Executive Summary
This Alert is flagged as TOP 25 Common Weakness Enumeration from CWE/SANS. For more information, you can read this.
| Summary | |
|---|---|
| Title | icedtea-web security update |
| Informations | |||
|---|---|---|---|
| Name | DSA-2768 | First vendor Publication | 2013-10-04 |
| Vendor | Debian | Last vendor Modification | 2013-10-04 |
| Severity (Vendor) | N/A | Revision | 1 |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:N/AC:M/Au:N/C:P/I:P/A:P) | |||
|---|---|---|---|
| Cvss Base Score | 6.8 | Attack Range | Network |
| Cvss Impact Score | 6.4 | Attack Complexity | Medium |
| Cvss Expoit Score | 8.6 | Authentication | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| A heap-based buffer overflow vulnerability was found in icedtea-web, a web browser plugin for running applets written in the Java programming language. If a user were tricked into opening a malicious website, an attacker could cause the plugin to crash or possibly execute arbitrary code as the user invoking the program. This problem was initially discovered by Arthur Gerkis and got assigned CVE-2012-4540. Fixes where applied in the 1.1, 1.2 and 1.3 branches but not to the 1.4 branch. For the stable distribution (wheezy), this problem has been fixed in version 1.4-3~deb7u2. For the unstable distribution (sid), this problem has been fixed in version 1.4-3.1. We recommend that you upgrade your icedtea-web packages. |
Original Source
| Url : http://www.debian.org/security/2013/dsa-2768 |
CWE : Common Weakness Enumeration
| % | Id | Name |
|---|---|---|
| 100 % | CWE-189 | Numeric Errors (CWE/SANS Top 25) |
OVAL Definitions
| Definition Id: oval:org.mitre.oval:def:17489 | |||
| Oval ID: | oval:org.mitre.oval:def:17489 | ||
| Title: | USN-1625-1 -- icedtea-web vulnerability | ||
| Description: | The Icedtea-Web plugin could be made to crash or run programs as your log in if it opened a specially crafted web page. | ||
| Family: | unix | Class: | patch |
| Reference(s): | USN-1625-1 CVE-2012-4540 | Version: | 7 |
| Platform(s): | Ubuntu 12.10 Ubuntu 12.04 Ubuntu 11.10 Ubuntu 10.04 | Product(s): | icedtea-web |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:20094 | |||
| Oval ID: | oval:org.mitre.oval:def:20094 | ||
| Title: | DSA-2768-1 icedtea-web - heap-based buffer overflow | ||
| Description: | A heap-based buffer overflow vulnerability was found in icedtea-web, a web browser plugin for running applets written in the Java programming language. If a user were tricked into opening a malicious website, an attacker could cause the plugin to crash or possibly execute arbitrary code as the user invoking the program. | ||
| Family: | unix | Class: | patch |
| Reference(s): | DSA-2768-1 CVE-2013-4349 CVE-2012-4540 | Version: | 5 |
| Platform(s): | Debian GNU/Linux 7 Debian GNU/kFreeBSD 7 | Product(s): | icedtea-web |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:21550 | |||
| Oval ID: | oval:org.mitre.oval:def:21550 | ||
| Title: | RHSA-2012:1434: icedtea-web security update (Critical) | ||
| Description: | Off-by-one error in the invoke function in IcedTeaScriptablePluginObject.cc in IcedTea-Web 1.1.x before 1.1.7, 1.2.x before 1.2.2, 1.3.x before 1.3.1, and 1.4.x before 1.4.1 allows remote attackers to obtain sensitive information, cause a denial of service (crash), or possibly execute arbitrary code via a crafted webpage that triggers a heap-based buffer overflow, related to an error message and a "triggering event attached to applet." NOTE: the 1.4.x versions were originally associated with CVE-2013-4349, but that entry has been MERGED with this one. | ||
| Family: | unix | Class: | patch |
| Reference(s): | RHSA-2012:1434-01 CESA-2012:1434 CVE-2012-4540 | Version: | 4 |
| Platform(s): | Red Hat Enterprise Linux 6 CentOS Linux 6 | Product(s): | icedtea-web |
| Definition Synopsis: | |||
| Definition Id: oval:org.mitre.oval:def:23241 | |||
| Oval ID: | oval:org.mitre.oval:def:23241 | ||
| Title: | ELSA-2012:1434: icedtea-web security update (Critical) | ||
| Description: | Off-by-one error in the invoke function in IcedTeaScriptablePluginObject.cc in IcedTea-Web 1.1.x before 1.1.7, 1.2.x before 1.2.2, 1.3.x before 1.3.1, and 1.4.x before 1.4.1 allows remote attackers to obtain sensitive information, cause a denial of service (crash), or possibly execute arbitrary code via a crafted webpage that triggers a heap-based buffer overflow, related to an error message and a "triggering event attached to applet." NOTE: the 1.4.x versions were originally associated with CVE-2013-4349, but that entry has been MERGED with this one. | ||
| Family: | unix | Class: | patch |
| Reference(s): | ELSA-2012:1434-01 CVE-2012-4540 | Version: | 6 |
| Platform(s): | Oracle Linux 6 | Product(s): | icedtea-web |
| Definition Synopsis: | |||
| Definition Id: oval:org.mitre.oval:def:27853 | |||
| Oval ID: | oval:org.mitre.oval:def:27853 | ||
| Title: | DEPRECATED: ELSA-2012-1434 -- icedtea-web security update (critical) | ||
| Description: | [1.2.2-1] - Updated to 1.2.2 - Resolves: CVE-2012-4540 | ||
| Family: | unix | Class: | patch |
| Reference(s): | ELSA-2012-1434 CVE-2012-4540 | Version: | 4 |
| Platform(s): | Oracle Linux 6 | Product(s): | icedtea-web |
| Definition Synopsis: | |||
CPE : Common Platform Enumeration
OpenVAS Exploits
| Date | Description |
|---|---|
| 2012-11-15 | Name : Fedora Update for icedtea-web FEDORA-2012-17745 File : nvt/gb_fedora_2012_17745_icedtea-web_fc16.nasl |
| 2012-11-15 | Name : Fedora Update for icedtea-web FEDORA-2012-17762 File : nvt/gb_fedora_2012_17762_icedtea-web_fc17.nasl |
| 2012-11-09 | Name : CentOS Update for icedtea-web CESA-2012:1434 centos6 File : nvt/gb_CESA-2012_1434_icedtea-web_centos6.nasl |
| 2012-11-09 | Name : RedHat Update for icedtea-web RHSA-2012:1434-01 File : nvt/gb_RHSA-2012_1434-01_icedtea-web.nasl |
| 2012-11-09 | Name : Ubuntu Update for icedtea-web USN-1625-1 File : nvt/gb_ubuntu_USN_1625_1.nasl |
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2015-09-23 | Name : The remote openSUSE host is missing a security update. File : openSUSE-2015-602.nasl - Type : ACT_GATHER_INFO |
| 2014-06-30 | Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-201406-32.nasl - Type : ACT_GATHER_INFO |
| 2014-06-13 | Name : The remote openSUSE host is missing a security update. File : openSUSE-2013-733.nasl - Type : ACT_GATHER_INFO |
| 2014-06-13 | Name : The remote openSUSE host is missing a security update. File : openSUSE-2012-797.nasl - Type : ACT_GATHER_INFO |
| 2013-10-06 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-2768.nasl - Type : ACT_GATHER_INFO |
| 2013-10-04 | Name : The remote Fedora host is missing a security update. File : fedora_2013-17016.nasl - Type : ACT_GATHER_INFO |
| 2013-10-03 | Name : The remote SuSE 11 host is missing a security update. File : suse_11_icedtea-web-130924.nasl - Type : ACT_GATHER_INFO |
| 2013-09-23 | Name : The remote Fedora host is missing a security update. File : fedora_2013-16971.nasl - Type : ACT_GATHER_INFO |
| 2013-09-21 | Name : The remote Fedora host is missing a security update. File : fedora_2013-17026.nasl - Type : ACT_GATHER_INFO |
| 2013-07-12 | Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2012-1434.nasl - Type : ACT_GATHER_INFO |
| 2013-01-25 | Name : The remote SuSE 11 host is missing a security update. File : suse_11_icedtea-web-121113.nasl - Type : ACT_GATHER_INFO |
| 2012-11-12 | Name : The remote Fedora host is missing a security update. File : fedora_2012-17827.nasl - Type : ACT_GATHER_INFO |
| 2012-11-12 | Name : The remote Fedora host is missing a security update. File : fedora_2012-17762.nasl - Type : ACT_GATHER_INFO |
| 2012-11-12 | Name : The remote Fedora host is missing a security update. File : fedora_2012-17745.nasl - Type : ACT_GATHER_INFO |
| 2012-11-12 | Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2012-1434.nasl - Type : ACT_GATHER_INFO |
| 2012-11-08 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2012-1434.nasl - Type : ACT_GATHER_INFO |
| 2012-11-08 | Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20121107_icedtea_web_on_SL6_x.nasl - Type : ACT_GATHER_INFO |
| 2012-11-08 | Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-1625-1.nasl - Type : ACT_GATHER_INFO |
Alert History
| Date | Informations |
|---|---|
| 2014-02-17 11:32:12 |
|
| 2013-11-03 00:22:29 |
|
| 2013-10-05 00:19:50 |
|
