CVE-2013-1926
The IcedTea-Web plugin before 1.2.3 and 1.3.x before 1.3.2 uses the same class loader for applets...
The IcedTea-Web plugin before 1.2.3 and 1.3.x before 1.3.2 uses the same class loader for applets with the same codebase path but from different domains, which allows remote attackers to obtain sensitive information or possibly alter other applets via a crafted applet.
Exploit likelihood
What each source reports
NVD Score used
The IcedTea-Web plugin before 1.2.3 and 1.3.x before 1.3.2 uses the same class loader for applets with the same codebase path but from different domains, which allows remote attackers to obtain sensitive information or possibly alter other applets via a crafted applet.
- Record
CVE-2013-1926- CVSS 2.0
- 5.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:N - Updated
- 2026-11-02
CVE List No score
The IcedTea-Web plugin before 1.2.3 and 1.3.x before 1.3.2 uses the same class loader for applets with the same codebase path but from different domains, which allows remote attackers to obtain sensitive information or possibly alter other applets via a crafted applet.
- Record
CVE-2013-1926- Updated
- 2026-11-02
EUVDEUVD-2013-1920 No score
The IcedTea-Web plugin before 1.2.3 and 1.3.x before 1.3.2 uses the same class loader for applets with the same codebase path but from different domains, which allows remote attackers to obtain sensitive information or possibly alter other applets via a crafted applet.
- Record
EUVD-2013-1920- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-vwgw-5wg9-mw8j No score
The IcedTea-Web plugin before 1.2.3 and 1.3.x before 1.3.2 uses the same class loader for applets...
The IcedTea-Web plugin before 1.2.3 and 1.3.x before 1.3.2 uses the same class loader for applets with the same codebase path but from different domains, which allows remote attackers to obtain sensitive information or possibly alter other applets via a crafted applet.
- Record
GHSA-vwgw-5wg9-mw8j- Updated
- 2026-11-02
OSV No score
The IcedTea-Web plugin before 1.2.3 and 1.3.x before 1.3.2 uses the same class loader for applets with the same codebase path but from different domains, which allows remote attackers to obtain sensitive information or possibly alter other applets via a crafted applet.
- Record
CVE-2013-1926- Updated
- 2026-11-02
OSVDEBIAN-CVE-2013-1926 No score
The IcedTea-Web plugin before 1.2.3 and 1.3.x before 1.3.2 uses the same class loader for applets with the same codebase path but from different domains, which allows remote attackers to obtain sensitive information or possibly alter other applets via a crafted applet.
- Record
DEBIAN-CVE-2013-1926- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10316-1 No score
icedtea-web-javadoc-1.6.2-3.3 on GA media
These are all security issues fixed in the icedtea-web-javadoc-1.6.2-3.3 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10316-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
icedtea-webDebian:12 |
before 1.3.2-1 | 1.3.2-1 |
icedtea-webDebian:13 |
before 1.3.2-1 | 1.3.2-1 |
icedtea-webDebian:14 |
before 1.3.2-1 | 1.3.2-1 |
icedtea-webRed Hat:enterprise_linux:6::client From an advisory covering 2 CVEs |
before 0:1.2.3-2.el6_4 | 0:1.2.3-2.el6_4 |
icedtea-web-debuginfoRed Hat:enterprise_linux:6::client From an advisory covering 2 CVEs |
before 0:1.2.3-2.el6_4 | 0:1.2.3-2.el6_4 |
icedtea-web-javadocRed Hat:enterprise_linux:6::client From an advisory covering 2 CVEs |
before 0:1.2.3-2.el6_4 | 0:1.2.3-2.el6_4 |
icedtea-webRed Hat:enterprise_linux:6::computenode From an advisory covering 2 CVEs |
before 0:1.2.3-2.el6_4 | 0:1.2.3-2.el6_4 |
icedtea-web-debuginfoRed Hat:enterprise_linux:6::computenode From an advisory covering 2 CVEs |
before 0:1.2.3-2.el6_4 | 0:1.2.3-2.el6_4 |
icedtea-web-javadocRed Hat:enterprise_linux:6::computenode From an advisory covering 2 CVEs |
before 0:1.2.3-2.el6_4 | 0:1.2.3-2.el6_4 |
icedtea-webRed Hat:enterprise_linux:6::server From an advisory covering 2 CVEs |
before 0:1.2.3-2.el6_4 | 0:1.2.3-2.el6_4 |
Show 5 moreShow less
| Package | Affected | Fixed |
|---|---|---|
icedtea-web-debuginfoRed Hat:enterprise_linux:6::server From an advisory covering 2 CVEs |
before 0:1.2.3-2.el6_4 | 0:1.2.3-2.el6_4 |
icedtea-web-javadocRed Hat:enterprise_linux:6::server From an advisory covering 2 CVEs |
before 0:1.2.3-2.el6_4 | 0:1.2.3-2.el6_4 |
icedtea-webRed Hat:enterprise_linux:6::workstation From an advisory covering 2 CVEs |
before 0:1.2.3-2.el6_4 | 0:1.2.3-2.el6_4 |
icedtea-web-debuginfoRed Hat:enterprise_linux:6::workstation From an advisory covering 2 CVEs |
before 0:1.2.3-2.el6_4 | 0:1.2.3-2.el6_4 |
icedtea-web-javadocRed Hat:enterprise_linux:6::workstation From an advisory covering 2 CVEs |
before 0:1.2.3-2.el6_4 | 0:1.2.3-2.el6_4 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2013-1926 is a medium vulnerability (CVSS 5.8) in Redhat Icedtea-web, published April 29, 2013. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.86%, the 79th percentile. Fixed in icedtea-web 1.3.2-1.
References
osvdb.org/92543
lists.opensuse.org/opensuse-security-announce/2013-05/msg00020.html
exchange.xforce.ibmcloud.com/vulnerabilities/83642
mandriva.com/security/advisories?name=MDVSA-2013:146
Show 39 moreShow less
secunia.com/advisories/53109
icedtea.classpath.org/hg/release/icedtea-web-1.2/rev/34b6f60ae586
rhn.redhat.com/errata/RHSA-2013-0753.html
ubuntu.com/usn/USN-1804-1
securityfocus.com/bid/59281
wiki.mageia.org/en/Support/Advisories/MGASA-2013-0123
bugzilla.redhat.com/show_bug.cgi?id=916774
mail.openjdk.java.net/pipermail/distro-pkg-dev/2013-April/022790.html
nvd.nist.gov/vuln/detail/CVE-2013-1926
github.com/advisories/GHSA-vwgw-5wg9-mw8j
security-tracker.debian.org/tracker/CVE-2013-1926
access.redhat.com/errata/RHSA-2013:0753
security.access.redhat.com/data/csaf/v2/advisories/2013/rhsa-2013_0753.json
cve.org/CVERecord?id=CVE-2013-1926
suse.com/security/cve/CVE-2011-2513