Kaspersky ID:
KLA11741
Detect Date:
09/19/2019
Updated:
01/22/2024

Description

Multiple vulnerabilities were found in Opera. Malicious users can exploit these vulnerabilities to obtain sensitive information, bypass security restrictions, cause denial of service, spoof user interface, execute arbitrary code.

Below is a complete list of vulnerabilities:

  1. Policy enforcement vulnerability in Blink can be exploited remotely via special crafted webpage to obtain sensitive information.
  2. Policy enforcement vulnerability in Blink can be exploited remotely via special crafted webpage to bypass origin policy.
  3. Policy enforcement vulnerability in Navigations can be exploited remotely via special crafted webpage to bypass origin policy.
  4. Use after free vulnerability in accessibility can be exploited remotely via special crafted webpage to potentially cause denial of service.
  5. Policy validation vulnerability in navigation on iOS can be exploited remotely via special crafted webpage to perform domain spoofing.
  6. Security vulnerability in URI schemes on Windows can be exploited remotely via special crafted webpage to bypass security restrictions.
  7. Out of bounds read vulnerability in SwiftShader can be exploited remotely via special crafted webpage to potentially obtain sensitive information.
  8. Policy enforcement vulnerability in reader mode can be exploited remotely via special crafted webpage to bypass security restrictions.
  9. Security UI vulnerability in Chromium can be exploited remotely via special crafted webpage.
  10. Heap buffer overflow vulenrability in Skia can be exploited remotely via special crafted webpage to potentially cause denial of service.
  11. Data validation vulnerability in developer tools can be exploited remotely via special crafted webpage to obtain sensitive information.
  12. Use after free vulnerability in V8 can be exploited remotely via special crafted webpage to potentially cause denial of service.
  13. Policy enforcement vulnerability in extensions can be exploited remotely via special crafted extention to execute arbitrary code.
  14. Policy enforcement vulnerability in Chromium can be exploited remotely via special crafted webpage to perform domain spoofing.
  15. Data validation vulnerability in downloads can be exploited remotely via special crafted webpage to bypass security restrictions.
  16. Security UI vulnerability in Omnibox can be exploited remotely via special crafted domain name to perform domain spoofing.
  17. Data validation vulnerability in extensions can be exploited remotely via special crafted webpage to bypass origin policy.
  18. Data validation vulnerability in navigation can be exploited via special crafted webpage to perform domain spoofing.
  19. Policy enforcement vulnerability in site isolation can be exploited remotely via special crafted webpage to bypass security restrictions.
  20. Security UI vulnerability in TLS can be exploited remotely to perform domain spoofing.
  21. Security UI vulnerability in Blink can be exploited remotely via special crafted webpage.
  22. Untrusted input vulnerability in navigation can be exploited remotely via special crafted webpage to perform domain spoofing.
  23. Policy enforcement vulnerability in PDFium can be exploited remotely via special crafted file to bypass security restrictions.
  24. Memory vulnerability in JavaScript can be exploited remotely via special crafted webpage to potentially cause denial of service.
  25. Data validation vulnerability in downloads can be exploited remotely via special crafted webpage to perform domain spoofing.
  26. Use after free vulnerabiltiy in media can be exploited remotely via special crafted webpage to bypass security restrictions.
  27. Use after free vulnerability in media can be exploited remotely via special crafted webpage to potentially cause denial of service.
  28. Policy enforcement vulnerability in external protocol handling can be exploited remotely via special crafted webpage to bypass same origin policy.
  29. Use after free vulnerability in Mojo can be exploited remotely via special crafted webpage to potentially cause denial of service.
  30. Policy enforcement vulnerability in developer tools can be exploited remotely via special crafted webpage to obtain sensitive information.
  31. Filtering vulnerability in Blink can be exploited remotely via special crafted webpage to bypass security restrictions.
  32. OSI vulnerability in storage can be exploited remotely via special crafted webpage.
  33. Data validation vulnerability in JavaScript can be exploited remotely via special crafted webpage to potentially cause denial of service.
  34. Security UI vulnerability in Omnibox can be exploited remotely via special crafted webpage to perform domain spoofing.
  35. Security UI vulnerability in Chromium can be exploited remotely vial special crafted webpage to spoof notifications.

Original advisories

Related products

CVE list

  • CVE-2019-5870
    high
  • CVE-2019-5871
    high
  • CVE-2019-5872
    warning
  • CVE-2019-5873
    warning
  • CVE-2019-5874
    high
  • CVE-2019-5875
    warning
  • CVE-2019-5876
    high
  • CVE-2019-5877
    high
  • CVE-2019-5878
    high
  • CVE-2019-5879
    warning
  • CVE-2019-5880
    warning
  • CVE-2019-5881
    high
  • CVE-2019-13659
    warning
  • CVE-2019-13660
    warning
  • CVE-2019-13661
    warning
  • CVE-2019-13662
    warning
  • CVE-2019-13663
    warning
  • CVE-2019-13664
    warning
  • CVE-2019-13665
    warning
  • CVE-2019-13666
    warning
  • CVE-2019-13667
    warning
  • CVE-2019-13668
    warning
  • CVE-2019-13669
    warning
  • CVE-2019-13670
    warning
  • CVE-2019-13671
    warning
  • CVE-2019-13673
    warning
  • CVE-2019-13674
    warning
  • CVE-2019-13675
    warning
  • CVE-2019-13676
    warning
  • CVE-2019-13677
    warning
  • CVE-2019-13678
    warning
  • CVE-2019-13679
    warning
  • CVE-2019-13680
    warning
  • CVE-2019-13681
    warning
  • CVE-2019-13682
    high
  • CVE-2019-13683
    warning
  • CVE-2019-13691
    warning
  • CVE-2019-13692
    high
  • CVE-2019-13766
    warning

Read more

Find out the statistics of the vulnerabilities spreading in your region on statistics.securelist.com

Found an inaccuracy in the description of this vulnerability? Let us know!
Kaspersky Next
Let’s go Next: redefine your business’s cybersecurity
Learn more
New Kaspersky!
Your digital life deserves complete protection!
Learn more
Confirm changes?
Your message has been sent successfully.