Multiple vulnerabilities in Opera

Description

Multiple vulnerabilities were found in Opera. Malicious users can exploit these vulnerabilities to bypass security restrictions, spoof user interface, cause denial of service, obtain sensitive information.

Below is a complete list of vulnerabilities:

1. Policy enforcement in Extensions component can be exploited via special crafted extension to bypass security restrictions.
2. Data validation vulnerability in Blink component can be exploited remotely via special crafted webpage to perform domain spoofing.
3. Map processing vulnerability in V8 componenct can be exploited remotely via special crafted webpage to potentially cause denial of service.
4. Heap buffer overflow vulnerability in Angle component can be exploited remotely via special crafted webpage to potentially cause denial of service.
5. Policy enforcement vulnerability in CORS componenct can be exploited remotely via special crafted webpage to obtain sensitive information.
6. Security UI vulnerability in browser component can be exploited remotely via special crafted webpage to perform domain spoofing.
7. Data validation vulnerability in URL parser component can be exploited remotely via special craft URL to bypass security restrictions.
8. Data validation vulnerability in XMLHttpRequest component can be exploited remotely via special crafted webpage to obtain sensitive information.
9. Cross-origin resources size disclosure vulnerability in Appcache component can be exploited remotely via special crafted webpage to obtain sensitive information.
10. Security UI vulnerability in popup blocker component on IOS can be exploited via special crafted webpage to bypass security restrictions.
11. Out of bounds read vulnerability in Skia component can be exploited remotely via special crafted webpage to potentially obtain sensitive information.
12. Out of bounds read vulnerability in Swiftshader component can be exploited remotely via special crafted webpage to potentially cause denial of service.
13. Use after free vulnerability in ServiceWorker component can be exploited remotely via special crafted webpage to potentially cause denial of service.
14. Use after free vulnerability in Download Manager component can be exploited remotely via special crafted webpage to potentially cause denial of service.

Original advisories

• Changelog for Opera 62

• Stable Channel Update for Desktop

Exploitation

Public exploits exist for this vulnerability.

Related products

• Opera

CVE list

• CVE-2019-5828
  critical
• CVE-2019-5829
  critical
• CVE-2019-5830
  high
• CVE-2019-5831
  critical
• CVE-2019-5832
  high
• CVE-2019-5833
  warning
• CVE-2019-5834
  high
• CVE-2019-5835
  high
• CVE-2019-5836
  critical
• CVE-2019-5837
  high
• CVE-2019-5838
  warning
• CVE-2019-5839
  warning
• CVE-2019-5840
  warning
• CVE-2019-5849
  critical

Read more

Find out the statistics of the vulnerabilities spreading in your region on statistics.securelist.com