Cross-site scripting (XSS) vulnerability in Opera 9 and 10 allows remote attackers to inject arbitrary web script or HTML via a (1) RSS or (2) Atom feed, related to the rendering of the application/rss+xml content type as "scripted content." NOTE: the vendor reportedly considers this behavior a "design feature," not a vulnerability.

Version upgrade of Opera to 10.1 to fix :

  - CVE-2009-3265: CVSS v2 Base Score: 4.3 CVE-2009-3266:
    CVSS v2 Base Score: 4.3 two XSS attacks via RSS/Atom

  - CVE-2009-3831: CVSS v2 Base Score: 9.3 possible remote     arbitrary code execution via crafted domain names

The version of Opera installed on the remote host is earlier than 10.01.  Such versions are potential affected by multiple issues :

  - Specially crafted domain names can cause a memory     corruption in Opera, which may lead to a crash or     possibly remote code execution. (938)

  - Opera may allow scripts to run on the feed subscription     page, thereby gaining access to the feeds object. (939)

  - In some cases, a Web font intended to be used for page     content could be incorrectly used by Opera to render     parts of the user interface, including the address     field. (940)

ID	Name	Product	Family	Severity
42464	openSUSE Security Update : opera (opera-1532)	Nessus	SuSE Local Security Checks	high
42461	openSUSE Security Update : opera (opera-1532)	Nessus	SuSE Local Security Checks	high
42458	openSUSE Security Update : opera (opera-1532)	Nessus	SuSE Local Security Checks	high
42291	Opera < 10.01 Multiple Vulnerabilities	Nessus	Windows	high

Detections

Analytics

CVE-2009-3265

medium

Tenable Plugins

high

high

high

high