Opera before 12.10 does not properly implement the Cross-Origin Resource Sharing (CORS) specification, which allows remote attackers to bypass intended page-content restrictions via a crafted request.

The remote host is affected by the vulnerability described in GLSA-201406-14 (Opera: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Opera. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could entice a user to open a specially crafted web       page using Opera, possibly resulting in execution of arbitrary code with       the privileges of the process or a Denial of Service condition.
      Furthermore, a remote attacker may be able to obtain sensitive       information, conduct Cross-Site Scripting (XSS) attacks, or bypass       security restrictions.
    A local attacker may be able to obtain sensitive information.
  Workaround :

    There is no known workaround at this time.

The remote host is running the Opera web browser. 

Versions of Opera earlier than 12.10 are potentially affected by the following vulnerabilities :

  - An error exists related to certificate revocation checking that can allow the application to indicate that a site is secure even though the check has not completed. (1029)

  - An error exists related to Cross-Origin Resource Sharing (CORS) handling that can allow specially crafted requests to aid in disclosing sensitive data. (1030)

  - An error exists related to data URIs that allows bypassing of the 'Same Origin Policy' and cross-site scripting attacks. (1031)

  - An error exists related to SVG image handling that can result in arbitrary code execution. (1033)

  - Two unspecified errors exist having unspecified impact.

The version of Opera installed on the remote host is earlier than 12.10 and is, therefore, reportedly affected by the following vulnerabilities : 

  - An error exists related to certificate revocation     checking that can allow the application to indicate     that a site is secure even though the check has not     completed. (1029)

  - An error exists related to Cross-Origin Resource     Sharing (CORS) handling that can allow specially     crafted requests to aid in disclosing sensitive     data. (1030)

  - An error exists related to data URIs that allows     bypassing of the 'Same Origin Policy' and cross-site     scripting attacks. (1031)

  - An error exists related to JavaScript and native     objects that allows domains to override methods of     other domains. This error can aid in cross-site     scripting attacks. (1032)

  - An error exists related to SVG image handling that     can result in arbitrary code execution. (1033)

  - An error exists related to the handling of shortcuts     in inline elements that can cause the application to     be redirected to malicious pages. This error can aid     in phishing attacks. (1034)

  - An error exists related to the handling of 'WebP'     images that can allow disclosure of memory contents.
    (1035)

ID	Name	Product	Family	Severity
76065	GLSA-201406-14 : Opera: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
6618	Opera < 12.10 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	high
62821	Opera < 12.10 Multiple Vulnerabilities	Nessus	Windows	high

Detections

Analytics

CVE-2012-6462

high

Tenable Plugins

high

high

high