FreeBSD : opera -- multiple vulnerabilities (4582948a-9716-11de-83a5-001999392805)

Opera Team Reports : - Issue where sites using revoked intermediate certificates might be shown as secure - Issue where the collapsed address bar didn't show the current domain - Issue where pages could trick users into uploading files - Some IDNA characters not correctly displaying in the addres...

openSUSE Security Update : opera (opera-1261)

Opera version 10 includes at least security fixes for an XML denial-of-service bug CVE-2009-1234 and the 'SSL tampering' attack CVE-2009-2059, CVE-2009-2063, CVE-2009-2067, CVE-2009-2070. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin...

openSUSE Security Update : opera (opera-1261)

Opera version 10 includes at least security fixes for an XML denial-of-service bug CVE-2009-1234 and the 'SSL tampering' attack CVE-2009-2059, CVE-2009-2063, CVE-2009-2067, CVE-2009-2070. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin...

CVE-2009-3047

Opera before 10.00, when a collapsed address bar is used, does not properly update the domain name from the previously visited site to the currently visited site, which might allow remote attackers to spoof URLs...

CVE-2009-3046

Opera before 10.00 does not check all intermediate X.509 certificates for revocation, which makes it easier for remote SSL servers to bypass validation of the certificate chain via a revoked certificate...

CVE-2009-3045

Opera before 10.00 trusts root X.509 certificates signed with the MD2 algorithm, which makes it easier for man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted server certificate...

CVE-2009-3048

Opera before 10.00 on Linux, Solaris, and FreeBSD does not properly implement the "INPUT TYPE=file" functionality, which allows remote attackers to trick a user into uploading an unintended file via vectors involving a "dropped file."...

CVE-2009-3049

Opera before 10.00 does not properly display all characters in Internationalized Domain Names IDN in the address bar, which allows remote attackers to spoof URLs and conduct phishing attacks, related to Unicode and Punycode...

Input validation

Opera before 10.00 on Linux, Solaris, and FreeBSD does not properly implement the "INPUT TYPE=file" functionality, which allows remote attackers to trick a user into uploading an unintended file via vectors involving a "dropped file."...

Design/Logic Flaw

Opera before 10.00, when a collapsed address bar is used, does not properly update the domain name from the previously visited site to the currently visited site, which might allow remote attackers to spoof URLs...

Code injection

Opera before 10.00 does not properly display all characters in Internationalized Domain Names IDN in the address bar, which allows remote attackers to spoof URLs and conduct phishing attacks, related to Unicode and Punycode...

Input validation

Opera before 10.00 does not check all intermediate X.509 certificates for revocation, which makes it easier for remote SSL servers to bypass validation of the certificate chain via a revoked certificate...

Design/Logic Flaw

Opera before 10.00 does not properly handle a 1 '\0' character or 2 invalid wildcard character in a domain name in the subject's Common Name CN field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate...

CVE-2009-3044

Opera before 10.00 does not properly handle a 1 '\0' character or 2 invalid wildcard character in a domain name in the subject's Common Name CN field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate...

Code injection

Opera before 10.00 trusts root X.509 certificates signed with the MD2 algorithm, which makes it easier for man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted server certificate...

CVE-2009-3047

Opera before 10.00, when a collapsed address bar is used, does not properly update the domain name from the previously visited site to the currently visited site, which might allow remote attackers to spoof URLs...

CVE-2009-3049

Opera before 10.00 does not properly display all characters in Internationalized Domain Names IDN in the address bar, which allows remote attackers to spoof URLs and conduct phishing attacks, related to Unicode and Punycode...

CVE-2009-3046

Opera before 10.00 is vulnerable because it does not check all intermediate X.509 certificates for revocation, allowing remote SSL servers to bypass certificate chain validation via a revoked certificate. Affected versions include Opera = 12.00.1467. This CVE is referenced in multiple advisories ...

CVE-2009-3044

Opera before 10.00 is affected by CVE-2009-3044 due to improper handling of a null character or invalid wildcard in the domain name in the X.509 certificate CN, enabling man‑in‑the‑middle spoofing of SSL servers via a certificate issued by a legitimate CA. The issue affects Opera’s certificate pa...

CVE-2009-3048

Opera before 10.00 on Linux, Solaris, and FreeBSD is vulnerable due to improper handling of INPUT TYPE=file, enabling a remote attacker to trick a user into uploading an unintended file via a dropped-file vector. The issue is documented in CVE-2009-3048 and is echoed across multiple feeds (NVD en...