Off-by-one error in the invoke function in IcedTeaScriptablePluginObject.cc in IcedTea-Web 1.1.x before 1.1.7, 1.2.x before 1.2.2, 1.3.x before 1.3.1, and 1.4.x before 1.4.1 allows remote attackers to obtain sensitive information, cause a denial of service (crash), or possibly execute arbitrary code via a crafted webpage that triggers a heap-based buffer overflow, related to an error message and a "triggering event attached to applet." NOTE: the 1.4.x versions were originally associated with CVE-2013-4349, but that entry has been MERGED with this one.

The icedtea-web java plugin was updated to 1.6.1.

Changes included :

  - Enabled Entry-Point attribute check

  - permissions sandbox and signed app and unsigned app with     permissions all-permissions now run in sandbox instead     of not at all.

  - fixed DownloadService

  - comments in deployment.properties now should persists     load/save

  - fixed bug in caching of files with query

  - fixed issues with recreating of existing shortcut

  - trustAll/trustNone now processed correctly

  - headless no longer shows dialogues

  - RH1231441 Unable to read the text of the buttons of the     security dialogue

  - Fixed RH1233697 icedtea-web: applet origin spoofing     (CVE-2015-5235, bsc#944208)

  - Fixed RH1233667 icedtea-web: unexpected permanent     authorization of unsigned applets (CVE-2015-5234,     bsc#944209)

  - MissingALACAdialog made available also for unsigned     applications (but ignoring actual manifest value) and     fixed

  - NetX

  - fixed issues with -html shortcuts

  - fixed issue with -html receiving garbage in width and     height

  - PolicyEditor

  - file flag made to work when used standalone

  - file flag and main argument cannot be used in     combination

  - Fix generation of man-pages with some versions of 'tail'

Also included is the update to 1.6

  - Massively improved offline abilities. Added Xoffline     switch to force work without inet connection.

  - Improved to be able to run with any JDK

  - JDK 6 and older no longer supported

  - JDK 8 support added (URLPermission granted if     applicable)

  - JDK 9 supported 

  - Added support for Entry-Point manifest attribute

  - Added KEY_ENABLE_MANIFEST_ATTRIBUTES_CHECK deployment     property to control scan of Manifest file 

  - starting arguments now accept also -- abbreviations

  - Added new documentation

  - Added support for menu shortcuts - both javaws     applications/applets and html applets are supported

  - added support for -html switch for javaws. Now you can     run most of the applets without browser at all

  - Control Panel

  - PR1856: ControlPanel UI improvement for lower     resolutions (800*600)

  - NetX

  - PR1858: Java Console accepts multi-byte encodings

  - PR1859: Java Console UI improvement for lower     resolutions (800*600)

  - RH1091563: [abrt] icedtea-web-1.5-2.fc20: Uncaught     exception java.lang.ClassCastException in method     sun.applet.PluginAppletViewer$8.run()

  - Dropped support for long unmaintained -basedir argument

  - Returned support for -jnlp argument

  - RH1095311, PR574 - References class sun.misc.Ref removed     in OpenJDK 9 - fixed, and so buildable on JDK9

  - Plugin

  - PR1743 - Intermittant deadlock in PluginRequestProcessor

  - PR1298 - LiveConnect - problem setting array elements     (applet variables) from JS

  - RH1121549: coverity defects

  - Resolves method overloading correctly with superclass     heirarchy distance

  - PolicyEditor

  - codebases can be renamed in-place, copied, and pasted

  - codebase URLs can be copied to system clipboard

  - displays a progress dialog while opening or saving files

  - codebases without permissions assigned save to file     anyway (and re-appear on next open)

  - PR1776: NullPointer on save-and-exit

  - PR1850: duplicate codebases when launching from security     dialogs

  - Fixed bug where clicking 'Cancel' on the 'Save before     Exiting' dialog could result in the editor exiting     without saving changes

  - Keyboard accelerators and mnemonics greatly improved

  - 'File - New' allows editing a new policy without first     selecting the file to save to

  - Common

  - PR1769: support signed applets which specify Sandbox     permissions in their manifests

  - Temporary Permissions in security dialog now     multi-selectable and based on PolicyEditor permissions

  - Update to 1.5.2

  - NetX

  - RH1095311, PR574 - References class sun.misc.Ref removed     in OpenJDK 9 - fixed, and so buildable on JDK9

  - RH1154177 - decoded file needed from cache

  - fixed NPE in https dialog

  - empty codebase behaves as '.'

