Opera before 9.64 allows remote attackers to conduct cross-domain scripting attacks via unspecified vectors related to plug-ins.

Opera 9.64 is a recommended security and stability upgrade, incorporating the Opera Presto 2.1.1 user agent engine. Opera highly recommends all users to upgrade to Opera 9.64 to take advantage of these improvements (CVE-2009-0914, CVE-2009-0915, CVE-2009-0916).

A detailed changelog can be found at http://www.opera.com/docs/changelogs/linux/964/

Opera Team reports :

An unspecified error in the processing of JPEG images can be exploited to trigger a memory corruption.

An error can be exploited to execute arbitrary script code in a different domain via unspecified plugins.

An unspecified error has a 'moderately severe' impact. No further information is available.

The version of Opera installed on the remote host is earlier than 9.64 and is reportedly affected by multiple issues :

  - A memory corruption vulnerability when processing specially crafted JPEG files could allow an attacker to execute arbitrary code with the privileges of the affected application. (926)

  - It may be possible for certain plugins to execute arbitrary code in the context of a different domain. An attacker could exploit this to steal authentication credentials as well as carry out other attacks. 

  - A denial of service issue when the application handles a maliciously crafted web page containing 'HTMLSelectElement' object with a large length attribute.

The version of Opera installed on the remote host is earlier than 9.64 and thus reportedly affected by multiple issues :

  - A memory-corruption vulnerability when processing specially     crafted JPEG files could allow an attacker to execute arbitrary     code with the privileges of the affected application. (926)   
  - It may be possible for certain plugins to execute arbitrary code     in the context of a different domain. An attacker could exploit     this to steal authentication credentials as well as carry out     other attacks.

ID	Name	Product	Family	Severity
40290	openSUSE Security Update : opera (opera-629)	Nessus	SuSE Local Security Checks	critical
40095	openSUSE Security Update : opera (opera-629)	Nessus	SuSE Local Security Checks	critical
35957	openSUSE 10 Security Update : opera (opera-6094)	Nessus	SuSE Local Security Checks	critical
35928	FreeBSD : opera -- multiple vulnerabilities (8c5205b4-11a0-11de-a964-0030843d3802)	Nessus	FreeBSD Local Security Checks	high
4945	Opera < 9.64 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	medium
35761	Opera < 9.64 Multiple Vulnerabilities	Nessus	Windows	high
800824	Opera < 9.64 Multiple Vulnerabilities	Log Correlation Engine	Web Clients	high

Detections

Analytics

CVE-2009-0915

medium

Tenable Plugins

critical

critical

critical

high

medium

high

high