lp:ubuntu/oneiric-security/icedtea-web

Branch merges

Propose for merging

No branches dependent on this one.

Related source package recipes

No recipes using this branch. (?)

Create packaging recipe

Related snap packages

Related bugs

Related blueprints

35. By Jamie Strandboge on 2013-04-23

Revert PR1161: X509VariableTrustManager does not work correctly with
OpenJDK7. The fix for PR1161 is needed for IcedTea 2.3.x and not 1.12.
We need to keep this patch reverted as long as we build icedtea-web
against 1.12 (LP: #1171506)

34. By Jamie Strandboge on 2013-04-17

[ Matthias Klose ]
* IcedTea-Web 1.2.3 release.
* Security Updates:
  - CVE-2013-1927: fixed gifar vulnerability.
  - CVE-2013-1926: Class-loader incorrectly shared for applets with same
    relative-path.
* Common:
  - PR1161: X509VariableTrustManager does not work correctly with OpenJDK7.
* NetX:
  - PR580: http://www.horaoficial.cl/ loads improperly.
* Plugin:
  - PR1157: Applets can hang browser after fatal exception.

[ Jamie Strandboge ]
* debian/rules: generate icedtea-plugin meta package
* debian/icedtea-netx.postinst.in: skip update-alternatives on
  openjdk-7 binaries if they don't exist
* Regenerate the control file

33. By Jamie Strandboge on 2012-11-06

* SECURITY UPDATE: Fix denial of service in exception handling
  - debian/patches/icedtea-web-CVE-2012-4540.patch: adjust off by one in
    exception string storage in IcedTeaScriptablePluginObject.cc. Also fix
    two memory leaks.
  - CVE-2012-4540

32. By Steve Beattie on 2012-08-03

debian/patches/fix-plugin-error-on-chromium.patch: fix plugin
table initialization to check only that the subset of hooks that
it uses exists. (LP: #1025553)

31. By Steve Beattie on 2012-07-28

* SECURITY UPDATE: uninitialized pointer use flaw
  - debian/patches/icedtea-web-CVE-2012-3422.patch: check for empty
    instance_to_id_map hash and return error if so.
  - CVE-2012-3422
* SECURITY UPDATE: incorrect handling of non NULL terminated strings
  - debian/patches/icedtea-web-CVE-2012-3423.patch: ensure NPVariant
    NPStrings are NULL terminated.
  - CVE-2012-3423

30. By Steve Beattie on 2012-06-30

* Backport IcedTea-web 1.2 to lucid in conjunction with OpenJDK 6/
  IcedTea 1.11.3 backport
* debian/rules: generate icedtea-plugin meta package
* debian/icedtea-netx.postinst.in: skip update-alternatives on
  openjdk-7 binaries if they don't exist
* Regenerate the control file.

29. By Steve Beattie on 2011-11-07

* SECURITY UPDATE: Same Origin Policy (SOP) bypass flaw:
  - debian/patches/SOP-bypass-icedtea-web-1.10.patch: Remove special
    case for SocketPermission.
  - CVE-2011-3377

28. By Matthias Klose on 2011-09-29

* Rebuild the control file.
* Fix non multiarch installation.

27. By Matthias Klose on 2011-09-04

* New upstream release.
  - PR769: IcedTea-Web does not work with some ssl sites.

26. By Matthias Klose on 2011-08-16

* Updates from the 1.1 branch:
  - PR749: sun.applet.PluginStreamHandler#handleMessage(String) really slow.
  - PR768: Signed applets/Web Start apps don't work with OpenJDK7 and up.