The remote host is affected by the vulnerability described in GLSA-201406-32 (IcedTea JDK: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in the IcedTea JDK. Please       review the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could possibly execute arbitrary code with the       privileges of the process, cause a Denial of Service condition, obtain       sensitive information, bypass intended security policies, or have other       unspecified impact.
  Workaround :

    There is no known workaround at this time.

This icedtea-web update fixes several security issues.

Changes in icedtea-web :

  - update to 1.4.1 (bnc#840572)

  - Improved and cleaned Temporary internet files panel

  - NetX

  - PR1465 - java.io.FileNotFoundException while trying to     download a JAR file

  - PR1473 - javaws should not depend on name of local file

  - Plugin

  - PR854: Resizing an applet several times causes 100% CPU     load

  - Security Updates

  - CVE-2013-4349, RH869040: Heap-based buffer overflow     after triggering event attached to applet CVE-2012-4540     nit fixed in icedtea-web 1.4

  - Misc 

  - reproducers tests are enabled in dist-tarball

  - application context support for OpenJDK build 25 and     higher

  - small patches into rhino support and

  - PR1533: Inherit jnlp.packEnabled and jnlp.versionEnabled     like other properties

  - need jpackage-utils on older distros

  - run more tests in %check

  - drop icedtea-web-AppContext.patch, already upstream

  - add javapackages-tools to build requires

The IcedTea Web Java plugin was updated to 1.3.1 (bnc#787846)

  - Security Updates

  - CVE-2012-4540, RH869040: Heap-based buffer overflow     after triggering event attached to applet

  - Common Bugfixes

  - PR1161: X509VariableTrustManager does not work correctly     with OpenJDK7 fixes the self-signed issue (mentioned in     bnc#784859, bnc#785333, bnc#786775)

A heap-based buffer overflow vulnerability was found in icedtea-web, a web browser plugin for running applets written in the Java programming language. If a user were tricked into opening a malicious website, an attacker could cause the plugin to crash or possibly execute arbitrary code as the user invoking the program.

This problem was initially discovered by Arthur Gerkis and got assigned CVE-2012-4540. Fixes where applied in the 1.1, 1.2 and 1.3 branches but not to the 1.4 branch.

Updated to icedtea-web 1.4.1 New in release 1.4.1 (2013-XX-YY) :

  - Improved and cleaned Temporary internet files panel

    - PR1465 - java.io.FileNotFoundException while trying to       download a JAR file

    - PR1473 - javaws should not depend on name of local       file

    - PR854: Resizing an applet several times causes 100%       CPU load

    - CVE-2012-4540, RH869040: Heap-based buffer overflow       after triggering event attached to applet

    - reproducers tests are enabled in dist-tarball

    - application context support for OpenJDK build 25 and       higher

    - small patches into rhino support and

    - PR1533: Inherit jnlp.packEnabled and       jnlp.versionEnabled like other properties

    - add icedtea-web man page

    - make check enabled again

    - should be build for non-standart archs

    - removed unused multilib arches

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This icedtea-web update adds a missing fix for an off-by-one heap-based buffer overflow.

  - icedtea-web 1.4.1 fixes the missing patch for     CVE-2012-4540. (bnc#840572: CVE-2013-4349)

From Red Hat Security Advisory 2012:1434 :

Updated icedtea-web packages that fix one security issue are now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having critical security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

The IcedTea-Web project provides a Java web browser plug-in and an implementation of Java Web Start, which is based on the Netx project.
It also contains a configuration tool for managing deployment settings for the plug-in and Web Start implementations.

A buffer overflow flaw was found in the IcedTea-Web plug-in. Visiting a malicious web page could cause a web browser using the IcedTea-Web plug-in to crash or, possibly, execute arbitrary code. (CVE-2012-4540)

Red Hat would like to thank Arthur Gerkis for reporting this issue.

This erratum also upgrades IcedTea-Web to version 1.2.2. Refer to the NEWS file, linked to in the References, for further information.

All IcedTea-Web users should upgrade to these updated packages, which resolve this issue. Web browsers using the IcedTea-Web browser plug-in must be restarted for this update to take effect.

