Key:
SX - h p://bugs.sun.com/bugda abase/view_bug.do?bug_id=X
PRX - h p://iced ea.classpa h.org/bugzilla/show_bug.cgi?id=X
RHX - h ps://bugzilla.redha .com/show_bug.cgi?id=X
DX - h p://bugs.debian.org/cgi-bin/bugrepor .cgi?bug=X
GX - h p://bugs.gen oo.org/show_bug.cgi?id=X
CVE-XXXX-YYYY: h p://www.cve.mi re.org/cgi-bin/cvename.cgi?name=XXXX-YYYY
New in release 1.6.2 (2016-02-03):
* all connec ion res ric ions now consider also por
* PR2779: h ml-gen.sh: Don' ry o call hg if .hg direc ory isn' presen
* PR2591 - IcedTea-Web reques resources wice for me a informa ions and causes Clien Abor Excep ion on omca in conjunc ion wi h JnlpDownloadServle
* PR2690 - Can' run BOM in o JNLP file
* PR2669 - remove bash-specific syn ax from op level Makefile.am
* PR2489 - various NPEs when codebase is null
* Ne X
- main-class a ribu e rimmed by defaul
- in s ric mode, main-class a ribu e checked for invalid charac ers
* Plugin
- RH1273691 - Escaped equals signs in deploymen .proper ies no un-escaped when used
- PR2746 - IcedTea-Web Plugin 1.6.1: ne .sourceforge.jnlp.LaunchExcep ion
- PR2714 - IcedTea-Web plugin sends unini ialized memory garbage across a pipe when NPN_Ge ValueForURL call fails
New in release 1.6.1 (2015-09-11):
* Enabled En ry-Poin a ribu e check
* permissions sandbox and signed app and unsigned app wi h permissions all-permissions now run in sandbox ins ead of no a all.
* fixed DownloadService
* commen s in deploymen .proper ies now should persis s load/save
* fixed bug in caching of files wi h query
* fixed issues wi h recrea ing of exis ing shor cu
* rus All/ rus None now processed correc ly
* headless no longer shows dialogues
* RH1231441 Unable o read he ex of he bu ons of he securi y dialogue
* Fixed RH1233697 iced ea-web: apple origin spoofing
* Fixed RH1233667 iced ea-web: unexpec ed permanen au horiza ion of unsigned apple s
* fixed fa al impac of ini ializa ion error of FileLog
* MissingALACAdialog made available also for unsigned applica ions (bu ignoring ac ual manifes value) and fixed
* Ne X
- fixed issues wi h -h ml shor cu s
- fixed issue wi h -h ml receiving garbage in wid h and heigh
* PolicyEdi or
- file flag made o work when used s andalone
- file flag and main argumen canno be used in combina ion
New in release 1.6 (2015-04-29):
* Massively improved offline abili ies. Added Xoffline swi ch o force work wi hou ine connec ion.
* Improved o be able o run wi h any JDK
* JDK 6 and older no longer suppor ed
* JDK 8 suppor added (URLPermission gran ed if applicable)
* JDK 9 suppor ed
* Added suppor for En ry-Poin manifes a ribu e
* Added KEY_ENABLE_MANIFEST_ATTRIBUTES_CHECK deploymen proper y o con rol scan of Manifes file
* s ar ing argumen s now accep also -- abbrevia ions
* Added new documen a ion
* Added suppor for menu shor cu s - bo h javaws applica ions/apple s and h ml apple s are suppor ed
* added suppor for -h ml swi ch for javaws. Now you can run mos of he apple s wi hou browser a all
* Con rol Panel
- PR1856: Con rolPanel UI improvemen for lower resolu ions (800*600)
* Ne X
- PR1858: Java Console accep s mul i-by e encodings
- PR1859: Java Console UI improvemen for lower resolu ions (800*600)
- RH1091563: [abr ] iced ea-web-1.5-2.fc20: Uncaugh excep ion java.lang.ClassCas Excep ion in me hod sun.apple .PluginApple Viewer$8.run()
- Dropped suppor for long unmain ained -basedir argumen
- Re urned suppor for -jnlp argumen
- RH1095311, PR574 - References class sun.misc.Ref removed in OpenJDK 9 - fixed, and so buildable on JDK9
* Plugin
- PR1743 - In ermi an deadlock in PluginReques Processor
