Key:

SX  - h        p://bugs.sun.com/bugda    abase/view_bug.do?bug_id=X
PRX - h        p://iced    ea.classpa    h.org/bugzilla/show_bug.cgi?id=X
RHX - h        ps://bugzilla.redha    .com/show_bug.cgi?id=X
DX  - h        p://bugs.debian.org/cgi-bin/bugrepor    .cgi?bug=X
GX  - h        p://bugs.gen    oo.org/show_bug.cgi?id=X

CVE-XXXX-YYYY: h        p://www.cve.mi    re.org/cgi-bin/cvename.cgi?name=XXXX-YYYY

New in release 1.6.2 (2016-02-03):
* all connec    ion res    ric    ions now consider also por    
* PR2779: h    ml-gen.sh: Don'         ry     o call hg if .hg direc    ory isn'     presen    
* PR2591 - IcedTea-Web reques     resources     wice for me    a informa    ions and causes Clien    Abor    Excep    ion on     omca     in conjunc    ion wi    h JnlpDownloadServle    
* PR2690 - Can'     run BOM in    o JNLP file
* PR2669 - remove bash-specific syn    ax from     op level Makefile.am
* PR2489 - various NPEs when codebase is null
* Ne    X
  - main-class a        ribu    e     rimmed by defaul    
  - in s    ric     mode, main-class a        ribu    e checked for invalid charac    ers
* Plugin
  - RH1273691 - Escaped equals signs in deploymen    .proper    ies no     un-escaped when used
  - PR2746 - IcedTea-Web Plugin 1.6.1: ne    .sourceforge.jnlp.LaunchExcep    ion
  - PR2714 - IcedTea-Web plugin sends unini    ialized memory garbage across a pipe when NPN_Ge    ValueForURL call fails

New in release 1.6.1 (2015-09-11):
* Enabled En    ry-Poin     a        ribu    e check
* permissions sandbox and signed app and unsigned app wi    h permissions all-permissions now run in sandbox ins    ead of no     a     all.
* fixed DownloadService
* commen    s in deploymen    .proper    ies now should persis    s load/save
* fixed bug in caching of files wi    h query
* fixed issues wi    h recrea    ing of exis    ing shor    cu    
*     rus    All/    rus    None now processed correc    ly
* headless no longer shows dialogues
* RH1231441 Unable     o read     he     ex     of     he bu        ons of     he securi    y dialogue
* Fixed RH1233697 iced    ea-web: apple     origin spoofing
* Fixed RH1233667 iced    ea-web: unexpec    ed permanen     au    horiza    ion of unsigned apple    s
* fixed fa    al impac     of ini    ializa    ion error of FileLog
* MissingALACAdialog made available also for unsigned applica    ions (bu     ignoring ac    ual manifes     value) and fixed
* Ne    X
  - fixed issues wi    h -h    ml shor    cu    s
  - fixed issue wi    h -h    ml receiving garbage in wid    h and heigh    
* PolicyEdi    or
  - file flag made     o work when used s    andalone
  - file flag and main argumen     canno     be used in combina    ion

New in release 1.6 (2015-04-29):
* Massively improved offline abili    ies. Added Xoffline swi    ch     o force work wi    hou     ine     connec    ion.
* Improved     o be able     o run wi    h any JDK
* JDK 6 and older no longer suppor    ed
* JDK 8 suppor     added (URLPermission gran    ed if applicable)
* JDK 9 suppor    ed
* Added suppor     for En    ry-Poin     manifes     a        ribu    e
* Added KEY_ENABLE_MANIFEST_ATTRIBUTES_CHECK deploymen     proper    y     o con    rol scan of Manifes     file
* s    ar    ing argumen    s now accep     also -- abbrevia    ions
* Added new documen    a    ion
* Added suppor     for menu shor    cu    s - bo    h javaws applica    ions/apple    s and h    ml apple    s are suppor    ed
* added suppor     for -h    ml swi    ch for javaws. Now you can run mos     of     he apple    s wi    hou     browser a     all
* Con    rol Panel
  - PR1856: Con    rolPanel UI improvemen     for lower resolu    ions (800*600)
* Ne    X
  - PR1858: Java Console accep    s mul    i-by    e encodings
  - PR1859: Java Console UI improvemen     for lower resolu    ions (800*600)
  - RH1091563: [abr    ] iced    ea-web-1.5-2.fc20: Uncaugh     excep    ion java.lang.ClassCas    Excep    ion in me    hod sun.apple    .PluginApple    Viewer$8.run()
  - Dropped suppor     for long unmain    ained -basedir argumen    
  - Re    urned suppor     for -jnlp argumen    
  - RH1095311, PR574 -  References class sun.misc.Ref removed in OpenJDK 9 - fixed, and so buildable on JDK9
* Plugin
  - PR1743 - In    ermi        an     deadlock in PluginReques    Processor
  - PR1298 - LiveConnec     - problem se        ing array elemen    s (apple     variables) from JS
  - RH1121549: coveri    y defec    s
  - Resolves me    hod overloading correc    ly wi    h superclass heirarchy dis    ance
* PolicyEdi    or
  - codebases can be renamed in-place, copied, and pas    ed
  - codebase URLs can be copied     o sys    em clipboard
  - displays a progress dialog while opening or saving files
  - codebases wi    hou     permissions assigned save     o file anyway (and re-appear on nex     open)
  - PR1776: NullPoin    er on save-and-exi    
  - PR1850: duplica    e codebases when launching from securi    y dialogs
  - Fixed bug where clicking "Cancel" on     he "Save before Exi    ing" dialog could resul     in     he edi    or
    exi    ing wi    hou     saving changes
  - Keyboard accelera    ors and mnemonics grea    ly improved
  - "File - New" allows edi    ing a new policy wi    hou     firs     selec    ing     he file     o save     o
* Common
  - PR1769: suppor     signed apple    s which specify Sandbox permissions in     heir manifes    s
* Temporary Permissions in securi    y dialog now mul    i-selec    able and based on PolicyEdi    or permissions

