Integer signedness error in Opera before 8.54 allows remote attackers to execute arbitrary code via long values in a stylesheet attribute, which pass a length check. NOTE: a sign extension problem makes the attack easier with shorter strings.

Integer signedness error in Opera before 8.54 allows remote attackers to execute arbitrary code via long values in a stylesheet attribute, which pass a length check. (CVE-2006-1834)

The remote host is affected by the vulnerability described in GLSA-200606-01 (Opera: Buffer overflow)

    SEC Consult has discovered a buffer overflow in the code     processing style sheet attributes. It is caused by an integer     signedness error in a length check followed by a call to a string     function. It seems to be hard to exploit this buffer overflow to     execute arbitrary code because of the very large amount memory that has     to be copied.
  Impact :

    A remote attacker can entice a user to visit a web page containing     a specially crafted style sheet attribute that will crash the user's     browser and maybe lead to the execution of arbitrary code.
  Workaround :

    There is no known workaround at this time.

The remote host is using Opera, an alternative web browser. 

The version of Opera installed on the remote host contains a buffer overflow that can be triggered by a long value within a stylesheet attribute.  Successful exploitation can lead to a browser crash and possibly allow for the execution of arbitrary code subject to the privileges of the user running Opera.

The remote host is using Opera. The version of Opera installed on the remote host contains a buffer overflow that can be triggered by a long value within a stylesheet attribute.  Successful exploitation can lead to a browser crash and possibly allow for the execution of arbitrary code subject to the privileges of the user running Opera.

ID	Name	Product	Family	Severity
27371	openSUSE 10 Security Update : opera (opera-1313)	Nessus	SuSE Local Security Checks	medium
21663	GLSA-200606-01 : Opera: Buffer overflow	Nessus	Gentoo Local Security Checks	medium
21221	Opera < 8.54 Multiple Vulnerabilities	Nessus	Windows	medium
3515	Opera < 8.54 signedness StyleSheet Overflow	Nessus Network Monitor	Web Clients	medium
800839	Opera < 8.54 signedness StyleSheet Overflow	Log Correlation Engine	Web Clients	medium

Detections

Analytics

CVE-2006-1834

critical

Tenable Plugins

medium

medium

medium

medium

medium