Opera before 9.26 allows user-assisted remote attackers to execute arbitrary script via images that contain custom comments, which are treated as script when the user displays the image properties.

The remote host is affected by the vulnerability described in GLSA-200803-09 (Opera: Multiple vulnerabilities)

    Mozilla discovered that Opera does not handle input to file form fields     properly, allowing scripts to manipulate the file path (CVE-2008-1080).
    Max Leonov found out that image comments might be treated as scripts,     and run within the wrong security context (CVE-2008-1081). Arnaud     reported that a wrong representation of DOM attribute values of     imported XML documents allows them to bypass sanitization filters     (CVE-2008-1082).
  Impact :

    A remote attacker could entice a user to upload a file with a known     path by entering text into a specially crafted form, to execute scripts     outside intended security boundaries and conduct Cross-Site Scripting     attacks.
  Workaround :

    There is no known workaround at this time.

Opera Software ASA reports about multiple security fixes :

- Fixed an issue where simulated text inputs could trick users into uploading arbitrary files, as reported by Mozilla.

- Image properties can no longer be used to execute scripts, as reported by Max Leonov.

- Fixed an issue where the representation of DOM attribute values could allow cross site scripting, as reported by Arnaud.lb.

The version of Opera installed on the remote host is reportedly affected by several issues :

 - Simulated text input could trick users into uploading arbitrary files.

 - Image properties comments containing script will be run when displaying the image properties, leading to code execution in the wrong security context.

 - Representation of DOM attribute values could allow cross-site scripting when importing XML into a document.

The version of Opera installed on the remote host reportedly is affected by several issues :

  - Simulated text input could trick users into     uploading arbitrary files.

  - Image properties comments containing script will     be run when displaying the image properties,     leading to code execution in the wrong security     context.

  - Representation of DOM attribute values could allow     cross-site scripting when importing XML into a     document.

ID	Name	Product	Family	Severity
31384	GLSA-200803-09 : Opera: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	medium
31154	FreeBSD : opera -- multiple vulnerabilities (30c560ff-e0df-11dc-891a-02061b08fc24)	Nessus	FreeBSD Local Security Checks	medium
4386	Opera < 9.26 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	medium
31129	Opera < 9.26 Multiple Vulnerabilities	Nessus	Windows	medium
800825	Opera < 9.26 Multiple Vulnerabilities	Log Correlation Engine	Web Clients	medium

Detections

Analytics

CVE-2008-1081

critical

Tenable Plugins

medium

medium

medium

medium

medium