Opera before 12.12 does not properly allocate memory for GIF images, which allows remote attackers to execute arbitrary code or cause a denial of service (memory overwrite) via a malformed image.

The remote host is affected by the vulnerability described in GLSA-201406-14 (Opera: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Opera. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could entice a user to open a specially crafted web       page using Opera, possibly resulting in execution of arbitrary code with       the privileges of the process or a Denial of Service condition.
      Furthermore, a remote attacker may be able to obtain sensitive       information, conduct Cross-Site Scripting (XSS) attacks, or bypass       security restrictions.
    A local attacker may be able to obtain sensitive information.
  Workaround :

    There is no known workaround at this time.

Versions of Opera earlier than 12.12 is reportedly affected by the following vulnerabilities :

  - An error exists related to GIF image file handling that can allow heap memory corruption and can lead to application crashes or arbitrary code execution. (1038)

  - An information-disclosure vulnerability exists due to improper profile folder permissions, that can allow access to read the sensitive contents of profile files such as cache, password, and Opera's configuration files. (This issue affects only Opera Linux/Unix) (1039)

  - An error exists related to URL handling and the address bar that can allow rapid, repeated web requests to cause the incorrect URL to be displayed. (1040)

The version of Opera installed on the remote host is earlier than 12.12 and is, therefore, reportedly affected by the following vulnerabilities :

  - An error exists related to GIF image file handling that     can allow heap memory corruption and can lead to     application crashes or arbitrary code execution. (1038)

  - An error exists related to URL handling and the address     bar that can allow rapid, repeated web requests to     cause the incorrect URL to be displayed. (1040)

ID	Name	Product	Family	Type	Severity
76065	GLSA-201406-14 : Opera: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	Local	high
6649	Opera < 12.12 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients		high
63301	Opera < 12.12 Multiple Vulnerabilities	Nessus	Windows	Local	high

Detections

Analytics

CVE-2012-6470

critical

Tenable Plugins

high

high

high