The rich text editing functionality in Opera before 9.25 allows remote attackers to conduct cross-domain scripting attacks by using designMode to modify contents of pages in other domains.

Opera released version 9.25 of their browser to fix various security problems.

CVE-2007-6520: Fixed an issue where plug-ins could be used to allow cross domain scripting, as reported by David Bloom. Details will be disclosed at a later date.

CVE-2007-6521: Fixed an issue with TLS certificates that could be used to execute arbitrary code, as reported by Alexander Klink (Cynops GmbH). Details will be disclosed at a later date.

CVE-2007-6522: Rich text editing can no longer be used to allow cross domain scripting, as reported by David Bloom. See our advisory.

CVE-2007-6523: Fixed a problem where malformed BMP files could cause Opera to temporarily freeze.

CVE-2007-6524: Prevented bitmaps from revealing random data from memory, as reported by Gynvael Coldwind. Details will be disclosed at a later date.

The remote host is affected by the vulnerability described in GLSA-200712-22 (Opera: Multiple vulnerabilities)

    David Bloom reported two vulnerabilities where plug-ins (CVE-2007-6520)     and Rich text editing (CVE-2007-6522) could be used to allow cross     domain scripting. Alexander Klink (Cynops GmbH) discovered an issue     with TLS certificates (CVE-2007-6521). Gynvael Coldwind reported that     bitmaps might reveal random data from memory (CVE-2007-6524).
  Impact :

    A remote attacker could exploit these vulnerabilities, possibly leading     to the execution of arbitrary code and cross domain scripting.
  Workaround :

    There is no known workaround at this time.

Opera Software ASA reports about multiple security fixes :

- Fixed an issue where plug-ins could be used to allow cross domain scripting, as reported by David Bloom. Details will be disclosed at a later date.

- Fixed an issue with TLS certificates that could be used to execute arbitrary code, as reported by Alexander Klink (Cynops GmbH). Details will be disclosed at a later date.

- Rich text editing can no longer be used to allow cross domain scripting, as reported by David Bloom. See our advisory.

- Prevented bitmaps from revealing random data from memory, as reported by Gynvael Coldwind. Details will be disclosed at a later date.

 The version of Opera installed on the remote host reportedly is affected by several issues : 

 - An issue where TLS certificates could be used to execute arbitrary code.

 - The browser processes a 3xx HTTP CONNECT response before a successful SSL handshake, which could allow a man-in-the-middle attacker to execute arbitrary web script in the context of a HTTPS server.

The version of Opera installed on the remote host reportedly is affected by several issues, including one in which TLS certificates could be used to execute arbitrary code.

The version of Opera installed on the remote host reportedly is affected by several issues : 

 - An issue where TLS certificates could be used to execute arbitrary code.

 - The browser processes a 3xx HTTP CONNECT response before a successful SSL handshake, which could allow a man-in-the-middle attacker to execute arbitrary web script in the context of a HTTPS server.

ID	Name	Product	Family	Severity
29884	openSUSE 10 Security Update : opera (opera-4858)	Nessus	SuSE Local Security Checks	critical
29819	GLSA-200712-22 : Opera: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
29771	FreeBSD : opera -- multiple vulnerabilities (31b045e7-ae75-11dc-a5f9-001a4d49522b)	Nessus	FreeBSD Local Security Checks	critical
4323	Opera < 9.25 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	medium
29742	Opera < 9.25 Multiple Vulnerabilities	Nessus	Windows	high
800812	Opera < 9.25 Multiple Vulnerabilities	Log Correlation Engine	Web Clients	high

Detections

Analytics

CVE-2007-6522

medium

Tenable Plugins

critical

critical

critical

medium

high

high