Kaspersky ID:
KLA11718
Detect Date:
12/27/2019
Updated:
01/22/2024

Description

Multiple vulnerabilities were found in Opera. Malicious users can exploit these vulnerabilities to execute arbitrary code, bypass security restrictions, cause denial of service, obtain sensitive information, spoof user interface.

Below is a complete list of vulnerabilities:

  1. Use after free vulnerability in Bluetooth component can be exploited remotely via specially designed webpage to execute arbitrary code.
  2. Buffer overflow vulnerability in password manager can be exploited remotely via specially designed webpage to execute arbitrary code.
  3. Insufficient policy enforcement vulnerability in WebSockets can be exploited remotely via specially designed webpage to bypass same origin policy.
  4. A heap buffer overflow vulnerability in JavaScript can be exploited remotely via specially designed webpage to cause denial of service.
  5. A heap buffer overflow vulnerability in WebSockets can be exploited remotely via specially designed webpage to cause denial of service.
  6. A heap buffer overflow vulnerability in WebAudio can be exploited remotely via specially designed webpage to cause denial of service.
  7. A heap buffer overflow vulnerability in SQLite can be exploited remotely via specially designed webpage to cause denial of service.
  8. An out of bounds write vulnerability in JavaScript can be exploited remotely via specially designed webpage to execute arbitrary code.
  9. A heap buffer overflow vulnerability in PDFium can be exploited remotely via specially crafted PDF file to cause denial of service.
  10. Insufficient policy enforcement vulnerability in autocomplete component can be exploited remotely via specially designed webpage to obtain sensitive information.
  11. Insufficient policy enforcement vulnerability in navigation component can be exploited remotely via specially designed webpage to bypass site isolation.
  12. Insufficient policy enforcement vulnerability in Omnibox can be exploited remotely via specially crafted domain name to perform domain spoofing.
  13. Incorrect security vulnerability of UI in sharing component can be exploited remotely via specially designed webpage to perform domain spoofing.
  14. Insufficient validation vulnerability in Blink can be exploited locally via specially crafted clipboard content to bypass same origin policy.
  15. URL bar vulnerability in Omibox can be exploited remotely via specially crafted domain name to spoof the contents.
  16. An UI spoof vulnerability in external protocol handling can be exploited remotely via specially designed webpage.
  17. Cross-context information leak vulnerability in cookies can be exploited remotely via specially designed webpage.
  18. Cross-context information leak vulnerability in audio can be exploited remotely via specially designed webpage.
  19. Insufficient policy enforcement vulnerability in Omnibox can be exploited remotely via specially designed webpage to spoof the contents.
  20. Uninitialized data structure in rendering component can be exploited remotely via specially designed webpage to cause denial of service.
  21. Insufficient policy enforcement vulnerability in developer tools can be exploited locally via specially designed webpage to obtain sensitive information.
  22. URL bar vulnerability in Omibox can be exploited remotely via specially designed webpage to spoof the contents.
  23. Insufficient data validation vulnerability in SQLite can be exploited remotely via specially designed webpage to bypass defense-in-depth measures.
  24. Uninitialized data structure in SQLite can be exploited remotely via specially designed webpage to obtain sensitive information.
  25. An out of bounds read vulnerability in SQLite can be exploited remotely to obtain sensitive information.
  26. Insufficient policy enforcement vulnerability in extensions can be exploited remotely via specially designed webpage to bypass navigation restrictions.
  27. Insufficient security UI vulnerability in printing component can be exploited remotely via specially designed webpage to perform domain spoofing
  28. Insufficient security UI vulnerability in Omnibox can be exploited remotely via specially crafted domain name to perform domain spoofing.
  29. Insufficient policy enforcement vulnerability in navigation component can be exploited remotely via specially designed webpage to bypass navigation restrictions.
  30. Insufficient security UI vulnerability in interstitials can be exploited remotely via specially designed webpage to perform domain spoofing.
  31. Insufficient policy enforcement vulnerability in downloads can be exploited locally via local code to spoof downloaded files.
  32. Cross-context information leak vulnerability in payments can be exploited remotely via specially designed webpage.
  33. Stack corruption due to incorrect number of arguments in WebRTC code can be exploited remotely via specially designed website to cause denial of service.

Original advisories

Related products

CVE list

  • CVE-2019-13722
    warning
  • CVE-2019-13725
    high
  • CVE-2019-13726
    high
  • CVE-2019-13727
    high
  • CVE-2019-13728
    high
  • CVE-2019-13729
    high
  • CVE-2019-13730
    high
  • CVE-2019-13732
    high
  • CVE-2019-13734
    high
  • CVE-2019-13735
    high
  • CVE-2019-13764
    high
  • CVE-2019-13736
    high
  • CVE-2019-13737
    warning
  • CVE-2019-13738
    warning
  • CVE-2019-13739
    warning
  • CVE-2019-13740
    warning
  • CVE-2019-13741
    high
  • CVE-2019-13742
    warning
  • CVE-2019-13743
    warning
  • CVE-2019-13744
    warning
  • CVE-2019-13745
    warning
  • CVE-2019-13746
    warning
  • CVE-2019-13747
    high
  • CVE-2019-13748
    warning
  • CVE-2019-13749
    warning
  • CVE-2019-13750
    warning
  • CVE-2019-13751
    warning
  • CVE-2019-13752
    warning
  • CVE-2019-13753
    warning
  • CVE-2019-13754
    warning
  • CVE-2019-13755
    warning
  • CVE-2019-13756
    warning
  • CVE-2019-13757
    warning
  • CVE-2019-13758
    warning
  • CVE-2019-13759
    warning
  • CVE-2019-13761
    warning
  • CVE-2019-13762
    warning
  • CVE-2019-13763
    warning

Read more

Find out the statistics of the vulnerabilities spreading in your region on statistics.securelist.com

Found an inaccuracy in the description of this vulnerability? Let us know!
Kaspersky IT Security Calculator
Calculate
Check now
Learn more about cybersecurity on Kaspersky Encyclopedia
For free
Learn more
Confirm changes?
Your message has been sent successfully.