Explain CVE-2013-1926
The IcedTea-Web plugin before 1.2.3 and 1.3.x before 1.3.2 uses the same class loader for applets with the same codebase path but from different domains, which allows remote attackers to obtain sensitive information or possibly alter other applets via a crafted applet.
Affected Products: n/a
References: [{'name': '92543', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/92543'}, {'name': 'SUSE-SU-2013:0851', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2013-05/msg00020.html'}, {'name': 'openSUSE-SU-2013:0897', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2013-06/msg00034.html'}, {'name': 'icedtea-cve20131940-security-bypass(83642)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/83642'}, {'name': 'MDVSA-2013:146', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://www.mandriva.com/security/advisories?name=MDVSA-2013:146'}, {'name': 'SUSE-SU-2013:1174', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00013.html'}, {'name': '53109', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/53109'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://icedtea.classpath.org/hg/release/icedtea-web-1.2/rev/34b6f60ae586'}, {'name': 'openSUSE-SU-2013:0826', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2013-05/msg00032.html'}, {'name': 'openSUSE-SU-2013:0735', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2013-05/msg00003.html'}, {'name': '53117', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/53117'}, {'name': 'RHSA-2013:0753', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2013-0753.html'}, {'name': 'openSUSE-SU-2013:0966', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2013-06/msg00101.html'}, {'name': 'openSUSE-SU-2013:0893', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2013-06/msg00030.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://icedtea.classpath.org/hg/release/icedtea-web-1.3/rev/25dd7c7ac39c'}, {'name': 'USN-1804-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-1804-1'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://icedtea.classpath.org/hg/release/icedtea-web-1.2/file/icedtea-web-1.2.3/NEWS'}, {'name': '59281', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/59281'}, {'tags': ['x_refsource_MISC'], 'url': 'https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0123'}, {'name': 'openSUSE-SU-2013:0715', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2013-04/msg00106.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=916774'}, {'name': '[distro-pkg-dev] 20130417 IcedTea-Web 1.3.2 and 1.2.3 released!', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://mail.openjdk.java.net/pipermail/distro-pkg-dev/2013-April/022790.html'}]
CVE State: PUBLISHED