PT-2014-3140 · Icedtea+1 · Icedtea-Web+1

Murray Mcallister · Published 2014-02-10 · Updated 2014-03-19 · CVE-2013-6493

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Low

Base vector

AV:L/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions IcedTea-Web versions prior to 1.4.2

Description The issue affects the LiveConnect implementation, allowing local users to intercept communication between a Java applet and a web browser. This is achieved by pre-creating a temporary socket file with a predictable name in /tmp, enabling the user to read the messages exchanged between the applet and the browser.

Recommendations For versions prior to 1.4.2, update to version 1.4.2 or later to resolve the issue.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2013-6493

MGASA-2014-0049

SUSE-SU-2014_0397-1

Affected Products

Icedtea-Web

Suse

References · 21

• 🔥 http://icedtea.classpath.org/hg/icedtea-web/rev/228e3652214a · Exploit
• https://advisories.mageia.org/MGASA-2014-0049.html · Security Note
• https://lists.fedoraproject.org/pipermail/package-announce/2014-February/127944.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2013-6493 · Security Note
• http://ubuntu.com/usn/USN-2131-1 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6493 · Security Note
• http://secunia.com/advisories/57036 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2013-6493 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2013-6493 · Vendor Advisory
• http://lists.opensuse.org/opensuse-updates/2014-02/msg00089.html · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2013-6493 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2014-0049 · Vendor Advisory
• http://mail.openjdk.java.net/pipermail/distro-pkg-dev/2014-February/026192.html · Note
• https://bugs.mageia.org/show_bug.cgi?id=12654 · Note
• https://lists.suse.com/pipermail/sle-security-updates/2014-March/000755.html · Note