CVE-2013-1926
Summary
| CVE | CVE-2013-1926 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2013-04-29 22:55:00 UTC |
| Updated | 2018-10-30 16:27:00 UTC |
| Description | The IcedTea-Web plugin before 1.2.3 and 1.3.x before 1.3.2 uses the same class loader for applets with the same codebase path but from different domains, which allows remote attackers to obtain sensitive information or possibly alter other applets via a crafted applet. |
Risk And Classification
Problem Types: NVD-CWE-noinfo
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Operating System | Canonical | Ubuntu Linux | 10.04 | - | lts | All |
| Operating System | Canonical | Ubuntu Linux | 11.10 | All | All | All |
| Operating System | Canonical | Ubuntu Linux | 12.04 | - | lts | All |
| Operating System | Canonical | Ubuntu Linux | 12.10 | All | All | All |
| Operating System | Canonical | Ubuntu Linux | 10.04 | - | lts | All |
| Operating System | Canonical | Ubuntu Linux | 11.10 | All | All | All |
| Operating System | Canonical | Ubuntu Linux | 12.04 | - | lts | All |
| Operating System | Canonical | Ubuntu Linux | 12.10 | All | All | All |
| Operating System | Opensuse | Opensuse | 12.2 | All | All | All |
| Operating System | Opensuse | Opensuse | 12.2 | All | All | All |
| Application | Redhat | Icedtea-web | 1.0 | All | All | All |
| Application | Redhat | Icedtea-web | 1.0.1 | All | All | All |
| Application | Redhat | Icedtea-web | 1.0.2 | All | All | All |
| Application | Redhat | Icedtea-web | 1.0.3 | All | All | All |
| Application | Redhat | Icedtea-web | 1.0.4 | All | All | All |
| Application | Redhat | Icedtea-web | 1.0.5 | All | All | All |
| Application | Redhat | Icedtea-web | 1.0.6 | All | All | All |
| Application | Redhat | Icedtea-web | 1.1 | All | All | All |
| Application | Redhat | Icedtea-web | 1.1.1 | All | All | All |
| Application | Redhat | Icedtea-web | 1.1.2 | All | All | All |
| Application | Redhat | Icedtea-web | 1.1.3 | All | All | All |
| Application | Redhat | Icedtea-web | 1.1.4 | All | All | All |
| Application | Redhat | Icedtea-web | 1.1.5 | All | All | All |
| Application | Redhat | Icedtea-web | 1.1.6 | All | All | All |
| Application | Redhat | Icedtea-web | 1.1.7 | All | All | All |
| Application | Redhat | Icedtea-web | 1.2 | All | All | All |
| Application | Redhat | Icedtea-web | 1.2.1 | All | All | All |
| Application | Redhat | Icedtea-web | 1.3 | All | All | All |
| Application | Redhat | Icedtea-web | 1.3.1 | All | All | All |
| Application | Redhat | Icedtea-web | 1.0 | All | All | All |
| Application | Redhat | Icedtea-web | 1.0.1 | All | All | All |
| Application | Redhat | Icedtea-web | 1.0.2 | All | All | All |
| Application | Redhat | Icedtea-web | 1.0.3 | All | All | All |
| Application | Redhat | Icedtea-web | 1.0.4 | All | All | All |
| Application | Redhat | Icedtea-web | 1.0.5 | All | All | All |
| Application | Redhat | Icedtea-web | 1.0.6 | All | All | All |
| Application | Redhat | Icedtea-web | 1.1 | All | All | All |
| Application | Redhat | Icedtea-web | 1.1.1 | All | All | All |
| Application | Redhat | Icedtea-web | 1.1.2 | All | All | All |
| Application | Redhat | Icedtea-web | 1.1.3 | All | All | All |
| Application | Redhat | Icedtea-web | 1.1.4 | All | All | All |
| Application | Redhat | Icedtea-web | 1.1.5 | All | All | All |
| Application | Redhat | Icedtea-web | 1.1.6 | All | All | All |
| Application | Redhat | Icedtea-web | 1.1.7 | All | All | All |
| Application | Redhat | Icedtea-web | 1.2 | All | All | All |
| Application | Redhat | Icedtea-web | 1.2.1 | All | All | All |
| Application | Redhat | Icedtea-web | 1.3 | All | All | All |
| Application | Redhat | Icedtea-web | 1.3.1 | All | All | All |
| Application | Redhat | Icedtea-web | All | All | All | All |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| Red Hat Customer Portal | REDHAT | rhn.redhat.com | |
| 916774 – (CVE-2013-1926) CVE-2013-1926 icedtea-web: class loader sharing for applets with same codebase paths | MISC | bugzilla.redhat.com | |
| Security Advisory SA53109 - Red Hat update for icedtea-web - Secunia | SECUNIA | secunia.com | Vendor Advisory |
| release/icedtea-web-1.3: 25dd7c7ac39c | CONFIRM | icedtea.classpath.org | |
| release/icedtea-web-1.2: 89bbadb66b07 NEWS | CONFIRM | icedtea.classpath.org | |
| Support / Security / Advisories / / MDVSA-2013:146 | Mandriva | MANDRIVA | www.mandriva.com | |
| openSUSE-SU-2013:0897-1: moderate: update for icedtea-web | SUSE | lists.opensuse.org | |
| [security-announce] SUSE-SU-2013:0851-1: important: Security update for | SUSE | lists.opensuse.org | |
| 92543 | OSVDB | osvdb.org | |
| openSUSE-SU-2013:0735-1: moderate: update for icedtea-web | SUSE | lists.opensuse.org | |
| openSUSE-SU-2013:0966-1: moderate: Package icedtea-web was updated to ve | SUSE | lists.opensuse.org | |
| openSUSE-SU-2013:0715-1: moderate: update for icedtea-web | SUSE | lists.opensuse.org | |
| USN-1804-1: IcedTea-Web vulnerabilities | Ubuntu | UBUNTU | www.ubuntu.com | |
| release/icedtea-web-1.2: 34b6f60ae586 | CONFIRM | icedtea.classpath.org | |
| Security Advisory SA53117 - Ubuntu update for icedtea-web - Secunia | SECUNIA | secunia.com | Vendor Advisory |
| IcedTea-Web 1.3.2 and 1.2.3 released! | MLIST | mail.openjdk.java.net | |
| openSUSE-SU-2013:0826-1: moderate: Package icedtea-web was updated to ve | SUSE | lists.opensuse.org | |
| IcedTea-Web CVE-2013-1926 Security Bypass Vulnerability | BID | www.securityfocus.com | |
| IBM X-Force Exchange | XF | exchange.xforce.ibmcloud.com | |
| [security-announce] SUSE-SU-2013:1174-1: important: Security update for | SUSE | lists.opensuse.org | |
| openSUSE-SU-2013:0893-1: moderate: Package icedtea-web was updated to ve | SUSE | lists.opensuse.org | |
| Support/Advisories/MGASA-2013-0123 - Mageia wiki | MISC | wiki.mageia.org | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.