New in release 1.5 (2014-XX-XX):
* IcedTea-Web now using     agsoup as defaul     (    agsoup dependence) sani    izer for inpu    
* JDK older     hen 1.5 no longer suppor    ed
* IcedTea-Web is now following XDG .config and .cache specifica    ion(RH947647)
* A console for debugging plugin and javaws
* Dialogs cen    er on screen before becoming visible
* Suppor     for u45 and u51 new manifes     a        ribu    es (Applica    ion-Name, Codebase, Permissions, Trus    ed-only)
* Cus    om apple     permission policies panel in i    web-se        ings con    rol panel
* javaws -version flag
* New PolicyEdi    or for easily adding/removing permissions     o individual apple    s
* Cache Viewer
  - Can be closed by ESC key
  - Enabling and disabling of opera    ional bu        ons is handled properly
  - Time consuming opera    ions are indica    ed by a mouse busy cursor
  - "Size" and "Las     Modified" columns display localized da    a
* Ne    X
  - PR1465 - java.io.FileNo    FoundExcep    ion while     rying     o download a JAR file
  - Ne    x can now parse malformed jnlp files using     agsoup
  - PR1026 - Apps fail     o run because of     he nanoxml parser's s    ric     XML valida    ion
  - PR1473 - javaws should no     depend on name of local file
  - Redesigned Abou     dialogue layou     and con    en    s
  - Console made aware of plugin messages
  - PR1856: Con    rolPanel UI improvemen     for lower resolu    ions (800*600)
  - PR1858: Java Console accep    s mul    i-by    e encodings
  - PR1859: Java Console UI improvemen     for lower resolu    ions (800*600)
* Plugin
  - PR854: Resizing an apple     several     imes causes 100% CPU load
  - PR1271: iced    ea-web does no     handle 'javascrip    :'-pro    ocol URLs
  - RH976833: Mul    iple apple    s on one page cause deadlock
  - Pipes moved in    o XDG_RUNTIME_DIR
  - Added debug     o file
  - RH1010958: insecure     emporary file use flaw in LiveConnec     implemen    a    ion
  - Resolves me    hod overloading correc    ly wi    h superclass heirarchy dis    ance
* Common
  - PR1474: Can'     ge     javaws     o use SOCKS proxy
  - Man page for i    web-se        ings
* Securi    y Upda    es
  - CVE-2012-4540, RH869040: Heap-based buffer overflow af    er     riggering even     a        ached     o apple    

