Opera before 9.25 allows remote attackers to obtain potentially sensitive memory contents via a crafted bitmap (BMP) file, as demonstrated using a CANVAS element and JavaScript in an HTML document for copying these contents from 9.50 beta, a related issue to CVE-2008-0420.

Opera released version 9.25 of their browser to fix various security problems.

CVE-2007-6520: Fixed an issue where plug-ins could be used to allow cross domain scripting, as reported by David Bloom. Details will be disclosed at a later date.

CVE-2007-6521: Fixed an issue with TLS certificates that could be used to execute arbitrary code, as reported by Alexander Klink (Cynops GmbH). Details will be disclosed at a later date.

CVE-2007-6522: Rich text editing can no longer be used to allow cross domain scripting, as reported by David Bloom. See our advisory.

CVE-2007-6523: Fixed a problem where malformed BMP files could cause Opera to temporarily freeze.

CVE-2007-6524: Prevented bitmaps from revealing random data from memory, as reported by Gynvael Coldwind. Details will be disclosed at a later date.

The remote host is affected by the vulnerability described in GLSA-200712-22 (Opera: Multiple vulnerabilities)

    David Bloom reported two vulnerabilities where plug-ins (CVE-2007-6520)     and Rich text editing (CVE-2007-6522) could be used to allow cross     domain scripting. Alexander Klink (Cynops GmbH) discovered an issue     with TLS certificates (CVE-2007-6521). Gynvael Coldwind reported that     bitmaps might reveal random data from memory (CVE-2007-6524).
  Impact :

    A remote attacker could exploit these vulnerabilities, possibly leading     to the execution of arbitrary code and cross domain scripting.
  Workaround :

    There is no known workaround at this time.

Opera Software ASA reports about multiple security fixes :

- Fixed an issue where plug-ins could be used to allow cross domain scripting, as reported by David Bloom. Details will be disclosed at a later date.

- Fixed an issue with TLS certificates that could be used to execute arbitrary code, as reported by Alexander Klink (Cynops GmbH). Details will be disclosed at a later date.

- Rich text editing can no longer be used to allow cross domain scripting, as reported by David Bloom. See our advisory.

- Prevented bitmaps from revealing random data from memory, as reported by Gynvael Coldwind. Details will be disclosed at a later date.

 The version of Opera installed on the remote host reportedly is affected by several issues : 

 - An issue where TLS certificates could be used to execute arbitrary code.

 - The browser processes a 3xx HTTP CONNECT response before a successful SSL handshake, which could allow a man-in-the-middle attacker to execute arbitrary web script in the context of a HTTPS server.

The version of Opera installed on the remote host reportedly is affected by several issues, including one in which TLS certificates could be used to execute arbitrary code.

ID	Name	Product	Family	Severity
29884	openSUSE 10 Security Update : opera (opera-4858)	Nessus	SuSE Local Security Checks	critical
29819	GLSA-200712-22 : Opera: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
29771	FreeBSD : opera -- multiple vulnerabilities (31b045e7-ae75-11dc-a5f9-001a4d49522b)	Nessus	FreeBSD Local Security Checks	critical
4323	Opera < 9.25 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	medium
29742	Opera < 9.25 Multiple Vulnerabilities	Nessus	Windows	high

Detections

Analytics

CVE-2007-6524

high

Tenable Plugins

critical

critical

critical

medium

high