Description
The IcedTea-Web plugin before 1.2.3 and 1.3.x before 1.3.2 uses the same class loader for applets with the same codebase path but from different domains, which allows remote attackers to obtain sensitive information or possibly alter other applets via a crafted applet.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | icedtea-web | 1.3.2-1 | — |
| Debian 13 | icedtea-web | 1.3.2-1 | — |
| Debian 12 | icedtea-web | 1.3.2-1 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 6 | icedtea-web +1 | 1.2.3-2.el6_4 | RHSA-2013:0753 |
Advisories 1
- RHSA-2013:0753 Red Hat Security Advisory: icedtea-web security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
References
- 92543 vdb-entry
- SUSE-SU-2013:0851 vendor-advisory
- openSUSE-SU-2013:0897 vendor-advisory
- icedtea-cve20131940-security-bypass(83642) vdb-entry
- MDVSA-2013:146 vendor-advisory
- SUSE-SU-2013:1174 vendor-advisory
- 53109 third-party-advisory
- http://icedtea.classpath.org/hg/release/icedtea-web-1.2/rev/34b6f60ae586
- openSUSE-SU-2013:0826 vendor-advisory
- openSUSE-SU-2013:0735 vendor-advisory
- 53117 third-party-advisory
- RHSA-2013:0753 vendor-advisory
- openSUSE-SU-2013:0966 vendor-advisory
- openSUSE-SU-2013:0893 vendor-advisory
- http://icedtea.classpath.org/hg/release/icedtea-web-1.3/rev/25dd7c7ac39c
- USN-1804-1 vendor-advisory
- http://icedtea.classpath.org/hg/release/icedtea-web-1.2/file/icedtea-web-1.2.3/NEWS
- 59281 vdb-entry
- https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0123
- openSUSE-SU-2013:0715 vendor-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=916774
- [distro-pkg-dev] 20130417 IcedTea-Web 1.3.2 and 1.2.3 released! mailing-list