Lucene search

K
freebsdFreeBSDDFC1DAA8-61DE-11DA-B64C-0001020EED82
HistoryNov 17, 2005 - 12:00 a.m.

opera -- command line URL shell command injection

2005-11-1700:00:00
vuxml.freebsd.org
16

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.151 Low

EPSS

Percentile

95.9%

An Opera Advisory reports:

Opera for UNIX uses a wrapper shell script to start up
Opera. This shell script reads the input arguments, like
the file names or URLs that Opera is to open. It also
performs some environment checks, for example whether Java
is available and if so, where it is located.
This wrapper script can also run commands embedded in the
URL, so that a specially crafted URL can make arbitrary
commands run on the recipient’s machine. Users who have
other programs set up to use Opera to open Web links are
vulnerable to this flaw. For these users, clicking a Web
link in for example OpenOffice.org or Evolution can run a
command that was put into the link.

OSVersionArchitecturePackageVersionFilename
FreeBSDanynoarchlinux-opera< 8.51UNKNOWN
FreeBSDanynoarchopera-devel< 8.51UNKNOWN
FreeBSDanynoarchopera< 8.51UNKNOWN

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.151 Low

EPSS

Percentile

95.9%

Related for DFC1DAA8-61DE-11DA-B64C-0001020EED82