CVE-2011-3377

IcedTea-Web 1.0.x < 1.0.6 and 1.1.x < 1.1.4 - Same Origin Policy Bypass via Subdomain Applet

Title source: llm
STIX 2.1

Description

The web browser plug-in in IcedTea-Web 1.0.x before 1.0.6 and 1.1.x before 1.1.4 allows remote attackers to bypass the Same Origin Policy (SOP) and execute arbitrary script or establish network connections to unintended hosts via an applet whose origin has the same second-level domain, but a different sub-domain than the targeted domain.

References (8)

Core 8
Core References
Vendor Advisory vendor-advisory x_refsource_redhat
http://rhn.redhat.com/errata/RHSA-2011-1441.html
Issue Tracking x_refsource_misc
https://bugzilla.redhat.com/show_bug.cgi?id=742515
Third Party Advisory, VDB Entry vdb-entry x_refsource_osvdb
http://www.osvdb.org/76940
Mailing List vendor-advisory x_refsource_suse
http://lists.opensuse.org/opensuse-updates/2012-03/msg00028.html
Third Party Advisory vendor-advisory x_refsource_debian
http://www.debian.org/security/2012/dsa-2420
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/50610
Vendor Advisory vendor-advisory x_refsource_ubuntu
http://www.ubuntu.com/usn/USN-1263-1

Scores

EPSS 0.0222
EPSS Percentile 80.7%

Details

CWE
CWE-264
Status published
Products (15)
canonical/ubuntu_linux 10.04
canonical/ubuntu_linux 10.10
canonical/ubuntu_linux 11.04
canonical/ubuntu_linux 11.10
opensuse/opensuse 12.1
redhat/icedtea-web 1.0
redhat/icedtea-web 1.0.1
redhat/icedtea-web 1.0.2
redhat/icedtea-web 1.0.3
redhat/icedtea-web 1.0.4
... and 5 more
Published Feb 05, 2014
Tracked Since Feb 18, 2026