Risks
Advisories
Browse
or
or
Ubuntu Security Notice - icedtea-web regression (USN-1804-2)
==========================================================================
Ubuntu Security Notice USN-1804-2
April 23, 2013

icedtea-web regression
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 12.04 LTS
- Ubuntu 11.10

Summary:

Due to a regression, IcedTea-Web might not be able to access some sites.

Software Description:
- icedtea-web: A web browser plugin to execute Java applets

Details:

USN-1804-1 fixed vulnerabilities in IcedTea-Web. This update introduced
a regression with the Java Network Launching Protocol (JNLP) when fetching
content over SSL under certain configurations, such as when using the
community-supported IcedTead 7 browser plugin. This update fixes the
problem.

We apologize for the inconvenience.

Original advisory details:

 Jiri Vanek discovered that IcedTea-Web would use the same classloader for
 applets from different domains. A remote attacker could exploit this to
 expose sensitive information or potentially manipulate applets from other
 domains. (CVE-2013-1926)

 It was discovered that IcedTea-Web did not properly verify JAR files and
 was susceptible to the GIFAR attack. If a user were tricked into opening a
 malicious website, a remote attacker could potentially exploit this to
 execute code under certain circumstances. (CVE-2013-1927)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 12.04 LTS:
  icedtea-7-plugin                1.2.3-0ubuntu0.12.04.2
  icedtea-netx                    1.2.3-0ubuntu0.12.04.2

Ubuntu 11.10:
  icedtea-netx                    1.2.3-0ubuntu0.11.10.2

After a standard system update you need to restart your browser to make
all the necessary changes.

References:
  http://www.ubuntu.com/usn/usn-1804-2
  http://www.ubuntu.com/usn/usn-1804-1
  https://launchpad.net/bugs/1171506

Package Information:
  https://launchpad.net/ubuntu/+source/icedtea-web/1.2.3-0ubuntu0.12.04.2
  https://launchpad.net/ubuntu/+source/icedtea-web/1.2.3-0ubuntu0.11.10.2




Spotlight

Dissecting the unpredictable DDoS landscape

Posted on 23 April 2014.  |  DDoS attacks are now more unpredictable and damaging than ever, crippling websites, shutting down operations, and costing millions of dollars in downtime, customer support and brand damage, according to Neustar.


Weekly newsletter

Reading our newsletter every Monday will keep you up-to-date with security news.
  



Daily digest

Receive a daily digest of the latest security news.
  

DON'T
MISS

Wed, Apr 23rd
    COPYRIGHT 1998-2014 BY HELP NET SECURITY.   // READ OUR PRIVACY POLICY // ABOUT US // ADVERTISE //