CVE-2013-6493

The LiveConnect implementation in plugin/icedteanp/IcedTeaNPPlugin.cc in IcedTea-Web before 1.4.2...

2.1 LowFix available

The LiveConnect implementation in plugin/icedteanp/IcedTeaNPPlugin.cc in IcedTea-Web before 1.4.2 allows local users to read the messages between a Java applet and a web browser by pre-creating a temporary socket file with a predictable name in /tmp.

Exploit likelihood

0.48%Down 0.6 points since Feb 4, 2022

What each source reports

NVD Score used 2.1

Record: CVE-2013-6493
CVSS 2.0: 2.1 LowAV:L/AC:L/Au:N/C:P/I:N/A:N
Weakness: CWE-200
Updated: 2026-11-02

CVE List No score

Record: CVE-2013-6493
Updated: 2026-11-02

EUVDEUVD-2013-6296 No score

Record: EUVD-2013-6296
Updated: 2026-11-03

GitHub AdvisoriesGHSA-5rjx-hhcc-fqph No score

The LiveConnect implementation in plugin/icedteanp/IcedTeaNPPlugin.cc in IcedTea-Web before 1.4.2...

Record: GHSA-5rjx-hhcc-fqph
Weakness: CWE-200
Updated: 2026-11-02

OSV No score

Record: CVE-2013-6493
Updated: 2026-11-02

OSVDEBIAN-CVE-2013-6493 No score

Record: DEBIAN-CVE-2013-6493
Updated: 2026-11-02

OSVMGASA-2014-0049 No score

Updated icedtea-web packages fix CVE-2013-6493

Updated icedtea-web packages fix security vulnerability:

LiveConnect provides a gateway between the JavaScript engine in the web browser and Java applets. An insecure temporary file use flaw was found in the LiveConnect implementation in the IcedTea-Web browser plug-in. A malicious, local user could possibly use this flaw to inject or read the communication between a Java applet and web browser of a different user's session (CVE-2013-6493).

Record: MGASA-2014-0049
Updated: 2026-11-02

Affected products

redhat icedtea-web

Affected packages

Affected packages
Package	Affected	Fixed
`icedtea-web` Debian:12	before 1.4.2-1	1.4.2-1
`icedtea-web` Debian:13	before 1.4.2-1	1.4.2-1
`icedtea-web` Debian:14	before 1.4.2-1	1.4.2-1
`icedtea-web` Mageia:3	before 1.4.2-1.mga3	1.4.2-1.mga3
`icedtea-web` Mageia:4	before 1.4.2-1.mga4	1.4.2-1.mga4
`icedtea-web-javadoc` Red Hat:enterprise_linux:6::client	before 0:1.5.1-1.el6	0:1.5.1-1.el6
`icedtea-web` Red Hat:enterprise_linux:6::client	before 0:1.5.1-1.el6	0:1.5.1-1.el6
`icedtea-web-debuginfo` Red Hat:enterprise_linux:6::client	before 0:1.5.1-1.el6	0:1.5.1-1.el6
`icedtea-web-javadoc` Red Hat:enterprise_linux:6::computenode	before 0:1.5.1-1.el6	0:1.5.1-1.el6
`icedtea-web` Red Hat:enterprise_linux:6::computenode	before 0:1.5.1-1.el6	0:1.5.1-1.el6

Show 7 moreShow less

Affected packages
Package	Affected	Fixed
`icedtea-web-debuginfo` Red Hat:enterprise_linux:6::computenode	before 0:1.5.1-1.el6	0:1.5.1-1.el6
`icedtea-web-javadoc` Red Hat:enterprise_linux:6::server	before 0:1.5.1-1.el6	0:1.5.1-1.el6
`icedtea-web` Red Hat:enterprise_linux:6::server	before 0:1.5.1-1.el6	0:1.5.1-1.el6
`icedtea-web-debuginfo` Red Hat:enterprise_linux:6::server	before 0:1.5.1-1.el6	0:1.5.1-1.el6
`icedtea-web-javadoc` Red Hat:enterprise_linux:6::workstation	before 0:1.5.1-1.el6	0:1.5.1-1.el6
`icedtea-web` Red Hat:enterprise_linux:6::workstation	before 0:1.5.1-1.el6	0:1.5.1-1.el6
`icedtea-web-debuginfo` Red Hat:enterprise_linux:6::workstation	before 0:1.5.1-1.el6	0:1.5.1-1.el6

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2013-6493 is a low vulnerability (CVSS 2.1) in Redhat Icedtea-web, published February 10, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.48%, the 41st percentile. Fixed in icedtea-web 1.4.2-1.

References

Show 11 moreShow less