The IcedTea-Web Java plugin has been updated to version 1.3.1 to fix various bugs and security issues.

1.3.1 changes :

  - Security Updates

  - RH869040: Heap-based buffer overflow after triggering     event attached to applet. (CVE-2012-4540)

  - Common

  - PR1161: X509VariableTrustManager does not work correctly     with OpenJDK7 fixes the self-signed issue (mentioned in     bnc#784859, bnc#785333, bnc#786775)

Updated icedtea-web packages that fix one security issue are now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having critical security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

The IcedTea-Web project provides a Java web browser plug-in and an implementation of Java Web Start, which is based on the Netx project.
It also contains a configuration tool for managing deployment settings for the plug-in and Web Start implementations.

A buffer overflow flaw was found in the IcedTea-Web plug-in. Visiting a malicious web page could cause a web browser using the IcedTea-Web plug-in to crash or, possibly, execute arbitrary code. (CVE-2012-4540)

Red Hat would like to thank Arthur Gerkis for reporting this issue.

This erratum also upgrades IcedTea-Web to version 1.2.2. Refer to the NEWS file, linked to in the References, for further information.

All IcedTea-Web users should upgrade to these updated packages, which resolve this issue. Web browsers using the IcedTea-Web browser plug-in must be restarted for this update to take effect.

Arthur Gerkis discovered a buffer overflow in the Icedtea-Web plugin.
If a user were tricked into opening a malicious website, an attacker could cause the plugin to crash or possibly execute arbitrary code as the user invoking the program.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This erratum also upgrades IcedTea-Web to version 1.2.2.

Web browsers using the IcedTea-Web browser plug-in must be restarted for this update to take effect.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2012:1434 advisory.

  - icedtea-web: IcedTeaScriptableJavaObject::invoke off-by-one heap-based buffer overflow (CVE-2012-4540)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
86094	openSUSE Security Update : icedtea-web (openSUSE-2015-602)	Nessus	SuSE Local Security Checks	medium
76303	GLSA-201406-32 : IcedTea JDK: Multiple vulnerabilities (BEAST) (ROBOT)	Nessus	Gentoo Local Security Checks	critical
75156	openSUSE Security Update : icedtea-web (openSUSE-SU-2013:1509-1)	Nessus	SuSE Local Security Checks	medium
74816	openSUSE Security Update : icedtea-web (openSUSE-SU-2012:1524-1)	Nessus	SuSE Local Security Checks	medium
70303	Debian DSA-2768-1 : icedtea-web - heap-based buffer overflow	Nessus	Debian Local Security Checks	medium
70296	Fedora 18 : icedtea-web-1.4.1-0.fc18 (2013-17016)	Nessus	Fedora Local Security Checks	medium
70289	SuSE 11.2 / 11.3 Security Update : icedtea-web (SAT Patch Numbers 8357 / 8358)	Nessus	SuSE Local Security Checks	medium
70060	Fedora 20 : icedtea-web-1.4.1-0.fc20 (2013-16971)	Nessus	Fedora Local Security Checks	medium
70037	Fedora 19 : icedtea-web-1.4.1-0.fc19 (2013-17026)	Nessus	Fedora Local Security Checks	medium
68652	Oracle Linux 6 : icedtea-web (ELSA-2012-1434)	Nessus	Oracle Linux Local Security Checks	medium
64156	SuSE 11.2 Security Update : icedtea-web (SAT Patch Number 7041)	Nessus	SuSE Local Security Checks	medium
62871	CentOS 6 : icedtea-web (CESA-2012:1434)	Nessus	CentOS Local Security Checks	medium
62860	Ubuntu 10.04 LTS / 11.10 / 12.04 LTS / 12.10 : icedtea-web vulnerability (USN-1625-1)	Nessus	Ubuntu Local Security Checks	medium
62859	Scientific Linux Security Update : icedtea-web on SL6.x i386/x86_64 (20121107)	Nessus	Scientific Linux Local Security Checks	medium
62857	RHEL 6 : icedtea-web (RHSA-2012:1434)	Nessus	Red Hat Local Security Checks	critical

Detections

Analytics

CVE-2012-4540

critical

Tenable Plugins

medium

critical

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

critical