CVE-2011-3377
The web browser plug-in in IcedTea-Web 1.0.x before 1.0.6 and 1.1.x before 1.1.4 allows remote...
CVE-2011-3377 is a medium vulnerability (CVSS 4.3) in Redhat Icedtea-web, published February 28, 2012. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.22%, the 82nd percentile. Fixed in icedtea-web 1.1.4-1.
- Severity
- 4.3 MediumCVSS 2.0, NVD
- Exploit chance
- 2.22%EPSS, 82nd percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
1.1.4-1icedtea-web +6 more
Description
The web browser plug-in in IcedTea-Web 1.0.x before 1.0.6 and 1.1.x before 1.1.4 allows remote attackers to bypass the Same Origin Policy (SOP) and execute arbitrary script or establish network connections to unintended hosts via an applet whose origin has the same second-level domain, but a different sub-domain than the targeted domain.
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
icedtea-webDebian:12 | before 1.1.4-1 | 1.1.4-1 |
icedtea-webDebian:13 | before 1.1.4-1 | 1.1.4-1 |
icedtea-webDebian:14 | before 1.1.4-1 | 1.1.4-1 |
openjdk-6Debian:6.0 From an advisory covering 10 CVEs | before 6b18-1.8.13-0+squeeze1, plus listed versions 6b18-1.8.10-0+squeeze16b18-1.8.10-0+squeeze26b18-1.8.10-0~lenny16b18-1.8.10-0~lenny26b18-1.8.3-2 Show 12 moreShow less6b18-1.8.3-2+squeeze16b18-1.8.4-16b18-1.8.5-16b18-1.8.7-16b18-1.8.7-26b18-1.8.7-2~lenny16b18-1.8.7-2~squeeze16b18-1.8.7-36b18-1.8.7-46b18-1.8.7-56b18-1.8.9-0.16b18-1.8.9-0.1~squeeze1 | 6b18-1.8.13-0+squeeze1 |
icedtea-webRed Hat:enterprise_linux:6::server | before 0:1.0.6-1.el6_1 | 0:1.0.6-1.el6_1 |
icedtea-web-debuginfoRed Hat:enterprise_linux:6::server | before 0:1.0.6-1.el6_1 | 0:1.0.6-1.el6_1 |
icedtea-web-javadocRed Hat:enterprise_linux:6::server | before 0:1.0.6-1.el6_1 | 0:1.0.6-1.el6_1 |
What each source reports
NVD Score used
The web browser plug-in in IcedTea-Web 1.0.x before 1.0.6 and 1.1.x before 1.1.4 allows remote attackers to bypass the Same Origin Policy (SOP) and execute arbitrary script or establish network connections to unintended hosts via an applet whose origin has the same second-level domain, but a different sub-domain than the targeted domain.
- Record
CVE-2011-3377- CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:N - Weakness
- CWE-264
- Updated
- 2026-11-02
CVE ListNo score
The web browser plug-in in IcedTea-Web 1.0.x before 1.0.6 and 1.1.x before 1.1.4 allows remote attackers to bypass the Same Origin Policy (SOP) and execute arbitrary script or establish network connections to unintended hosts via an applet whose origin has the same second-level domain, but a different sub-domain than the targeted domain.
- Record
CVE-2011-3377- Updated
- 2026-11-02
EUVDEUVD-2011-3340No score
The web browser plug-in in IcedTea-Web 1.0.x before 1.0.6 and 1.1.x before 1.1.4 allows remote attackers to bypass the Same Origin Policy (SOP) and execute arbitrary script or establish network connections to unintended hosts via an applet whose origin has the same second-level domain, but a different sub-domain than the targeted domain.
- Record
EUVD-2011-3340- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-cqp6-h2hr-w9xjNo score
The web browser plug-in in IcedTea-Web 1.0.x before 1.0.6 and 1.1.x before 1.1.4 allows remote...
The web browser plug-in in IcedTea-Web 1.0.x before 1.0.6 and 1.1.x before 1.1.4 allows remote attackers to bypass the Same Origin Policy (SOP) and execute arbitrary script or establish network connections to unintended hosts via an applet whose origin has the same second-level domain, but a different sub-domain than the targeted domain.
- Record
GHSA-cqp6-h2hr-w9xj- Updated
- 2026-11-02
OSVNo score
The web browser plug-in in IcedTea-Web 1.0.x before 1.0.6 and 1.1.x before 1.1.4 allows remote attackers to bypass the Same Origin Policy (SOP) and execute arbitrary script or establish network connections to unintended hosts via an applet whose origin has the same second-level domain, but a different sub-domain than the targeted domain.
- Record
CVE-2011-3377- Updated
- 2026-11-02
OSVDEBIAN-CVE-2011-3377No score
The web browser plug-in in IcedTea-Web 1.0.x before 1.0.6 and 1.1.x before 1.1.4 allows remote attackers to bypass the Same Origin Policy (SOP) and execute arbitrary script or establish network connections to unintended hosts via an applet whose origin has the same second-level domain, but a different sub-domain than the targeted domain.
- Record
DEBIAN-CVE-2011-3377- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10316-1No score
icedtea-web-javadoc-1.6.2-3.3 on GA media
These are all security issues fixed in the icedtea-web-javadoc-1.6.2-3.3 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10316-1- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
bugzilla.redhat.com/show_bug.cgi?id=742515
rhn.redhat.com/errata/RHSA-2011-1441.html
dbhole.wordpress.com/2011/11/08/icedtea-web-1-0-6-and-1-1-4-security-releases-released
osvdb.org/76940
lists.opensuse.org/opensuse-updates/2012-03/msg00028.html
debian.org/security/2012/dsa-2420
Show 21 moreShow less
securityfocus.com/bid/50610
ubuntu.com/usn/USN-1263-1
nvd.nist.gov/vuln/detail/CVE-2011-3377
github.com/advisories/GHSA-cqp6-h2hr-w9xj
security-tracker.debian.org/tracker/CVE-2011-3377
access.redhat.com/errata/RHSA-2011:1441
security.access.redhat.com/data/csaf/v2/advisories/2011/rhsa-2011_1441.json
cve.org/CVERecord?id=CVE-2011-3377
suse.com/security/cve/CVE-2011-2513