The Javascript SVG support in Opera before 9.10 does not properly validate object types in a createSVGTransformFromMatrix request, which allows remote attackers to execute arbitrary code via JavaScript code that uses an invalid object in this request that causes a controlled pointer to be referenced during the virtual function call.

The remote host is affected by the vulnerability described in GLSA-200701-08 (Opera: Two remote code execution vulnerabilities)

    Christoph Deal discovered that JPEG files with a specially crafted DHT     marker can be exploited to cause a heap overflow. Furthermore, an     anonymous person discovered that Opera does not correctly handle     objects passed to the 'createSVGTransformFromMatrix()' function.
  Impact :

    An attacker could potentially exploit the vulnerabilities to execute     arbitrary code with the privileges of the user running Opera by     enticing a victim to open a specially crafted JPEG file or a website     containing malicious JavaScript code.
  Workaround :

    The vendor recommends disabling JavaScript to avoid the     'createSVGTransformFromMatrix' vulnerability. There is no known     workaround for the other vulnerability.

iDefense reports :

The vulnerability specifically exists due to Opera improperly processing a JPEG DHT marker. The DHT marker is used to define a Huffman Table which is used for decoding the image data. An invalid number of index bytes in the DHT marker will trigger a heap overflow with partially user controlled data.

Exploitation of this vulnerability would allow an attacker to execute arbitrary code on the affected host. The attacker would first need to construct a website containing the malicious image and trick the vulnerable user into visiting the site. This would trigger the vulnerability and allow the code to execute with the privileges of the local user.

A flaw exists within Opera's JavaScript SVG implementation. When processing a createSVGTransformFromMatrix request Opera does not properly validate the type of object passed to the function. Passing an incorrect object to this function can result in it using a pointer that is user controlled when it attempts to make the virtual function call.

Exploitation of this vulnerability would allow an attacker to execute arbitrary code on the affected host. The attacker would first need to construct a website containing the malicious JavaScript and trick the vulnerable user into visiting the site. This would trigger the vulnerability and allow the code to execute with the privileges of the local user.

The version of Opera installed on the remote host reportedly contains a heap overflow vulnerability that can be triggered when processing the DHT marker in a specially crafted JPEG image to crash the browser or possibly allow execution of arbitrary code on the affected host. 

In addition, another flaw in Opera's createSVGTransformFromMatrix object typecasting may lead to a browser crash or arbitrary code execution if support for JavaScript is enabled.

ID	Name	Product	Family	Type	Severity
24206	GLSA-200701-08 : Opera: Two remote code execution vulnerabilities	Nessus	Gentoo Local Security Checks	Local	high
23988	FreeBSD : opera -- multiple vulnerabilities (78ad2525-9d0c-11db-a5f6-000c6ec775d9)	Nessus	FreeBSD Local Security Checks	Local	high
23977	Opera < 9.10 Multiple Vulnerabilities	Nessus	Windows	Local	high

Detections

Analytics

CVE-2007-0127

critical

Tenable Plugins

high

high

high