CVE-2012-3423

Exploit

EPSS 6.17%
Veröffentlicht 07.08.2012 21:55:01
Zuletzt bearbeitet 16.06.2026 23:43:11
Quelle secalert@redhat.com
CVE-Watchlists
Login
Unerledigt
Login

The IcedTea-Web plugin before 1.2.1 does not properly handle NPVariant NPStrings without NUL terminators, which allows remote attackers to cause a denial of service (crash), obtain sensitive information from memory, or execute arbitrary code via a crafted Java applet.

Betroffene Produkte Warnungen 0 Metriken 2 CWE 1 Referenzen 21

NVD 3 VulnDex Vulnerability Enrichment 0

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Redhat ≫ Icedtea-web Version <= 1.2

Redhat ≫ Icedtea-web Version1.0

Redhat ≫ Icedtea-web Version1.1

Zu dieser CVE wurde keine Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	6.17%	0.926

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
nvd@nist.gov	7.5	10	6.4	AV:N/AC:L/Au:N/C:P/I:P/A:P

CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer

The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

http://security.gentoo.org/glsa/glsa-201406-32.xml

http://icedtea.classpath.org/hg/release/icedtea-web-1.2/file/icedtea-web-1.2.1/NEWS

http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00003.html

http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00004.html

http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00005.html

http://lists.opensuse.org/opensuse-security-announce/2013-05/msg00020.html

http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00013.html

http://lists.opensuse.org/opensuse-updates/2013-05/msg00032.html

http://lists.opensuse.org/opensuse-updates/2013-06/msg00030.html

http://lists.opensuse.org/opensuse-updates/2013-06/msg00101.html

http://rhn.redhat.com/errata/RHSA-2012-1132.html

http://secunia.com/advisories/50089

Vendor Advisory

http://www.ubuntu.com/usn/USN-1521-1

http://icedtea.classpath.org/bugzilla/show_bug.cgi?id=518

http://icedtea.classpath.org/bugzilla/show_bug.cgi?id=863

Vendor Advisory

http://icedtea.classpath.org/hg/release/icedtea-web-1.2/rev/d65bd94e0ba9

Patch

Exploit

http://icedtea.classpath.org/hg/release/icedtea-web-1.2/rev/d7375e2a9076

Patch

Exploit

https://bugzilla.redhat.com/show_bug.cgi?id=841345

https://nvd.nist.gov/vuln/detail/CVE-2012-3423

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2012-3423

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2012-3423

EUVD

Team-orientierte Vulnerability Management Plattform

Features der Plattform

CVE-2012-3423