CVE-2012-3423: Buffer Overflow
First published: Wed Jul 18 2012(Updated: )
It was discovered that the IcedTea-Web web browser plugin incorrectly assumed that all strings provided by browser are NUL terminated, which is not guaranteed by the NPAPI (Netscape Plugin Application Programming Interface). When used in a browser that does not NUL terminate NPVariant NPStrings, this could lead to buffer over-read or over-write, resulting in possible information leak, crash, or code execution. Mozilla browsers currently NUL terminate strings, however recent Chrome versions are known not to provide NUL terminated data. Related upstream bug reports and commits: <a href="http://icedtea.classpath.org/bugzilla/show_bug.cgi?id=518">http://icedtea.classpath.org/bugzilla/show_bug.cgi?id=518</a> <a href="http://icedtea.classpath.org/bugzilla/show_bug.cgi?id=863">http://icedtea.classpath.org/bugzilla/show_bug.cgi?id=863</a> <a href="http://icedtea.classpath.org/hg/release/icedtea-web-1.2/rev/d7375e2a9076">http://icedtea.classpath.org/hg/release/icedtea-web-1.2/rev/d7375e2a9076</a> <a href="http://icedtea.classpath.org/hg/release/icedtea-web-1.2/rev/d65bd94e0ba9">http://icedtea.classpath.org/hg/release/icedtea-web-1.2/rev/d65bd94e0ba9</a>
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| redhat/icedtea-web | <1.1.6 | 1.1.6 |
| redhat/icedtea-web | <1.2.1 | 1.2.1 |
| Red Hat IcedTea-Web | <=1.2 | |
| Red Hat IcedTea-Web | =1.0 | |
| Red Hat IcedTea-Web | =1.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://icedtea.classpath.org/bugzilla/show_bug.cgi?id=518
- http://icedtea.classpath.org/bugzilla/show_bug.cgi?id=863
- http://icedtea.classpath.org/hg/release/icedtea-web-1.2/rev/d7375e2a9076
- http://icedtea.classpath.org/hg/release/icedtea-web-1.2/rev/d65bd94e0ba9
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=844770
- http://mail.openjdk.java.net/pipermail/distro-pkg-dev/2012-July/019580.html
- https://rhn.redhat.com/errata/RHSA-2012-1132.html
- https://bugzilla.redhat.com/show_bug.cgi?id=841345
- http://icedtea.classpath.org/hg/release/icedtea-web-1.2/file/icedtea-web-1.2.1/NEWS
- http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00003.html
- http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00004.html
- http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00005.html
- http://lists.opensuse.org/opensuse-security-announce/2013-05/msg00020.html
- http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00013.html
- http://lists.opensuse.org/opensuse-updates/2013-05/msg00032.html
- http://lists.opensuse.org/opensuse-updates/2013-06/msg00030.html
- http://lists.opensuse.org/opensuse-updates/2013-06/msg00101.html
- http://rhn.redhat.com/errata/RHSA-2012-1132.html
- http://secunia.com/advisories/50089
- http://security.gentoo.org/glsa/glsa-201406-32.xml
- http://www.ubuntu.com/usn/USN-1521-1
Frequently Asked Questions
What is the severity of CVE-2012-3423?
CVE-2012-3423 has a medium severity rating due to potential security implications when dealing with untrusted input.
How do I fix CVE-2012-3423?
To fix CVE-2012-3423, update IcedTea-Web to version 1.1.6 or 1.2.1 or higher.
What software is affected by CVE-2012-3423?
CVE-2012-3423 affects versions of IcedTea-Web prior to 1.1.6 and 1.2.1.
Can CVE-2012-3423 lead to application crashes?
Yes, CVE-2012-3423 can cause application crashes if non-NUL terminated strings are processed.
Is CVE-2012-3423 specific to any web browsers?
CVE-2012-3423 can affect any web browser that utilizes the IcedTea-Web plugin which fails to handle NPVariant NPStrings correctly.
- collector/redhat-bugzilla
- alias/CVE-2012-3423
- agent/type
- agent/first-publish-date
- agent/last-modified-date
- agent/remedy
- collector/nvd-index
- agent/software-canonical-lookup-request
- agent/author
- agent/references
- agent/severity
- agent/weakness
- agent/tags
- agent/softwarecombine
- agent/description
- agent/event
- package-manager/redhat
- vendor/redhat
- canonical/red hat icedtea-web
- version/red hat icedtea-web/1.2
- version/red hat icedtea-web/1.0
- version/red hat icedtea-web/1.1