- PR1298 - LiveConnec - problem se ing array elemen s (apple variables) from JS
- RH1121549: coveri y defec s
- Resolves me hod overloading correc ly wi h superclass heirarchy dis ance
* PolicyEdi or
- codebases can be renamed in-place, copied, and pas ed
- codebase URLs can be copied o sys em clipboard
- displays a progress dialog while opening or saving files
- codebases wi hou permissions assigned save o file anyway (and re-appear on nex open)
- PR1776: NullPoin er on save-and-exi
- PR1850: duplica e codebases when launching from securi y dialogs
- Fixed bug where clicking "Cancel" on he "Save before Exi ing" dialog could resul in he edi or
exi ing wi hou saving changes
- Keyboard accelera ors and mnemonics grea ly improved
- "File - New" allows edi ing a new policy wi hou firs selec ing he file o save o
* Common
- PR1769: suppor signed apple s which specify Sandbox permissions in heir manifes s
* Temporary Permissions in securi y dialog now mul i-selec able and based on PolicyEdi or permissions
New in release 1.5 (2014-XX-XX):
* IcedTea-Web now using agsoup as defaul ( agsoup dependence) sani izer for inpu
* JDK older hen 1.5 no longer suppor ed
* IcedTea-Web is now following XDG .config and .cache specifica ion(RH947647)
* A console for debugging plugin and javaws
* Dialogs cen er on screen before becoming visible
* Suppor for u45 and u51 new manifes a ribu es (Applica ion-Name, Codebase, Permissions, Trus ed-only)
* Cus om apple permission policies panel in i web-se ings con rol panel
* javaws -version flag
* New PolicyEdi or for easily adding/removing permissions o individual apple s
* Cache Viewer
- Can be closed by ESC key
- Enabling and disabling of opera ional bu ons is handled properly
- Time consuming opera ions are indica ed by a mouse busy cursor
- "Size" and "Las Modified" columns display localized da a
* Ne X
- PR1465 - java.io.FileNo FoundExcep ion while rying o download a JAR file
- Ne x can now parse malformed jnlp files using agsoup
- PR1026 - Apps fail o run because of he nanoxml parser's s ric XML valida ion
- PR1473 - javaws should no depend on name of local file
- Redesigned Abou dialogue layou and con en s
- Console made aware of plugin messages
- PR1856: Con rolPanel UI improvemen for lower resolu ions (800*600)
- PR1858: Java Console accep s mul i-by e encodings
- PR1859: Java Console UI improvemen for lower resolu ions (800*600)
* Plugin
- PR854: Resizing an apple several imes causes 100% CPU load
- PR1271: iced ea-web does no handle 'javascrip :'-pro ocol URLs
- RH976833: Mul iple apple s on one page cause deadlock
- Pipes moved in o XDG_RUNTIME_DIR
- Added debug o file
- RH1010958: insecure emporary file use flaw in LiveConnec implemen a ion
- Resolves me hod overloading correc ly wi h superclass heirarchy dis ance
* Common
- PR1474: Can' ge javaws o use SOCKS proxy
- Man page for i web-se ings
* Securi y Upda es
- CVE-2012-4540, RH869040: Heap-based buffer overflow af er riggering even a ached o apple
New in release 1.4 (2013-XX-XX):
* Added cs localiza ion
* Added de localiza ion
* Added pl localiza ion
* Splash screen for javaws and plugin
* Be er error repor ing for plugin via Error-splash-screen
* All IcedTea-Web dialogues are cen ered o middle of ac ive screen
* Download indica or made compac for more hen one jar
* User can selec i s own JVM via i w-se ings and deploy.proper ies.
* Added ex ended apple s securi y se ings and dialogue
* Securi y upda es
- CVE-2013-1926, RH916774: Class-loader incorrec ly shared for apple s wi h same rela ive-pa h.
