Vulnerabilidades

Desbordamiento de entero en Opera v8.54 y anteriores permite a atacantes remotos ejecutar código de su elección a través de una imagen JPEG con medidas excesivas de ancho y largo, lo que provoca se reserve menos memoria de la que se requiere.

Error de entero sin signo en Opera en versiones anteriores a 8.54 permite a atacantes remotos ejecutar código arbitrario a través de valores largos en un atributo de la hoja de estilos, lo que pasa una verificación de longitud. NOTA: un problema de extensión de signo hace el ataque más fácil con cadenas cortas.

Opera 8.02 and earlier allows remote attackers to cause a denial of service (client crash) via (1) a crafted HTML file with a "content: url(0);" style attribute, a "bodyA" tag, a long string, and a "u" tag with a long attribute, as demonstrated by opera.html; and (2) a BGSOUND element with a "margin:-99;" STYLE…

Opera before 8.51, when running on Windows with Input Method Editor (IME) installed, allows remote attackers to cause a denial of service (persistent application crash) by bookmarking a site with a long title.

Opera 8.50 allows remote attackers to cause a denial of service (crash) via a Java applet with a large string argument to the removeMember JNI method for the com.opera.JSObject class.

Opera anterior a 8.51 en sistemas Linux y Unix permite a atacantes remotos ejecutar código de su elección mediante metacaractérs de 'shell' ('backticks') en una URL que otro producto provee en un argumento de línea de comandos cuando se lanza Opera.

Opera Web Browser 8.50 and 8.0 through 8.0.2 allows remote attackers to spoof the URL in the status bar via the title in an image in a link to a trusted site within a form to the malicious site.

Multiple unspecified vulnerabilities in Opera 8.50 on Linux and Windows have unknown impact and attack vectors, related to (1) " handling of must-revalidate cache directive for HTTPS pages" or (2) a "display issue with cookie comment encoding."

Unspecified "drag-and-drop vulnerability" in Opera Web Browser before 8.50 on Windows allows "unintentional file uploads."

The mail client in Opera before 8.50 opens attached files from the user's cache directory without warning the user, which might allow remote attackers to inject arbitrary web script and spoof attachment filenames.

Opera before 8.50 allows remote attackers to spoof the content type of files via a filename with a trailing "." (dot), which might allow remote attackers to trick users into processing dangerous content.

Opera 8.01 permite que atacantes remotos puedan realizar ataques con secuencias de comandos en sitios cruzados incitando al usuario a arrastrar una imagen que es una URI "javascript:".

Opera 8.0.1, cuando está instalado el font Arial Unicode MS, no maneja adecuadamente los caracteres ASCII extendidos en el diálogo de descarga de ficheros, lo que permite que atacantes remotos engañen con las extensiones de ficheros y posiblemente induzcan a los usuarios a ejecutar código arbitrario.

Un error de diseño en Opera 8.01 y anteriores permite a atacantes con la implicación del usuario superponer una ventana nueva maliciosa sobre un cuadro de diálogo de descarga de fichero, y entonces engañar al usuario para que haga doble clic en el botón "Ejecutar", tcc "link hijacking".

Opera 8.01 permite que atacantes remotos causen una denegación de servicio (consumo de CPU) mediante una imagen JPEG amañada. Queda demostrado usando "random.jpg".

Opera 7.x and 8 before 8.01 does not clearly associate a Javascript dialog box with the web page that generated it, which allows remote attackers to spoof a dialog box from a trusted site and facilitates phishing attacks, aka the "Dialog Origin Spoofing Vulnerability."

The XMLHttpRequest object in Opera 8.0 Final Build 1095 allows remote attackers to bypass access restrictions and perform unauthorized actions on other domains via a redirect.

Cross-site scripting (XSS) vulnerability in Opera 8.0 Final Build 1095 allows remote attackers to inject arbitrary web script or HTML via "javascript:" URLs when a new window or frame is opened, which allows remote attackers to bypass access restrictions and perform unauthorized actions on other domains.

The International Domain Name (IDN) support in Opera 7.54 allows remote attackers to spoof domain names using punycode encoded domain names that are decoded in URLs and SSL certificates in a way that uses homograph characters from other character sets, which facilitates phishing attacks.

The International Domain Name (IDN) support in Epiphany allows remote attackers to spoof domain names using punycode encoded domain names that are decoded in URLs and SSL certificates in a way that uses homograph characters from other character sets, which facilitates phishing attacks.

Opera 7.54 and earlier on Gentoo Linux uses an insecure path for plugins, which could allow local users to gain privileges by inserting malicious libraries into the PORTAGE_TMPDIR (portage) temporary directory.

Opera 8 Beta 3, when using first-generation vetted digital certificates, displays the Organizational information of an SSL certificate, which is easily spoofed and can facilitate phishing attacks.

The International Domain Name (IDN) support in Firefox 1.0, Camino .8.5, and Mozilla before 1.7.6 allows remote attackers to spoof domain names using punycode encoded domain names that are decoded in URLs and SSL certificates in a way that uses homograph characters from other character sets, which facilitates phishing…

Opera 7.54 and earlier does not properly validate base64 encoded binary data in a data: (RFC 2397) URL, which causes the URL to be obscured in a download dialog, which may allow remote attackers to trick users into executing arbitrary code.

Opera 7.54 allows remote attackers to cause a denial of service (application crash from memory exhaustion), as demonstrated using Javascript code that continuously creates nested arrays and then sorts the newly created arrays.