Red Hat Icedtea-Web vulnerabilities

10 CVEs affecting Red Hat Icedtea-Web, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2011-2514, published 2014-05-14.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2012-3423, published 2012-08-07. High severity, CVSS 7.5. EPSS: 6.2% chance of exploitation in the next 30 days. The IcedTea-Web plugin before 1.2.1 does not properly handle NPVariant NPStrings without NUL terminators, which allows remote attackers to cause a denial of service (crash), obtain sensitive…
CVE-2013-1927, published 2013-04-29. Medium severity, CVSS 6.8. EPSS: 4.3% chance of exploitation in the next 30 days. The IcedTea-Web plugin before 1.2.3 and 1.3.x before 1.3.2 allows remote attackers to execute arbitrary code via a crafted file that validates as both a GIF and a Java JAR file, aka "GIFAR."
CVE-2012-4540, published 2012-11-11. Medium severity, CVSS 6.8. EPSS: 3.4% chance of exploitation in the next 30 days. Off-by-one error in the invoke function in IcedTeaScriptablePluginObject.cc in IcedTea-Web 1.1.x before 1.1.7, 1.2.x before 1.2.2, 1.3.x before 1.3.1, and 1.4.x before 1.4.1 allows remote attackers…
CVE-2012-3422, published 2012-08-07. Medium severity, CVSS 6.8. EPSS: 3.1% chance of exploitation in the next 30 days. The getFirstInTableInstance function in the IcedTea-Web plugin before 1.2.1 returns an uninitialized pointer when the instance_to_id_map hash is empty, which allows remote attackers to cause a denial…
CVE-2011-0706, published 2011-02-19. High severity, CVSS 7.5. EPSS: 3.1% chance of exploitation in the next 30 days. The JNLPClassLoader class in IcedTea-Web before 1.0.1, as used in OpenJDK Runtime Environment 1.6.0, allows remote attackers to gain privileges via unknown vectors related to multiple signers and the…
CVE-2011-2513, published 2014-05-14. Medium severity, CVSS 5.0. EPSS: 2.5% chance of exploitation in the next 30 days. The Java Network Launching Protocol (JNLP) implementation in IcedTea6 1.9.x before 1.9.9 and before 1.8.9, and IcedTea-Web 1.1.x before 1.1.1 and before 1.0.4, allows remote attackers to obtain the…
CVE-2011-2514, published 2014-05-14. Medium severity, CVSS 6.8. EPSS: 2.4% chance of exploitation in the next 30 days. The Java Network Launching Protocol (JNLP) implementation in IcedTea6 1.9.x before 1.9.9 and before 1.8.9, and IcedTea-Web 1.1.x before 1.1.1 and before 1.0.4, allows remote attackers to trick…
CVE-2011-3377, published 2014-02-05. Medium severity, CVSS 4.3. EPSS: 2.2% chance of exploitation in the next 30 days. The web browser plug-in in IcedTea-Web 1.0.x before 1.0.6 and 1.1.x before 1.1.4 allows remote attackers to bypass the Same Origin Policy (SOP) and execute arbitrary script or establish network…
CVE-2013-1926, published 2013-04-29. Medium severity, CVSS 5.8. EPSS: 1.9% chance of exploitation in the next 30 days. The IcedTea-Web plugin before 1.2.3 and 1.3.x before 1.3.2 uses the same class loader for applets with the same codebase path but from different domains, which allows remote attackers to obtain…
CVE-2013-6493, published 2014-03-03. Low severity, CVSS 2.1. EPSS: 0.5% chance of exploitation in the next 30 days. The LiveConnect implementation in plugin/icedteanp/IcedTeaNPPlugin.cc in IcedTea-Web before 1.4.2 allows local users to read the messages between a Java applet and a web browser by pre-creating a…