Executive Summary
Summary | |
---|---|
Title | icedtea-web security update |
Informations | |||
---|---|---|---|
Name | RHSA-2012:1434 | First vendor Publication | 2012-11-07 |
Vendor | RedHat | Last vendor Modification | 2012-11-07 |
Severity (Vendor) | Critical | Revision | 01 |
Security-Database Scoring CVSS v3
Cvss vector : N/A | |||
---|---|---|---|
Overall CVSS Score | NA | ||
Base Score | NA | Environmental Score | NA |
impact SubScore | NA | Temporal Score | NA |
Exploitabality Sub Score | NA | ||
Calculate full CVSS 3.0 Vectors scores |
Security-Database Scoring CVSS v2
Cvss vector : (AV:N/AC:M/Au:N/C:P/I:P/A:P) | |||
---|---|---|---|
Cvss Base Score | 6.8 | Attack Range | Network |
Cvss Impact Score | 6.4 | Attack Complexity | Medium |
Cvss Expoit Score | 8.6 | Authentication | None Required |
Calculate full CVSS 2.0 Vectors scores |
Detail
Problem Description: Updated icedtea-web packages that fix one security issue are now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having critical security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux Desktop (v. 6) - i386, x86_64 Red Hat Enterprise Linux Desktop Optional (v. 6) - i386, x86_64 Red Hat Enterprise Linux HPC Node (v. 6) - x86_64 Red Hat Enterprise Linux HPC Node Optional (v. 6) - x86_64 Red Hat Enterprise Linux Server (v. 6) - i386, x86_64 Red Hat Enterprise Linux Server Optional (v. 6) - i386, x86_64 Red Hat Enterprise Linux Workstation (v. 6) - i386, x86_64 Red Hat Enterprise Linux Workstation Optional (v. 6) - i386, x86_64 3. Description: The IcedTea-Web project provides a Java web browser plug-in and an implementation of Java Web Start, which is based on the Netx project. It also contains a configuration tool for managing deployment settings for the plug-in and Web Start implementations. A buffer overflow flaw was found in the IcedTea-Web plug-in. Visiting a malicious web page could cause a web browser using the IcedTea-Web plug-in to crash or, possibly, execute arbitrary code. (CVE-2012-4540) Red Hat would like to thank Arthur Gerkis for reporting this issue. This erratum also upgrades IcedTea-Web to version 1.2.2. Refer to the NEWS file, linked to in the References, for further information. All IcedTea-Web users should upgrade to these updated packages, which resolve this issue. Web browsers using the IcedTea-Web browser plug-in must be restarted for this update to take effect. 4. Solution: Before applying this update, make sure all previously-released errata relevant to your system have been applied. This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/knowledge/articles/11258 5. Bugs fixed (http://bugzilla.redhat.com/): 869040 - CVE-2012-4540 icedtea-web: IcedTeaScriptableJavaObject::invoke off-by-one heap-based buffer overflow |
Original Source
Url : https://rhn.redhat.com/errata/RHSA-2012-1434.html |
CWE : Common Weakness Enumeration
% | Id | Name |
---|---|---|
100 % | CWE-189 | Numeric Errors (CWE/SANS Top 25) |
OVAL Definitions
Definition Id: oval:org.mitre.oval:def:17489 | |||
Oval ID: | oval:org.mitre.oval:def:17489 | ||
Title: | USN-1625-1 -- icedtea-web vulnerability | ||
Description: | The Icedtea-Web plugin could be made to crash or run programs as your log in if it opened a specially crafted web page. | ||
Family: | unix | Class: | patch |
Reference(s): | USN-1625-1 CVE-2012-4540 | Version: | 7 |
Platform(s): | Ubuntu 12.10 Ubuntu 12.04 Ubuntu 11.10 Ubuntu 10.04 | Product(s): | icedtea-web |
Definition Synopsis: | |||
|
Definition Id: oval:org.mitre.oval:def:20094 | |||
Oval ID: | oval:org.mitre.oval:def:20094 | ||
Title: | DSA-2768-1 icedtea-web - heap-based buffer overflow | ||
Description: | A heap-based buffer overflow vulnerability was found in icedtea-web, a web browser plugin for running applets written in the Java programming language. If a user were tricked into opening a malicious website, an attacker could cause the plugin to crash or possibly execute arbitrary code as the user invoking the program. | ||
Family: | unix | Class: | patch |
Reference(s): | DSA-2768-1 CVE-2013-4349 CVE-2012-4540 | Version: | 5 |
Platform(s): | Debian GNU/Linux 7 Debian GNU/kFreeBSD 7 | Product(s): | icedtea-web |
Definition Synopsis: | |||
|
Definition Id: oval:org.mitre.oval:def:21550 | |||
Oval ID: | oval:org.mitre.oval:def:21550 | ||
Title: | RHSA-2012:1434: icedtea-web security update (Critical) | ||
Description: | Off-by-one error in the invoke function in IcedTeaScriptablePluginObject.cc in IcedTea-Web 1.1.x before 1.1.7, 1.2.x before 1.2.2, 1.3.x before 1.3.1, and 1.4.x before 1.4.1 allows remote attackers to obtain sensitive information, cause a denial of service (crash), or possibly execute arbitrary code via a crafted webpage that triggers a heap-based buffer overflow, related to an error message and a "triggering event attached to applet." NOTE: the 1.4.x versions were originally associated with CVE-2013-4349, but that entry has been MERGED with this one. | ||
