Key: SX - http://bugs.sun.com/bugdatabase/view_bug.do?bug_id=X PRX - http://icedtea.classpath.org/bugzilla/show_bug.cgi?id=X RHX - https://bugzilla.redhat.com/show_bug.cgi?id=X DX - http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=X GX - http://bugs.gentoo.org/show_bug.cgi?id=X CVE-XXXX-YYYY: http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=XXXX-YYYY New in release 1.5.1 (2014-08-13): * Massively improved offline abilities. * Improved to be able to run with any JDK * JDK 8 support added (URLPermission granted if applicable) * Added DE and PL localizations * Added KEY_ENABLE_MANIFEST_ATTRIBUTES_CHECK deployment property to control scan of Manifest file * Control Panel - PR1856: ControlPanel UI improvement for lower resolutions (800*600) * NetX - PR1858: Java Console accepts multi-byte encodings - PR1859: Java Console UI improvement for lower resolutions (800*600) - RH1091563: [abrt] icedtea-web-1.5-2.fc20: Uncaught exception java.lang.ClassCastException in method sun.applet.PluginAppletViewer$8.run() * Plugin - PR1743 - Intermittant deadlock in PluginRequestProcessor - RH1121549: coverity defects * PolicyEditor - codebases without permissions assigned save to file anyway (and re-appear on next open) - PR1776: NullPointer on save-and-exit - Custom permissions are properly formatted New in release 1.5 (2014-04-02): * IcedTea-Web now using tagsoup as default (tagsoup dependence) sanitizer for input * JDK older then 1.5 no longer supported * IcedTea-Web is now following XDG .config and .cache specification(RH947647) * A console for debugging plugin and javaws * Dialogs center on screen before becoming visible * Support for u45 and u51 new manifest attributes (Application-Name, Codebase, Permissions, Trusted-only) * Custom applet permission policies panel in itweb-settings control panel * javaws -version flag * New PolicyEditor for easily adding/removing permissions to individual applets * Cache Viewer - Can be closed by ESC key - Enabling and disabling of operational buttons is handled properly - Time consuming operations are indicated by a mouse busy cursor - "Size" and "Last Modified" columns display localized data * NetX - PR1465 - java.io.FileNotFoundException while trying to download a JAR file - Netx can now parse malformed jnlp files using tagsoup - PR1026 - Apps fail to run because of the nanoxml parser's strict XML validation - PR1473 - javaws should not depend on name of local file - Redesigned About dialogue layout and contents - Console made aware of plugin messages * Plugin - PR854: Resizing an applet several times causes 100% CPU load - PR1271: icedtea-web does not handle 'javascript:'-protocol URLs - RH976833: Multiple applets on one page cause deadlock - Pipes moved into XDG_RUNTIME_DIR - Added debug to file - RH1010958: insecure temporary file use flaw in LiveConnect implementation * Common - PR1474: Can't get javaws to use SOCKS proxy - Man page for itweb-settings * Security Updates - CVE-2012-4540, RH869040: Heap-based buffer overflow after triggering event attached to applet New in release 1.4 (2013-XX-XX): * Added cs localization * Added de localization * Added pl localization * Splash screen for javaws and plugin * Better error reporting for plugin via Error-splash-screen * All IcedTea-Web dialogues are centered to middle of active screen * Download indicator made compact for more then one jar * User can select its own JVM via itw-settings and deploy.properties. * Added extended applets security settings and dialogue * Security updates - CVE-2013-1926, RH916774: Class-loader incorrectly shared for applets with same relative-path. - CVE-2013-1927, RH884705: fixed gifar vulnerabilit - CVE-2012-3422, RH840592: Potential read from an uninitialized memory location - CVE-2012-3423, RH841345: Incorrect handling of not 0-terminated strings * NetX - PR1027: DownloadService is not supported by IcedTea-Web - PR725: JNLP applications will prompt for creating desktop shortcuts every time they are run - PR1292: Javaws does not resolve versioned jar names with periods correctly * Plugin - PR1106: Buffer overflow in plugin table- - PR1166: Embedded JNLP File is not supported in applet tag - PR1217: Add command line arguments for plugins - PR1189: Icedtea-plugin requires code attribute when using jnlp_href - PR1198: JSObject is not passed to javascript correctly - PR1260: IcedTea-Web should not rely on GTK - PR1157: Applets can hang browser after fatal exception - PR580: http://www.horaoficial.cl/ loads improperly * Common - PR1049: Extension jnlp's signed jar with the content of only META-INF/* is considered - PR955: regression: SweetHome3D fails to run - PR1145: IcedTea-Web can cause ClassCircularityError - PR1161: X509VariableTrustManager does not work correctly with OpenJDK7 - PR822: Applets fail to load if jars have different signers - PR1186: System.getProperty("deployment.user.security.trusted.cacerts") is null - PR909: The Java applet at http://de.gosupermodel.com/games/wardrobegame.jsp fails - PR1299: WebStart doesn't read socket proxy settings from firefox correctly New in release 1.3 (2012-XX-XX): * NetX - PR898: signed applications with big jnlp-file doesn't start (webstart affect like "frozen") - PR811: javaws is not handling urls with spaces (and other characters needing encoding) correctly * Plugin - PR820: IcedTea-Web 1.1.3 crashing Firefox when loading Citrix XenApp - PR863: Error passing strings to applet methods in Chromium - PR895: IcedTea-Web searches for missing classes on each loadClass or findClass - PR861: Allow loading from non