CVE-2012-4540
Using N/A by N/A?
Get instant alerts when new vulnerabilities affect N/A - before attackers find them.
Description
Off-by-one error in the invoke function in IcedTeaScriptablePluginObject.cc in IcedTea-Web 1.1.x before 1.1.7, 1.2.x before 1.2.2, 1.3.x before 1.3.1, and 1.4.x before 1.4.1 allows remote attackers to obtain sensitive information, cause a denial of service (crash), or possibly execute arbitrary code via a crafted webpage that triggers a heap-based buffer overflow, related to an error message and a "triggering event attached to applet." NOTE: the 1.4.x versions were originally associated with CVE-2013-4349, but that entry has been MERGED with this one.
Remediation
No guide yetNo remediation guidance has been written for this CVE yet. What the record does show:
Patch and advisory references
- http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00019.html
- http://lists.opensuse.org/opensuse-updates/2012-11/msg00040.html
- http://lists.opensuse.org/opensuse-updates/2013-01/msg00065.html
- http://lists.opensuse.org/opensuse-updates/2013-09/msg00071.html
- http://lists.opensuse.org/opensuse-updates/2013-09/msg00073.html
References (25)
Quick Info
Get alerted
Stop reading CVE feeds looking for your own stack
Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.