CVE-2006-1834

Integer signedness error in Opera before 8.54 allows remote attackers to execute arbitrary code via long values in a stylesheet attribute, which pass a length check. NOTE: a sign extension problem makes the attack easier with shorter strings...

CVE-2006-1834

Opera before 8.54 is affected by a vulnerability caused by an integer signedness error in the handling of long values in a stylesheet attribute, which can bypass a length check and potentially allow remote code execution. This is documented in multiple sources associated with CVE-2006-1834, inclu...

Opera < 8.54 Multiple Vulnerabilities

The remote host is using Opera, an alternative web browser. The version of Opera installed on the remote host contains a buffer overflow that can be triggered by a long value within a stylesheet attribute. Successful exploitation can lead to a browser crash and possibly allow for the execution of...

[Full-disclosure] SEC Consult SA-20060314 :: Opera Browser CSS Attribute Integer Wrap / Buffer Overflow

SEC-CONSULT Security Advisory 20060413-0 ======================================== title: Opera Browser CSS Attribute Integer Wrap / Buffer Overflow program: Opera vulnerable version: = 8.52 homepage: www.opera.com found: 2006-03-01 by: SEC Consult / www.sec-consult.com...

Opera browser integer overflow

Integer overflow on long stylsheet sttribute. Can potentially be used for hidden malware installation...

Opera Web Browser 8.52 - Stylesheet Attribute Buffer Overflow

Opera Web Browser 8.52 - Stylesheet Attribute Buffer Overflow source: https://www.securityfocus.com/bid/17513/info Opera is prone to a buffer-overflow vulnerability. This issue is due to the application's failure to properly bounds-check user-supplied input before using it in a string-copy...

Opera Web Browser 8.52 - Stylesheet Attribute Buffer Overflow

source: https://www.securityfocus.com/bid/17513/info Opera is prone to a buffer-overflow vulnerability. This issue is due to the application's failure to properly bounds-check user-supplied input before using it in a string-copy operation. This issue allows remote attackers to crash affected web...

wmp_overflow.htm.txt

WMP Plugin EMBED Exploit // Windows Media Player Plug-In EMBED Overflow Universal Exploit MS06-006 // By Matthew Murphy [email protected] // // DISCLAIMER: // // This exploit code is intended only as a demonstration tool for // educational or testing purposes. It is not intended to be used for...

wmp_plugin_ms06_006.pm.txt

This file is part of the Metasploit Framework and may be redistributed according to the licenses defined in the Authors field below. In the case of an unknown or missing license, this file defaults to the same license as the core Framework dual GPLv2 and Artistic. The latest version of the...

Microsoft Windows Media Player 9 - Plugin Overflow (MS06-006) (Metasploit)

This file is part of the Metasploit Framework and may be redistributed according to the licenses defined in the Authors field below. In the case of an unknown or missing license, this file defaults to the same license as the core Framework dual GPLv2 and Artistic. The latest version of the...

Microsoft Windows Media Player 10 - Plugin Overflow (MS06-006)

WMP Plugin EMBED Exploit // Windows Media Player Plug-In EMBED Overflow Universal Exploit MS06-006 // By Matthew Murphy [email protected] // // DISCLAIMER: // // This exploit code is intended only as a demonstration tool for // educational or testing purposes. It is not intended to be used for...

Microsoft Windows Media Player 10 - Plugin Overflow (MS06-006)

Microsoft Windows Media Player 10 - Plugin Overflow MS06-006 WMP Plugin EMBED Exploit // Windows Media Player Plug-In EMBED Overflow Universal Exploit MS06-006 // By Matthew Murphy [email protected] // // DISCLAIMER: // // This exploit code is intended only as a demonstration tool for //...

MS Windows Media Player 10 Plugin Overflow Exploit (MS06-006)

Exploit for unknown platform in category remote exploits ============================================================= MS Windows Media Player 10 Plugin Overflow Exploit MS06-006 ============================================================= WMP Plugin EMBED Exploit // Windows Media Player Plug-In...

Microsoft Windows Media Player 9 - Plugin Overflow (MS06-006) (Metasploit)

Microsoft Windows Media Player 9 - Plugin Overflow MS06-006 Metasploit This file is part of the Metasploit Framework and may be redistributed according to the licenses defined in the Authors field below. In the case of an unknown or missing license, this file defaults to the same license as the...

The link tooltip and the statusbar can be misleading – Opera Security Advisories

The link tooltip and the statusbar can be misleading – Opera Security Advisories OPCOM Team | February 17, 2006 Summary Opera’s status bar shows the “title” attribute of a form inputimage, not the form’s “action” URL. This may mislead the user. Severity: Very low Problem description It is possibl...

CVE-2005-4718

CVE-2005-4718 affects Opera 8.02 and earlier. The issue allows remote denial of service (client crash) via two vectors: (1) a crafted HTML file containing a content: url(0); style attribute, a bodyA tag, a long string, and a long attribute on a u tag (oper a.html demonstrated); and (2) a BGSOUND ...

CVE-2005-4718

Opera 8.02 and earlier allows remote attackers to cause a denial of service client crash via 1 a crafted HTML file with a "content: url0;" style attribute, a "bodyA" tag, a long string, and a "u" tag with a long attribute, as demonstrated by opera.html; and 2 a BGSOUND element with a "margin:-99;...

Malicious WMF files stored in Opera’s cache can infect Windows – Opera Security Advisories

Malicious WMF files stored in Opera’s cache can infect Windows – Opera Security Advisories OPCOM Team | January 13, 2006 Summary Windows Meta Files .wmf can contain executable code. A specially craftedWMF file can infect Microsoft Windows with malicious software when it is openedwith Windows’ own...

CVE-2005-4718

Opera 8.02 and earlier allows remote attackers to cause a denial of service client crash via 1 a crafted HTML file with a "content: url0;" style attribute, a "bodyA" tag, a long string, and a "u" tag with a long attribute, as demonstrated by opera.html; and 2 a BGSOUND element with a "margin:-99;...

GLSA-200512-10 : Opera: Command-line URL shell command injection

The remote host is affected by the vulnerability described in GLSA-200512-10 Opera: Command-line URL shell command injection Peter Zelezny discovered that the shell script used to launch Opera parses shell commands that are enclosed within backticks in the URL provided via the command line. Impac...