{"id":"CVE-2013-1926","aliases":["DEBIAN-CVE-2013-1926","EUVD-2013-1920","GHSA-vwgw-5wg9-mw8j","RHSA-2013:0753","openSUSE-SU-2024:10316-1"],"status":"published","title":"The IcedTea-Web plugin before 1.2.3 and 1.3.x before 1.3.2 uses the same class loader for applets...","description":"The IcedTea-Web plugin before 1.2.3 and 1.3.x before 1.3.2 uses the same class loader for applets with the same codebase path but from different domains, which allows remote attackers to obtain sensitive information or possibly alter other applets via a crafted applet.","severity":{"version":"2.0","score":5.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.01865,"percentile":0.79426,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2013-04-29T22:00:00Z","modified":"2026-09-01T20:03:15Z","fixes":[{"ecosystem":"Debian:12","package":"icedtea-web","fixed_in":["1.3.2-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"icedtea-web","fixed_in":["1.3.2-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"icedtea-web","fixed_in":["1.3.2-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"icedtea-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.2-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"icedtea-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.2-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"icedtea-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.2-1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"icedtea-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.3-2.el6_4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"icedtea-web-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.3-2.el6_4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"icedtea-web-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.3-2.el6_4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"icedtea-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.3-2.el6_4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"icedtea-web-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.3-2.el6_4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"icedtea-web-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.3-2.el6_4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"icedtea-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.3-2.el6_4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"icedtea-web-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.3-2.el6_4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"icedtea-web-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.3-2.el6_4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"icedtea-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.3-2.el6_4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"icedtea-web-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.3-2.el6_4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"icedtea-web-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.3-2.el6_4"}]}],"bundled":2}],"products":[{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"opensuse","product":"opensuse"},{"vendor":"redhat","product":"icedtea-web"}],"references":[{"url":"http://osvdb.org/92543","tags":["vdb-entry","x_refsource_OSVDB","x_transferred","web"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2013-05/msg00020.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"http://lists.opensuse.org/opensuse-updates/2013-06/msg00034.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/83642","tags":["vdb-entry","x_refsource_XF","x_transferred","web"]},{"url":"http://www.mandriva.com/security/advisories?name=MDVSA-2013:146","tags":["vendor-advisory","x_refsource_MANDRIVA","x_transferred","advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00013.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"http://secunia.com/advisories/53109","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Vendor Advisory","advisory"]},{"url":"http://icedtea.classpath.org/hg/release/icedtea-web-1.2/rev/34b6f60ae586","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://lists.opensuse.org/opensuse-updates/2013-05/msg00032.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"http://lists.opensuse.org/opensuse-updates/2013-05/msg00003.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"http://secunia.com/advisories/53117","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Vendor Advisory","advisory"]},{"url":"http://rhn.redhat.com/errata/RHSA-2013-0753.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory"]},{"url":"http://lists.opensuse.org/opensuse-updates/2013-06/msg00101.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"http://lists.opensuse.org/opensuse-updates/2013-06/msg00030.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"http://icedtea.classpath.org/hg/release/icedtea-web-1.3/rev/25dd7c7ac39c","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://www.ubuntu.com/usn/USN-1804-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","advisory"]},{"url":"http://icedtea.classpath.org/hg/release/icedtea-web-1.2/file/icedtea-web-1.2.3/NEWS","tags":["x_refsource_CONFIRM","x_transferred","web","article"]},{"url":"http://www.securityfocus.com/bid/59281","tags":["vdb-entry","x_refsource_BID","x_transferred","web"]},{"url":"https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0123","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"http://lists.opensuse.org/opensuse-updates/2013-04/msg00106.