Opera before 10.54 on Windows and Mac OS X, and before 10.60 on UNIX platforms, does not properly restrict certain uses of homograph characters in domain names, which makes it easier for remote attackers to spoof IDN domains via unspecified choices of characters.

The remote host is affected by the vulnerability described in GLSA-201206-03 (Opera: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Opera. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could entice a user to open a specially crafted web       page, possibly resulting in execution of arbitrary code with the       privileges of the process or a Denial of Service condition. A remote       attacker may be able to: trick users into downloading and executing       arbitrary files, bypass intended access restrictions, spoof trusted       content, spoof URLs, bypass the Same Origin Policy, obtain sensitive       information, force subscriptions to arbitrary feeds, bypass the popup       blocker, bypass CSS filtering, conduct cross-site scripting attacks, or       have other unknown impact.
    A local attacker could perform symlink attacks to overwrite arbitrary       files with the privileges of the user running the application or possibly       obtain sensitive information.
    A physically proximate attacker may be able to access an email account.
  Workaround :

    There is no known workaround at this time.

The remote mobile host is a using a version of Apple iOS earlier than 4.0. Such versions are potentially affected by multiple vulnerabilities. Apple iOS 4.0 contains security fixes for the following components :

  - Application Sandbox

  - CFNetwork

  - ImageIO

  - LibSystem

  - libxml

  - Passcode Lock

  - Safari

  - Settings

  - WebKit

The version of Opera installed on the remote host is earlier than 10.54.  Such versions are potentially affected by the following issues :

  - Web fonts may be used to trigger a privilege elevation     vulnerability in the Windows operating system (MS10-032)     (954)

  - It may be possible to use data URIs in a cross-site     scripting attack. (955)

  - File inputs may disclose the path to selected files.     (960)

  - It may be possible to use certain characters for domain     name spoofing. (961)

  - It may be possible for a widget to use unrestricted file     I/O to execute arbitrary code. (962)

The remote host is running the Opera web browser. 

Versions of Opera earlier than 10.54 are potentially affected by multiple vulnerabilities :

  - Opera may be used as a vector for a font issue in the underlying operating system. (KB 954)

  - An extremely severe issue due to an undisclosed error.

  - A highly severe issue due to an undisclosed error.

  - A moderately severe issue due to an undisclosed issue.

  - A less severe issue due to an undisclosed error.

ID	Name	Product	Family	Severity
59631	GLSA-201206-03 : Opera: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
5578	Apple iOS < 4.0 Multiple Vulnerabilities	Nessus Network Monitor	Mobile Devices	critical
47113	Opera < 10.54 Multiple Vulnerabilities	Nessus	Windows	high
5576	Opera < 10.54 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	medium

Detections

Analytics

CVE-2010-2660

high

Tenable Plugins

critical

critical

high

medium