KLA11736 Multiple vulnerabilities in Opera

Multiple vulnerabilities were found in Opera. Malicious users can exploit these vulnerabilities to bypass security restrictions, spoof user interface, cause denial of service, obtain sensitive information.

Below is a complete list of vulnerabilities:

1. Policy enforcement in Extensions component can be exploited via special crafted extension to bypass security restrictions.
2. Data validation vulnerability in Blink component can be exploited remotely via special crafted webpage to perform domain spoofing.
3. Map processing vulnerability in V8 componenct can be exploited remotely via special crafted webpage to potentially cause denial of service.
4. Heap buffer overflow vulnerability in Angle component can be exploited remotely via special crafted webpage to potentially cause denial of service.
5. Policy enforcement vulnerability in CORS componenct can be exploited remotely via special crafted webpage to obtain sensitive information.
6. Security UI vulnerability in browser component can be exploited remotely via special crafted webpage to perform domain spoofing.
7. Data validation vulnerability in URL parser component can be exploited remotely via special craft URL to bypass security restrictions.
8. Data validation vulnerability in XMLHttpRequest component can be exploited remotely via special crafted webpage to obtain sensitive information.
9. Cross-origin resources size disclosure vulnerability in Appcache component can be exploited remotely via special crafted webpage to obtain sensitive information.
10. Security UI vulnerability in popup blocker component on IOS can be exploited via special crafted webpage to bypass security restrictions.
11. Out of bounds read vulnerability in Skia component can be exploited remotely via special crafted webpage to potentially obtain sensitive information.
12. Out of bounds read vulnerability in Swiftshader component can be exploited remotely via special crafted webpage to potentially cause denial of service.
13. Use after free vulnerability in ServiceWorker component can be exploited remotely via special crafted webpage to potentially cause denial of service.
14. Use after free vulnerability in Download Manager component can be exploited remotely via special crafted webpage to potentially cause denial of service.

Original advisories

Changelog for Opera 62

Stable Channel Update for Desktop

Related products

Opera

CVE list

CVE-2019-5828 high

CVE-2019-5829 high

CVE-2019-5830 warning

CVE-2019-5831 high

CVE-2019-5832 warning

CVE-2019-5833 warning

CVE-2019-5834 warning

CVE-2019-5835 warning

CVE-2019-5836 high

CVE-2019-5837 warning

CVE-2019-5838 warning

CVE-2019-5839 warning

CVE-2019-5840 warning

CVE-2019-5849 high

Solution

Update to the latest version

Download Opera

Impacts

• OSI

Obtain sensitive information. Exploitation of vulnerabilities with this impact can lead to capturing by abuser information, critical for user or system.

• DoS

Denial of service. Exploitation of vulnerabilities with this impact can lead to loss of system availability or critical functional fault.

• SB

Security bypass. Exploitation of vulnerabilities with this impact can lead to performing actions restricted by current security settings.

• SUI

Spoof user interface. Exploitation of vulnerabilities with this impact can lead to changes in user interface to beguile user into inaccurate behavior.

Affected Products

• Opera earlier than 62.0.3331.14