Bug 483198 – <dev-java/icedtea-web-1.3.2 : Multiple vulnerabilities (CVE-2013-{1926,1927})

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description GLSAMaker/CVETool Bot 2013-08-31 21:48:25 UTC]

CVE-2013-1927 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-1927):
  The IcedTea-Web plugin before 1.2.3 and 1.3.x before 1.3.2 allows remote
  attackers to execute arbitrary code via a crafted file that validates as
  both a GIF and a Java JAR file, aka "GIFAR."

CVE-2013-1926 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-1926):
  The IcedTea-Web plugin before 1.2.3 and 1.3.x before 1.3.2 uses the same
  class loader for applets with the same codebase path but from different
  domains, which allows remote attackers to obtain sensitive information or
  possibly alter other applets via a crafted applet.


Looks like all we need to do here is cleanup.

[Comment 1 Agostino Sarubbo 2013-08-31 21:56:30 UTC]

1.2.3 is not anymore in the tree

[Comment 2 Yury German 2013-12-30 06:10:56 UTC]

Ping!

Maintainer(s), please drop the vulnerable version.

[Comment 3 Tom Wijsman (TomWij) (RETIRED) 2013-12-30 17:23:56 UTC]

Dropped 1.3.1*; since the summary change is odd, do we need to drop 1.3.2*?

+  30 Dec 2013; Tom Wijsman <[e-mail]> -icedtea-web-1.3.1-r7.ebuild,
+  -icedtea-web-1.3.1.ebuild, metadata.xml:
+  Dropped vulnerable 1.3.1* (and unused local USE-descriptions gtk2 and gtk3)
+  for security bug #483198.

[Comment 4 Agostino Sarubbo 2013-12-30 19:42:38 UTC]

(In reply to Tom Wijsman (TomWij) from comment #3)
> Dropped 1.3.1*; since the summary change is odd, do we need to drop 1.3.2*?
The change is not odd. This is fine as-is. Thanks for the cleanup.

Closing as noglsa.