CVE-2013-1927

icedtea-web: GIFAR issue

Severity Score

6.8

*CVSS v2

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

The IcedTea-Web plugin before 1.2.3 and 1.3.x before 1.3.2 allows remote attackers to execute arbitrary code via a crafted file that validates as both a GIF and a Java JAR file, aka "GIFAR."

El plugin IcedTea-Web antes de v1.2.3 y v1.3.x antes de v1.3.2 permite a atacantes remotos ejecutar código de su elección a través de un archivo creado para tal fin que valida tanto como archivo GIF y archivo JAR de Java, también conocido como archivo "GIFAR."

*Credits: N/A

Attack Vector

Network

Attack Complexity

Medium

Authentication

None

Confidentiality

Partial

Integrity

Partial

Availability

Partial

Attack Vector

Network

Attack Complexity

Medium

Authentication

None

Confidentiality

Partial

Integrity

Partial

Availability

None

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2013-02-19 CVE Reserved
2013-04-18 CVE Published
2023-11-15 EPSS Updated
2024-08-06 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CAPEC

References (23)

URL	Tag	Source
http://icedtea.classpath.org/hg/release/icedtea-web-1.2/file/icedtea-web-1.2.3/NEWS	X_refsource_confirm
http://icedtea.classpath.org/hg/release/icedtea-web-1.2/rev/cb58b31c450e	X_refsource_confirm
http://icedtea.classpath.org/hg/release/icedtea-web-1.3/rev/19f5282f53e8	X_refsource_confirm
http://mail.openjdk.java.net/pipermail/distro-pkg-dev/2013-April/022790.html	Mailing List
http://osvdb.org/92544	Vdb Entry
http://www.securityfocus.com/bid/59286	Vdb Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/83640	Vdb Entry
https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0123	X_refsource_misc

URL	Date	SRC

URL	Date	SRC

URL	Date	SRC
http://lists.opensuse.org/opensuse-security-announce/2013-05/msg00020.html	2018-10-30
http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00013.html	2018-10-30
http://lists.opensuse.org/opensuse-updates/2013-04/msg00106.html	2018-10-30
http://lists.opensuse.org/opensuse-updates/2013-05/msg00003.html	2018-10-30
http://lists.opensuse.org/opensuse-updates/2013-05/msg00032.html	2018-10-30
http://lists.opensuse.org/opensuse-updates/2013-06/msg00030.html	2018-10-30
http://lists.opensuse.org/opensuse-updates/2013-06/msg00034.html	2018-10-30
http://lists.opensuse.org/opensuse-updates/2013-06/msg00101.html	2018-10-30
http://rhn.redhat.com/errata/RHSA-2013-0753.html	2018-10-30
http://secunia.com/advisories/53109	2018-10-30
http://secunia.com/advisories/53117	2018-10-30
http://www.mandriva.com/security/advisories?name=MDVSA-2013:146	2018-10-30
http://www.ubuntu.com/usn/USN-1804-1	2018-10-30
https://bugzilla.redhat.com/show_bug.cgi?id=884705	2013-04-17
https://access.redhat.com/security/cve/CVE-2013-1927	2013-04-17