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=916774","tags":["x_refsource_MISC","x_transferred","report"]},{"url":"http://mail.openjdk.java.net/pipermail/distro-pkg-dev/2013-April/022790.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-1926","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-vwgw-5wg9-mw8j"},{"url":"https://security-tracker.debian.org/tracker/CVE-2013-1926","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2013:0753","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=884705","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2013/rhsa-2013_0753.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2013-1926","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-1926","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2013-1927","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-1927","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-1927","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2011-2513","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2011-2514","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2011-3377","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-3422","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-3423","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-4540","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-1926","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-1927","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4349","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5234","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5235","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2013-1926","description":"The IcedTea-Web plugin before 1.2.3 and 1.3.x before 1.3.2 uses the same class loader for applets with the same codebase path but from different domains, which allows remote attackers to obtain sensitive information or possibly alter other applets via a crafted applet.","status":"published","published":"2013-04-29T22:00:00Z","modified":"2024-08-06T15:20:37.229Z","updated_at":"2026-11-02T14:34:58.534075Z"}],"euvd":[{"id":"EUVD-2013-1920","description":"The IcedTea-Web plugin before 1.2.3 and 1.3.x before 1.3.2 uses the same class loader for applets with the same codebase path but from different domains, which allows remote attackers to obtain sensitive information or possibly alter other applets via a crafted applet.","status":"published","published":"2013-04-29T22:00:00Z","modified":"2024-08-06T15:20:37Z","updated_at":"2026-11-03T01:56:40.540333Z"}],"ghsa":[{"id":"GHSA-vwgw-5wg9-mw8j","title":"The IcedTea-Web plugin before 1.2.3 and 1.3.x before 1.3.2 uses the same class loader for applets...","description":"The IcedTea-Web plugin before 1.2.3 and 1.3.x before 1.3.2 uses the same class loader for applets with the same codebase path but from different domains, which allows remote attackers to obtain sensitive information or possibly alter other applets via a crafted applet.","status":"published","published":"2022-05-14T02:11:22Z","modified":"2023-02-02T05:05:19Z","updated_at":"2026-11-02T14:52:04.117158Z"}],"nvd":[{"id":"CVE-2013-1926","description":"The IcedTea-Web plugin before 1.2.3 and 1.3.x before 1.3.2 uses the same class loader for applets with the same codebase path but from different domains, which allows remote attackers to obtain sensitive information or possibly alter other applets via a crafted applet.","status":"published","published":"2013-04-29T22:55:08.297Z","modified":"2026-06-16T23:52:24.843Z","cvss":[{"version":"2.0","score":5.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:N","level":"medium","assessor":"primary"}],"updated_at":"2026-11-02T14:02:25.704053Z"}],"osv":[{"id":"CVE-2013-1926","description":"The IcedTea-Web plugin before 1.2.3 and 1.3.x before 1.3.2 uses the same class loader for applets with the same codebase path but from different domains, which allows remote attackers to obtain sensitive information or possibly alter other applets via a crafted applet.","status":"published","published":"2013-04-29T22:55:08Z","modified":"2026-04-10T03:42:44.571412Z","updated_at":"2026-11-02T15:43:58.802805Z"},{"id":"DEBIAN-CVE-2013-1926","description":"The IcedTea-Web plugin before 1.2.3 and 1.3.x before 1.3.2 uses the same class loader for applets with the same codebase path but from different domains, which allows remote attackers to obtain sensitive information or possibly alter other applets via a crafted applet.","status":"published","published":"2013-04-29T22:55:08.297Z","modified":"2026-09-01T20:03:15.153889555Z","updated_at":"2026-11-02T15:45:25.514579Z"},{"id":"openSUSE-SU-2024:10316-1","title":"icedtea-web-javadoc-1.6.2-3.3 on GA media","description":"These are all security issues fixed in the icedtea-web-javadoc-1.6.2-3.3 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2025-05-07T18:08:40.025018Z","updated_at":"2026-11-02T16:58:33.135986Z"},{"id":"RHSA-2013:0753","title":"Red Hat Security Advisory: icedtea-web security update","status":"published","published":"2024-09-15T20:46:37Z","modified":"2026-06-26T10:21:33Z","updated_at":"2026-11-02T15:53:01.993625Z"}]}}