GCVE - cpe:2.3:a:redhat:icedtea-web:1.0:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:redhat:icedtea-web:1.0:*:*:*:*:*:*:*

part: a version: 1.0 update: *

Vendor	Redhat (`e942785a-ca89-506e-bd99-50782639cde3`)
Product	Icedtea Web (`6a6b8624-2355-5143-b9e2-8e2ee7793c38`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:deb/debian/icedtea-web`	purl2cpe	2026-06-01 10:12:57.347674
`pkg:deb/ubuntu/icedtea-web`	purl2cpe	2026-06-01 10:12:57.347677
`pkg:github/adoptopenjdk/icedtea-web`	purl2cpe	2026-06-01 10:12:57.347680
`pkg:gitlab/redhat/icedtea-web`	purl2cpe	2026-06-01 10:12:57.347682
`pkg:rpm/fedora/icedtea-web`	purl2cpe	2026-06-01 10:12:57.347685
`pkg:rpm/opensuse/icedtea-web`	purl2cpe	2026-06-01 10:12:57.347688

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2013-1927`	vulnerable	2026-06-08 05:03:57.314231	Details available The IcedTea-Web plugin before 1.2.3 and 1.3.x before 1.3.2 allows remote attackers to execute arbitrary code via a crafted file that validates as both a GIF and a Java JAR file, aka "GIFAR." Published: 2013-04-29T22:00:00.000Z Updated: 2024-08-06T15:20:37.135Z Open on db.gcve.eu Reference links http://osvdb.org/92544 http://lists.opensuse.org/opensuse-security-announce/2013-05/msg00020.html http://lists.opensuse.org/opensuse-updates/2013-06/msg00034.html http://www.mandriva.com/security/advisories?name=MDVSA-2013:146 http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00013.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2013-1926`	vulnerable	2026-06-08 05:03:57.303967	Details available The IcedTea-Web plugin before 1.2.3 and 1.3.x before 1.3.2 uses the same class loader for applets with the same codebase path but from different domains, which allows remote attackers to obtain sensitive information or possibly alter other applets via a crafted applet. Published: 2013-04-29T22:00:00.000Z Updated: 2024-08-06T15:20:37.229Z Open on db.gcve.eu Reference links http://osvdb.org/92543 http://lists.opensuse.org/opensuse-security-announce/2013-05/msg00020.html http://lists.opensuse.org/opensuse-updates/2013-06/msg00034.html https://exchange.xforce.ibmcloud.com/vulnerabilities/83642 http://www.mandriva.com/security/advisories?name=MDVSA-2013:146	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2012-3423`	vulnerable	2026-06-08 05:02:09.718532	Details available The IcedTea-Web plugin before 1.2.1 does not properly handle NPVariant NPStrings without NUL terminators, which allows remote attackers to cause a denial of service (crash), obtain sensitive information from memory, or execute arbitrary code via a crafted Java applet. Published: 2012-08-07T21:00:00.000Z Updated: 2024-08-06T20:05:12.503Z Open on db.gcve.eu Reference links http://security.gentoo.org/glsa/glsa-201406-32.xml http://icedtea.classpath.org/hg/release/icedtea-web-1.2/file/icedtea-web-1.2.1/NEWS http://icedtea.classpath.org/bugzilla/show_bug.cgi?id=863 http://lists.opensuse.org/opensuse-security-announce/2013-05/msg00020.html http://www.ubuntu.com/usn/USN-1521-1	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2012-3422`	vulnerable	2026-06-08 05:02:09.717319	Details available The getFirstInTableInstance function in the IcedTea-Web plugin before 1.2.1 returns an uninitialized pointer when the instance_to_id_map hash is empty, which allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted web page, which causes an uninitialized memory location to be read. Published: 2012-08-07T21:00:00.000Z Updated: 2024-08-06T20:05:12.373Z Open on db.gcve.eu Reference links http://security.gentoo.org/glsa/glsa-201406-32.xml http://icedtea.classpath.org/hg/release/icedtea-web-1.2/file/icedtea-web-1.2.1/NEWS https://bugzilla.redhat.com/show_bug.cgi?id=840592 http://lists.opensuse.org/opensuse-security-announce/2013-05/msg00020.html http://www.ubuntu.com/usn/USN-1521-1	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2011-3377`	vulnerable	2026-06-08 04:59:25.160417	Details available The web browser plug-in in IcedTea-Web 1.0.x before 1.0.6 and 1.1.x before 1.1.4 allows remote attackers to bypass the Same Origin Policy (SOP) and execute arbitrary script or establish network connections to unintended hosts via an applet whose origin has the same second-level domain, but a different sub-domain than the targeted domain. Published: 2014-02-05T19:00:00.000Z Updated: 2024-08-06T23:29:56.889Z Open on db.gcve.eu Reference links https://bugzilla.redhat.com/show_bug.cgi?id=742515 http://rhn.redhat.com/errata/RHSA-2011-1441.html http://dbhole.wordpress.com/2011/11/08/icedtea-web-1-0-6-and-1-1-4-security-releases-released/ http://www.osvdb.org/76940 http://lists.opensuse.org/opensuse-updates/2012-03/msg00028.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2011-2514`	vulnerable	2026-06-08 04:58:07.366111	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2011-2513`	vulnerable	2026-06-08 04:58:07.353577	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2011-0706`	vulnerable	2026-06-08 04:56:38.712837	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.