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Redhat Search vendor "Redhat"		Icedtea-web Search vendor "Redhat" for product "Icedtea-web"				<= 1.2.2 Search vendor "Redhat" for product "Icedtea-web" and version " <= 1.2.2"		-		Affected
Redhat Search vendor "Redhat"		Icedtea-web Search vendor "Redhat" for product "Icedtea-web"				1.0 Search vendor "Redhat" for product "Icedtea-web" and version "1.0"		-		Affected
Redhat Search vendor "Redhat"		Icedtea-web Search vendor "Redhat" for product "Icedtea-web"				1.0.1 Search vendor "Redhat" for product "Icedtea-web" and version "1.0.1"		-		Affected
Redhat Search vendor "Redhat"		Icedtea-web Search vendor "Redhat" for product "Icedtea-web"				1.0.2 Search vendor "Redhat" for product "Icedtea-web" and version "1.0.2"		-		Affected
Redhat Search vendor "Redhat"		Icedtea-web Search vendor "Redhat" for product "Icedtea-web"				1.0.3 Search vendor "Redhat" for product "Icedtea-web" and version "1.0.3"		-		Affected
Redhat Search vendor "Redhat"		Icedtea-web Search vendor "Redhat" for product "Icedtea-web"				1.0.4 Search vendor "Redhat" for product "Icedtea-web" and version "1.0.4"		-		Affected
Redhat Search vendor "Redhat"		Icedtea-web Search vendor "Redhat" for product "Icedtea-web"				1.0.5 Search vendor "Redhat" for product "Icedtea-web" and version "1.0.5"		-		Affected
Redhat Search vendor "Redhat"		Icedtea-web Search vendor "Redhat" for product "Icedtea-web"				1.0.6 Search vendor "Redhat" for product "Icedtea-web" and version "1.0.6"		-		Affected
Redhat Search vendor "Redhat"		Icedtea-web Search vendor "Redhat" for product "Icedtea-web"				1.1 Search vendor "Redhat" for product "Icedtea-web" and version "1.1"		-		Affected
Redhat Search vendor "Redhat"		Icedtea-web Search vendor "Redhat" for product "Icedtea-web"				1.1.1 Search vendor "Redhat" for product "Icedtea-web" and version "1.1.1"		-		Affected
Redhat Search vendor "Redhat"		Icedtea-web Search vendor "Redhat" for product "Icedtea-web"				1.1.2 Search vendor "Redhat" for product "Icedtea-web" and version "1.1.2"		-		Affected
Redhat Search vendor "Redhat"		Icedtea-web Search vendor "Redhat" for product "Icedtea-web"				1.1.3 Search vendor "Redhat" for product "Icedtea-web" and version "1.1.3"		-		Affected
Redhat Search vendor "Redhat"		Icedtea-web Search vendor "Redhat" for product "Icedtea-web"				1.1.4 Search vendor "Redhat" for product "Icedtea-web" and version "1.1.4"		-		Affected
Redhat Search vendor "Redhat"		Icedtea-web Search vendor "Redhat" for product "Icedtea-web"				1.1.5 Search vendor "Redhat" for product "Icedtea-web" and version "1.1.5"		-		Affected
Redhat Search vendor "Redhat"		Icedtea-web Search vendor "Redhat" for product "Icedtea-web"				1.1.6 Search vendor "Redhat" for product "Icedtea-web" and version "1.1.6"		-		Affected
Redhat Search vendor "Redhat"		Icedtea-web Search vendor "Redhat" for product "Icedtea-web"				1.1.7 Search vendor "Redhat" for product "Icedtea-web" and version "1.1.7"		-		Affected
Redhat Search vendor "Redhat"		Icedtea-web Search vendor "Redhat" for product "Icedtea-web"				1.2 Search vendor "Redhat" for product "Icedtea-web" and version "1.2"		-		Affected
Redhat Search vendor "Redhat"		Icedtea-web Search vendor "Redhat" for product "Icedtea-web"				1.2.1 Search vendor "Redhat" for product "Icedtea-web" and version "1.2.1"		-		Affected
Redhat Search vendor "Redhat"		Icedtea-web Search vendor "Redhat" for product "Icedtea-web"				1.3 Search vendor "Redhat" for product "Icedtea-web" and version "1.3"		-		Affected
Redhat Search vendor "Redhat"		Icedtea-web Search vendor "Redhat" for product "Icedtea-web"				1.3.1 Search vendor "Redhat" for product "Icedtea-web" and version "1.3.1"		-		Affected
Canonical Search vendor "Canonical"		Ubuntu Linux Search vendor "Canonical" for product "Ubuntu Linux"				10.04 Search vendor "Canonical" for product "Ubuntu Linux" and version "10.04"		lts		Affected
Canonical Search vendor "Canonical"		Ubuntu Linux Search vendor "Canonical" for product "Ubuntu Linux"				11.10 Search vendor "Canonical" for product "Ubuntu Linux" and version "11.10"		-		Affected
Canonical Search vendor "Canonical"		Ubuntu Linux Search vendor "Canonical" for product "Ubuntu Linux"				12.04 Search vendor "Canonical" for product "Ubuntu Linux" and version "12.04"		lts		Affected
Canonical Search vendor "Canonical"		Ubuntu Linux Search vendor "Canonical" for product "Ubuntu Linux"				12.10 Search vendor "Canonical" for product "Ubuntu Linux" and version "12.10"		-		Affected
Opensuse Search vendor "Opensuse"		Opensuse Search vendor "Opensuse" for product "Opensuse"				12.2 Search vendor "Opensuse" for product "Opensuse" and version "12.2"		-		Affected