Heap-based buffer overflow in Opera 9.62 on Windows allows remote attackers to execute arbitrary code via a long file:// URI. NOTE: this might overlap CVE-2008-5680.

The remote host is affected by the vulnerability described in GLSA-200903-30 (Opera: Multiple vulnerabilities)

    Multiple vulnerabilities were discovered in Opera:
    Vitaly McLain reported a heap-based buffer overflow when processing     host names in file:// URLs (CVE-2008-5178).
    Alexios Fakos reported a vulnerability in the HTML parsing engine     when processing web pages that trigger an invalid pointer calculation     and heap corruption (CVE-2008-5679).
    Red XIII reported that certain text-area contents can be     manipulated to cause a buffer overlow (CVE-2008-5680).
    David Bloom discovered that unspecified 'scripted URLs' are not     blocked during the feed preview (CVE-2008-5681).
    Robert Swiecki of the Google Security Team reported a Cross-site     scripting vulnerability (CVE-2008-5682).
    An unspecified vulnerability reveals random data     (CVE-2008-5683).
    Tavis Ormandy of the Google Security Team reported a vulnerability     when processing JPEG images that may corrupt memory     (CVE-2009-0914).
  Impact :

    A remote attacker could entice a user to open a specially crafted JPEG     image to cause a Denial of Service or execute arbitrary code, to     process an overly long file:// URL or to open a specially crafted web     page to execute arbitrary code. He could also read existing     subscriptions and force subscriptions to arbitrary feed URLs, as well     as inject arbitrary web script or HTML via built-in XSLT templates.
  Workaround :

    There is no known workaround at this time.

The Opera Team reports :

Manipulating certain text-area contents can cause a buffer overflow, which may be exploited to execute arbitrary code.

Certain HTML constructs can cause the resulting DOM to change unexpectedly, which triggers a crash. To inject code, additional techniques will have to be employed.

Exceptionally long host names in file: URLs can cause a buffer overflow, which may be exploited to execute arbitrary code. Remote Web pages cannot refer to file: URLs, so successful exploitation involves tricking users into manually opening the exploit URL, or a local file that refers to it.

When Opera is previewing a news feed, some scripted URLs are not correctly blocked. These can execute scripts which are able to subscribe the user to any feed URL that the attacker chooses, and can also view the contents of any feeds that the user is subscribed to.
These may contain sensitive information.

Built-in XSLT templates incorrectly handle escaped content and can cause it to be treated as markup. If a site accepts content from untrusted users, which it then displays using XSLT as escaped strings, this can allow scripted markup to be injected. The scripts will then be executed in the security context of that site.

The version of Opera installed on the remote host is earlier than 9.63 and is reportedly affected by several issues : 

  - It may be possible to execute arbitrary code on the remote system by manipulating certain text-area contents. (920)

  - It may be possible to crash the remote browser using certain HTML constructs or inject code under certain conditions. (921)

  - While previewing news feeds, Opera does not correctly block certain scripted URLs. Such scripts, if not blocked, may be able to subscribe a user to other arbitrary feeds and view contents of the feeds to which the user is currently subscribed. (923)

  - By displaying content using XSLT as escaped strings, it may be possible for a website to inject scripted markup. (924)

The version of Opera installed on the remote host is earlier than 9.63 and thus reportedly affected by several issues :

  - It may be possible to execute arbitrary code on the     remote system by manipulating certain text-area     contents. (920)

  - It may be possible to crash the remote browser using     certain HTML constructs or inject code under certain     conditions. (921)

  - It may be possible to trigger a buffer overflow, and     potentially execute arbitrary code, by tricking an     user to click on a URL that contains exceptionally     long host names. (922)

  - While previewing news feeds, Opera does not correctly     block certain scripted URLs. Such scripts, if not     blocked, may be able to subscribe a user to other     arbitrary feeds and view contents of the feeds to which     the user is currently subscribed. (923)

  - By displaying content using XSLT as escaped strings, it     may be possible for a website to inject scripted     markup. (924)

  - SSL server certificates are not properly validated due     to an unspecified error. (CVE-2012-1251)

ID	Name	Product	Family	Severity
35943	GLSA-200903-30 : Opera: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
35240	FreeBSD : opera -- multiple vulnerabilities (225bc349-ce10-11dd-a721-0030843d3802)	Nessus	FreeBSD Local Security Checks	high
4791	Opera < 9.63 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	medium
35185	Opera < 9.63 Multiple Vulnerabilities	Nessus	Windows	high

Detections

Analytics

CVE-2008-5178

critical

Tenable Plugins

high

high

medium

high