Summary
The host is installed with Opera and is prone to multiple vulnerabilities.
Impact
Successful exploitation could allow attackers to execute arbitrary code in the context of the browser, inject scripts, bypass certain security restrictions, conduct spoofing attacks, or cause a denial of service condition.
Impact Level: System/Application
Solution
Upgrade to the Opera version 11.62 or later,
For updates refer to http://www.opera.com/download/
Insight
Multiple flaws are due to
- An error in web page dialogs handling, which displays the wrong address in the address field.
- An error in history.state, which leaks the state data from cross domain pages via history.pushState() and history.replaceState() functions.
- Fails to ensure that a dialog window is placed on top of content windows, allows attackers to trick users into executing downloads.
- A small window for the download dialog.
- A timed page reloads and redirects to different domains.
- The web page content displayed outside of the intended content area.
Affected
Opera version before 11.62
References
- http://www.opera.com/docs/changelogs/mac/1162/
- http://www.opera.com/support/kb/view/1009/
- http://www.opera.com/support/kb/view/1010/
- http://www.opera.com/support/kb/view/1011/
- http://www.opera.com/support/kb/view/1012/
- http://www.opera.com/support/kb/view/1013/
- http://www.opera.com/support/kb/view/1014/
Updated on 2015-03-25
Severity
Classification
-
CVE CVE-2012-1924, CVE-2012-1925, CVE-2012-1926, CVE-2012-1927, CVE-2012-1928, CVE-2012-1929 -
CVSS Base Score: 6.8
AV:N/AC:M/Au:N/C:P/I:P/A:P
Related Vulnerabilities
- Adobe LiveCycle Designer Untrusted Search Path Vulnerability (Windows)
- Apple Safari Secure Cookie Security Bypass Vulnerability (Mac OS X)
- Apache Tomcat AJP Request Remote Denial Of Service Vulnerability
- Apple Safari 'setInterval()' Address Bar Spoofing Vulnerability (Win)
- Apache /server-info accessible