Summary
The host is installed with Opera and is prone to multiple vulnerabilities.
Impact
Successful exploitation could allow attackers to execute arbitrary code in the context of the browser, inject scripts, bypass certain security restrictions, conduct spoofing attacks, or cause a denial of service condition.
Impact Level: System/Application
Solution
Upgrade to the Opera version 11.62 or later,
For updates refer to http://www.opera.com/download/
Insight
Multiple flaws are due to
- An error in web page dialogs handling, which displays the wrong address in the address field.
- An error in history.state, which leaks the state data from cross domain pages via history.pushState() and history.replaceState() functions.
- Fails to ensure that a dialog window is placed on top of content windows, allows attackers to trick users into executing downloads.
- A small window for the download dialog.
- A timed page reloads and redirects to different domains.
Affected
Opera version before 11.62 on Windows
References
Severity
Classification
-
CVE CVE-2012-1924, CVE-2012-1925, CVE-2012-1926, CVE-2012-1927, CVE-2012-1928 -
CVSS Base Score: 6.8
AV:N/AC:M/Au:N/C:P/I:P/A:P
Related Vulnerabilities
- Apple Safari 'Webkit' Multiple Vulnerabilities-01 Mar14 (Mac OS X)
- Apple Safari JavaScript Implementation Information Disclosure Vulnerability (Mac OS X)
- APC PowerChute Business Edition Unspecified Cross Site Scripting Vulnerability
- Apple QuickTime Multiple Arbitrary Code Execution Vulnerabilities (Win)
- Asterisk SIP Response Username Enumeration Remote Information Disclosure Vulnerability