GCVE - cpe:2.3:a:redhat:icedtea-web:1.1:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:redhat:icedtea-web:1.1:*:*:*:*:*:*:*

part: a version: 1.1 update: *

Vendor	Redhat (`e942785a-ca89-506e-bd99-50782639cde3`)
Product	Icedtea Web (`6a6b8624-2355-5143-b9e2-8e2ee7793c38`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:deb/debian/icedtea-web`	purl2cpe	2026-06-01 10:12:57.357469
`pkg:deb/ubuntu/icedtea-web`	purl2cpe	2026-06-01 10:12:57.357471
`pkg:github/adoptopenjdk/icedtea-web`	purl2cpe	2026-06-01 10:12:57.357472
`pkg:gitlab/redhat/icedtea-web`	purl2cpe	2026-06-01 10:12:57.357473
`pkg:rpm/fedora/icedtea-web`	purl2cpe	2026-06-01 10:12:57.357474
`pkg:rpm/opensuse/icedtea-web`	purl2cpe	2026-06-01 10:12:57.357476

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2013-6493`	vulnerable	2026-06-08 05:04:57.197897	Details available The LiveConnect implementation in plugin/icedteanp/IcedTeaNPPlugin.cc in IcedTea-Web before 1.4.2 allows local users to read the messages between a Java applet and a web browser by pre-creating a temporary socket file with a predictable name in /tmp. Published: 2014-03-03T16:00:00.000Z Updated: 2024-08-06T17:46:22.328Z Open on db.gcve.eu Reference links http://mail.openjdk.java.net/pipermail/distro-pkg-dev/2014-February/026192.html https://bugzilla.redhat.com/show_bug.cgi?id=1010958 http://www.ubuntu.com/usn/USN-2131-1 http://seclists.org/oss-sec/2014/q1/282 http://secunia.com/advisories/57036	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2013-1927`	vulnerable	2026-06-08 05:03:57.314352	Details available The IcedTea-Web plugin before 1.2.3 and 1.3.x before 1.3.2 allows remote attackers to execute arbitrary code via a crafted file that validates as both a GIF and a Java JAR file, aka "GIFAR." Published: 2013-04-29T22:00:00.000Z Updated: 2024-08-06T15:20:37.135Z Open on db.gcve.eu Reference links http://osvdb.org/92544 http://lists.opensuse.org/opensuse-security-announce/2013-05/msg00020.html http://lists.opensuse.org/opensuse-updates/2013-06/msg00034.html http://www.mandriva.com/security/advisories?name=MDVSA-2013:146 http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00013.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2013-1926`	vulnerable	2026-06-08 05:03:57.307972	Details available The IcedTea-Web plugin before 1.2.3 and 1.3.x before 1.3.2 uses the same class loader for applets with the same codebase path but from different domains, which allows remote attackers to obtain sensitive information or possibly alter other applets via a crafted applet. Published: 2013-04-29T22:00:00.000Z Updated: 2024-08-06T15:20:37.229Z Open on db.gcve.eu Reference links http://osvdb.org/92543 http://lists.opensuse.org/opensuse-security-announce/2013-05/msg00020.html http://lists.opensuse.org/opensuse-updates/2013-06/msg00034.html https://exchange.xforce.ibmcloud.com/vulnerabilities/83642 http://www.mandriva.com/security/advisories?name=MDVSA-2013:146	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2012-4540`	vulnerable	2026-06-08 05:02:51.332159	Details available Off-by-one error in the invoke function in IcedTeaScriptablePluginObject.cc in IcedTea-Web 1.1.x before 1.1.7, 1.2.x before 1.2.2, 1.3.x before 1.3.1, and 1.4.x before 1.4.1 allows remote attackers to obtain sensitive information, cause a denial of service (crash), or possibly execute arbitrary code via a crafted webpage that triggers a heap-based buffer overflow, related to an error message and a "triggering event attached to applet." NOTE: the 1.4.x versions were originally associated with CVE-2013-4349, but that entry has been MERGED with this one. Published: 2012-11-11T11:00:00.000Z Updated: 2024-08-06T20:42:53.644Z Open on db.gcve.eu Reference links http://security.gentoo.org/glsa/glsa-201406-32.xml http://icedtea.classpath.org/hg/release/icedtea-web-1.1/file/d759ec560073/NEWS http://www.debian.org/security/2013/dsa-2768 http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00019.html http://icedtea.classpath.org/hg/release/icedtea-web-1.2/rev/596a718be03f	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2012-3423`	vulnerable	2026-06-08 05:02:09.718552	Details available The IcedTea-Web plugin before 1.2.1 does not properly handle NPVariant NPStrings without NUL terminators, which allows remote attackers to cause a denial of service (crash), obtain sensitive information from memory, or execute arbitrary code via a crafted Java applet. Published: 2012-08-07T21:00:00.000Z Updated: 2024-08-06T20:05:12.503Z Open on db.gcve.eu Reference links http://security.gentoo.org/glsa/glsa-201406-32.xml http://icedtea.classpath.org/hg/release/icedtea-web-1.2/file/icedtea-web-1.2.1/NEWS http://icedtea.classpath.org/bugzilla/show_bug.cgi?id=863 http://lists.opensuse.org/opensuse-security-announce/2013-05/msg00020.html http://www.ubuntu.com/usn/USN-1521-1	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2012-3422`	vulnerable	2026-06-08 05:02:09.717898	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2011-3377`	vulnerable	2026-06-08 04:59:25.165793	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2011-2514`	vulnerable	2026-06-08 04:58:07.366172	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2011-2513`	vulnerable	2026-06-08 04:58:07.356173	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.