p PatchFirst

CVE-2012-4540

CVE-2012-4540

This page contains facts from public vulnerability sources. Check the original advisory before updating.

This page shows selected source facts. See the linked advisories for the complete description and affected versions.

Off-by-one error in the invoke function in IcedTeaScriptablePluginObject.cc in IcedTea-Web 1.1.x before 1.1.7, 1.2.x before 1.2.2, 1.3.x before 1.3.1, and 1.4.x before 1.4.1 allows remote attackers to obtain sensitive information, cause a denial of service (crash), or possibly execute arbitrary code via a crafted webpage that triggers a heap-based buffer overflow, related to an error message and a "triggering event attached to applet." NOTE: the 1.4.x versions were originally associated with CVE-2013-4349, but that entry has been MERGED with this one.

EPSS 3.4% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • n/a

    Versions
    • n/a: Affected

    No fix published

  • icedtea-web Debian:12

    Affected ranges
    • ECOSYSTEM: < 1.3.1-1

    Update to 1.3.1-1

  • icedtea-web Debian:13

    Affected ranges
    • ECOSYSTEM: < 1.3.1-1

    Update to 1.3.1-1

  • icedtea-web Debian:14

    Affected ranges
    • ECOSYSTEM: < 1.3.1-1

    Update to 1.3.1-1

Original sources

Check your server →