Integer overflow in Opera 8.54 and earlier allows remote attackers to execute arbitrary code via a JPEG image with large height and width values, which causes less memory to be allocated than intended.

The webbrowser Opera has been upgraded to version 9.0 to add lots of new features, and to fix the following security problem :

CVE-2006-3198: An integer overflow vulnerability exists in the Opera Web Browser due to the improper handling of JPEG files.

If excessively large height and width values are specified in certain fields of a JPEG file, an integer overflow may cause Opera to allocate insufficient memory for the image. This will lead to a buffer overflow when the image is loaded into memory, which can be exploited to execute arbitrary code.

This updates the previous version, which had a directory conflict.

The webbrowser Opera has been upgraded to version 9.0 to add lots of new features, and to fix the following security problem :

CVE-2006-3198: An integer overflow vulnerability exists in the Opera Web Browser due to the improper handling of JPEG files.

If excessively large height and width values are specified in certain fields of a JPEG file, an integer overflow may cause Opera to allocate insufficient memory for the image. This will lead to a buffer overflow when the image is loaded into memory, which can be exploited to execute arbitrary code.

The version of Opera installed on the remote host reportedly contains an issue that presents itself when the height and width parameters of a JPEG image are set excessively high, causing Opera to allocate insufficient memory for the image and crash as it tries to write to memory at the wrong location. 

In addition, it is reportedly affected by a flaw that may allow an attacker to display an SSL certificate from a trusted site on an untrusted one.

The remote host is using Opera 9.00.  The version of Opera installed on the remote host contains a flaw in the way that it handles JPEG images.  An attacker exploiting this flaw would need to be able to convince an Opera user to browse to a malicious URI.  Successful exploitation would result in the browser crashing and possibly executing arbitrary code.

ID	Name	Product	Family	Severity
27373	openSUSE 10 Security Update : opera (opera-1699)	Nessus	SuSE Local Security Checks	high
27372	openSUSE 10 Security Update : opera (opera-1697)	Nessus	SuSE Local Security Checks	high
21786	Opera < 9.00 Multiple Vulnerabilities	Nessus	Windows	high
3662	Opera < 9.01 Malformed JPEG Overflow	Nessus Network Monitor	Web Clients	high
800819	Opera < 9.01 Malformed JPEG Overflow	Log Correlation Engine	Web Clients	high

Detections

Analytics

CVE-2006-3198

critical

Tenable Plugins

high

high

high

high

high