Opera before 10.54 on Windows and Mac OS X does not properly enforce permission requirements for widget filesystem access and directory selection, which allows user-assisted remote attackers to create or modify arbitrary files, and consequently execute arbitrary code, via widget File I/O operations.

The version of Opera installed on the remote host is earlier than 10.54.  Such versions are potentially affected by the following issues :

  - Web fonts may be used to trigger a privilege elevation     vulnerability in the Windows operating system (MS10-032)     (954)

  - It may be possible to use data URIs in a cross-site     scripting attack. (955)

  - File inputs may disclose the path to selected files.     (960)

  - It may be possible to use certain characters for domain     name spoofing. (961)

  - It may be possible for a widget to use unrestricted file     I/O to execute arbitrary code. (962)

The remote host is running the Opera web browser.

Versions of Opera earlier than 10.54 are potentially affected by multiple vulnerabilities :

  - Opera may be used as a vector for a font issue in the underlying operating system. (KB 954)

  - An extremely severe issue due to an undisclosed error.

  - A highly severe issue due to an undisclosed error.

  - A moderately severe issue due to an undisclosed issue.

  - A less severe issue due to an undisclosed error.

The remote host is running the Opera web browser. 

Versions of Opera earlier than 10.54 are potentially affected by multiple vulnerabilities :

  - Opera may be used as a vector for a font issue in the underlying operating system. (KB 954)

  - An extremely severe issue due to an undisclosed error.

  - A highly severe issue due to an undisclosed error.

  - A moderately severe issue due to an undisclosed issue.

  - A less severe issue due to an undisclosed error.

ID	Name	Product	Family	Severity
47113	Opera < 10.54 Multiple Vulnerabilities	Nessus	Windows	high
800860	Opera < 10.54 Multiple Vulnerabilities	Log Correlation Engine	Web Clients	high
5576	Opera < 10.54 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	medium

Detections

Analytics

CVE-2010-2666

high

Tenable Plugins

high

high

medium