[Full-Disclosure] Race conditions in security dialogs

I discovered arbitrary code execution holes in Mozilla, Internet Explorer, and Opera that involve human reaction time. One version of the attack works like this: the page contains a captcha displaying the word "only" and asks you to type the word to verify that you are a human. As soon as you typ...

Re: [Full-Disclosure] iDEFENSE Security Advisory 05.12.04: Opera Telnet URI Handler File Creation/Truncation Vulnerability

Another minor issue has also been corrected in Opera Browser version 7.50, allowing malicious websites to spoof the address bar. The solutions remains the same, therefore no need to paste our full advisory here. However, if you wish further details, they can be found at:...

URI handler vulnerabilities in several browsers

Karol Wiesek and Greg MacManus reported via iDEFENSE that the Opera web browser contains a flaw in the handling of certain URIs. When presented with these URIs, Opera would invoke external commands to process them after some validation. However, if the hostname component of a URI begins with a -'...

CVE-2003-0593

Opera allows remote attackers to bypass intended cookie access restrictions on a web application via "%2e%2e" encoded dot dot directory traversal sequences in a URL, which causes Opera to send the cookie outside the specified URL subsets, e.g. to a vulnerable application that runs on the same...

opera723.txt

Opera Array Allocation Managment Exploit ===================================== Dicovered by- d3thStaR !AM Greets: !AM Crew, Atomix, d3thstar, mgrd, 0x29A Crew, rootthief.com. Sources: Safari Overflow Exploit- kang Confirmed products effected- Opera 7.23 Linux, Opera 7.23 Windows =======Descriptio...

CVE-2003-1397

The PluginContext object of Opera 6.05 and 7.0 allows remote attackers to cause a denial of service crash via an HTTP request containing a long string that gets passed to the ShowDocument method...

CVE-2003-1420

Cross-site scripting XSS vulnerability in Opera 6.0 through 7.0 with automatic redirection disabled allows remote attackers to inject arbitrary web script or HTML via the HTTP Location header...

Opera Browser 6.0 6 - URI Display Obfuscation

Opera Browser 6.0 6 - URI Display Obfuscation source: https://www.securityfocus.com/bid/9281/info A weakness has been reported in Opera that may allow attackers to obfuscate the URI for a visited page. The problem is said to occur when a URI that is designed to access a specific location with a...

Opera Browser 6.0 6 - URI Display Obfuscation

source: https://www.securityfocus.com/bid/9281/info A weakness has been reported in Opera that may allow attackers to obfuscate the URI for a visited page. The problem is said to occur when a URI that is designed to access a specific location with a supplied username, contains a specially crafted...

[Full-Disclosure] Opera directory traversal and buffer overflow

OVERVIEW ======== Two vulnerabilities were found in the Opera web browser versions up to 7.22. They are related to skin files. The first one is a directory traversal problem which allows an attacker to upload a file to an arbitrary location on the victim system. The second is a buffer overflow in...

Opera Directory Traversal in Internal URI Protocol (Advisory)

Opera Web Browser Directory Traversal in Internal URI Protocol ============================================================== I ABSTRACT: Opera Web Browser defines an internal URI Protocol like command called "opera:". Among other things, it is used to display documentation and help files for the...

Opera Web Browser 7 - IFRAME Zone Restriction Bypass

Opera Web Browser 7 - IFRAME Zone Restriction Bypass source: https://www.securityfocus.com/bid/8887/info A flaw in the Opera web browsers security model has been discovered that could allow an attacker to access a users filesystem within the Local Zone. The problem occurs when handling malformed...

Opera Web Browser 7 - IFRAME Zone Restriction Bypass

source: https://www.securityfocus.com/bid/8887/info A flaw in the Opera web browsers security model has been discovered that could allow an attacker to access a users filesystem within the Local Zone. The problem occurs when handling malformed HTML iframes which point to local system locations...

Opera HREF escaped server name overflow

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 @stake, Inc. www.atstake.com Security Advisory Advisory Name: Opera HREF escaped server name overflow Release Date: 10/20/2003 Application: Opera 7.11, 7.20 Platform: Windows XP/2000 and GNU/Linux 2.4 tested, others may be vulnerable Severity: Remote...

Opera 7.117.20 HREF - Malformed Server Name Heap Corruption

Opera 7.117.20 HREF - Malformed Server Name Heap Corruption source: https://www.securityfocus.com/bid/8853/info A vulnerability has been discovered in the Opera web browser that could lead to remote code execution. The problem is said to trigger when handling malformed HTML HREF values and may...

Opera 7.11/7.20 HREF - Malformed Server Name Heap Corruption

source: https://www.securityfocus.com/bid/8853/info A vulnerability has been discovered in the Opera web browser that could lead to remote code execution. The problem is said to trigger when handling malformed HTML HREF values and may result in a buffer overrun occuring within heap memory. As a...

Opera < 7.21 HREF Escaped Character Overflow

The installed version of Opera on the remote host is vulnerable to a buffer overflow in the code that parses HREF tags in the server. To exploit them, an attacker would need to set up a rogue website, then lure a user of this host to visit the site using Opera. The attacker would then be able to...

Secunia Research: Opera browser filename extension buffer overflows

Hi all, The second issue in this advisory is the same as reported by Nesumin. However, Secunia has been waiting for Opera Software to fix these vulnerabilities and therefore, we have not released our research until now. Unfortunately, while we were waiting for the vendor fix, the second...

Opera 7.07.10 - JavaScript Console Single Quote Attribute Injection

Opera 7.07.10 - JavaScript Console Single Quote Attribute Injection source: https://www.securityfocus.com/bid/7449/info A vulnerability has been reported for Opera 7 browsers for Microsoft Windows operating systems. The vulnerability exists in the Opera JavaScript console. Attackers may exploit t...

Opera 6.07.0 - Filename Download Buffer Overrun

Opera 6.07.0 - Filename Download Buffer Overrun source: https://www.securityfocus.com/bid/7056/info A buffer overrun vulnerability has been discovered in the Opera web browser. The issue affects Opera versions 6 and 7 on the Microsoft Windows platform. Due to insufficient bounds checking when...