NVD

Id
45916  
Name
CVE-2012-4540  
Description
Off-by-one error in the invoke function in IcedTeaScriptablePluginObject.cc in IcedTea-Web 1.1.x before 1.1.7, 1.2.x before 1.2.2, 1.3.x before 1.3.1, and 1.4.x before 1.4.1 allows remote attackers to obtain sensitive information, cause a denial of service (crash), or possibly execute arbitrary code via a crafted webpage that triggers a heap-based buffer overflow, related to an error message and a "triggering event attached to applet." NOTE: the 1.4.x versions were originally associated with CVE-2013-4349, but that entry has been MERGED with this one.  
Reject
 
CVSS Version
2  
CVSS Score
6.8  
Severity
Medium  
CVSS Base Score
6.8  
CVSS Impact Subscore
6.4  
CVSS Exploit Subscore
8.6  
CVSS Vector
(AV:N/AC:M/Au:N/C:P/I:P/A:P)  
Pub Date
2017-01-19  
Published
2012-11-11  
Modified Date
2016-05-31  
Seq
2012-4540  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
230647 45916 CVE-2012-4540 http://icedtea.classpath.org/hg/release/icedtea-web-1.1/file/d759ec560073/NEWS  View
230648 45916 CVE-2012-4540 http://icedtea.classpath.org/hg/release/icedtea-web-1.2/rev/596a718be03f  View
230649 45916 CVE-2012-4540 http://icedtea.classpath.org/hg/release/icedtea-web-1.3/rev/e7970f3da5fe  View
230650 45916 CVE-2012-4540 openSUSE-SU-2015:1595  View
230651 45916 CVE-2012-4540 openSUSE-SU-2012:1524  View
230652 45916 CVE-2012-4540 openSUSE-SU-2013:0174  View
230653 45916 CVE-2012-4540 openSUSE-SU-2013:1509  View
230654 45916 CVE-2012-4540 openSUSE-SU-2013:1511  View
230655 45916 CVE-2012-4540 [distro-pkg-dev] 20121107 IcedTea-Web 1.1.7, 1.2.2 and 1.3.1 [security releases] released!  View
230656 45916 CVE-2012-4540 [distro-pkg-dev] 20130919 IcedTea-Web 1.4.1 released!  View
230657 45916 CVE-2012-4540 RHSA-2012:1434  View
230658 45916 CVE-2012-4540 GLSA-201406-32  View
230659 45916 CVE-2012-4540 DSA-2768  View
230660 45916 CVE-2012-4540 MDVSA-2012:171  View
230661 45916 CVE-2012-4540 [oss-security] 20121107 IcedTea-Web CVE-2012-4540  View
230662 45916 CVE-2012-4540 56434  View
230663 45916 CVE-2012-4540 62426  View
230664 45916 CVE-2012-4540 1027738  View
230665 45916 CVE-2012-4540 USN-1625-1  View
230666 45916 CVE-2012-4540 icedtea-applet-bo(79894)  View
230667 45916 CVE-2012-4540 https://bugzilla.redhat.com/show_bug.cgi?id=1007960  View
230668 45916 CVE-2012-4540 https://bugzilla.redhat.com/show_bug.cgi?id=869040  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
29605 JVNDB-2012-005312 IcedTea-Web の IcedTeaScriptablePluginObject.cc における重要な情報を取得される脆弱性 IcedTea-Web の IcedTeaScriptablePluginObject.cc 内の invoke 関数には、一つずれエラー (Off-by-One error) により、重要な情報を取得される、サービス運用妨害 (クラッシュ) 状態となる、または任意のコードを実行される脆弱性が存在します。 CVE-2012-4540 57778 CVE-2012-4540 45916 6.8 http://jvndb.jvn.jp/ja/contents/2012/JVNDB-2012-005312.html 2012-11-07 2012-12-07 View