CVE-2012-3423

IcedTea-Web < 1.2.1 - Remote Code Execution via NPVariant NPString Handling

Title source: llm
STIX 2.1

Description

The IcedTea-Web plugin before 1.2.1 does not properly handle NPVariant NPStrings without NUL terminators, which allows remote attackers to cause a denial of service (crash), obtain sensitive information from memory, or execute arbitrary code via a crafted Java applet.

References (18)

Core 18
Core References
Vendor Advisory vendor-advisory x_refsource_redhat
http://rhn.redhat.com/errata/RHSA-2012-1132.html
Third Party Advisory vendor-advisory x_refsource_gentoo
http://security.gentoo.org/glsa/glsa-201406-32.xml
Vendor Advisory x_refsource_confirm
http://icedtea.classpath.org/bugzilla/show_bug.cgi?id=863
Vendor Advisory vendor-advisory x_refsource_ubuntu
http://www.ubuntu.com/usn/USN-1521-1
Mailing List vendor-advisory x_refsource_suse
http://lists.opensuse.org/opensuse-updates/2013-05/msg00032.html
Mailing List vendor-advisory x_refsource_suse
http://lists.opensuse.org/opensuse-updates/2013-06/msg00101.html
Mailing List vendor-advisory x_refsource_suse
http://lists.opensuse.org/opensuse-updates/2013-06/msg00030.html
Issue Tracking x_refsource_misc
https://bugzilla.redhat.com/show_bug.cgi?id=841345
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/50089
Various Sources x_refsource_confirm
http://icedtea.classpath.org/bugzilla/show_bug.cgi?id=518

Scores

EPSS 0.0617
EPSS Percentile 92.7%

Details

CWE
CWE-119
Status published
Products (3)
redhat/icedtea-web 1.0
redhat/icedtea-web 1.1
redhat/icedtea-web < 1.2
Published Aug 07, 2012
Tracked Since Feb 18, 2026