Red Hat has issued an update for icedtea-web. This fixes two vulnerabilities, which can be exploited by malicious people to potentially compromise an application using the plugin.

1) An error due to the "getFirstInTableInstance()" function returning an uninitialised pointer can be exploited to potentially execute arbitrary code via a malicious web page.

2) A memory corruption error when handling strings without NUL termination can be exploited to potentially execute arbitrary code via a web page containing a malicious Java applet.

Solution
Updated packages are available via Red Hat Network.
Further details available to Secunia VIM customers

Provided and/or discovered by
1) Red Hat credits Chamal De Silva.
2) Reported by the vendor.

Original Advisory
RHSA-2012:1132-1:
https://rhn.redhat.com/errata/RHSA-2012-1132.html

Red Hat Bugs #840592 and #841345:
https://bugzilla.redhat.com/show_bug.cgi?id=840592
https://bugzilla.redhat.com/show_bug.cgi?id=841345

IcedTea-Web:
http://icedtea.classpath.org/hg/release/icedtea-web-1.2/file/icedtea-web-1.2.1/NEWS

Deep Links
Links available to Secunia VIM customers