1 Key:

2

3 SX - http://bugs.sun.com/bugdatabase/view_bug.do?bug_id=X

4 PRX - http://icedtea.classpath.org/bugzilla/show_bug.cgi?id=X

5 RHX - https://bugzilla.redhat.com/show_bug.cgi?id=X

6 DX - http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=X

7 GX - http://bugs.gentoo.org/show_bug.cgi?id=X

8

9 CVE-XXXX-YYYY: http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=XXXX-YYYY

10

11 New in release 1.2.1 (2012-07-31):

12 * Security Updates

13 - CVE-2012-3422, RH840592: Potential read from an uninitialized memory location

14 - CVE-2012-3423, RH841345: Incorrect handling of not 0-terminated strings

15 * NetX

16 - PR898: signed applications with big jnlp-file doesn't start (webstart affect like "frozen")

17 - PR811: javaws is not handling urls with spaces (and other characters needing encoding) correctly

18 - 816592: icedtea-web not loading GeoGebra java applets in Firefox or Chrome

19 * Plugin

20 - PR863: Error passing strings to applet methods in Chromium

21 - PR895: IcedTea-Web searches for missing classes on each loadClass or findClass

22 - PR518: NPString.utf8characters not guaranteed to be nul-terminated

23 * Common

24 - RH838417: Disambiguate signed applet security prompt from certificate warning

25 - RH838559: Disambiguate signed applet security prompt from certificate warning

26

27 New in release 1.2 (2012-03-05):

28 * Security updates:

29 - RH718164, CVE-2011-2513: Home directory path disclosure to untrusted applications

30 - RH718170, CVE-2011-2514: Java Web Start security warning dialog manipulation

31 - RH742515, CVE-2011-3377: IcedTea-Web: second-level domain subdomains and suffix domain SOP bypass

32 * NetX

33 - PR618: Can't install OpenDJ, JavaWebStart fails with Input stream is null error

34 - PR765: JNLP file with all resource jars marked as 'lazy' fails to validate signature and stops the launch of application

35 - PR788: Elluminate Live! is not working

36 - PR804: javaws launcher incorrectly handles file names with spaces

37 * Plugin

38 - PR749: sun.applet.PluginStreamHandler#handleMessage(String) really slow

39 - PR782: Support building against npapi-sdk as well

40 - PR820: IcedTea-Web 1.1.3 crashing Firefox when loading Citrix XenApp

41 - PR838: IcedTea plugin crashes with chrome browser when javascript is executed

42 - PR852: Classloader not being flushed after last applet from a site is closed

43 - RH586194: Unable to connect to connect with Juniper VPN client

44 - RH718693: MindTerm SSH Applet doesn't work

45 Common

46 - PR768: Signed applets/Web Start apps don't work with OpenJDK7 and up

47 - PR771: IcedTea-Web certificate verification code does not use the right API

48 - PR742: IcedTea-Web checks certs only upto 1 level deep before declaring them untrusted.

49 - PR769: IcedTea-Web does not work with some ssl sites with OpenJDK7

50 - PR778: Jar download and server certificate verification deadlock

51 - PR789: typo in jrunscript.sh

52 - PR794: IcedTea-Web does not work if a Web Start app jar has a Class-Path element in the manifest

53 - PR808: javaws is unable to start, when missing jars are enumerated before main jar

54 - RH734081: Javaws cannot use proxy settings from Firefox

55 - RH738814: Access denied at ssl handshake

56 - Support for authenticating using client certificates

57

58 New in release 1.1 (2011-XX-XX):

59 * Security updates

60 - S6983554, CVE-2010-4450: Launcher incorrect processing of empty library path entries

61 - RH677332, CVE-2011-0706: IcedTea multiple signers privilege escalation

62 * New Features

63 - IcedTea-Web now installs to a FHS-compliant location

64 - IcedTea-Web can now handle Proxy Auto Config files

65 - Binary launchers replaced with simple shell scripts

66 - Can now use codebase_lookup=false with applets.

67 * Common Fixes and Improvements

68 - PR497: Mercurial revision detection not very reliable

69 - PR638: JNLPClassLoader.loadClass(String name) can return null

70 - RH677772: NoSuchAlgorithmException using SSL/TLS in javaws

71 - PR724: Possible NullPointerException in JNLPClassLoader.getClassPathsFromManifest

72 * NetX

73 - Use Firefox's proxy settings if possible

74 - The user's default browser (determined from xdg-open or $BROWSER) is used

75 - RH669942: javaws fails to download version/packed files (missing support for jnlp.packEnabled and jnlp.versionEnabled)

76 - PR464: plugin can now load parameters from jnlp files.

77 - PR658: now jnlp.packEnabled works with applets.

78 - PR726: closing javaws -about no longer throws exceptions.

79 - PR727: cache now properly removes files.

80 * Plugin

81 - PR475, RH604061: Allow applets from the same page to use the same classloader

82 - PR612: NetDania application ends on java.security.AccessControlException: access denied (java.util.PropertyPermission browser read)

83 - PR664: Sound doesn't play on runescape.com.

84 - PR721: IcedTeaPlugin.so cannot run g_main_context_iteration on a different thread unless a different GMainContext *context is used

85 - PR735: Firefox 4 sometimes freezes if the applet calls showDocument()

86

87 New in release 1.0 (2010-XX-XX):

88

89 * Initial release of IcedTea-Web

90 * Security updates

91 - RH645843, CVE-2010-3860: IcedTea System property information leak via public static

92 - RH672262, CVE-2011-0025: IcedTea jarfile signature verification bypass

93 * Plugin

94 - PR542: Plugin fails with NPE on http://www.openprocessing.org/visuals/iframe.php?visualID=2615

95 - PR552: Support for FreeBSD's pthread implementation

96 - PR554: System.err writes content two times

97 - PR556: Applet initialization code is prone to race conditions

98 - PR557: Applet opens in a separate window if tab is closed when the applet loads

99 - PR565: UIDefaults.getUI fails with jgoodies:looks 2.3.1

100 - PR593: Increment of invalidated iterator in IcedTeaPluginUtils (patch from barbara.xxx1975@libero.it)

101 - PR597: Entities are parsed incorrectly in PARAM tag in applet plugin

102 - PR619: Improper finalization by the plugin can crash the browser

103 - Applets are now double-buffered to eliminate flicker in ones that do heavy drawing

104 - RH665104: OpenJDK Firefox Java plugin loses a cookie

105 * NetX

106 - Add a new option -Xclearcache

107 - Interfaces javax.jnlp.IntegrationService and javax.jnlp.DownloadService2 are now available

108 - PR592: NetX can create invalid desktop entry files

109 - RH663680, CVE-2010-4351: IcedTea JNLP SecurityManager bypass

110 * Control Panel

111 - Modifications to deployments.properties file can now be done through a GUI