An off-by-one heap-based buffer overflow was found in IcedTeaScriptableJavaObject::invoke function. This problem was discovered in Oct 2012 and was assigned CVE-2012-4540.
Version 1.4 released in May 2013 did not include the fix and is affected by the issue.
