Explain CVE-2013-1927
The IcedTea-Web plugin before 1.2.3 and 1.3.x before 1.3.2 allows remote attackers to execute arbitrary code via a crafted file that validates as both a GIF and a Java JAR file, aka "GIFAR."
Affected Products: n/a
References: [{'name': '92544', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/92544'}, {'name': 'SUSE-SU-2013:0851', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2013-05/msg00020.html'}, {'name': 'openSUSE-SU-2013:0897', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2013-06/msg00034.html'}, {'name': 'MDVSA-2013:146', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://www.mandriva.com/security/advisories?name=MDVSA-2013:146'}, {'name': 'SUSE-SU-2013:1174', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00013.html'}, {'name': '53109', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/53109'}, {'name': 'openSUSE-SU-2013:0826', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2013-05/msg00032.html'}, {'name': '59286', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/59286'}, {'name': 'icedtea-cve20131927-sec-bypass(83640)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/83640'}, {'name': 'openSUSE-SU-2013:0735', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2013-05/msg00003.html'}, {'name': '53117', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/53117'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://icedtea.classpath.org/hg/release/icedtea-web-1.3/rev/19f5282f53e8'}, {'name': 'RHSA-2013:0753', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2013-0753.html'}, {'name': 'openSUSE-SU-2013:0966', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2013-06/msg00101.html'}, {'name': 'openSUSE-SU-2013:0893', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2013-06/msg00030.html'}, {'name': 'USN-1804-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-1804-1'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://icedtea.classpath.org/hg/release/icedtea-web-1.2/file/icedtea-web-1.2.3/NEWS'}, {'tags': ['x_refsource_MISC'], 'url': 'https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0123'}, {'name': 'openSUSE-SU-2013:0715', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2013-04/msg00106.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=884705'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://icedtea.classpath.org/hg/release/icedtea-web-1.2/rev/cb58b31c450e'}, {'name': '[distro-pkg-dev] 20130417 IcedTea-Web 1.3.2 and 1.2.3 released!', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://mail.openjdk.java.net/pipermail/distro-pkg-dev/2013-April/022790.html'}]
CVE State: PUBLISHED