PT-2012-5471 · Icedtea+3 · Icedtea-Web+3

Arthur Gerkis

·

Publicado

2012-11-07

·

Atualizado

2018-10-30

·

CVE-2012-4540

CVSS v2.0

6.8

Média

VetorAV:N/AC:M/Au:N/C:P/I:P/A:P
Name of the Vulnerable Software and Affected Versions IcedTea-Web versions 1.1.x through 1.1.6 IcedTea-Web versions 1.2.x through 1.2.1 IcedTea-Web versions 1.3.x through 1.3.0 IcedTea-Web versions 1.4.x through 1.4.0
Description The issue is related to an off-by-one error in the invoke function, which can be triggered by a crafted webpage. This can lead to a heap-based buffer overflow, allowing remote attackers to obtain sensitive information, cause a denial of service, or possibly execute arbitrary code.
Recommendations For versions 1.1.x, update to version 1.1.7 or later. For versions 1.2.x, update to version 1.2.2 or later. For versions 1.3.x, update to version 1.3.1 or later. For versions 1.4.x, update to version 1.4.1 or later.

Correção

DoS

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-189

Identificadores relacionados

CESA-2012_1434
CVE-2012-4540
DSA-2768-1
OPENSUSE-SU-2015_1595-1
OPENSUSE-SU-2024:10316-1
RHSA-2012:1434
RHSA-2012_1434
SUSE-SU-2012_1511-1
SUSE-SU-2013_1520-1

Produtos afetados

Centos
Icedtea-Web
Red Hat
Suse