The web browser plug-in in IcedTea-Web 1.0.x before 1.0.6 and 1.1.x before 1.1.4 allows remote attackers to bypass the Same Origin Policy (SOP) and execute arbitrary script or establish network connections to unintended hosts via an applet whose origin has the same second-level domain, but a different sub-domain than the targeted domain.
CVSS Details
- CVSS 3.1 Base Score: 5.3
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade icedtea-web | Jul 30, 2024 | Feb 5, 2014 |
| Oracle_linux | — | Upgrade icedtea-web-javadocUpgrade icedtea-web | Oct 16, 2024 | Feb 5, 2014 |
| Suse | — | Upgrade java-1_7_0-openjdk-pluginUpgrade icedtea-webUpgrade java-1_8_0-openjdk-plugin | Dec 12, 2013 | Jul 9, 2013 |
| Ubuntu | — | Upgrade icedtea6-pluginUpgrade openjdk-6-jdkUpgrade icedtea-6-jre-jamvmUpgrade openjdk-6-jre-zeroUpgrade openjdk-6-demoUpgrade openjdk-6-jre-headlessUpgrade openjdk-6-jreUpgrade icedtea-pluginUpgrade icedtea-netxUpgrade openjdk-6-jre-libUpgrade icedtea-6-jre-cacao | Nov 8, 2024 | Feb 5, 2014 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub