CVE-2013-6493 The LiveConnect implementation in plugin/icedteanp/IcedTeaNPPlugin.cc in IcedTea-Web before 1.4.2 allows local users to read the messages between a Java applet and a web browser by pre-creating a temp...
LowCVSS 2.1
EPSS 0.48%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The LiveConnect implementation in plugin/icedteanp/IcedTeaNPPlugin.cc in IcedTea-Web before 1.4.2 allows local users to read the messages between a Java applet and a web browser by pre-creating a temporary socket file with a predictable name in /tmp.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/icedtea-web(Debian:12) | < 1.4.2-1 | 1.4.2-1 |
| debian/icedtea-web(Debian:13) | < 1.4.2-1 | 1.4.2-1 |
| debian/icedtea-web(Debian:14) | < 1.4.2-1 | 1.4.2-1 |
| redhat icedtea-web | <= 1.3.2 | No fix listed |
| redhat icedtea-web | = 1.0.1 | No fix listed |
| redhat icedtea-web | = 1.0.2 | No fix listed |
| redhat icedtea-web | = 1.0.3 | No fix listed |
| redhat icedtea-web | = 1.0.4 | No fix listed |
| redhat icedtea-web | = 1.0.5 | No fix listed |
| redhat icedtea-web | = 1.0.6 | No fix listed |
| redhat icedtea-web | = 1.1 | No fix listed |
| redhat icedtea-web | = 1.1.1 | No fix listed |
| redhat icedtea-web | = 1.1.2 | No fix listed |
| redhat icedtea-web | = 1.1.3 | No fix listed |
| redhat icedtea-web | = 1.1.4 | No fix listed |
| redhat icedtea-web | = 1.1.5 | No fix listed |
| redhat icedtea-web | = 1.1.6 | No fix listed |
| redhat icedtea-web | = 1.1.7 | No fix listed |
| redhat icedtea-web | = 1.2 | No fix listed |
| redhat icedtea-web | = 1.2.1 | No fix listed |
| redhat icedtea-web | = 1.2.2 | No fix listed |
| redhat icedtea-web | = 1.3 | No fix listed |
| redhat icedtea-web | = 1.3.1 | No fix listed |
References
- Debian Security Tracker CVE-2013-6493 vendor-advisory
- icedtea.classpath.org exploit patch
- openSUSE-SU-2014:0310 vendor-advisory
- [distro-pkg-dev] 20140305 IcedTea-Web 1.4.2 released! mailing-list
- [oss-security] 20140207 IcedTea-Web insecure temporary directory use - CVE-2013-6493 mailing-list
- 57036 third-party-advisory vendor-advisory
- USN-2131-1 vendor-advisory
- bugzilla.redhat.com