Unspecified vulnerability in the SVG BiDi implementation in Opera before 11.50 allows remote attackers to cause a denial of service (application crash or hang) via unknown vectors.

opera 11.50 fixes several security vulnerabilities.

The full changelog is available at http://www.opera.com/docs/changelogs/unix/1150/

opera 11.50 has been released, fixing numerous vulnerabilities.

The full changelog is available at http://www.opera.com/docs/changelogs/unix/1150/

The remote host is affected by the vulnerability described in GLSA-201206-03 (Opera: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Opera. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could entice a user to open a specially crafted web       page, possibly resulting in execution of arbitrary code with the       privileges of the process or a Denial of Service condition. A remote       attacker may be able to: trick users into downloading and executing       arbitrary files, bypass intended access restrictions, spoof trusted       content, spoof URLs, bypass the Same Origin Policy, obtain sensitive       information, force subscriptions to arbitrary feeds, bypass the popup       blocker, bypass CSS filtering, conduct cross-site scripting attacks, or       have other unknown impact.
    A local attacker could perform symlink attacks to overwrite arbitrary       files with the privileges of the user running the application or possibly       obtain sensitive information.
    A physically proximate attacker may be able to access an email account.
  Workaround :

    There is no known workaround at this time.

The version of Opera installed on the remote Windows host is earlier than 11.50 and thus potentially affected by multiple vulnerabilities:

  - An error exists in the handling of data URIs that     allows cross-site scripting in some unspecified cases.     (Issue #995)

  - An error exists in the browser's handling of error     pages. Opera generates error pages in response to an     invalid URL. If enough invalid URLs are attempted, the     host's disk space is eventually filled, the browser     crashes and the error files are left behind.     (Issue #996)

  - An additional, moderately severe and unspecified error     exists. Details regarding this error are to be released     in the future. (CVE-2011-2610)

  - Several unspecified errors exist that can cause     application crashes. Affected items or functionaility     are: printing, unspecified web content, JavaScript     Array.prototype.join method, drawing paths with many     characters, selecting text nodes, iframes,     closed or removed pop-up windows, moving audio or     video elements between windows, canvas elements, SVG     items, CSS files, form layouts, web workers, SVG BiDi,     large tables and print preview, select elements with     many items, and the src attribute of the iframe element.
    (CVE-2011-2611, CVE-2011-2612, CVE-2011-2613,     CVE-2011-2614, CVE-2011-2615, CVE-2011-2616,     CVE-2011-2617, CVE-2011-2618, CVE-2011-2619,     CVE-2011-2620, CVE-2011-2621, CVE-2011-2622,     CVE-2011-2623, CVE-2011-2624, CVE-2011-2625,     CVE-2011-2626, CVE-2011-2627)

The remote host is running the Opera web browser.

Versions of Opera earlier than 11.50 are potentially affected by multiple vulnerabilities : 

  - An error in the handling of data URIs that allows cross-site scripting in some unspecified cases. (Issue 995)

  - An error exists in the browser's handling of error pages.  Opera generates error pages in response to an invalid URL.  If enough invalid URLs are attempted, the host's disk space is eventually filled, the browser crashes and the error files are left behind. (Issue 996)

  - An additional, moderately severe and unspecified error exists.  Details regarding this error are to be released in the future. (CVE-2011-2610)

  - Several unspecified errors exist that can cause application crashes.  Affected items or functionality are :  printing, unspecified web content, JavaScript, Array.prototype.join method, drawing paths with many characters, selecting text nodes, iframes, closed or removed pop-up windows, moving audio or video elements between windows, canvas elements, SVG items, CSS files, form layouts, web workers, SVG BiDi, large tables and print preview, select elements with many items, and the src attribute of the iframe element. (CVE-2011-2611, CVE-2011-2612, CVE-2011-2613, CVE-2011-2614, CVE-2011-2615, CVE-2011-2616, CVE-2011-2617, CVE-2011-2618, CVE-2011-2619, CVE-2011-2620, CVE-2011-2621, CVE-2011-2622, CVE-2011-2623, CVE-2011-2624, CVE-2011-2625, CVE-2011-2626, CVE-2011-2627)

The remote host is running the Opera web browser. 

Versions of Opera earlier than 11.50 are potentially affected by multiple vulnerabilities : 

  - An error in the handling of data URIs that allows cross-site scripting in some unspecified cases. (Issue 995)

  - An error exists in the browser's handling of error pages.  Opera generates error pages in response to an invalid URL.  If enough invalid URLs are attempted, the host's disk space is eventually filled, the browser crashes and the error files are left behind. (Issue 996)

  - An additional, moderately severe and unspecified error exists.  Details regarding this error are to be released in the future. (CVE-2011-2610)

  - Several unspecified errors exist that can cause application crashes.  Affected items or functionality are :  printing, unspecified web content, JavaScript, Array.prototype.join method, drawing paths with many characters, selecting text nodes, iframes, closed or removed pop-up windows, moving audio or video elements between windows, canvas elements, SVG items, CSS files, form layouts, web workers, SVG BiDi, large tables and print preview, select elements with many items, and the src attribute of the iframe element. (CVE-2011-2611, CVE-2011-2612, CVE-2011-2613, CVE-2011-2614, CVE-2011-2615, CVE-2011-2616, CVE-2011-2617, CVE-2011-2618, CVE-2011-2619, CVE-2011-2620, CVE-2011-2621, CVE-2011-2622, CVE-2011-2623, CVE-2011-2624, CVE-2011-2625, CVE-2011-2626, CVE-2011-2627)

ID	Name	Product	Family	Severity
75983	openSUSE Security Update : opera (openSUSE-SU-2011:0790-1)	Nessus	SuSE Local Security Checks	critical
75696	openSUSE Security Update : opera (openSUSE-SU-2011:0790-1)	Nessus	SuSE Local Security Checks	critical
59631	GLSA-201206-03 : Opera: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
55470	Opera < 11.50 Multiple Vulnerabilities	Nessus	Windows	critical
800843	Opera < 11.50 Multiple Vulnerabilities	Log Correlation Engine	Web Clients	medium
5971	Opera < 11.50 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	low

Detections

Analytics

CVE-2011-2623

high

Tenable Plugins

critical

critical

critical

critical

medium

low