Opera before 9.64 allows remote attackers to execute arbitrary code via a crafted JPEG image that triggers memory corruption.

Opera 9.64 is a recommended security and stability upgrade, incorporating the Opera Presto 2.1.1 user agent engine. Opera highly recommends all users to upgrade to Opera 9.64 to take advantage of these improvements (CVE-2009-0914, CVE-2009-0915, CVE-2009-0916).

A detailed changelog can be found at http://www.opera.com/docs/changelogs/linux/964/

The remote host is affected by the vulnerability described in GLSA-200903-30 (Opera: Multiple vulnerabilities)

    Multiple vulnerabilities were discovered in Opera:
    Vitaly McLain reported a heap-based buffer overflow when processing     host names in file:// URLs (CVE-2008-5178).
    Alexios Fakos reported a vulnerability in the HTML parsing engine     when processing web pages that trigger an invalid pointer calculation     and heap corruption (CVE-2008-5679).
    Red XIII reported that certain text-area contents can be     manipulated to cause a buffer overlow (CVE-2008-5680).
    David Bloom discovered that unspecified 'scripted URLs' are not     blocked during the feed preview (CVE-2008-5681).
    Robert Swiecki of the Google Security Team reported a Cross-site     scripting vulnerability (CVE-2008-5682).
    An unspecified vulnerability reveals random data     (CVE-2008-5683).
    Tavis Ormandy of the Google Security Team reported a vulnerability     when processing JPEG images that may corrupt memory     (CVE-2009-0914).
  Impact :

    A remote attacker could entice a user to open a specially crafted JPEG     image to cause a Denial of Service or execute arbitrary code, to     process an overly long file:// URL or to open a specially crafted web     page to execute arbitrary code. He could also read existing     subscriptions and force subscriptions to arbitrary feed URLs, as well     as inject arbitrary web script or HTML via built-in XSLT templates.
  Workaround :

    There is no known workaround at this time.

Opera Team reports :

An unspecified error in the processing of JPEG images can be exploited to trigger a memory corruption.

An error can be exploited to execute arbitrary script code in a different domain via unspecified plugins.

An unspecified error has a 'moderately severe' impact. No further information is available.

The version of Opera installed on the remote host is earlier than 9.64 and is reportedly affected by multiple issues :

  - A memory corruption vulnerability when processing specially crafted JPEG files could allow an attacker to execute arbitrary code with the privileges of the affected application. (926)

  - It may be possible for certain plugins to execute arbitrary code in the context of a different domain. An attacker could exploit this to steal authentication credentials as well as carry out other attacks. 

  - A denial of service issue when the application handles a maliciously crafted web page containing 'HTMLSelectElement' object with a large length attribute.

The version of Opera installed on the remote host is earlier than 9.64 and thus reportedly affected by multiple issues :

  - A memory-corruption vulnerability when processing specially     crafted JPEG files could allow an attacker to execute arbitrary     code with the privileges of the affected application. (926)   
  - It may be possible for certain plugins to execute arbitrary code     in the context of a different domain. An attacker could exploit     this to steal authentication credentials as well as carry out     other attacks.

ID	Name	Product	Family	Severity
40290	openSUSE Security Update : opera (opera-629)	Nessus	SuSE Local Security Checks	critical
40095	openSUSE Security Update : opera (opera-629)	Nessus	SuSE Local Security Checks	critical
35957	openSUSE 10 Security Update : opera (opera-6094)	Nessus	SuSE Local Security Checks	critical
35943	GLSA-200903-30 : Opera: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
35928	FreeBSD : opera -- multiple vulnerabilities (8c5205b4-11a0-11de-a964-0030843d3802)	Nessus	FreeBSD Local Security Checks	high
4945	Opera < 9.64 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	medium
35761	Opera < 9.64 Multiple Vulnerabilities	Nessus	Windows	high
800824	Opera < 9.64 Multiple Vulnerabilities	Log Correlation Engine	Web Clients	high

Detections

Analytics

CVE-2009-0914

high

Tenable Plugins

critical

critical

critical

high

high

medium

high

high