerability.


1) Input validation error (CVE-ID: CVE-2013-1926)

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

The IcedTea-Web plugin before 1.2.3 and 1.3.x before 1.3.2 uses the same class loader for applets with the same codebase path but from different domains, which allows remote attackers to obtain sensitive information or possibly alter other applets via a crafted applet. Per http://www.ubuntu.com/usn/USN-1804-1/ "A security issue affects these releases of Ubuntu and its derivatives: Ubuntu 12.10 Ubuntu 12.04 LTS Ubuntu 11.10 Ubuntu 10.04 LTS" Per http://lists.opensuse.org/opensuse-updates/2013-04/msg00106.html "Affected Products: openSUSE 12.2"


Remediation

Install update from vendor's website.

References