CVE-2012-3422

CWE-119 — Buffer Overflow9 documents8 sources

Severity

6.8MEDIUM

EPSS

1.2%

top 21.31%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Redhat Icedtea-web

Timeline

PublishedAug 7

Latest updateMay 17

Description

The getFirstInTableInstance function in the IcedTea-Web plugin before 1.2.1 returns an uninitialized pointer when the instance_to_id_map hash is empty, which allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted web page, which causes an uninitialized memory location to be read.

CVSS vector

AV:N/AC:M/C:P/I:P/A:PExploitability: 8.6 | Impact: 6.4

Affected Packages2 packages

▶Debianicedtea-web< 1.3-1+3

▶NVDredhat/icedtea-web1.2+2

🔴Vulnerability Details

GHSA

GHSA-qwm3-gpj3-x6c9: The getFirstInTableInstance function in the IcedTea-Web plugin before 1↗2022-05-17

▶

CVEList

CVE-2012-3422: The getFirstInTableInstance function in the IcedTea-Web plugin before 1↗2012-08-07

▶

OSV

CVE-2012-3422: The getFirstInTableInstance function in the IcedTea-Web plugin before 1↗2012-08-07

▶

📋Vendor Advisories

Red Hat

icedtea-web: getvalueforurl uninitialized instance pointer↗2012-07-31

▶

Ubuntu

IcedTea-Web vulnerabilities↗2012-07-31

▶

Debian

CVE-2012-3422: icedtea-web - The getFirstInTableInstance function in the IcedTea-Web plugin before 1.2.1 retu...↗2012

▶

💬Community

Bugzilla

CVE-2012-3422 CVE-2012-3423 icedtea-web various flaws [fedora-all]↗2012-07-31

▶

Bugzilla

CVE-2012-3422 icedtea-web: getvalueforurl uninitialized instance pointer↗2012-07-16

▶