Heap-based buffer overflow in Opera 9.0 and 9.01 allows remote attackers to execute arbitrary code via a long URL in a tag (long link address).

This update fixes the RSA signature checking problem found in openssl in the Opera webbrowser (which is statically linked against openssl).
(CVE-2006-4339) A URL tag parsing heap overflow in Opera could be used to potentially execute code. (CVE-2006-4819)

The version of Opera installed on the remote host reportedly contains a heap overflow vulnerability that can be triggered when processing the DHT marker in a specially-crafted JPEG image to crash the browser or possibly allow execution of arbitrary code on the affected host.  In addition, another flaw in Opera's createSVGTransformFromMatrix object typecasting may lead to a browser crash or arbitrary code execution if support for Javascript is enabled. 

iDefense Labs reports :

Remote exploitation of a heap overflow vulnerability within version 9 of Opera Software's Opera Web browser could allow an attacker to execute arbitrary code on the affected host.

A flaw exists within Opera when parsing a tag that contains a URL. A heap buffer with a constant size of 256 bytes is allocated to store the URL, and the tag's URL is copied into this buffer without sufficient bounds checking of its length.

The version of Opera installed on the remote host reportedly contains a heap buffer overflow vulnerability that can be triggered by a long link.  Successful exploitation of this issue may result in a crash of the application or even allow for execution of arbitrary code subject to the user's privileges.

The version of Opera installed on the remote host reportedly contains a heap-based buffer overflow vulnerability that can be triggered by a long link.  Successful exploitation of this issue may result in a crash of the application or even allow for execution of arbitrary code subject to the user's privileges.

The version of Opera installed on the remote host reportedly contains a heap overflow vulnerability that can be triggered when processing the DHT marker in a specially-crafted JPEG image to crash the browser or possibly allow execution of arbitrary code on the affected host.  In addition, another flaw in Opera's createSVGTransformFromMatrix object typecasting may lead to a browser crash or arbitrary code execution if support for Javascript is enabled.

ID	Name	Product	Family	Severity
27374	openSUSE 10 Security Update : opera (opera-2181)	Nessus	SuSE Local Security Checks	medium
3878	Opera < 9.10 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	medium
22909	FreeBSD : opera -- URL parsing heap overflow vulnerability (4867ae85-608d-11db-8faf-000c6ec775d9)	Nessus	FreeBSD Local Security Checks	medium
3796	Opera < 9.02 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	medium
22875	Opera < 9.02 Multiple Vulnerabilities	Nessus	Windows	medium
800823	Opera < 9.10 Multiple Vulnerabilities	Log Correlation Engine	Web Clients	high
800816	Opera < 9.02 Multiple Vulnerabilities	Log Correlation Engine	Web Clients	medium

Detections

Analytics

CVE-2006-4819

critical

Tenable Plugins

medium

medium

medium

medium

medium

high

medium