- CVE-2013-1927, RH884705: fixed gifar vulnerabili
- CVE-2012-3422, RH840592: Po en ial read from an unini ialized memory loca ion
- CVE-2012-3423, RH841345: Incorrec handling of no 0- ermina ed s rings
* Ne X
- PR1027: DownloadService is no suppor ed by IcedTea-Web
- PR725: JNLP applica ions will promp for crea ing desk op shor cu s every ime hey are run
- PR1292: Javaws does no resolve versioned jar names wi h periods correc ly
* Plugin
- PR1106: Buffer overflow in plugin able-
- PR1166: Embedded JNLP File is no suppor ed in apple ag
- PR1217: Add command line argumen s for plugins
- PR1189: Iced ea-plugin requires code a ribu e when using jnlp_href
- PR1198: JSObjec is no passed o javascrip correc ly
- PR1260: IcedTea-Web should no rely on GTK
- PR1157: Apple s can hang browser af er fa al excep ion
- PR580: h p://www.horaoficial.cl/ loads improperly
* Common
- PR1049: Ex ension jnlp's signed jar wi h he con en of only META-INF/* is considered
- PR955: regression: Swee Home3D fails o run
- PR1145: IcedTea-Web can cause ClassCirculari yError
- PR1161: X509VariableTrus Manager does no work correc ly wi h OpenJDK7
- PR822: Apple s fail o load if jars have differen signers
- PR1186: Sys em.ge Proper y("deploymen .user.securi y. rus ed.cacer s") is null
- PR909: The Java apple a h p://de.gosupermodel.com/games/wardrobegame.jsp fails
- PR1299: WebS ar doesn' read socke proxy se ings from firefox correc ly
New in release 1.3 (2012-XX-XX):
* Ne X
- PR898: signed applica ions wi h big jnlp-file doesn' s ar (webs ar affec like "frozen")
- PR811: javaws is no handling urls wi h spaces (and o her charac ers needing encoding) correc ly
* Plugin
- PR820: IcedTea-Web 1.1.3 crashing Firefox when loading Ci rix XenApp
- PR863: Error passing s rings o apple me hods in Chromium
- PR895: IcedTea-Web searches for missing classes on each loadClass or findClass
- PR861: Allow loading from non codebase hos s. Allow code o connec o hos ing server
- PR518: NPS ring.u f8charac ers no guaran eed o be nul- ermina ed
- PR722: META-INF/ unsigned en ries should be ignored in signing
- PR855: Apple S ub ge Documen Base() doesn' re urn full URL
- PR1011: Folders rea ed as jar files in archive ag
- PR588: Cookies no wri en from cookie jar o browser cookies
- PR920: Classes a emp ed o load wice when class ex ends from ou side jar
* Common
- PR918: java apple windows uses a low resulu ion black/whi e icon
- RH838417: Disambigua e signed apple securi y promp from cer ifica e warning
- RH838559: Disambigua e signed apple securi y promp from cer ifica e warning
- RH720836: projec can be compiled agains GTK+ 2 or 3 librarie
New in release 1.2 (2011-XX-XX):
* Securi y upda es:
- RH718164, CVE-2011-2513: Home direc ory pa h disclosure o un rus ed applica ions
- RH718170, CVE-2011-2514: Java Web S ar securi y warning dialog manipula ion
- RH742515, CVE-2011-3377: IcedTea-Web: second-level domain subdomains and suffix domain SOP bypass
* Ne X
- PR618: Can' ins all OpenDJ, JavaWebS ar fails wi h Inpu s ream is null error
- PR765: JNLP file wi h all resource jars marked as 'lazy' fails o valida e signa ure and s ops he launch of applica ion
- PR788: Ellumina e Live! is no working
- PR804: javaws launcher incorrec ly handles file names wi h spaces
* Plugin
- PR749: sun.apple .PluginS reamHandler#handleMessage(S ring) really slow
- PR782: Suppor building agains npapi-sdk as well
- PR838: IcedTea plugin crashes wi h chrome browser when javascrip is execu ed
- PR852: Classloader no being flushed af er las apple from a si e is closed
- RH586194: Unable o connec o connec wi h Juniper VPN clien
- RH718693: MindTerm SSH Apple doesn' work
Common
- PR768: Signed apple s/Web S ar apps don' work wi h OpenJDK7 and up
- PR771: IcedTea-Web cer ifica e verifica ion code does no use he righ API
- PR742: IcedTea-Web checks cer s only up o 1 level deep before declaring hem un rus ed.
