Detections
Analytics
Opera < 22 Multiple Chromium Vulnerabilities
high Nessus Plugin ID 74362
Language:
Synopsis
The remote host contains a web browser that is affected by multiple vulnerabilities.Description
The version of Opera installed on the remote host is prior to version 22. It is, therefore, reportedly affected by multiple vulnerabilities in the bundled version of Chromium :- Use-after-free errors exist related to 'styles' and 'SVG' handling. (CVE-2014-1743, CVE-2014-1745)
- An integer overflow error exists related to audio handling. (CVE-2014-1744)
- An out-of-bounds read error exists related to media filters. (CVE-2014-1746)
- A user-input validation error exists related to handling local MHTML files that could allow for universal cross-site scripting (UXSS) attacks.
(CVE-2014-1747)
- An unspecified error exists related to the scrollbar that could allow UI spoofing. (CVE-2014-1748)
- Various unspecified errors. (CVE-2014-1749)
- An integer underflow error exists related to the V8 JavaScript engine that could allow a denial of service condition. (CVE-2014-3152)
- An error exists related to the 'Blick' 'SpeechInput' feature that could allow click-jacking and information disclosure. (CVE-2014-3803)
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
Solution
Upgrade to Opera 22 or later.See Also
https://blogs.opera.com/desktop/changelog22/
http://www.nessus.org/u?2da726ba
http://web.archive.org/web/20170922104144/http://www.opera.com:80/docs/changelogs/unified/2200/
Plugin Details
Severity: High
ID: 74362
File Name: opera_2200.nasl
Version: 1.10
Type: local
Agent: windows
Family: Windows
Published: 6/6/2014
Updated: 11/26/2019
Supported Sensors: Nessus Agent, Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 6.6
CVSS v2
Risk Factor: High
Base Score: 7.5
Temporal Score: 5.5
Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P
CVSS Score Source: CVE-2014-3152
Vulnerability Information
CPE: cpe:/a:opera:opera_browser
Required KB Items: SMB/Opera/Version, SMB/Opera/Path
Exploit Ease: No known exploits are available
Patch Publication Date: 6/3/2014
Vulnerability Publication Date: 4/6/2014
Reference Information
CVE: CVE-2014-1743, CVE-2014-1744, CVE-2014-1745, CVE-2014-1746, CVE-2014-1747, CVE-2014-1748, CVE-2014-1749, CVE-2014-3152, CVE-2014-3803