Family: | unix | Class: | patch |
Reference(s): | RHSA-2012:1434-01 CESA-2012:1434 CVE-2012-4540 | Version: | 4 |
Platform(s): | Red Hat Enterprise Linux 6 CentOS Linux 6 | Product(s): | icedtea-web |
Definition Synopsis: | |||
Definition Id: oval:org.mitre.oval:def:23241 | |||
Oval ID: | oval:org.mitre.oval:def:23241 | ||
Title: | ELSA-2012:1434: icedtea-web security update (Critical) | ||
Description: | Off-by-one error in the invoke function in IcedTeaScriptablePluginObject.cc in IcedTea-Web 1.1.x before 1.1.7, 1.2.x before 1.2.2, 1.3.x before 1.3.1, and 1.4.x before 1.4.1 allows remote attackers to obtain sensitive information, cause a denial of service (crash), or possibly execute arbitrary code via a crafted webpage that triggers a heap-based buffer overflow, related to an error message and a "triggering event attached to applet." NOTE: the 1.4.x versions were originally associated with CVE-2013-4349, but that entry has been MERGED with this one. | ||
Family: | unix | Class: | patch |
Reference(s): | ELSA-2012:1434-01 CVE-2012-4540 | Version: | 6 |
Platform(s): | Oracle Linux 6 | Product(s): | icedtea-web |
Definition Synopsis: | |||
Definition Id: oval:org.mitre.oval:def:27853 | |||
Oval ID: | oval:org.mitre.oval:def:27853 | ||
Title: | DEPRECATED: ELSA-2012-1434 -- icedtea-web security update (critical) | ||
Description: | [1.2.2-1] - Updated to 1.2.2 - Resolves: CVE-2012-4540 | ||
Family: | unix | Class: | patch |
Reference(s): | ELSA-2012-1434 CVE-2012-4540 | Version: | 4 |
Platform(s): | Oracle Linux 6 | Product(s): | icedtea-web |
Definition Synopsis: | |||
CPE : Common Platform Enumeration
OpenVAS Exploits
Date | Description |
---|---|
2012-11-15 | Name : Fedora Update for icedtea-web FEDORA-2012-17745 File : nvt/gb_fedora_2012_17745_icedtea-web_fc16.nasl |
2012-11-15 | Name : Fedora Update for icedtea-web FEDORA-2012-17762 File : nvt/gb_fedora_2012_17762_icedtea-web_fc17.nasl |
2012-11-09 | Name : CentOS Update for icedtea-web CESA-2012:1434 centos6 File : nvt/gb_CESA-2012_1434_icedtea-web_centos6.nasl |
2012-11-09 | Name : RedHat Update for icedtea-web RHSA-2012:1434-01 File : nvt/gb_RHSA-2012_1434-01_icedtea-web.nasl |
2012-11-09 | Name : Ubuntu Update for icedtea-web USN-1625-1 File : nvt/gb_ubuntu_USN_1625_1.nasl |
Nessus® Vulnerability Scanner
Date | Description |
---|---|
2015-09-23 | Name : The remote openSUSE host is missing a security update. File : openSUSE-2015-602.nasl - Type : ACT_GATHER_INFO |
2014-06-30 | Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-201406-32.nasl - Type : ACT_GATHER_INFO |
2014-06-13 | Name : The remote openSUSE host is missing a security update. File : openSUSE-2013-733.nasl - Type : ACT_GATHER_INFO |
2014-06-13 | Name : The remote openSUSE host is missing a security update. File : openSUSE-2012-797.nasl - Type : ACT_GATHER_INFO |
2013-10-06 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-2768.nasl - Type : ACT_GATHER_INFO |
2013-10-04 | Name : The remote Fedora host is missing a security update. File : fedora_2013-17016.nasl - Type : ACT_GATHER_INFO |
2013-10-03 | Name : The remote SuSE 11 host is missing a security update. File : suse_11_icedtea-web-130924.nasl - Type : ACT_GATHER_INFO |
2013-09-23 | Name : The remote Fedora host is missing a security update. File : fedora_2013-16971.nasl - Type : ACT_GATHER_INFO |
2013-09-21 | Name : The remote Fedora host is missing a security update. File : fedora_2013-17026.nasl - Type : ACT_GATHER_INFO |
2013-07-12 | Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2012-1434.nasl - Type : ACT_GATHER_INFO |
2013-01-25 | Name : The remote SuSE 11 host is missing a security update. File : suse_11_icedtea-web-121113.nasl - Type : ACT_GATHER_INFO |
2012-11-12 | Name : The remote Fedora host is missing a security update. File : fedora_2012-17827.nasl - Type : ACT_GATHER_INFO |
2012-11-12 | Name : The remote Fedora host is missing a security update. File : fedora_2012-17762.nasl - Type : ACT_GATHER_INFO |
2012-11-12 | Name : The remote Fedora host is missing a security update. File : fedora_2012-17745.nasl - Type : ACT_GATHER_INFO |
2012-11-12 | Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2012-1434.nasl - Type : ACT_GATHER_INFO |
2012-11-08 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2012-1434.nasl - Type : ACT_GATHER_INFO |
2012-11-08 | Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20121107_icedtea_web_on_SL6_x.nasl - Type : ACT_GATHER_INFO |
2012-11-08 | Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-1625-1.nasl - Type : ACT_GATHER_INFO |
Alert History
Date | Informations |
---|---|
2014-02-17 11:56:31 |
|
2012-11-13 13:21:58 |
|
2012-11-11 17:20:41 |
|
2012-11-07 21:18:01 |
|