codebase hosts. Allow code to connect to hosting server - PR518: NPString.utf8characters not guaranteed to be nul-terminated - PR722: META-INF/ unsigned entries should be ignored in signing - PR855: AppletStub getDocumentBase() doesn't return full URL - PR1011: Folders treated as jar files in archive tag - PR588: Cookies not written from cookie jar to browser cookies - PR920: Classes attempted to load twice when class extends from outside jar * Common - PR918: java applet windows uses a low resulution black/white icon - RH838417: Disambiguate signed applet security prompt from certificate warning - RH838559: Disambiguate signed applet security prompt from certificate warning - RH720836: project can be compiled against GTK+ 2 or 3 librarie New in release 1.2 (2011-XX-XX): * Security updates: - RH718164, CVE-2011-2513: Home directory path disclosure to untrusted applications - RH718170, CVE-2011-2514: Java Web Start security warning dialog manipulation - RH742515, CVE-2011-3377: IcedTea-Web: second-level domain subdomains and suffix domain SOP bypass * NetX - PR618: Can't install OpenDJ, JavaWebStart fails with Input stream is null error - PR765: JNLP file with all resource jars marked as 'lazy' fails to validate signature and stops the launch of application - PR788: Elluminate Live! is not working - PR804: javaws launcher incorrectly handles file names with spaces * Plugin - PR749: sun.applet.PluginStreamHandler#handleMessage(String) really slow - PR782: Support building against npapi-sdk as well - PR838: IcedTea plugin crashes with chrome browser when javascript is executed - PR852: Classloader not being flushed after last applet from a site is closed - RH586194: Unable to connect to connect with Juniper VPN client - RH718693: MindTerm SSH Applet doesn't work Common - PR768: Signed applets/Web Start apps don't work with OpenJDK7 and up - PR771: IcedTea-Web certificate verification code does not use the right API - PR742: IcedTea-Web checks certs only upto 1 level deep before declaring them untrusted. - PR769: IcedTea-Web does not work with some ssl sites with OpenJDK7 - PR778: Jar download and server certificate verification deadlock - PR789: typo in jrunscript.sh - PR794: IcedTea-Web does not work if a Web Start app jar has a Class-Path element in the manifest - PR808: javaws is unable to start, when missing jars are enumerated before main jar - RH734081: Javaws cannot use proxy settings from Firefox - RH738814: Access denied at ssl handshake - Support for authenticating using client certificates New in release 1.1 (2011-XX-XX): * Security updates - S6983554, CVE-2010-4450: Launcher incorrect processing of empty library path entries - RH677332, CVE-2011-0706: IcedTea multiple signers privilege escalation * New Features - IcedTea-Web now installs to a FHS-compliant location - IcedTea-Web can now handle Proxy Auto Config files - Binary launchers replaced with simple shell scripts - Can now use codebase_lookup=false with applets. * Common Fixes and Improvements - PR497: Mercurial revision detection not very reliable - PR638: JNLPClassLoader.loadClass(String name) can return null - RH677772: NoSuchAlgorithmException using SSL/TLS in javaws - PR724: Possible NullPointerException in JNLPClassLoader.getClassPathsFromManifest * NetX - Use Firefox's proxy settings if possible - The user's default browser (determined from xdg-open or $BROWSER) is used - RH669942: javaws fails to download version/packed files (missing support for jnlp.packEnabled and jnlp.versionEnabled) - PR464: plugin can now load parameters from jnlp files. - PR658: now jnlp.packEnabled works with applets. - PR726: closing javaws -about no longer throws exceptions. - PR727: cache now properly removes files. * Plugin - PR475, RH604061: Allow applets from the same page to use the same classloader - PR612: NetDania application ends on java.security.AccessControlException: access denied (java.util.PropertyPermission browser read) - PR664: Sound doesn't play on runescape.com. - PR721: IcedTeaPlugin.so cannot run g_main_context_iteration on a different thread unless a different GMainContext *context is used - PR735: Firefox 4 sometimes freezes if the applet calls showDocument() New in release 1.0 (2010-XX-XX): * Initial release of IcedTea-Web * Security updates - RH645843, CVE-2010-3860: IcedTea System property information leak via public static - RH672262, CVE-2011-0025: IcedTea jarfile signature verification bypass * Plugin - PR542: Plugin fails with NPE on http://www.openprocessing.org/visuals/iframe.php?visualID=2615 - PR552: Support for FreeBSD's pthread implementation - PR554: System.err writes content two times - PR556: Applet initialization code is prone to race conditions - PR557: Applet opens in a separate window if tab is closed when the applet loads - PR565: UIDefaults.getUI fails with jgoodies:looks 2.3.1 - PR593: Increment of invalidated iterator in IcedTeaPluginUtils (patch from barbara.xxx1975@libero.it) - PR597: Entities are parsed incorrectly in PARAM tag in applet plugin - PR619: Improper finalization by the plugin can crash the browser - Applets are now double-buffered to eliminate flicker in ones that do heavy drawing - RH665104: OpenJDK Firefox Java plugin loses a cookie * NetX - Add a new option -Xclearcache - Interfaces javax.jnlp.IntegrationService and javax.jnlp.DownloadService2 are now available - PR592: NetX can create invalid desktop entry files - RH663680, CVE-2010-4351: IcedTea JNLP SecurityManager bypass * Control Panel - Modifications to deployments.properties file can now be done through a GUI