New in release 1.4 (2013-XX-XX):
* Added cs localiza    ion
* Added de localiza    ion
* Added pl localiza    ion
* Splash screen for javaws and plugin
* Be        er error repor    ing for plugin via Error-splash-screen
* All IcedTea-Web dialogues are cen    ered     o middle of ac    ive screen
* Download indica    or made compac     for more     hen one jar
* User can selec     i    s own JVM via i    w-se        ings and deploy.proper    ies.
* Added ex    ended apple    s securi    y se        ings and dialogue
* Securi    y upda    es
  - CVE-2013-1926, RH916774: Class-loader incorrec    ly shared for apple    s wi    h same rela    ive-pa    h.
  - CVE-2013-1927, RH884705: fixed gifar vulnerabili    
  - CVE-2012-3422, RH840592: Po    en    ial read from an unini    ialized memory loca    ion
  - CVE-2012-3423, RH841345: Incorrec     handling of no     0-    ermina    ed s    rings
* Ne    X
  - PR1027: DownloadService is no     suppor    ed by IcedTea-Web
  - PR725: JNLP applica    ions will promp     for crea    ing desk    op shor    cu    s every     ime     hey are run
  - PR1292: Javaws does no     resolve versioned jar names wi    h periods correc    ly
* Plugin
  - PR1106: Buffer overflow in plugin     able-
  - PR1166: Embedded JNLP File is no     suppor    ed in apple         ag
  - PR1217: Add command line argumen    s for plugins
  - PR1189: Iced    ea-plugin requires code a        ribu    e when using jnlp_href
  - PR1198: JSObjec     is no     passed     o javascrip     correc    ly
  - PR1260: IcedTea-Web should no     rely on GTK
  - PR1157: Apple    s can hang browser af    er fa    al excep    ion
  - PR580: h        p://www.horaoficial.cl/ loads improperly
* Common
  - PR1049: Ex    ension jnlp's signed jar wi    h     he con    en     of only META-INF/* is considered
  - PR955: regression: Swee    Home3D fails     o run
  - PR1145: IcedTea-Web can cause ClassCirculari    yError
  - PR1161: X509VariableTrus    Manager does no     work correc    ly wi    h OpenJDK7
  - PR822: Apple    s fail     o load if jars have differen     signers
  - PR1186: Sys    em.ge    Proper    y("deploymen    .user.securi    y.    rus    ed.cacer    s") is null
  - PR909: The Java apple     a     h        p://de.gosupermodel.com/games/wardrobegame.jsp fails
  - PR1299: WebS    ar     doesn'     read socke     proxy se        ings from firefox correc    ly

New in release 1.3 (2012-XX-XX):
* Ne    X
  - PR898: signed applica    ions wi    h big jnlp-file doesn'     s    ar     (webs    ar     affec     like "frozen")
  - PR811: javaws is no     handling urls wi    h spaces (and o    her charac    ers needing encoding) correc    ly
* Plugin
  - PR820: IcedTea-Web 1.1.3 crashing Firefox when loading Ci    rix XenApp
  - PR863: Error passing s    rings     o apple     me    hods in Chromium
  - PR895: IcedTea-Web searches for missing classes on each loadClass or findClass
  - PR861: Allow loading from non codebase hos    s. Allow code     o connec         o hos    ing server
  - PR518: NPS    ring.u    f8charac    ers no     guaran    eed     o be nul-    ermina    ed
  - PR722: META-INF/ unsigned en    ries should be ignored in signing
  - PR855: Apple    S    ub ge    Documen    Base() doesn'     re    urn full URL
  - PR1011: Folders     rea    ed as jar files in archive     ag
  - PR588: Cookies no     wri        en from cookie jar     o browser cookies
  - PR920: Classes a        emp    ed     o load     wice when class ex    ends from ou    side jar
* Common
  - PR918: java apple     windows uses a low resulu    ion black/whi    e icon
  - RH838417: Disambigua    e signed apple     securi    y promp     from cer    ifica    e warning
  - RH838559: Disambigua    e signed apple     securi    y promp     from cer    ifica    e warning
  - RH720836: projec     can be compiled agains     GTK+ 2 or 3 librarie

New in release 1.2 (2011-XX-XX):
* Securi    y upda    es:
- RH718164, CVE-2011-2513: Home direc    ory pa    h disclosure     o un    rus    ed applica    ions
- RH718170, CVE-2011-2514: Java Web S    ar     securi    y warning dialog manipula    ion
- RH742515, CVE-2011-3377: IcedTea-Web: second-level domain subdomains and suffix domain SOP bypass
* Ne    X
  - PR618: Can'     ins    all OpenDJ, JavaWebS    ar     fails wi    h Inpu     s    ream is null error
  - PR765: JNLP file wi    h all resource jars marked as 'lazy' fails     o valida    e signa    ure and s    ops     he launch of applica    ion
  - PR788: Ellumina    e Live! is no     working
  - PR804: javaws launcher incorrec    ly handles file names wi    h spaces
* Plugin
  - PR749: sun.apple    .PluginS    reamHandler#handleMessage(S    ring) really slow
  - PR782: Suppor     building agains     npapi-sdk as well
  - PR838: IcedTea plugin crashes wi    h chrome browser when javascrip     is execu    ed
  - PR852: Classloader no     being flushed af    er las     apple     from a si    e is closed
  - RH586194: Unable     o connec         o connec     wi    h Juniper VPN clien    
  - RH718693: MindTerm SSH Apple     doesn'     work
Common
  - PR768: Signed apple    s/Web S    ar     apps don'     work wi    h OpenJDK7 and up
  - PR771: IcedTea-Web cer    ifica    e verifica    ion code does no     use     he righ     API
  - PR742: IcedTea-Web checks cer    s only up    o 1 level deep before declaring     hem un    rus    ed.
  - PR769: IcedTea-Web does no     work wi    h some ssl si    es wi    h OpenJDK7
  - PR778: Jar download and server cer    ifica    e verifica    ion deadlock
  - PR789:     ypo in jrunscrip    .sh
  - PR794: IcedTea-Web does no     work if a Web S    ar     app jar has a Class-Pa    h elemen     in     he manifes    
  - PR808: javaws is unable     o s    ar    , when missing jars are enumera    ed before main jar
  - RH734081: Javaws canno     use proxy se        ings from Firefox
  - RH738814: Access denied a     ssl handshake
  - Suppor     for au    hen    ica    ing using clien     cer    ifica    es

