CVE-2011-3377
The web browser plug-in in IcedTea-Web 1.0.x before 1.0.6 and 1.1.x before 1.1.4 allows remote...
CVE-2011-3377 is a medium vulnerability (CVSS 4.3) in Redhat Icedtea-web, published February 28, 2012. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.22%, the 82nd percentile. Fixed in icedtea-web 1.1.4-1.
The web browser plug-in in IcedTea-Web 1.0.x before 1.0.6 and 1.1.x before 1.1.4 allows remote attackers to bypass the Same Origin Policy (SOP) and execute arbitrary script or establish network connections to unintended hosts via an applet whose origin has the same second-level domain, but a different sub-domain than the targeted domain.
Exploit likelihood
What each source reports
NVD Score used
The web browser plug-in in IcedTea-Web 1.0.x before 1.0.6 and 1.1.x before 1.1.4 allows remote attackers to bypass the Same Origin Policy (SOP) and execute arbitrary script or establish network connections to unintended hosts via an applet whose origin has the same second-level domain, but a different sub-domain than the targeted domain.
- Record
CVE-2011-3377- CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:N - Weakness
- CWE-264
- Updated
- 2026-11-02
CVE List No score
The web browser plug-in in IcedTea-Web 1.0.x before 1.0.6 and 1.1.x before 1.1.4 allows remote attackers to bypass the Same Origin Policy (SOP) and execute arbitrary script or establish network connections to unintended hosts via an applet whose origin has the same second-level domain, but a different sub-domain than the targeted domain.
- Record
CVE-2011-3377- Updated
- 2026-11-02
EUVDEUVD-2011-3340 No score
The web browser plug-in in IcedTea-Web 1.0.x before 1.0.6 and 1.1.x before 1.1.4 allows remote attackers to bypass the Same Origin Policy (SOP) and execute arbitrary script or establish network connections to unintended hosts via an applet whose origin has the same second-level domain, but a different sub-domain than the targeted domain.
- Record
EUVD-2011-3340- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-cqp6-h2hr-w9xj No score
The web browser plug-in in IcedTea-Web 1.0.x before 1.0.6 and 1.1.x before 1.1.4 allows remote...
The web browser plug-in in IcedTea-Web 1.0.x before 1.0.6 and 1.1.x before 1.1.4 allows remote attackers to bypass the Same Origin Policy (SOP) and execute arbitrary script or establish network connections to unintended hosts via an applet whose origin has the same second-level domain, but a different sub-domain than the targeted domain.
- Record
GHSA-cqp6-h2hr-w9xj- Updated
- 2026-11-02
OSV No score
The web browser plug-in in IcedTea-Web 1.0.x before 1.0.6 and 1.1.x before 1.1.4 allows remote attackers to bypass the Same Origin Policy (SOP) and execute arbitrary script or establish network connections to unintended hosts via an applet whose origin has the same second-level domain, but a different sub-domain than the targeted domain.
- Record
CVE-2011-3377- Updated
- 2026-11-02
OSVDEBIAN-CVE-2011-3377 No score
The web browser plug-in in IcedTea-Web 1.0.x before 1.0.6 and 1.1.x before 1.1.4 allows remote attackers to bypass the Same Origin Policy (SOP) and execute arbitrary script or establish network connections to unintended hosts via an applet whose origin has the same second-level domain, but a different sub-domain than the targeted domain.
- Record
DEBIAN-CVE-2011-3377- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10316-1 No score
icedtea-web-javadoc-1.6.2-3.3 on GA media
These are all security issues fixed in the icedtea-web-javadoc-1.6.2-3.3 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10316-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
icedtea-webDebian:12 |
before 1.1.4-1 | 1.1.4-1 |
icedtea-webDebian:13 |
before 1.1.4-1 | 1.1.4-1 |
icedtea-webDebian:14 |
before 1.1.4-1 | 1.1.4-1 |
openjdk-6Debian:6.0 |
before 6b18-1.8.13-0+squeeze1, plus listed versions 6b18-1.8.10-0+squeeze16b18-1.8.10-0+squeeze26b18-1.8.10-0~lenny16b18-1.8.10-0~lenny26b18-1.8.3-2 Show 12 moreShow less6b18-1.8.3-2+squeeze16b18-1.8.4-16b18-1.8.5-16b18-1.8.7-16b18-1.8.7-26b18-1.8.7-2~lenny16b18-1.8.7-2~squeeze16b18-1.8.7-36b18-1.8.7-46b18-1.8.7-56b18-1.8.9-0.16b18-1.8.9-0.1~squeeze1 |
6b18-1.8.13-0+squeeze1 |
icedtea-webRed Hat:enterprise_linux:6::server |
before 0:1.0.6-1.el6_1 | 0:1.0.6-1.el6_1 |
icedtea-web-debuginfoRed Hat:enterprise_linux:6::server |
before 0:1.0.6-1.el6_1 | 0:1.0.6-1.el6_1 |
icedtea-web-javadocRed Hat:enterprise_linux:6::server |
before 0:1.0.6-1.el6_1 | 0:1.0.6-1.el6_1 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
bugzilla.redhat.com/show_bug.cgi?id=742515
rhn.redhat.com/errata/RHSA-2011-1441.html
dbhole.wordpress.com/2011/11/08/icedtea-web-1-0-6-and-1-1-4-security-releases-released
osvdb.org/76940
lists.opensuse.org/opensuse-updates/2012-03/msg00028.html
debian.org/security/2012/dsa-2420
Show 21 moreShow less
securityfocus.com/bid/50610
ubuntu.com/usn/USN-1263-1
nvd.nist.gov/vuln/detail/CVE-2011-3377
github.com/advisories/GHSA-cqp6-h2hr-w9xj
security-tracker.debian.org/tracker/CVE-2011-3377
access.redhat.com/errata/RHSA-2011:1441
security.access.redhat.com/data/csaf/v2/advisories/2011/rhsa-2011_1441.json
cve.org/CVERecord?id=CVE-2011-3377
suse.com/security/cve/CVE-2011-2513