From http://www.openwall.com/lists/oss-security/2012/11/07/5 :
IcedTea-Web versions 1.1.7, 1.2.2 and 1.3.1 that were just released fix
a buffer overflow IcedTeaScriptableJavaObject::invoke. The issue got
Off-by-one error in the invoke function in IcedTeaScriptablePluginObject.cc
in IcedTea-Web 1.1.x before 1.1.7, 1.2.x before 1.2.2, and 1.3.x before
1.3.1 allows remote attackers to obtain sensitive information, cause a
denial of service (crash), or possibly execute arbitrary code via a crafted
webpage that triggers a heap-based buffer overflow, related to an error
message and a "triggering event attached to applet."
icedtea-web bumped to 1.3.1
nsplugin part of icedtea-bin built and bumped
Please stabilize dev-java/icedtea-bin-220.127.116.11-r1
(test the nsplugin, the rest is unchanged from -r0)
There is no dev-java/icedtea-bin-18.104.22.168-r1 in portage as of now!?
(In reply to comment #3)
> There is no dev-java/icedtea-bin-22.214.171.124-r1 in portage as of now!?
Sorry, it was 126.96.36.199-r1
(In reply to comment #5)
> (In reply to comment #3)
> > There is no dev-java/icedtea-bin-188.8.131.52-r1 in portage as of now!?
> Sorry, it was 184.108.40.206-r1
I know, I did it correctly:
16 Nov 2012; Agostino Sarubbo <firstname.lastname@example.org>
Stable for amd64, wrt bug #442478
Already on existing GLSA draft.
I'm just going to close this since no one cares. These versions have long gone.