Bug 9779 - icedtea-web new security issues CVE-2013-1926 and CVE-2013-1927
: icedtea-web new security issues CVE-2013-1926 and CVE-2013-1927
Status: RESOLVED FIXED
Product: Mageia
Classification: Unclassified
Component: Security
: 2
: i586 Linux
: Normal Severity: major
: ---
Assigned To: QA Team
: Sec team
: http://lwn.net/Vulnerabilities/547754/
: MGA2-64-OK MGA2-32-OK
: validated_update
:
:
  Show dependency treegraph
 
Reported: 2013-04-17 20:40 CEST by David Walser
Modified: 2013-04-18 21:09 CEST (History)
3 users (show)

See Also:
Source RPM: icedtea-web-1.3.1-1.mga2.src.rpm
CVE:
Status comment:


Attachments

Description David Walser 2013-04-17 20:40:03 CEST
RedHat has issued an advisory today (April 17):
https://rhn.redhat.com/errata/RHSA-2013-0753.html

Updated packages uploaded for Mageia 2 and Cauldron.

Advisory:
========================

Updated icedtea-web packages fix security vulnerabilities:

It was discovered that the IcedTea-Web plug-in incorrectly used the same
class loader instance for applets with the same value of the codebase
attribute, even when they originated from different domains. A malicious
applet could use this flaw to gain information about and possibly
manipulate applets from different domains currently running in the browser
(CVE-2013-1926).

The IcedTea-Web plug-in did not properly check the format of the downloaded
Java Archive (JAR) files. This could cause the plug-in to execute code
hidden in a file in a different format, possibly allowing attackers to
execute code in the context of web sites that allow uploads of specific
file types, known as a GIFAR attack (CVE-2013-1927).

References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1926
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1927
http://mail.openjdk.java.net/pipermail/distro-pkg-dev/2013-April/022790.html
https://rhn.redhat.com/errata/RHSA-2013-0753.html
========================

Updated packages in core/updates_testing:
========================
icedtea-web-1.3.2-1.mga2
icedtea-web-javadoc-1.3.2-1.mga2

from icedtea-web-1.3.2-1.mga2.src.rpm

Reproducible: 

Steps to Reproduce:
Comment 1 Dave Hodgins 2013-04-17 23:19:52 CEST
Testing complete on Mageia 2 i586 and x86_64.

Could someone from the sysadmin team push the srpm
icedtea-web-1.3.2-1.mga2.src.rpm
from Mageia 2 Core Updates Testing to Core Updates.

Advisory: Updated icedtea-web packages fix security vulnerabilities:

It was discovered that the IcedTea-Web plug-in incorrectly used the same
class loader instance for applets with the same value of the codebase
attribute, even when they originated from different domains. A malicious
applet could use this flaw to gain information about and possibly
manipulate applets from different domains currently running in the browser
(CVE-2013-1926).

The IcedTea-Web plug-in did not properly check the format of the downloaded
Java Archive (JAR) files. This could cause the plug-in to execute code
hidden in a file in a different format, possibly allowing attackers to
execute code in the context of web sites that allow uploads of specific
file types, known as a GIFAR attack (CVE-2013-1927).

References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1926
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1927
http://mail.openjdk.java.net/pipermail/distro-pkg-dev/2013-April/022790.html
https://rhn.redhat.com/errata/RHSA-2013-0753.html

https://bugs.mageia.org/show_bug.cgi?id=9779
Comment 2 Thomas Backlund 2013-04-18 00:34:44 CEST
Update pushed:
https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0123

Note You need to log in before you can comment on or make changes to this bug.