CVE-2011-3377

NameCVE-2011-3377
DescriptionThe web browser plug-in in IcedTea-Web 1.0.x before 1.0.6 and 1.1.x before 1.1.4 allows remote attackers to bypass the Same Origin Policy (SOP) and execute arbitrary script or establish network connections to unintended hosts via an applet whose origin has the same second-level domain, but a different sub-domain than the targeted domain.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
ReferencesDSA-2420-1
NVD severitymedium

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
icedtea-web (PTS)jessie1.5.3-1fixed
jessie (security)1.5.3-1+deb8u1fixed
stretch1.6.2-3.1+deb9u1fixed
buster1.7.2-2fixed
bullseye, sid1.8.3-2fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
icedtea-websource(unstable)1.1.4-1
openjdk-6source(unstable)6b21~pre1-1
openjdk-6sourcesqueeze6b18-1.8.13-0+squeeze1DSA-2420-1

Notes

Browser plugin was removed in openjdk-6 6b21~pre1-1.

Search for package or bug name: Reporting problems