- PR769: IcedTea-Web does no work wi h some ssl si es wi h OpenJDK7
- PR778: Jar download and server cer ifica e verifica ion deadlock
- PR789: ypo in jrunscrip .sh
- PR794: IcedTea-Web does no work if a Web S ar app jar has a Class-Pa h elemen in he manifes
- PR808: javaws is unable o s ar , when missing jars are enumera ed before main jar
- RH734081: Javaws canno use proxy se ings from Firefox
- RH738814: Access denied a ssl handshake
- Suppor for au hen ica ing using clien cer ifica es
New in release 1.1 (2011-XX-XX):
* Securi y upda es
- S6983554, CVE-2010-4450: Launcher incorrec processing of emp y library pa h en ries
- RH677332, CVE-2011-0706: IcedTea mul iple signers privilege escala ion
* New Fea ures
- IcedTea-Web now ins alls o a FHS-complian loca ion
- IcedTea-Web can now handle Proxy Au o Config files
- Binary launchers replaced wi h simple shell scrip s
- Can now use codebase_lookup=false wi h apple s.
* Common Fixes and Improvemen s
- PR497: Mercurial revision de ec ion no very reliable
- PR638: JNLPClassLoader.loadClass(S ring name) can re urn null
- RH677772: NoSuchAlgori hmExcep ion using SSL/TLS in javaws
- PR724: Possible NullPoin erExcep ion in JNLPClassLoader.ge ClassPa hsFromManifes
* Ne X
- Use Firefox's proxy se ings if possible
- The user's defaul browser (de ermined from xdg-open or $BROWSER) is used
- RH669942: javaws fails o download version/packed files (missing suppor for jnlp.packEnabled and jnlp.versionEnabled)
- PR464: plugin can now load parame ers from jnlp files.
- PR658: now jnlp.packEnabled works wi h apple s.
- PR726: closing javaws -abou no longer hrows excep ions.
- PR727: cache now properly removes files.
* Plugin
- PR475, RH604061: Allow apple s from he same page o use he same classloader
- PR612: Ne Dania applica ion ends on java.securi y.AccessCon rolExcep ion: access denied (java.u il.Proper yPermission browser read)
- PR664: Sound doesn' play on runescape.com.
- PR721: IcedTeaPlugin.so canno run g_main_con ex _i era ion on a differen hread unless a differen GMainCon ex *con ex is used
- PR735: Firefox 4 some imes freezes if he apple calls showDocumen ()
New in release 1.0 (2010-XX-XX):
* Ini ial release of IcedTea-Web
* Securi y upda es
- RH645843, CVE-2010-3860: IcedTea Sys em proper y informa ion leak via public s a ic
- RH672262, CVE-2011-0025: IcedTea jarfile signa ure verifica ion bypass
* Plugin
- PR542: Plugin fails wi h NPE on h p://www.openprocessing.org/visuals/iframe.php?visualID=2615
- PR552: Suppor for FreeBSD's p hread implemen a ion
- PR554: Sys em.err wri es con en wo imes
- PR556: Apple ini ializa ion code is prone o race condi ions
- PR557: Apple opens in a separa e window if ab is closed when he apple loads
- PR565: UIDefaul s.ge UI fails wi h jgoodies:looks 2.3.1
- PR593: Incremen of invalida ed i era or in IcedTeaPluginU ils (pa ch from barbara.xxx1975@libero.i )
- PR597: En i ies are parsed incorrec ly in PARAM ag in apple plugin
- PR619: Improper finaliza ion by he plugin can crash he browser
- Apple s are now double-buffered o elimina e flicker in ones ha do heavy drawing
- RH665104: OpenJDK Firefox Java plugin loses a cookie
* Ne X
- Add a new op ion -Xclearcache
- In erfaces javax.jnlp.In egra ionService and javax.jnlp.DownloadService2 are now available
- PR592: Ne X can crea e invalid desk op en ry files
- RH663680, CVE-2010-4351: IcedTea JNLP Securi yManager bypass
* Con rol Panel
- Modifica ions o deploymen s.proper ies file can now be done hrough a GUI