Vulnerability in Apple Mac OS X

CVE-2013-0967

CoreTypes in Apple Mac OS X before 10.8.3 includes JNLP files in the list of safe file types, which allows remote attackers to bypass a Java plug-in disabled setting, and trigger the launch of Java Web Start applications, via a crafted web site.

EPSS: 0.015 (71.6th percentile) — read the EPSS interpretation.

Affected products

Apple Mac_os_x — versions 10.7.0, 10.7.1, 10.7.2
Apple Mac_os_x_server — versions 10.7.0, 10.7.1, 10.7.2
N/a — versions n/a

References

product-security@apple.com (vendor-advisory, x_refsource_APPLE, Vendor Advisory)