CVE-2013-1926: Medium severity red hat icedtea-web vulnerability
It was discovered that IcedTea-Web browser plugin incorrectly used the same class loader for applets with the same codebase paths. The default and commonly used codebase value is ".". A malicious applet could use this flaw to gain information about or possibly manipulate other applets currently running in the browser. This could possibly lead to malicious applet's code being executed as part of the other applet.
Other sources
The IcedTea-Web plugin before 1.2.3 and 1.3.x before 1.3.2 uses the same class loader for applets with the same codebase path but from different domains, which allows remote attackers to obtain sensitive information or possibly alter other applets via a crafted applet.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2013-1926?
CVE-2013-1926 has a medium severity rating, indicating potential access and information exposure risks.
How do I fix CVE-2013-1926?
To fix CVE-2013-1926, update IcedTea-Web to version 1.2.3 or 1.3.2 or higher.
What systems are affected by CVE-2013-1926?
CVE-2013-1926 affects various versions of the IcedTea-Web plugin from Red Hat and Ubuntu systems.
What is the impact of CVE-2013-1926?
The impact of CVE-2013-1926 includes the risk of malicious applets potentially gaining unauthorized access to information from other applets.
Is CVE-2013-1926 still a concern for users?
Yes, CVE-2013-1926 remains a concern for users running outdated versions of IcedTea-Web, especially in susceptible environments.