From $URL : Description Kaveh Ghaemmaghami has discovered a vulnerability in Opera, which can be exploited by malicious people to potentially compromise a user's system. The vulnerability is caused due to an error when decoding image data and can be exploited to cause a heap-based buffer underflow via a specially crafted GIF image. Successful exploitation may allow execution of arbitrary code. The vulnerability is confirmed in version 12.11 Build 1661. Other versions may also be affected. Solution No official solution is currently available.
- Security - * Fixed an issue where malformed GIF images could allow execution of arbitrary code; see our advisory[1] * Fixed an issue where repeated attempts to access a target site could trigger address field spoofing, as reported by Masato Kinugawa; see our advisory[2] * UNIX-only Fixed an issue where private data could be disclosed to other computer users, or be modified by them, as reported by Jann Horn; see our advisory[3] [1] http://www.opera.com/support/kb/view/1038/ [2] http://www.opera.com/support/kb/view/1040/ [3] http://www.opera.com/support/kb/view/1039/ - - - - - - - - - - - Arch teams, please test and mark stable: =www-client/opera-12.12_p1707 Stable KEYWORDS : amd64 x86
x86 done.
amd64 stable
Added to existing GLSA request.
CVE-2012-6472 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-6472): Opera before 12.12 on UNIX uses weak permissions for the profile directory, which allows local users to obtain sensitive information by reading a (1) cache file, (2) password file, or (3) configuration file, or (4) possibly gain privileges by modifying or overwriting a configuration file. CVE-2012-6471 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-6471): Opera before 12.12 allows remote attackers to spoof the address field via a high rate of HTTP requests. CVE-2012-6470 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-6470): Opera before 12.12 does not properly allocate memory for GIF images, which allows remote attackers to execute arbitrary code or cause a denial of service (memory overwrite) via a malformed image.
This issue was resolved and addressed in GLSA 201406-14 at http://security.gentoo.org/glsa/glsa-201406-14.xml by GLSA coordinator Chris Reffett (creffett).
