KLA11741 Multiple vulnerabilities in Opera

Multiple vulnerabilities were found in Opera. Malicious users can exploit these vulnerabilities to obtain sensitive information, bypass security restrictions, cause denial of service, spoof user interface, execute arbitrary code.

Below is a complete list of vulnerabilities:

1. Policy enforcement vulnerability in Blink can be exploited remotely via special crafted webpage to obtain sensitive information.
2. Policy enforcement vulnerability in Blink can be exploited remotely via special crafted webpage to bypass origin policy.
3. Policy enforcement vulnerability in Navigations can be exploited remotely via special crafted webpage to bypass origin policy.
4. Use after free vulnerability in accessibility can be exploited remotely via special crafted webpage to potentially cause denial of service.
5. Policy validation vulnerability in navigation on iOS can be exploited remotely via special crafted webpage to perform domain spoofing.
6. Security vulnerability in URI schemes on Windows can be exploited remotely via special crafted webpage to bypass security restrictions.
7. Out of bounds read vulnerability in SwiftShader can be exploited remotely via special crafted webpage to potentially obtain sensitive information.
8. Policy enforcement vulnerability in reader mode can be exploited remotely via special crafted webpage to bypass security restrictions.
9. Security UI vulnerability in Chromium can be exploited remotely via special crafted webpage.
10. Heap buffer overflow vulenrability in Skia can be exploited remotely via special crafted webpage to potentially cause denial of service.
11. Data validation vulnerability in developer tools can be exploited remotely via special crafted webpage to obtain sensitive information.
12. Use after free vulnerability in V8 can be exploited remotely via special crafted webpage to potentially cause denial of service.
13. Policy enforcement vulnerability in extensions can be exploited remotely via special crafted extention to execute arbitrary code.
14. Policy enforcement vulnerability in Chromium can be exploited remotely via special crafted webpage to perform domain spoofing.
15. Data validation vulnerability in downloads can be exploited remotely via special crafted webpage to bypass security restrictions.
16. Security UI vulnerability in Omnibox can be exploited remotely via special crafted domain name to perform domain spoofing.
17. Data validation vulnerability in extensions can be exploited remotely via special crafted webpage to bypass origin policy.
18. Data validation vulnerability in navigation can be exploited via special crafted webpage to perform domain spoofing.
19. Policy enforcement vulnerability in site isolation can be exploited remotely via special crafted webpage to bypass security restrictions.
20. Security UI vulnerability in TLS can be exploited remotely to perform domain spoofing.
21. Security UI vulnerability in Blink can be exploited remotely via special crafted webpage.
22. Untrusted input vulnerability in navigation can be exploited remotely via special crafted webpage to perform domain spoofing.
23. Policy enforcement vulnerability in PDFium can be exploited remotely via special crafted file to bypass security restrictions.
24. Memory vulnerability in JavaScript can be exploited remotely via special crafted webpage to potentially cause denial of service.
25. Data validation vulnerability in downloads can be exploited remotely via special crafted webpage to perform domain spoofing.
26. Use after free vulnerabiltiy in media can be exploited remotely via special crafted webpage to bypass security restrictions.
27. Use after free vulnerability in media can be exploited remotely via special crafted webpage to potentially cause denial of service.
28. Policy enforcement vulnerability in external protocol handling can be exploited remotely via special crafted webpage to bypass same origin policy.
29. Use after free vulnerability in Mojo can be exploited remotely via special crafted webpage to potentially cause denial of service.
30. Policy enforcement vulnerability in developer tools can be exploited remotely via special crafted webpage to obtain sensitive information.
31. Filtering vulnerability in Blink can be exploited remotely via special crafted webpage to bypass security restrictions.
32. OSI vulnerability in storage can be exploited remotely via special crafted webpage.
33. Data validation vulnerability in JavaScript can be exploited remotely via special crafted webpage to potentially cause denial of service.
34. Security UI vulnerability in Omnibox can be exploited remotely via special crafted webpage to perform domain spoofing.
35. Security UI vulnerability in Chromium can be exploited remotely vial special crafted webpage to spoof notifications.

Original advisories

Changelog for Opera 64

Stable Channel Update for Desktop

Related products

Opera

CVE list

CVE-2019-5870 high

CVE-2019-5871 high

CVE-2019-5872 warning

CVE-2019-5873 warning

CVE-2019-5874 high

CVE-2019-5875 warning

CVE-2019-5876 high

CVE-2019-5877 high

CVE-2019-5878 high

CVE-2019-5879 warning

CVE-2019-5880 warning

CVE-2019-5881 high

CVE-2019-13659 warning

CVE-2019-13660 warning

CVE-2019-13661 warning

CVE-2019-13662 warning

CVE-2019-13663 warning

CVE-2019-13664 warning

CVE-2019-13665 warning

CVE-2019-13666 warning

CVE-2019-13667 warning

CVE-2019-13668 warning

CVE-2019-13669 warning

CVE-2019-13670 warning

CVE-2019-13671 warning

CVE-2019-13673 warning

CVE-2019-13674 warning

CVE-2019-13675 warning

CVE-2019-13676 warning

CVE-2019-13677 warning

CVE-2019-13678 warning

CVE-2019-13679 warning

CVE-2019-13680 warning

CVE-2019-13681 warning

CVE-2019-13682 high

CVE-2019-13683 warning

CVE-2019-13691 warning

CVE-2019-13692 high

CVE-2019-13766 warning

Solution

Update to the latest version

Download Opera

Impacts

• ACE

Arbitrary code execution. Exploitation of vulnerabilities with this impact can lead to executing by abuser any code or commands at vulnerable machine or process.

• OSI

Obtain sensitive information. Exploitation of vulnerabilities with this impact can lead to capturing by abuser information, critical for user or system.

• DoS

Denial of service. Exploitation of vulnerabilities with this impact can lead to loss of system availability or critical functional fault.

• SB

Security bypass. Exploitation of vulnerabilities with this impact can lead to performing actions restricted by current security settings.

• SUI

Spoof user interface. Exploitation of vulnerabilities with this impact can lead to changes in user interface to beguile user into inaccurate behavior.

Affected Products

• Opera earlier than 64.0.3417.19