Opera may insecurely load executable files

Overview Opera may use unsafe methods for determining how to load executables .exe. Opera loads certain executables .exe when opening the folder where downloaded contents are stored. Opera contains an issue with the file search path, which may insecurely load executables. Makoto Shiotsuki reporte...

JVN#33880169: Opera may insecurely load executable files

Opera loads certain executables .exe when opening the folder where downloaded contents are stored. Opera contains an issue with the file search path, which may insecurely load executables. Impact An attacker may execute arbitrary code with the privilege of running the application. Solution Update...

CVE-2011-0684

Opera before 11.01 does not properly handle redirections and unspecified other HTTP responses, which allows remote web servers to obtain sufficient access to local files to use these files as page resources, and consequently obtain potentially sensitive information from the contents of the files,...

CVE-2011-0683

Opera before 11.01 does not properly restrict the use of opera: URLs, which makes it easier for remote attackers to conduct clickjacking attacks via a crafted web site...

CVE-2011-0685

The Delete Private Data feature in Opera before 11.01 does not properly implement the "Clear all email account passwords" option, which might allow physically proximate attackers to access an e-mail account via an unattended workstation...

CVE-2011-0687

Opera before 11.01 does not properly implement Wireless Application Protocol WAP dropdown lists, which allows user-assisted remote attackers to cause a denial of service application crash via a crafted WAP document...

CVE-2011-0686

Unspecified vulnerability in Opera before 11.01 allows remote attackers to cause a denial of service application crash via unknown content on a web page, as demonstrated by vkontakte.ru...

CVE-2011-0682

Integer truncation error in opera.dll in Opera before 11.01 allows remote attackers to execute arbitrary code or cause a denial of service memory corruption via an HTML form with a select element that contains a large number of children...

CVE-2011-0681

The Cascading Style Sheets CSS Extensions for XML implementation in Opera before 11.01 recognizes links to javascript: URLs in the -o-link property, which makes it easier for remote attackers to bypass CSS filtering via a crafted URL...

Design/Logic Flaw

Opera before 11.01 does not properly handle redirections and unspecified other HTTP responses, which allows remote web servers to obtain sufficient access to local files to use these files as page resources, and consequently obtain potentially sensitive information from the contents of the files,...

Design/Logic Flaw

Unspecified vulnerability in Opera before 11.01 allows remote attackers to cause a denial of service application crash via unknown content on a web page, as demonstrated by vkontakte.ru...

Design/Logic Flaw

The Cascading Style Sheets CSS Extensions for XML implementation in Opera before 11.01 recognizes links to javascript: URLs in the -o-link property, which makes it easier for remote attackers to bypass CSS filtering via a crafted URL...

Integer overflow

Integer truncation error in opera.dll in Opera before 11.01 allows remote attackers to execute arbitrary code or cause a denial of service memory corruption via an HTML form with a select element that contains a large number of children...

Design/Logic Flaw

The Delete Private Data feature in Opera before 11.01 does not properly implement the "Clear all email account passwords" option, which might allow physically proximate attackers to access an e-mail account via an unattended workstation...

Code injection

Opera before 11.01 does not properly implement Wireless Application Protocol WAP dropdown lists, which allows user-assisted remote attackers to cause a denial of service application crash via a crafted WAP document...

Code injection

Opera before 11.01 does not properly restrict the use of opera: URLs, which makes it easier for remote attackers to conduct clickjacking attacks via a crafted web site...

CVE-2011-0450

The downloads manager in Opera before 11.01 on Windows does not properly determine the pathname of the filesystem-viewing application, which allows user-assisted remote attackers to execute arbitrary code via a crafted web site that hosts an executable file...

CVE-2011-0683

Opera before 11.01 did not properly restrict opera: URLs, enabling clickjacking via a crafted site. A remote attacker could lure a user to a malicious page to perform a clickjacking attack. Affected: Opera up to version 11.00; remediation: upgrade to Opera 11.01 or later where the issue is fixed....

Code injection

The downloads manager in Opera before 11.01 on Windows does not properly determine the pathname of the filesystem-viewing application, which allows user-assisted remote attackers to execute arbitrary code via a crafted web site that hosts an executable file...

CVE-2011-0686

CVE-2011-0686 concerns Opera before 11.01, where remote attackers could trigger a denial of service (application crash) by serving crafted content on a web page (as demonstrated by vkontakte.ru). The issue affects Opera's handling of web-page content and results in an availability impact (crash) ...