openjdk team mailing list archive

Thread
Date

Bug#723118: icedtea-web: CVE-2013-4349: patch for CVE-2012-4540 not applied to 1.4 branch

To: Debian Bug Tracking System <submit@xxxxxxxxxxxxxxx>
From: Salvatore Bonaccorso <carnil@xxxxxxxxxx>
Date: Mon, 16 Sep 2013 16:57:26 -0000
Delivered-to: submit@xxxxxxxxxxxxxxx
Reply-to: Salvatore Bonaccorso <carnil@xxxxxxxxxx>, 723118@xxxxxxxxxxxxxxx
Resent-cc: carnil@xxxxxxxxxx, team@xxxxxxxxxxxxxxxxxxx, secure-testing-team@xxxxxxxxxxxxxxxxxxxxxxx, OpenJDK Team <openjdk@xxxxxxxxxxxxxxxxxxx>
Resent-date: Mon, 16 Sep 2013 16:57:14 +0000
Resent-from: Salvatore Bonaccorso <carnil@xxxxxxxxxx>
Resent-message-id: <handler.723118.B.137935061330567@xxxxxxxxxxxxxxx>
Resent-sender: Debian BTS <debbugs@xxxxxxxxxxxxxxxxxxxx>
Resent-to: debian-bugs-dist@xxxxxxxxxxxxxxxx

Package: icedtea-web
Version: 1.4-3~deb7u1
Severity: grave
Tags: security upstream patch fixed-upstream
Control: found -1 1.4-3

Hi

the following vulnerability was published for icedtea-web.

CVE-2013-4349[0]:
IcedTeaScriptableJavaObject::invoke off-by-one heap-based buffer overflow

This previously was already fixed in 1.1, 1.2, and 1.3 IcedTea-Web
branches (this was CVE-2012-4540). But this did not get applied to
head at that time.

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] http://security-tracker.debian.org/tracker/CVE-2013-4349
[1] http://icedtea.classpath.org/hg/release/icedtea-web-1.4/rev/82e007d8b05a

Regards,
Salvatore