← Back

CVE-2011-3377

nvd nist
Published: Feb 5, 2014Modified: Apr 29, 2026

JSON object

Loading...
4.3
Vector
AV:N/AC:M/Au:N/C:N/I:P/A:N
Exploitability: 8.6 / Impact: 2.9
Source: NVD

Description

The web browser plug-in in IcedTea-Web 1.0.x before 1.0.6 and 1.1.x before 1.1.4 allows remote attackers to bypass the Same Origin Policy (SOP) and execute arbitrary script or establish network connections to unintended hosts via an applet whose origin has the same second-level domain, but a different sub-domain than the targeted domain.

Affected (15)

Redhat
1 product
Icedtea Web
Canonical
1 product
Ubuntu Linux
Opensuse
1 product
Opensuse
Configuration A
10 vulnerable
Vulnerable SoftwareAffected Versions
Redhat
Icedtea Web
Version 1.0.1
Icedtea Web
Version 1.0.2
Icedtea Web
Version 1.0.3
Icedtea Web
Version 1.0.4
Icedtea Web
Version 1.0.5
Icedtea Web
Version 1.0
Icedtea Web
Version 1.1.1
Icedtea Web
Version 1.1.2
Icedtea Web
Version 1.1.3
Icedtea Web
Version 1.1
Configuration B
5 vulnerable
Vulnerable SoftwareAffected Versions
Canonical
Ubuntu Linux
Version 10.04
Ubuntu Linux
Version 10.10
Ubuntu Linux
Version 11.04
Ubuntu Linux
Version 11.10
Opensuse
Version 12.1

Related CWEs

CWE-264
CWE-264

References (16)

Source: secalert@redhat.com
PatchVendor Advisory
Source: secalert@redhat.com
Source: secalert@redhat.com
Source: secalert@redhat.com
Source: secalert@redhat.com
Source: secalert@redhat.com
Source: secalert@redhat.com
Source: secalert@redhat.com
Source: af854a3a-2127-422b-91ae-364da2661108
PatchVendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.