CVE-2011-3377
CVE-2011-3377
This page contains facts from public vulnerability sources. Check the original advisory before updating.
The web browser plug-in in IcedTea-Web 1.0.x before 1.0.6 and 1.1.x before 1.1.4 allows remote attackers to bypass the Same Origin Policy (SOP) and execute arbitrary script or establish network connections to unintended hosts via an applet whose origin has the same second-level domain, but a different sub-domain than the targeted domain.
EPSS 2.2% · Fix available
- Published
- Updated
Stack: system
Affected products and versions
n/a
- Versions
- n/a: Affected
No fix published
icedtea-web Debian:12
- Affected ranges
- ECOSYSTEM: < 1.1.4-1
Update to 1.1.4-1
icedtea-web Debian:13
- Affected ranges
- ECOSYSTEM: < 1.1.4-1
Update to 1.1.4-1
icedtea-web Debian:14
- Affected ranges
- ECOSYSTEM: < 1.1.4-1
Update to 1.1.4-1
Original sources
- https://bugzilla.redhat.com/show_bug.cgi?id=742515
- http://rhn.redhat.com/errata/RHSA-2011-1441.html
- http://dbhole.wordpress.com/2011/11/08/icedtea-web-1-0-6-and-1-1-4-security-releases-released/
- http://www.osvdb.org/76940
- http://lists.opensuse.org/opensuse-updates/2012-03/msg00028.html
- http://www.debian.org/security/2012/dsa-2420
- http://www.securityfocus.com/bid/50610
- http://www.ubuntu.com/usn/USN-1263-1
- https://nvd.nist.gov/vuln/detail/CVE-2011-3377