New in release 1.1 (2011-XX-XX):
* Securi    y upda    es
  - S6983554, CVE-2010-4450: Launcher incorrec     processing of emp    y library pa    h en    ries
  - RH677332, CVE-2011-0706: IcedTea mul    iple signers privilege escala    ion
* New Fea    ures
  - IcedTea-Web now ins    alls     o a FHS-complian     loca    ion
  - IcedTea-Web can now handle Proxy Au    o Config files
  - Binary launchers replaced wi    h simple shell scrip    s
  - Can now use codebase_lookup=false wi    h apple    s.
* Common Fixes and Improvemen    s
  - PR497: Mercurial revision de    ec    ion no     very reliable
  - PR638: JNLPClassLoader.loadClass(S    ring name) can re    urn null
  - RH677772: NoSuchAlgori    hmExcep    ion using SSL/TLS in javaws
  - PR724: Possible NullPoin    erExcep    ion in JNLPClassLoader.ge    ClassPa    hsFromManifes    
* Ne    X
  - Use Firefox's proxy se        ings if possible
  - The user's defaul     browser (de    ermined from xdg-open or $BROWSER) is used
  - RH669942: javaws fails     o download version/packed files (missing suppor     for jnlp.packEnabled and jnlp.versionEnabled)
  - PR464: plugin can now load parame    ers from jnlp files.
  - PR658: now jnlp.packEnabled works wi    h apple    s.
  - PR726: closing javaws -abou     no longer     hrows excep    ions.
  - PR727: cache now properly removes files.
* Plugin
  - PR475, RH604061: Allow apple    s from     he same page     o use     he same classloader
  - PR612: Ne    Dania applica    ion ends on java.securi    y.AccessCon    rolExcep    ion: access denied (java.u    il.Proper    yPermission browser read)
  - PR664: Sound doesn'     play on runescape.com.
  - PR721: IcedTeaPlugin.so canno     run g_main_con    ex    _i    era    ion on a differen         hread unless a differen     GMainCon    ex     *con    ex     is used
  - PR735: Firefox 4 some    imes freezes if     he apple     calls showDocumen    ()

New in release 1.0 (2010-XX-XX):

* Ini    ial release of IcedTea-Web
* Securi    y upda    es
  - RH645843, CVE-2010-3860: IcedTea Sys    em proper    y informa    ion leak via public s    a    ic
  - RH672262, CVE-2011-0025: IcedTea jarfile signa    ure verifica    ion bypass
* Plugin
  - PR542: Plugin fails wi    h NPE on h        p://www.openprocessing.org/visuals/iframe.php?visualID=2615
  - PR552: Suppor     for FreeBSD's p    hread implemen    a    ion
  - PR554: Sys    em.err wri    es con    en         wo     imes
  - PR556: Apple     ini    ializa    ion code is prone     o race condi    ions
  - PR557: Apple     opens in a separa    e window if     ab is closed when     he apple     loads
  - PR565: UIDefaul    s.ge    UI fails wi    h jgoodies:looks 2.3.1
  - PR593: Incremen     of invalida    ed i    era    or in IcedTeaPluginU    ils (pa    ch from barbara.xxx1975@libero.i    )
  - PR597: En    i    ies are parsed incorrec    ly in PARAM     ag in apple     plugin
  - PR619: Improper finaliza    ion by     he plugin can crash     he browser
  - Apple    s are now double-buffered     o elimina    e flicker in ones     ha     do heavy drawing
  - RH665104: OpenJDK Firefox Java plugin loses a cookie
* Ne    X
  - Add a new op    ion -Xclearcache
  - In    erfaces javax.jnlp.In    egra    ionService and javax.jnlp.DownloadService2 are now available
  - PR592: Ne    X can crea    e invalid desk    op en    ry files
  - RH663680, CVE-2010-4351: IcedTea JNLP Securi    yManager bypass
* Con    rol Panel
  - Modifica    ions     o deploymen    s.proper    ies file can now be done     hrough a GUI