CVE-2007-0127 The Javascript SVG support in Opera before 9.10 does not properly validate object types in a createSVGTransformFromMatrix request, which allows remote attackers to execute arbitrary code via JavaScrip...
HighCVSS 9.3
EPSS 4.8%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The Javascript SVG support in Opera before 9.10 does not properly validate object types in a createSVGTransformFromMatrix request, which allows remote attackers to execute arbitrary code via JavaScript code that uses an invalid object in this request that causes a controlled pointer to be referenced during the virtual function call.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| opera browser | <= 9.02 | No fix listed |
| opera browser | = 1.00 | No fix listed |
| opera browser | = 2.00 | No fix listed |
| opera browser | = 2.10 | No fix listed |
| opera browser | = 2.10-beta1 | No fix listed |
| opera browser | = 2.10-beta2 | No fix listed |
| opera browser | = 2.10-beta3 | No fix listed |
| opera browser | = 2.12 | No fix listed |
| opera browser | = 3.00 | No fix listed |
| opera browser | = 3.00-beta | No fix listed |
| opera browser | = 3.10 | No fix listed |
| opera browser | = 3.21 | No fix listed |
| opera browser | = 3.50 | No fix listed |
| opera browser | = 3.51 | No fix listed |
| opera browser | = 3.60 | No fix listed |
| opera browser | = 3.61 | No fix listed |
| opera browser | = 3.62 | No fix listed |
| opera browser | = 3.62-beta | No fix listed |
| opera browser | = 4.00 | No fix listed |
| opera browser | = 4.00-beta2 | No fix listed |
| opera browser | = 4.00-beta3 | No fix listed |
| opera browser | = 4.00-beta4 | No fix listed |
| opera browser | = 4.00-beta5 | No fix listed |
| opera browser | = 4.00-beta6 | No fix listed |
| opera browser | = 4.01 | No fix listed |
Show 69 more
| Product | Affected versions | Fixed in |
|---|---|---|
| opera browser | = 4.02 | No fix listed |
| opera browser | = 5.0 | No fix listed |
| opera browser | = 5.0-beta2 | No fix listed |
| opera browser | = 5.0-beta3 | No fix listed |
| opera browser | = 5.0-beta4 | No fix listed |
| opera browser | = 5.0-beta5 | No fix listed |
| opera browser | = 5.0-beta6 | No fix listed |
| opera browser | = 5.0-beta7 | No fix listed |
| opera browser | = 5.0-beta8 | No fix listed |
| opera browser | = 5.02 | No fix listed |
| opera browser | = 5.10 | No fix listed |
| opera browser | = 5.11 | No fix listed |
| opera browser | = 5.12 | No fix listed |
| opera browser | = 6.0 | No fix listed |
| opera browser | = 6.0-beta1 | No fix listed |
| opera browser | = 6.0-beta2 | No fix listed |
| opera browser | = 6.0-tp1 | No fix listed |
| opera browser | = 6.0-tp2 | No fix listed |
| opera browser | = 6.0-tp3 | No fix listed |
| opera browser | = 6.1 | No fix listed |
| opera browser | = 6.01 | No fix listed |
| opera browser | = 6.1-beta1 | No fix listed |
| opera browser | = 6.02 | No fix listed |
| opera browser | = 6.03 | No fix listed |
| opera browser | = 6.04 | No fix listed |
| opera browser | = 6.05 | No fix listed |
| opera browser | = 6.06 | No fix listed |
| opera browser | = 6.11 | No fix listed |
| opera browser | = 6.12 | No fix listed |
| opera browser | = 7.0 | No fix listed |
| opera browser | = 7.0-beta1 | No fix listed |
| opera browser | = 7.0-beta1_v2 | No fix listed |
| opera browser | = 7.0-beta2 | No fix listed |
| opera browser | = 7.01 | No fix listed |
| opera browser | = 7.02 | No fix listed |
| opera browser | = 7.03 | No fix listed |
| opera browser | = 7.10 | No fix listed |
| opera browser | = 7.10-beta1 | No fix listed |
| opera browser | = 7.11 | No fix listed |
| opera browser | = 7.11-beta2 | No fix listed |
| opera browser | = 7.20 | No fix listed |
| opera browser | = 7.20-beta7 | No fix listed |
| opera browser | = 7.21 | No fix listed |
| opera browser | = 7.22 | No fix listed |
| opera browser | = 7.23 | No fix listed |
| opera browser | = 7.50 | No fix listed |
| opera browser | = 7.50-beta1 | No fix listed |
| opera browser | = 7.51 | No fix listed |
| opera browser | = 7.52 | No fix listed |
| opera browser | = 7.53 | No fix listed |
| opera browser | = 7.54 | No fix listed |
| opera browser | = 7.54-update1 | No fix listed |
| opera browser | = 7.54-update2 | No fix listed |
| opera browser | = 7.60 | No fix listed |
| opera browser | = 8.0 | No fix listed |
| opera browser | = 8.0-beta1 | No fix listed |
| opera browser | = 8.0-beta2 | No fix listed |
| opera browser | = 8.0-beta3 | No fix listed |
| opera browser | = 8.01 | No fix listed |
| opera browser | = 8.02 | No fix listed |
| opera browser | = 8.50 | No fix listed |
| opera browser | = 8.51 | No fix listed |
| opera browser | = 8.52 | No fix listed |
| opera browser | = 8.53 | No fix listed |
| opera browser | = 8.54 | No fix listed |
| opera browser | = 9.0 | No fix listed |
| opera browser | = 9.0-beta1 | No fix listed |
| opera browser | = 9.0-beta2 | No fix listed |
| opera browser | = 9.01 | No fix listed |
References
- 20070105 Opera Software Opera Web Browser createSVGTransformFromMatrix Object Typecasting Vulnerability patch third-party-advisory vendor-advisory
- SUSE-SA:2007:009 vendor-advisory
- 31575 vdb-entry
- 23613 patch third-party-advisory vendor-advisory
- 23739 third-party-advisory vendor-advisory
- 23771 third-party-advisory vendor-advisory
- 1017473 vdb-entry
- GLSA-200701-08 vendor-advisory
- www.opera.com
- ADV-2007-0060 vdb-entry